@scayle/h3-session 0.4.2 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @scayle/h3-session
 
+## 0.5.0
+
+### Minor Changes
+
+- Cookie metadata is no longer saved in the session store. Previously, `h3-session` stored a copy of the cookie settings in the session store alongside the session data. This has been changed and now only the session data itself is stored. The cookie settings can still be read and manipulated from the `Session` object.
+
+### Patch Changes
+
+- Removed dependency `zod@^3.23.8`
+- Replace regex used for cookie parsing
+
 ## 0.4.2
 
 ### Patch Changes

package/dist/index.d.mts

@@ -41,7 +41,7 @@ declare class UnstorageSessionStore implements SessionStore {
      * Get the session with the specified session ID
      * @param sid the un-prefixed session ID
      */
-    get(sid: string): Promise<RawSession | undefined>;
+    get(sid: string): Promise<SessionDataT | undefined>;
     /**
      * Save the session with the specified session ID
      * If the session has expired (has a TTL <= 0) it is deleted.
@@ -62,7 +62,7 @@ declare class UnstorageSessionStore implements SessionStore {
     /**
      * Fetch all saved sessions.
      */
-    all(): Promise<RawSession[]>;
+    all(): Promise<SessionDataT[]>;
     /**
      * Returns the number of saved sessions
      */
@@ -84,9 +84,7 @@ type SessionCookie = SessionCookieOptions & {
 };
 interface SessionDataT {
 }
-type RawSession = SessionDataT & {
-    cookie?: SessionCookieOptions;
-};
+type RawSession = SessionDataT;
 interface SessionStore {
     all?: () => Promise<RawSession[]>;
     destroy: (sid: string) => Promise<void>;
@@ -128,6 +126,13 @@ declare module 'h3' {
  * @param secrets an array of secret strings to verify with
  */
 declare function unsignCookie(value: string, secrets: string[]): Promise<string | false>;
+/**
+ * Creates a signed cookie value in the format `s:[value].[signature]`
+ * @param value
+ * @param secret
+ */
+declare function signCookie(value: string, secret: string): Promise<string>;
+declare function validateConfig(config: H3SessionOptions): void;
 /**
  * Attach a session to an H3Event
  * @param event
@@ -135,4 +140,4 @@ declare function unsignCookie(value: string, secrets: string[]): Promise<string
  */
 declare function useSession(event: H3Event, config: H3SessionOptions): Promise<void>;
 
-export { type RawSession, Session, type SessionCookie, type SessionCookieOptions, type SessionDataT, type SessionMethods, type SessionStore, UnstorageSessionStore, unsignCookie, useSession };
+export { type H3SessionOptions, type RawSession, Session, type SessionCookie, type SessionCookieOptions, type SessionDataT, type SessionMethods, type SessionStore, UnstorageSessionStore, signCookie, unsignCookie, useSession, validateConfig };

package/dist/index.d.ts

@@ -41,7 +41,7 @@ declare class UnstorageSessionStore implements SessionStore {
      * Get the session with the specified session ID
      * @param sid the un-prefixed session ID
      */
-    get(sid: string): Promise<RawSession | undefined>;
+    get(sid: string): Promise<SessionDataT | undefined>;
     /**
      * Save the session with the specified session ID
      * If the session has expired (has a TTL <= 0) it is deleted.
@@ -62,7 +62,7 @@ declare class UnstorageSessionStore implements SessionStore {
     /**
      * Fetch all saved sessions.
      */
-    all(): Promise<RawSession[]>;
+    all(): Promise<SessionDataT[]>;
     /**
      * Returns the number of saved sessions
      */
@@ -84,9 +84,7 @@ type SessionCookie = SessionCookieOptions & {
 };
 interface SessionDataT {
 }
-type RawSession = SessionDataT & {
-    cookie?: SessionCookieOptions;
-};
+type RawSession = SessionDataT;
 interface SessionStore {
     all?: () => Promise<RawSession[]>;
     destroy: (sid: string) => Promise<void>;
@@ -128,6 +126,13 @@ declare module 'h3' {
  * @param secrets an array of secret strings to verify with
  */
 declare function unsignCookie(value: string, secrets: string[]): Promise<string | false>;
+/**
+ * Creates a signed cookie value in the format `s:[value].[signature]`
+ * @param value
+ * @param secret
+ */
+declare function signCookie(value: string, secret: string): Promise<string>;
+declare function validateConfig(config: H3SessionOptions): void;
 /**
  * Attach a session to an H3Event
  * @param event
@@ -135,4 +140,4 @@ declare function unsignCookie(value: string, secrets: string[]): Promise<string
  */
 declare function useSession(event: H3Event, config: H3SessionOptions): Promise<void>;
 
