@octanejs/remix-router 0.1.0

package/src/lib/server-runtime/cookies.ts

@@ -0,0 +1,240 @@
+// Vendored from react-router@7.18.1 packages/react-router/lib/server-runtime/cookies.ts — unmodified.
+// Re-vendor with `node scripts/vendor-remix-router.mjs`; never hand-edit.
+import type { ParseOptions, SerializeOptions } from 'cookie';
+import { parse, serialize } from 'cookie';
+
+import { sign, unsign } from './crypto';
+import { warnOnce } from './warnings';
+
+export type { ParseOptions as CookieParseOptions, SerializeOptions as CookieSerializeOptions };
+
+export interface CookieSignatureOptions {
+	/**
+	 * An array of secrets that may be used to sign/unsign the value of a cookie.
+	 *
+	 * The array makes it easy to rotate secrets. New secrets should be added to
+	 * the beginning of the array. `cookie.serialize()` will always use the first
+	 * value in the array, but `cookie.parse()` may use any of them so that
+	 * cookies that were signed with older secrets still work.
+	 */
+	secrets?: string[];
+}
+
+export type CookieOptions = ParseOptions & SerializeOptions & CookieSignatureOptions;
+
+/**
+ * A HTTP cookie.
+ *
+ * A Cookie is a logical container for metadata about a HTTP cookie; its name
+ * and options. But it doesn't contain a value. Instead, it has `parse()` and
+ * `serialize()` methods that allow a single instance to be reused for
+ * parsing/encoding multiple different values.
+ *
+ * @see https://remix.run/utils/cookies#cookie-api
+ */
+export interface Cookie {
+	/**
+	 * The name of the cookie, used in the `Cookie` and `Set-Cookie` headers.
+	 */
+	readonly name: string;
+
+	/**
+	 * True if this cookie uses one or more secrets for verification.
+	 */
+	readonly isSigned: boolean;
+
+	/**
+	 * The Date this cookie expires.
+	 *
+	 * Note: This is calculated at access time using `maxAge` when no `expires`
+	 * option is provided to `createCookie()`.
+	 */
+	readonly expires?: Date;
+
+	/**
+	 * Parses a raw `Cookie` header and returns the value of this cookie or
+	 * `null` if it's not present.
+	 */
+	parse(cookieHeader: string | null, options?: ParseOptions): Promise<any>;
+
+	/**
+	 * Serializes the given value to a string and returns the `Set-Cookie`
+	 * header.
+	 */
+	serialize(value: any, options?: SerializeOptions): Promise<string>;
+}
+
+/**
+ * Creates a logical container for managing a browser cookie from the server.
+ */
+export const createCookie = (name: string, cookieOptions: CookieOptions = {}): Cookie => {
+	let { secrets = [], ...options } = {
+		path: '/',
+		sameSite: 'lax' as const,
+		...cookieOptions,
+	};
+
+	warnOnceAboutExpiresCookie(name, options.expires);
+
+	return {
+		get name() {
+			return name;
+		},
+		get isSigned() {
+			return secrets.length > 0;
+		},
+		get expires() {
+			// Max-Age takes precedence over Expires
+			return typeof options.maxAge !== 'undefined'
+				? new Date(Date.now() + options.maxAge * 1000)
+				: options.expires;
+		},
+		async parse(cookieHeader, parseOptions) {
+			if (!cookieHeader) return null;
+			let cookies = parse(cookieHeader, { ...options, ...parseOptions });
+			if (name in cookies) {
+				let value = cookies[name];
+				if (typeof value === 'string' && value !== '') {
+					let decoded = await decodeCookieValue(value, secrets);
+					return decoded;
+				} else {
+					return '';
+				}
+			} else {
+				return null;
+			}
+		},
+		async serialize(value, serializeOptions) {
+			return serialize(name, value === '' ? '' : await encodeCookieValue(value, secrets), {
+				...options,
+				...serializeOptions,
+			});
+		},
+	};
+};
+
+export type IsCookieFunction = (object: any) => object is Cookie;
+
+/**
+ * Returns true if an object is a Remix cookie container.
+ *
+ * @see https://remix.run/utils/cookies#iscookie
+ */
+export const isCookie: IsCookieFunction = (object): object is Cookie => {
+	return (
+		object != null &&
+		typeof object.name === 'string' &&
+		typeof object.isSigned === 'boolean' &&
+		typeof object.parse === 'function' &&
+		typeof object.serialize === 'function'
+	);
+};
+
+async function encodeCookieValue(value: any, secrets: string[]): Promise<string> {
+	let encoded = encodeData(value);
+
+	if (secrets.length > 0) {
+		encoded = await sign(encoded, secrets[0]);
+	}
+
+	return encoded;
+}
+
+async function decodeCookieValue(value: string, secrets: string[]): Promise<any> {
+	if (secrets.length > 0) {
+		for (let secret of secrets) {
+			let unsignedValue = await unsign(value, secret);
+			if (unsignedValue !== false) {
+				return decodeData(unsignedValue);
+			}
+		}
+
+		return null;
+	}
+
+	return decodeData(value);
+}
+
+function encodeData(value: any): string {
+	return btoa(myUnescape(encodeURIComponent(JSON.stringify(value))));
+}
+
+function decodeData(value: string): any {
+	try {
+		return JSON.parse(decodeURIComponent(myEscape(atob(value))));
+	} catch (
+		// eslint-disable-next-line @typescript-eslint/no-unused-vars
+		e
+	) {
+		return {};
+	}
+}
+
+// See: https://github.com/zloirock/core-js/blob/master/packages/core-js/modules/es.escape.js
+function myEscape(value: string): string {
+	let str = value.toString();
+	let result = '';
+	let index = 0;
+	let chr, code;
+	while (index < str.length) {
+		chr = str.charAt(index++);
+		if (/[\w*+\-./@]/.exec(chr)) {
+			result += chr;
+		} else {
+			code = chr.charCodeAt(0);
+			if (code < 256) {
+				result += '%' + hex(code, 2);
+			} else {
+				result += '%u' + hex(code, 4).toUpperCase();
+			}
+		}
+	}
+	return result;
+}
+
+function hex(code: number, length: number): string {
+	let result = code.toString(16);
+	while (result.length < length) result = '0' + result;
+	return result;
+}
+
+// See: https://github.com/zloirock/core-js/blob/master/packages/core-js/modules/es.unescape.js
+function myUnescape(value: string): string {
+	let str = value.toString();
+	let result = '';
+	let index = 0;
+	let chr, part;
+	while (index < str.length) {
+		chr = str.charAt(index++);
+		if (chr === '%') {
+			if (str.charAt(index) === 'u') {
+				part = str.slice(index + 1, index + 5);
+				if (/^[\da-f]{4}$/i.exec(part)) {
+					result += String.fromCharCode(parseInt(part, 16));
+					index += 5;
+					continue;
+				}
+			} else {
+				part = str.slice(index, index + 2);
+				if (/^[\da-f]{2}$/i.exec(part)) {
+					result += String.fromCharCode(parseInt(part, 16));
+					index += 2;
+					continue;
+				}
+			}
+		}
+		result += chr;
+	}
+	return result;
+}
+
+function warnOnceAboutExpiresCookie(name: string, expires?: Date) {
+	warnOnce(
+		!expires,
+		`The "${name}" cookie has an "expires" property set. ` +
+			`This will cause the expires value to not be updated when the session is committed. ` +
+			`Instead, you should set the expires value when serializing the cookie. ` +
+			`You can use \`commitSession(session, { expires })\` if using a session storage object, ` +
+			`or \`cookie.serialize("value", { expires })\` if you're using the cookie directly.`,
+	);
+}

