@prairielearn/session 2.0.6 → 3.0.1

package/dist/index.test.js

@@ -1,38 +1,36 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = __importDefault(require("express"));
-const chai_1 = require("chai");
-const node_fetch_1 = __importDefault(require("node-fetch"));
-const fetch_cookie_1 = __importDefault(require("fetch-cookie"));
-const set_cookie_parser_1 = require("set-cookie-parser");
-const express_async_handler_1 = __importDefault(require("express-async-handler"));
-const express_test_utils_1 = require("@prairielearn/express-test-utils");
-const index_1 = require("./index");
-const memory_store_1 = require("./memory-store");
+import { assert } from 'chai';
+import express from 'express';
+import asyncHandler from 'express-async-handler';
+import fetchCookie from 'fetch-cookie';
+import fetch from 'node-fetch';
+import setCookie from 'set-cookie-parser';
+import { withServer } from '@prairielearn/express-test-utils';
+import { MemoryStore } from './memory-store.js';
+import { createSessionMiddleware } from './index.js';
 const TEST_SECRET = 'test-secret';
+function parseSetCookie(header) {
+    return setCookie.parse(setCookie.splitCookiesString(header));
+}
 describe('session middleware', () => {
     it('sets a session cookie', async () => {
-        const app = (0, express_1.default)();
-        app.use((0, index_1.createSessionMiddleware)({ secret: TEST_SECRET, store: new memory_store_1.MemoryStore() }));
+        const app = express();
+        app.use(createSessionMiddleware({ secret: TEST_SECRET, store: new MemoryStore() }));
         app.get('/', (_req, res) => res.sendStatus(200));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const res = await (0, node_fetch_1.default)(url);
-            chai_1.assert.equal(res.status, 200);
+        await withServer(app, async ({ url }) => {
+            const res = await fetch(url);
+            assert.equal(res.status, 200);
             const header = res.headers.get('set-cookie');
-            const cookies = (0, set_cookie_parser_1.parse)(header ?? '');
-            chai_1.assert.equal(cookies.length, 1);
-            chai_1.assert.equal(cookies[0].name, 'session');
-            chai_1.assert.equal(cookies[0].path, '/');
+            const cookies = parseSetCookie(header ?? '');
+            assert.equal(cookies.length, 1);
+            assert.equal(cookies[0].name, 'session');
+            assert.equal(cookies[0].path, '/');
         });
     });
     it('sets a session cookie with options', async () => {
-        const app = (0, express_1.default)();
-        app.use((0, index_1.createSessionMiddleware)({
+        const app = express();
+        app.use(createSessionMiddleware({
             secret: TEST_SECRET,
-            store: new memory_store_1.MemoryStore(),
+            store: new MemoryStore(),
             cookie: {
                 name: 'prairielearn_session',
                 httpOnly: true,
@@ -42,163 +40,163 @@ describe('session middleware', () => {
             },
         }));
         app.get('/', (_req, res) => res.sendStatus(200));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const res = await (0, node_fetch_1.default)(url);
-            chai_1.assert.equal(res.status, 200);
+        await withServer(app, async ({ url }) => {
+            const res = await fetch(url);
+            assert.equal(res.status, 200);
             const header = res.headers.get('set-cookie');
-            const cookies = (0, set_cookie_parser_1.parse)(header ?? '');
-            chai_1.assert.equal(cookies.length, 1);
-            chai_1.assert.equal(cookies[0].name, 'prairielearn_session');
-            chai_1.assert.equal(cookies[0].path, '/');
-            chai_1.assert.isTrue(cookies[0].httpOnly);
-            chai_1.assert.equal(cookies[0].domain, '.localhost');
-            chai_1.assert.equal(cookies[0].sameSite, 'Strict');
+            const cookies = parseSetCookie(header ?? '');
+            assert.equal(cookies.length, 1);
+            assert.equal(cookies[0].name, 'prairielearn_session');
+            assert.equal(cookies[0].path, '/');
+            assert.isTrue(cookies[0].httpOnly);
+            assert.equal(cookies[0].domain, '.localhost');
+            assert.equal(cookies[0].sameSite, 'Strict');
         });
     });
     it('sets a secure cookie for proxied HTTPS request', async () => {
-        const app = (0, express_1.default)();
+        const app = express();
         app.enable('trust proxy');
-        app.use((0, index_1.createSessionMiddleware)({
+        app.use(createSessionMiddleware({
             secret: TEST_SECRET,
-            store: new memory_store_1.MemoryStore(),
+            store: new MemoryStore(),