-export { type RawSession, Session, type SessionCookie, type SessionCookieOptions, type SessionDataT, type SessionMethods, type SessionStore, UnstorageSessionStore, unsignCookie, useSession };
+export { type H3SessionOptions, type RawSession, Session, type SessionCookie, type SessionCookieOptions, type SessionDataT, type SessionMethods, type SessionStore, UnstorageSessionStore, signCookie, unsignCookie, useSession, validateConfig };

package/dist/index.mjs

@@ -2,7 +2,6 @@ import { Buffer } from 'node:buffer';
 import { getCookie, setCookie } from 'h3';
 import { defu } from 'defu';
 import { subtle, randomUUID } from 'uncrypto';
-import { z } from 'zod';
 
 class Session {
   #id;
@@ -21,7 +20,7 @@ class Session {
     return this.#id;
   }
   async save() {
-    await this.#store.set(this.#id, { ...this.data, cookie: this.cookie });
+    await this.#store.set(this.#id, this.data);
   }
   async reload() {
     this.data = await this.#store.get(this.#id) ?? (await this.#generate()).data;
@@ -39,15 +38,6 @@ class Session {
   }
 }
 
-const CookieSchema = z.object({
-  domain: z.string().optional(),
-  expires: z.coerce.date().optional(),
-  httpOnly: z.boolean().optional(),
-  maxAge: z.number().optional(),
-  path: z.string().optional(),
-  sameSite: z.enum(["lax", "none", "strict"]).or(z.boolean()).optional(),
-  secure: z.boolean().optional()
-});
 class UnstorageSessionStore {
   storage;
   prefix;
@@ -70,13 +60,6 @@ class UnstorageSessionStore {
    */
   async get(sid) {
     const item = await this.storage.getItem(this.getKey(sid));
-    if (item && item.cookie) {
-      try {
-        item.cookie = CookieSchema.parse(item.cookie);
-      } catch {
-        delete item.cookie;
-      }
-    }
     return item ?? void 0;
   }
   /**
@@ -144,12 +127,26 @@ class UnstorageSessionStore {
   }
 }
 
+const signatureLength = 43;
+function parseCookieValue(value) {
+  if (value.length < signatureLength + 3) {
+    return void 0;
+  }
+  const separatorIndex = value.length - signatureLength - 1;
+  if (value.charAt(0) !== "s" || value.charAt(1) !== ":" || value.charAt(separatorIndex) !== ".") {
+    return void 0;
+  }
+  return [
+    value.substring(2, separatorIndex),
+    value.substring(separatorIndex + 1)
+  ];
+}
 async function unsignCookie(value, secrets) {
-  const matches = /s:([^.]*)\.(.*)/.exec(value);
+  const matches = parseCookieValue(value);
   if (!matches) {
     return false;
   }
-  const [, message, signature] = matches;
+  const [message, signature] = matches;
   const encoder = new TextEncoder();
   const messageUint8Array = encoder.encode(message);
   const signatureUint8Array = Uint8Array.from(Buffer.from(signature, "base64"));
@@ -175,6 +172,12 @@ async function unsignCookie(value, secrets) {
   return false;
 }
 async function signCookie(value, secret) {
+  if (!value) {
+    throw new Error("[h3-session] No value was provided!");
+  }
+  if (!secret) {
+    throw new Error("[h3-session] No secret was provided!");
+  }
   const encoder = new TextEncoder();
   const messageUint8Array = encoder.encode(value);
   const keyUint8Array = encoder.encode(secret);
@@ -273,4 +276,4 @@ async function useSession(event, config) {
   event.context.sessionStore = store;
 }
 
-export { Session, UnstorageSessionStore, unsignCookie, useSession };
+export { Session, UnstorageSessionStore, signCookie, unsignCookie, useSession, validateConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scayle/h3-session",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Persistent sessions for h3",
   "author": "SCAYLE Commerce Engine",
   "license": "MIT",
@@ -22,7 +22,11 @@
     "format": "dprint check",
     "format:fix": "dprint fmt",
     "lint": "eslint . --format gitlab",
-    "lint:fix": "eslint . --fix"
+    "lint:fix": "eslint . --fix",
+    "test": "vitest run",
+    "test:ci": "vitest --run --coverage --reporter=default --reporter=junit --outputFile=./junit.xml",
+    "test:watch": "vitest watch",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "peerDependencies": {
     "h3": "^1.10.0"
@@ -30,8 +34,7 @@
   "dependencies": {
     "defu": "^6.1.4",
     "uncrypto": "^0.1.3",
-    "unstorage": "^1.10.2",
-    "zod": "^3.23.8"
+    "unstorage": "^1.10.2"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.17.1",
@@ -41,7 +44,8 @@
     "eslint-formatter-gitlab": "5.1.0",
     "h3": "1.13.0",
     "typescript": "5.6.3",
-    "unbuild": "3.0.1"
+    "unbuild": "3.0.1",
+    "vitest": "2.1.8"
   },
   "volta": {
     "node": "22.12.0"