package/src/lib/server-runtime/crypto.ts

@@ -0,0 +1,55 @@
+// Vendored from react-router@7.18.1 packages/react-router/lib/server-runtime/crypto.ts — unmodified except: type-only: bare Uint8Array return widens to Uint8Array<ArrayBufferLike> under TS 5.7+ typed-array generics, which crypto.subtle.verify's BufferSource rejects.
+// Re-vendor with `node scripts/vendor-remix-router.mjs`; never hand-edit.
+const encoder = /* @__PURE__ */ new TextEncoder();
+
+export const sign = async (value: string, secret: string): Promise<string> => {
+	let data = encoder.encode(value);
+	let key = await createKey(secret, ['sign']);
+	let signature = await crypto.subtle.sign('HMAC', key, data);
+	let hash = btoa(String.fromCharCode(...new Uint8Array(signature))).replace(/=+$/, '');
+
+	return value + '.' + hash;
+};
+
+export const unsign = async (cookie: string, secret: string): Promise<string | false> => {
+	let index = cookie.lastIndexOf('.');
+	let value = cookie.slice(0, index);
+	let hash = cookie.slice(index + 1);
+
+	let data = encoder.encode(value);
+
+	let key = await createKey(secret, ['verify']);
+	try {
+		let signature = byteStringToUint8Array(atob(hash));
+		let valid = await crypto.subtle.verify('HMAC', key, signature, data);
+
+		return valid ? value : false;
+	} catch (
+		// eslint-disable-next-line @typescript-eslint/no-unused-vars
+		e
+	) {
+		// atob will throw a DOMException with name === 'InvalidCharacterError'
+		// if the signature contains a non-base64 character, which should just
+		// be treated as an invalid signature.
+		return false;
+	}
+};
+
+const createKey = async (secret: string, usages: CryptoKey['usages']): Promise<CryptoKey> =>
+	crypto.subtle.importKey(
+		'raw',
+		encoder.encode(secret),
+		{ name: 'HMAC', hash: 'SHA-256' },
+		false,
+		usages,
+	);
+
+function byteStringToUint8Array(byteString: string): Uint8Array<ArrayBuffer> {
+	let array = new Uint8Array(byteString.length);
+
+	for (let i = 0; i < byteString.length; i++) {
+		array[i] = byteString.charCodeAt(i);
+	}
+
+	return array;
+}