             cookie: {
                 secure: true,
             },
         }));
         app.get('/', (_req, res) => res.sendStatus(200));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const res = await (0, node_fetch_1.default)(url, {
+        await withServer(app, async ({ url }) => {
+            const res = await fetch(url, {
                 headers: {
                     'X-Forwarded-Proto': 'https',
                 },
             });
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             const header = res.headers.get('set-cookie');
-            const cookies = (0, set_cookie_parser_1.parse)(header ?? '');
-            chai_1.assert.equal(cookies.length, 1);
-            chai_1.assert.equal(cookies[0].name, 'session');
-            chai_1.assert.equal(cookies[0].path, '/');
-            chai_1.assert.isTrue(cookies[0].secure);
+            const cookies = parseSetCookie(header ?? '');
+            assert.equal(cookies.length, 1);
+            assert.equal(cookies[0].name, 'session');
+            assert.equal(cookies[0].path, '/');
+            assert.isTrue(cookies[0].secure);
         });
     });
     it('does not set a secure cookie for proxied HTTP request', async () => {
-        const app = (0, express_1.default)();
+        const app = express();
         app.enable('trust proxy');
-        app.use((0, index_1.createSessionMiddleware)({
+        app.use(createSessionMiddleware({
             secret: TEST_SECRET,
-            store: new memory_store_1.MemoryStore(),
+            store: new MemoryStore(),
             cookie: {
                 secure: true,
             },
         }));
         app.get('/', (_req, res) => res.sendStatus(200));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const res = await (0, node_fetch_1.default)(url, {
+        await withServer(app, async ({ url }) => {
+            const res = await fetch(url, {
                 headers: {
                     'X-Forwarded-Proto': 'http',
                 },
             });
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             const header = res.headers.get('set-cookie');
-            chai_1.assert.isNull(header);
+            assert.isNull(header);
         });
     });
     it('automatically sets secure for proxied HTTPS request', async () => {
-        const app = (0, express_1.default)();
+        const app = express();
         app.enable('trust proxy');
-        app.use((0, index_1.createSessionMiddleware)({
+        app.use(createSessionMiddleware({
             secret: TEST_SECRET,
-            store: new memory_store_1.MemoryStore(),
+            store: new MemoryStore(),
             cookie: {
                 secure: 'auto',
             },
         }));
         app.get('/', (_req, res) => res.sendStatus(200));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const res = await (0, node_fetch_1.default)(url, {
+        await withServer(app, async ({ url }) => {
+            const res = await fetch(url, {
                 headers: {
                     'X-Forwarded-Proto': 'https',
                 },
             });
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             const header = res.headers.get('set-cookie');
-            const cookies = (0, set_cookie_parser_1.parse)(header ?? '');
-            chai_1.assert.equal(cookies.length, 1);
-            chai_1.assert.equal(cookies[0].name, 'session');
-            chai_1.assert.equal(cookies[0].path, '/');
-            chai_1.assert.isTrue(cookies[0].secure);
+            const cookies = parseSetCookie(header ?? '');
+            assert.equal(cookies.length, 1);
+            assert.equal(cookies[0].name, 'session');
+            assert.equal(cookies[0].path, '/');
+            assert.isTrue(cookies[0].secure);
         });
     });
     it('automatically sets secure for proxied HTTP request', async () => {
-        const app = (0, express_1.default)();
+        const app = express();
         app.enable('trust proxy');
-        app.use((0, index_1.createSessionMiddleware)({
+        app.use(createSessionMiddleware({
             secret: TEST_SECRET,
-            store: new memory_store_1.MemoryStore(),
+            store: new MemoryStore(),
             cookie: {
                 secure: 'auto',
             },
         }));
         app.get('/', (_req, res) => res.sendStatus(200));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const res = await (0, node_fetch_1.default)(url, {
+        await withServer(app, async ({ url }) => {
+            const res = await fetch(url, {
                 headers: {
                     'X-Forwarded-Proto': 'http',
                 },
