@rodit/rodit-auth-be 9.13.0 → 9.14.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to `@rodit/rodit-auth-be` are documented here.
 
+## [9.14.0] — 2026-07-16
+
+### Removed
+
+- **`createExpressSessionMiddleware`** — unused cookie-session HMAC helper; JWT
+  auth uses EdDSA only.
+- **`SECURITY_OPTIONS.SESSION_SECRET`** config key and env mapping
+  (`SECURITY_OPTIONS_SESSION_SECRET`). Not part of the RODiT/JWT auth path.
+
 ## [9.13.0] — 2026-07-15
 
 ### Added

package/README.md

@@ -2369,7 +2369,7 @@ const {
 } = require('@rodit/rodit-auth-be')
 // Note: Session storage configuration functions are available via:
 // const { setExpressSessionStore, configureStorageFromConfig,
-  // createExpressSessionMiddleware, InMemorySessionStorage }
+  // InMemorySessionStorage }
 // = require('@rodit/rodit-auth-be/lib/auth/sessionmanager');
 ```
 

package/lib/auth/sessionmanager.js

@@ -338,29 +338,6 @@ function configureStorageFromConfig() {
   }
 }
 
-// Optional helper to create a real express-session middleware using the current store
-function createExpressSessionMiddleware(options = {}) {
-  if (!sessionLib) {
-    logger.warnWithContext('express-session not installed; returning no-op session middleware', {
-      component: 'SessionManager',
-      operation: 'session.middleware.create'
-    });
-    return (req, res, next) => next();
-  }
-  const secret = config.get('SECURITY_OPTIONS.SESSION_SECRET');
-  const store = (currentStorage instanceof ExpressSessionStoreAdapter)
-    ? currentStorage.store
-    : new sessionLib.MemoryStore();
-
-  return sessionLib({
-    saveUninitialized: false,
-    resave: false,
-    ...options,
-    secret,
-    store,
-  });
-}
-
 class SessionManager {
   constructor() {
     const instanceId = ulid();
@@ -1411,7 +1388,6 @@ module.exports = {
   setStorage,
   setExpressSessionStore,
   configureStorageFromConfig,
-  createExpressSessionMiddleware,
   SESSION_CLEANUP_INTERVAL,
   SESSION_TOKEN_RETENTION_PERIOD
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rodit/rodit-auth-be",
-  "version": "9.13.0",
+  "version": "9.14.0",
   "description": "RODiT-based authentication system for Express.js applications",
   "main": "index.js",
   "exports": {
@@ -46,7 +46,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/discernible-io/rodit-auth-be.git"
+    "url": "git+https://github.com/discernible-io/rodit-auth-be.git"
   },
   "publishConfig": {
     "access": "public"

package/services/configsdk.js

@@ -244,10 +244,6 @@ const FALLBACK_DEFAULTS = {
     // - true: allow relaxed validation checks
     // - false: enforce strict validation checks
     RELAXED_SESSION_VALIDATION: true,
-    // Session middleware secret used for signing session data.
-    // Options:
-    // - any non-empty string (recommended: long, random secret on main)
-    SESSION_SECRET: "HMAC-session-secret-is-not-set",
     // Webhook outbound TLS verification.
     // Options:
     // - true: skip TLS certificate verification (for controlled/self-signed setups)
@@ -398,16 +394,6 @@ const VALIDATION_RULES = {
     type: 'boolean',
     validate: () => null
   },
-  'SECURITY_OPTIONS.SESSION_SECRET': {
-    required: false,
-    type: 'string',
-    validate: (value) => {
-      if (!value || value.length === 0) {
-        return 'SECURITY_OPTIONS.SESSION_SECRET cannot be empty when provided';
-      }
-      return null;
-    }
-  },
   'SECURITY_OPTIONS.FALLBACK_JWT_DURATION': {
     required: false,
     type: 'number',