package/src/lib/server-runtime/mode.ts

@@ -0,0 +1,16 @@
+// Vendored from react-router@7.18.1 packages/react-router/lib/server-runtime/mode.ts — unmodified.
+// Re-vendor with `node scripts/vendor-remix-router.mjs`; never hand-edit.
+/**
+ * The mode to use when running the server.
+ */
+export enum ServerMode {
+	Development = 'development',
+	Production = 'production',
+	Test = 'test',
+}
+
+export function isServerMode(value: any): value is ServerMode {
+	return (
+		value === ServerMode.Development || value === ServerMode.Production || value === ServerMode.Test
+	);
+}

package/src/lib/server-runtime/sessions/cookieStorage.ts

@@ -0,0 +1,54 @@
+// Vendored from react-router@7.18.1 packages/react-router/lib/server-runtime/sessions/cookieStorage.ts — unmodified.
+// Re-vendor with `node scripts/vendor-remix-router.mjs`; never hand-edit.
+import { createCookie, isCookie } from '../cookies';
+import type { SessionStorage, SessionIdStorageStrategy, SessionData } from '../sessions';
+import { warnOnceAboutSigningSessionCookie, createSession } from '../sessions';
+
+interface CookieSessionStorageOptions {
+	/**
+	 * The Cookie used to store the session data on the client, or options used
+	 * to automatically create one.
+	 */
+	cookie?: SessionIdStorageStrategy['cookie'];
+}
+
+/**
+ * Creates and returns a SessionStorage object that stores all session data
+ * directly in the session cookie itself.
+ *
+ * This has the advantage that no database or other backend services are
+ * needed, and can help to simplify some load-balanced scenarios. However, it
+ * also has the limitation that serialized session data may not exceed the
+ * browser's maximum cookie size. Trade-offs!
+ */
+export function createCookieSessionStorage<Data = SessionData, FlashData = Data>({
+	cookie: cookieArg,
+}: CookieSessionStorageOptions = {}): SessionStorage<Data, FlashData> {
+	let cookie = isCookie(cookieArg)
+		? cookieArg
+		: createCookie(cookieArg?.name || '__session', cookieArg);
+
+	warnOnceAboutSigningSessionCookie(cookie);
+
+	return {
+		async getSession(cookieHeader, options) {
+			return createSession((cookieHeader && (await cookie.parse(cookieHeader, options))) || {});
+		},
+		async commitSession(session, options) {
+			let serializedCookie = await cookie.serialize(session.data, options);
+			if (serializedCookie.length > 4096) {
+				throw new Error(
+					'Cookie length will exceed browser maximum. Length: ' + serializedCookie.length,
+				);
+			}
+			return serializedCookie;
+		},
+		async destroySession(_session, options) {
+			return cookie.serialize('', {
+				...options,
+				maxAge: undefined,
+				expires: new Date(0),
+			});
+		},
+	};
+}

package/src/lib/server-runtime/sessions/memoryStorage.ts

@@ -0,0 +1,59 @@
+// Vendored from react-router@7.18.1 packages/react-router/lib/server-runtime/sessions/memoryStorage.ts — unmodified.
+// Re-vendor with `node scripts/vendor-remix-router.mjs`; never hand-edit.
+import type {
+	SessionData,
+	SessionStorage,
+	SessionIdStorageStrategy,
+	FlashSessionData,
+} from '../sessions';
+import { createSessionStorage } from '../sessions';
+
+interface MemorySessionStorageOptions {
+	/**
+	 * The Cookie used to store the session id on the client, or options used
+	 * to automatically create one.
+	 */
+	cookie?: SessionIdStorageStrategy['cookie'];
+}
+
+/**
+ * Creates and returns a simple in-memory SessionStorage object, mostly useful
+ * for testing and as a reference implementation.
+ *
+ * Note: This storage does not scale beyond a single process, so it is not
+ * suitable for most production scenarios.
+ */
+export function createMemorySessionStorage<Data = SessionData, FlashData = Data>({
+	cookie,
+}: MemorySessionStorageOptions = {}): SessionStorage<Data, FlashData> {
+	let map = new Map<string, { data: FlashSessionData<Data, FlashData>; expires?: Date }>();
+
+	return createSessionStorage({
+		cookie,
+		async createData(data, expires) {
+			let id = Math.random().toString(36).substring(2, 10);
+			map.set(id, { data, expires });
+			return id;
+		},
+		async readData(id) {
+			if (map.has(id)) {
+				let { data, expires } = map.get(id)!;
+
+				if (!expires || expires > new Date()) {
+					return data;
+				}
+
+				// Remove expired session data.
+				if (expires) map.delete(id);
+			}
+
+			return null;
+		},
+		async updateData(id, data, expires) {
+			map.set(id, { data, expires });
+		},
+		async deleteData(id) {
+			map.delete(id);
+		},
+	});
+}