             });
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             const header = res.headers.get('set-cookie');
-            const cookies = (0, set_cookie_parser_1.parse)(header ?? '');
-            chai_1.assert.equal(cookies.length, 1);
-            chai_1.assert.equal(cookies[0].name, 'session');
-            chai_1.assert.equal(cookies[0].path, '/');
-            chai_1.assert.isUndefined(cookies[0].secure);
+            const cookies = parseSetCookie(header ?? '');
+            assert.equal(cookies.length, 1);
+            assert.equal(cookies[0].name, 'session');
+            assert.equal(cookies[0].path, '/');
+            assert.isUndefined(cookies[0].secure);
         });
     });
     it('sets secure cookie based on a function', async () => {
-        const app = (0, express_1.default)();
+        const app = express();
         app.enable('trust proxy');
-        app.use((0, index_1.createSessionMiddleware)({
+        app.use(createSessionMiddleware({
             secret: TEST_SECRET,
-            store: new memory_store_1.MemoryStore(),
+            store: new MemoryStore(),
             cookie: {
                 secure: (req) => req.hostname === 'example.com',
             },
         }));
         app.get('/', (_req, res) => res.sendStatus(200));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const insecureRes = await (0, node_fetch_1.default)(url, {
+        await withServer(app, async ({ url }) => {
+            const insecureRes = await fetch(url, {
                 headers: {
                     'X-Forwarded-Host': 'subdomain.example.com',
                     'X-Forwarded-Proto': 'http',
                 },
             });
-            chai_1.assert.equal(insecureRes.status, 200);
+            assert.equal(insecureRes.status, 200);
             const insecureHeader = insecureRes.headers.get('set-cookie');
-            const insecureCookie = (0, set_cookie_parser_1.parse)(insecureHeader ?? '');
-            chai_1.assert.equal(insecureCookie.length, 1);
-            chai_1.assert.equal(insecureCookie[0].name, 'session');
-            chai_1.assert.equal(insecureCookie[0].path, '/');
-            chai_1.assert.isUndefined(insecureCookie[0].secure);
-            const secureRes = await (0, node_fetch_1.default)(url, {
+            const insecureCookie = parseSetCookie(insecureHeader ?? '');
+            assert.equal(insecureCookie.length, 1);
+            assert.equal(insecureCookie[0].name, 'session');
+            assert.equal(insecureCookie[0].path, '/');
+            assert.isUndefined(insecureCookie[0].secure);
+            const secureRes = await fetch(url, {
                 headers: {
                     'X-Forwarded-Host': 'example.com',
                     'X-Forwarded-Proto': 'https',
                 },
             });
-            chai_1.assert.equal(secureRes.status, 200);
+            assert.equal(secureRes.status, 200);
             const secureHeader = secureRes.headers.get('set-cookie');
-            const secureCookies = (0, set_cookie_parser_1.parse)(secureHeader ?? '');
-            chai_1.assert.equal(secureCookies.length, 1);
-            chai_1.assert.equal(secureCookies[0].name, 'session');
-            chai_1.assert.equal(secureCookies[0].path, '/');
-            chai_1.assert.isTrue(secureCookies[0].secure);
+            const secureCookies = parseSetCookie(secureHeader ?? '');
+            assert.equal(secureCookies.length, 1);
+            assert.equal(secureCookies[0].name, 'session');
+            assert.equal(secureCookies[0].path, '/');
+            assert.isTrue(secureCookies[0].secure);
         });
     });
     it('persists session data across requests', async () => {
-        const app = (0, express_1.default)();
-        app.use((0, index_1.createSessionMiddleware)({
-            store: new memory_store_1.MemoryStore(),
+        const app = express();
+        app.use(createSessionMiddleware({
+            store: new MemoryStore(),
             secret: TEST_SECRET,
         }));
         app.get('/', (req, res) => {
@@ -206,20 +204,20 @@ describe('session middleware', () => {
             req.session.count += 1;
             res.send(req.session.count.toString());
         });
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const fetchWithCookies = (0, fetch_cookie_1.default)(node_fetch_1.default);
+        await withServer(app, async ({ url }) => {
+            const fetchWithCookies = fetchCookie(fetch);
             let res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
-            chai_1.assert.equal(await res.text(), '1');
+            assert.equal(res.status, 200);
+            assert.equal(await res.text(), '1');
             res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
-            chai_1.assert.equal(await res.text(), '2');
+            assert.equal(res.status, 200);
+            assert.equal(await res.text(), '2');
         });
     });
     it('commits the session before sending a redirect', async () => {
-        const app = (0, express_1.default)();
-        app.use((0, index_1.createSessionMiddleware)({
-            store: new memory_store_1.MemoryStore(),
+        const app = express();
+        app.use(createSessionMiddleware({
+            store: new MemoryStore(),
             secret: TEST_SECRET,
         }));
         app.post('/', (req, res) => {
@@ -229,104 +227,104 @@ describe('session middleware', () => {
         app.get('/', (req, res) => {
             res.send(req.session.test ?? 'NO VALUE');
         });
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const res = await (0, fetch_cookie_1.default)(node_fetch_1.default)(url, {
+        await withServer(app, async ({ url }) => {
+            const res = await fetchCookie(fetch)(url, {
                 method: 'POST',
             });
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             const body = await res.text();
-            chai_1.assert.equal(body, 'test');
+            assert.equal(body, 'test');
         });
     });
     it('destroys session', async () => {
-        const store = new memory_store_1.MemoryStore();
-        const app = (0, express_1.default)();
-        app.use((0, index_1.createSessionMiddleware)({
+        const store = new MemoryStore();
+        const app = express();
+        app.use(createSessionMiddleware({
             store,
             secret: TEST_SECRET,
         }));
         app.get('/', (_req, res) => res.sendStatus(200));
-        app.use('/destroy', (0, express_async_handler_1.default)(async (req, res) => {
+        app.use('/destroy', asyncHandler(async (req, res) => {
             await req.session.destroy();
             res.sendStatus(200);
         }));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const fetchWithCookies = (0, fetch_cookie_1.default)(node_fetch_1.default);
+        await withServer(app, async ({ url }) => {
+            const fetchWithCookies = fetchCookie(fetch);
             // Generate a new session.
             await fetchWithCookies(url);
             // Destroy the session.
             const destroyRes = await fetchWithCookies(`${url}/destroy`);
-            chai_1.assert.equal(destroyRes.status, 200);
+            assert.equal(destroyRes.status, 200);
             // Ensure the session cookie was cleared in the response.
             const header = destroyRes.headers.get('set-cookie');
-            const cookies = (0, set_cookie_parser_1.parse)(header ?? '');
-            chai_1.assert.equal(cookies.length, 1);
-            chai_1.assert.equal(cookies[0].name, 'session');
-            chai_1.assert.equal(cookies[0].path, '/');
-            chai_1.assert.equal(cookies[0].expires?.getTime(), 0);
+            const cookies = parseSetCookie(header ?? '');
+            assert.equal(cookies.length, 1);
+            assert.equal(cookies[0].name, 'session');
+            assert.equal(cookies[0].path, '/');
+            assert.equal(cookies[0].expires?.getTime(), 0);
             // Ensure the session was destroyed in the session store.
             const sessionId = cookies[0].value.split('.')[0];
-            chai_1.assert.isNull(await store.get(sessionId));
+            assert.isNull(await store.get(sessionId));
         });
     });
     it('regenerates session', async () => {
-        const store = new memory_store_1.MemoryStore();
-        const app = (0, express_1.default)();
-        app.use((0, index_1.createSessionMiddleware)({
+        const store = new MemoryStore();
+        const app = express();
+        app.use(createSessionMiddleware({
             store,
             secret: TEST_SECRET,
         }));
         app.get('/', (req, res) => {
             res.send(req.session.regenerated ? 'true' : 'false');
         });
-        app.get('/regenerate', (0, express_async_handler_1.default)(async (req, res) => {
+        app.get('/regenerate', asyncHandler(async (req, res) => {
             await req.session.regenerate();
             req.session.regenerated = true;
             res.sendStatus(200);
         }));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const fetchWithCookies = (0, fetch_cookie_1.default)(node_fetch_1.default);
+        await withServer(app, async ({ url }) => {
+            const fetchWithCookies = fetchCookie(fetch);
             // Generate a new session.
             let res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
-            chai_1.assert.equal(await res.text(), 'false');
+            assert.equal(res.status, 200);
+            assert.equal(await res.text(), 'false');
             // Extract the original cookie value.
             let header = res.headers.get('set-cookie');
-            let cookies = (0, set_cookie_parser_1.parse)(header ?? '');
-            chai_1.assert.equal(cookies.length, 1);
+            let cookies = parseSetCookie(header ?? '');
+            assert.equal(cookies.length, 1);
             const originalCookieValue = cookies[0].value;
             // Regenerate the session.
             res = await fetchWithCookies(`${url}/regenerate`);
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             // Ensure that the session cookie was changed.
             header = res.headers.get('set-cookie');
-            cookies = (0, set_cookie_parser_1.parse)(header ?? '');
-            chai_1.assert.equal(cookies.length, 1);
+            cookies = parseSetCookie(header ?? '');
+            assert.equal(cookies.length, 1);
             const newCookieValue = cookies[0].value;
-            chai_1.assert.notEqual(newCookieValue, originalCookieValue);
+            assert.notEqual(newCookieValue, originalCookieValue);
             // Ensure the original session is no longer present in the session store.
             const originalSessionId = originalCookieValue.split('.')[0];
-            chai_1.assert.isNull(await store.get(originalSessionId));
+            assert.isNull(await store.get(originalSessionId));
             // Ensure that the regenerated session data was persisted.
             res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
-            chai_1.assert.equal(await res.text(), 'true');
+            assert.equal(res.status, 200);
+            assert.equal(await res.text(), 'true');
         });
     });
     it('creates a new session if signature checks fail', async () => {
-        const store = new memory_store_1.MemoryStore();
-        const app = (0, express_1.default)();
-        app.use((0, index_1.createSessionMiddleware)({
+        const store = new MemoryStore();
+        const app = express();
+        app.use(createSessionMiddleware({
             store,
             secret: TEST_SECRET,
         }));
         app.get('/', (req, res) => res.send(req.session.id));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const cookieJar = new fetch_cookie_1.default.toughCookie.CookieJar();
-            const fetchWithCookies = (0, fetch_cookie_1.default)(node_fetch_1.default, cookieJar);
+        await withServer(app, async ({ url }) => {
+            const cookieJar = new fetchCookie.toughCookie.CookieJar();
+            const fetchWithCookies = fetchCookie(fetch, cookieJar);
             // Generate a new session.
             let res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             const originalSessionId = await res.text();
             // Tamper with the session cookie.
             const cookie = cookieJar.getCookiesSync(url)[0];
@@ -334,39 +332,39 @@ describe('session middleware', () => {
             cookieJar.setCookieSync(cookie, url);
             // Make sure we get a new session.
             res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             const newSessionId = await res.text();
-            chai_1.assert.notEqual(newSessionId, originalSessionId);
+            assert.notEqual(newSessionId, originalSessionId);
             // Make sure the existing session is still present in the store. We don't
             // want someone to be able to evict other sessions by submitting invalid
             // cookies.
-            chai_1.assert.isNotNull(await store.get(originalSessionId));
+            assert.isNotNull(await store.get(originalSessionId));
         });
     });
     it('does not re-set the cookie on subsequent requests', async () => {
-        const app = (0, express_1.default)();
-        app.use((0, index_1.createSessionMiddleware)({
-            store: new memory_store_1.MemoryStore(),
+        const app = express();
+        app.use(createSessionMiddleware({
+            store: new MemoryStore(),
             secret: TEST_SECRET,
         }));
         app.get('/', (_req, res) => res.sendStatus(200));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const fetchWithCookies = (0, fetch_cookie_1.default)(node_fetch_1.default);
+        await withServer(app, async ({ url }) => {
+            const fetchWithCookies = fetchCookie(fetch);
             // Generate a new session.
             let res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             // Make another request with the same session.
             res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             // Ensure that the cookie wasn't set again.
             const header = res.headers.get('set-cookie');
-            chai_1.assert.isNull(header);
+            assert.isNull(header);
         });
     });
     it('extends the expiration date of the cookie', async () => {
-        const store = new memory_store_1.MemoryStore();
-        const app = (0, express_1.default)();
-        app.use((0, index_1.createSessionMiddleware)({
+        const store = new MemoryStore();
+        const app = express();
+        app.use(createSessionMiddleware({
             store,
             secret: TEST_SECRET,
             cookie: {
@@ -378,79 +376,79 @@ describe('session middleware', () => {
             req.session.setExpiration(Date.now() + 10000);
             res.sendStatus(200);
         });
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const fetchWithCookies = (0, fetch_cookie_1.default)(node_fetch_1.default);
+        await withServer(app, async ({ url }) => {
+            const fetchWithCookies = fetchCookie(fetch);
             // Generate a new session.
             let res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             // Grab the original expiration date.
             let header = res.headers.get('set-cookie');
-            let cookies = (0, set_cookie_parser_1.parse)(header ?? '');
-            chai_1.assert.equal(cookies.length, 1);
-            chai_1.assert.isUndefined(cookies[0].maxAge);
+            let cookies = parseSetCookie(header ?? '');
+            assert.equal(cookies.length, 1);
+            assert.isUndefined(cookies[0].maxAge);
             const originalExpirationDate = cookies[0].expires;
-            (0, chai_1.assert)(originalExpirationDate);
+            assert(originalExpirationDate);
             // Also grab the expiration date from the store.
             const sessionId = cookies[0].value.split('.')[0];
             const session = await store.get(sessionId);
-            (0, chai_1.assert)(session);
+            assert(session);
             const originalStoreExpirationDate = session.expiresAt;
             // Ensure that the expiration dates are consistent.
-            chai_1.assert.equal(originalExpirationDate.getTime(), originalStoreExpirationDate.getTime());
+            assert.equal(originalExpirationDate.getTime(), originalStoreExpirationDate.getTime());
             // Make another request with the same session.
             res = await fetchWithCookies(`${url}/extend`);
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             // Ensure that the cookie was set again.
             header = res.headers.get('set-cookie');
-            cookies = (0, set_cookie_parser_1.parse)(header ?? '');
-            chai_1.assert.equal(cookies.length, 1);
-            chai_1.assert.isUndefined(cookies[0].maxAge);
+            cookies = parseSetCookie(header ?? '');
+            assert.equal(cookies.length, 1);
+            assert.isUndefined(cookies[0].maxAge);
             const newExpirationDate = cookies[0].expires;
-            (0, chai_1.assert)(newExpirationDate);
+            assert(newExpirationDate);
             // Ensure that the expiration date was extended.
-            chai_1.assert.notEqual(newExpirationDate.getTime(), originalExpirationDate.getTime());
+            assert.notEqual(newExpirationDate.getTime(), originalExpirationDate.getTime());
             // Also grab the new expiration date from the store.
             const newSession = await store.get(sessionId);
-            (0, chai_1.assert)(newSession);
+            assert(newSession);
             const newStoreExpirationDate = newSession.expiresAt;
             // Ensure that the expiration dates are consistent.
-            chai_1.assert.equal(newExpirationDate.getTime(), newStoreExpirationDate.getTime());
+            assert.equal(newExpirationDate.getTime(), newStoreExpirationDate.getTime());
         });
     });
     it('does not persist session data if the session did not change', async () => {
-        const store = new memory_store_1.MemoryStore();
+        const store = new MemoryStore();
         let setCount = 0;
         const originalStoreSet = store.set.bind(store);
         store.set = async (...args) => {
             setCount += 1;
             await originalStoreSet(...args);
         };
-        const app = (0, express_1.default)();
-        app.use((0, index_1.createSessionMiddleware)({
+        const app = express();
+        app.use(createSessionMiddleware({
             store,
             secret: TEST_SECRET,
         }));
         app.get('/', (_req, res) => res.sendStatus(200));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const fetchWithCookies = (0, fetch_cookie_1.default)(node_fetch_1.default);
+        await withServer(app, async ({ url }) => {
+            const fetchWithCookies = fetchCookie(fetch);
             // Generate a new session.
             let res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             // Ensure the session was persisted.
-            chai_1.assert.equal(setCount, 1);
+            assert.equal(setCount, 1);
             // Make another request with the same session.
             res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             // Ensure the session was not persisted.
-            chai_1.assert.equal(setCount, 1);
+            assert.equal(setCount, 1);
         });
     });
     it('rotates to a new cookie when needed', async () => {
-        const fetchWithCookies = (0, fetch_cookie_1.default)(node_fetch_1.default);
-        const store = new memory_store_1.MemoryStore();
+        const fetchWithCookies = fetchCookie(fetch);
+        const store = new MemoryStore();
         // Will create "legacy" sessions.
-        const legacyApp = (0, express_1.default)();
-        legacyApp.use((0, index_1.createSessionMiddleware)({
+        const legacyApp = express();
+        legacyApp.use(createSessionMiddleware({
             store,
             secret: TEST_SECRET,
             cookie: {
@@ -459,51 +457,56 @@ describe('session middleware', () => {
         }));
         legacyApp.get('/', (req, res) => res.send(req.session.id.toString()));
         // Will create "new" sessions and upgrade "legacy" sessions.
-        const app = (0, express_1.default)();
-        app.use((0, index_1.createSessionMiddleware)({
+        const app = express();
+        app.use(createSessionMiddleware({
             store,
             secret: TEST_SECRET,
             cookie: {
-                name: ['session', 'legacy_session'],
+                name: 'legacy_session',
+                writeNames: ['legacy_session', 'session'],
+                writeOverrides: [{ domain: undefined }, { domain: '.example.com' }],
             },
         }));
         app.get('/', (req, res) => res.send(req.session.id.toString()));
         let legacySessionId = null;
-        await (0, express_test_utils_1.withServer)(legacyApp, async ({ url }) => {
+        await withServer(legacyApp, async ({ url }) => {
             // Generate a legacy session.
             const res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             legacySessionId = await res.text();
         });
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
+        await withServer(app, async ({ url }) => {
             const res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
             const newSessionId = await res.text();
             // Ensure that the new session cookie was set.
             const header = res.headers.get('set-cookie');
-            chai_1.assert.isNotNull(header);
-            const cookies = (0, set_cookie_parser_1.parse)(header ?? '');
-            chai_1.assert.equal(cookies.length, 1);
-            chai_1.assert.equal(cookies[0].name, 'session');
+            assert.isNotNull(header);
+            const cookies = parseSetCookie(header ?? '');
+            assert.equal(cookies.length, 2);
+            assert.equal(cookies[0].name, 'legacy_session');
+            assert.isUndefined(cookies[0].domain);
+            assert.equal(cookies[1].name, 'session');
+            assert.equal(cookies[1].domain, '.example.com');
             // Ensure that the legacy session is migrated to a new session.
-            chai_1.assert.equal(newSessionId, legacySessionId);
+            assert.equal(newSessionId, legacySessionId);
         });
     });
     it('persists the session immediately after creation', async () => {
-        const store = new memory_store_1.MemoryStore();
-        const app = (0, express_1.default)();
-        app.use((0, index_1.createSessionMiddleware)({
+        const store = new MemoryStore();
+        const app = express();
+        app.use(createSessionMiddleware({
             store,
             secret: TEST_SECRET,
         }));
-        app.get('/', (0, express_async_handler_1.default)(async (req, res) => {
+        app.get('/', asyncHandler(async (req, res) => {
             const persistedSession = await store.get(req.session.id);
             res.status(persistedSession == null ? 500 : 200).send();
         }));
-        await (0, express_test_utils_1.withServer)(app, async ({ url }) => {
-            const fetchWithCookies = (0, fetch_cookie_1.default)(node_fetch_1.default);
+        await withServer(app, async ({ url }) => {
+            const fetchWithCookies = fetchCookie(fetch);
             const res = await fetchWithCookies(url);
-            chai_1.assert.equal(res.status, 200);
+            assert.equal(res.status, 200);
         });
     });
 });