@scayle/h3-session 0.5.1 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @scayle/h3-session
 
+## 0.6.1
+
+### Patch Changes
+
+- Disallow setting `name`, `path` or `domain` on the session cookie. Setting these properties would result in a new cookie rather than updating the existing cookie. It is now blocked to prevent unexpected behavior.
+
+## 0.6.0
+
+### Minor Changes
+
+- [Performance] Reduce the calls to `importKey` to improve performance.
+
 ## 0.5.1
 
 ### Patch Changes

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 SCAYLE GmbH
+Copyright (c) 2025 SCAYLE GmbH
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/index.d.mts

@@ -140,4 +140,5 @@ declare function validateConfig(config: H3SessionOptions): void;
  */
 declare function useSession(event: H3Event, config: H3SessionOptions): Promise<void>;
 
-export { type H3SessionOptions, type RawSession, Session, type SessionCookie, type SessionCookieOptions, type SessionDataT, type SessionMethods, type SessionStore, UnstorageSessionStore, signCookie, unsignCookie, useSession, validateConfig };
+export { Session, UnstorageSessionStore, signCookie, unsignCookie, useSession, validateConfig };
+export type { H3SessionOptions, RawSession, SessionCookie, SessionCookieOptions, SessionDataT, SessionMethods, SessionStore };

package/dist/index.d.ts

@@ -140,4 +140,5 @@ declare function validateConfig(config: H3SessionOptions): void;
  */
 declare function useSession(event: H3Event, config: H3SessionOptions): Promise<void>;
 
-export { type H3SessionOptions, type RawSession, Session, type SessionCookie, type SessionCookieOptions, type SessionDataT, type SessionMethods, type SessionStore, UnstorageSessionStore, signCookie, unsignCookie, useSession, validateConfig };
+export { Session, UnstorageSessionStore, signCookie, unsignCookie, useSession, validateConfig };
+export type { H3SessionOptions, RawSession, SessionCookie, SessionCookieOptions, SessionDataT, SessionMethods, SessionStore };

package/dist/index.mjs

@@ -3,6 +3,41 @@ import { getCookie, setCookie } from 'h3';
 import { defu } from 'defu';
 import { subtle, randomUUID } from 'uncrypto';
 
+const _signKeys = {};
+async function getCryptoSignKey(secret) {
+  if (_signKeys[secret]) {
+    return _signKeys[secret];
+  }
+  const encoder = new TextEncoder();
+  const keyUint8Array = encoder.encode(secret);
+  const cryptoKey = await subtle.importKey(
+    "raw",
+    keyUint8Array,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  _signKeys[secret] = cryptoKey;
+  return cryptoKey;
+}
+const _verifyKeys = {};
+async function getCryptoVerifyKey(secret) {
+  if (_verifyKeys[secret]) {
+    return _verifyKeys[secret];
+  }
+  const encoder = new TextEncoder();
+  const keyUint8Array = encoder.encode(secret);
+  const cryptoKey = await subtle.importKey(
+    "raw",
+    keyUint8Array,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"]
+  );
+  _verifyKeys[secret] = cryptoKey;
+  return cryptoKey;
+}
+
 class Session {
   #id;
   #store;
@@ -152,14 +187,7 @@ async function unsignCookie(value, secrets) {
   const messageUint8Array = encoder.encode(message);
   const signatureUint8Array = Uint8Array.from(Buffer.from(signature, "base64"));
   for (let i = 0; i < secrets.length; i++) {
-    const keyUint8Array = encoder.encode(secrets[i]);
-    const cryptoKey = await subtle.importKey(
-      "raw",
-      keyUint8Array,
-      { name: "HMAC", hash: "SHA-256" },
-      false,
-      ["verify"]
-    );
+    const cryptoKey = await getCryptoVerifyKey(secrets[i]);
     const result = await subtle.verify(
       "HMAC",
       cryptoKey,
@@ -181,14 +209,7 @@ async function signCookie(value, secret) {
   }
   const encoder = new TextEncoder();
   const messageUint8Array = encoder.encode(value);
-  const keyUint8Array = encoder.encode(secret);
-  const cryptoKey = await subtle.importKey(
-    "raw",
-    keyUint8Array,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
+  const cryptoKey = await getCryptoSignKey(secret);
   const signature = await subtle.sign("HMAC", cryptoKey, messageUint8Array);
   const b64Signature = Buffer.from(signature).toString("base64").replace(/=+$/, "");
   return `s:${value}.${b64Signature}`;
@@ -201,6 +222,7 @@ function validateConfig(config) {
     throw new Error("[h3-session] Session secret is required!");
   }
 }
+const uniqueCookieAttributes = /* @__PURE__ */ new Set(["name", "path", "domain"]);
 async function useSession(event, config) {
   if (event.context.session) {
     return;
@@ -240,6 +262,11 @@ async function useSession(event, config) {
     await cookie.setSessionId(sid);
     return new Proxy(cookie, {
       set(target, property, value) {
+        if (uniqueCookieAttributes.has(property)) {
+          throw new Error(
+            `[h3-session] Cannot change ${property} on a session cookie!`
+          );
+        }
         target[property] = value;
         setCookie(event, sessionConfig.name, signedCookie, cookie);
         return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scayle/h3-session",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "description": "Persistent sessions for h3",
   "author": "SCAYLE Commerce Engine",
   "license": "MIT",
@@ -8,6 +8,13 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
+  "repository": {
+    "url": "git+https://github.com/scayle/h3-session.git"
+  },
+  "keywords": [
+    "h3",
+    "session"
+  ],
   "exports": {
     ".": "./dist/index.mjs"
   },
@@ -21,10 +28,11 @@
     "verify-packaging": "attw --pack . --profile esm-only",
     "format": "dprint check",
     "format:fix": "dprint fmt",
-    "lint": "eslint . --format gitlab",
+    "lint": "eslint .",
+    "lint:ci": "eslint . --format gitlab",
     "lint:fix": "eslint . --fix",
     "test": "vitest run",
-    "test:ci": "vitest --run --coverage --reporter=default --reporter=junit --outputFile=./junit.xml",
+    "test:ci": "vitest --run --coverage --reporter=default --reporter=junit --outputFile=./coverage/junit.xml",
     "test:watch": "vitest watch",
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
@@ -37,18 +45,18 @@
     "unstorage": "^1.10.2"
   },
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.17.2",
-    "@scayle/eslint-config-storefront": "4.4.0",
-    "cookie-es": "1.2.2",
-    "dprint": "0.48.0",
-    "eslint": "9.17.0",
-    "eslint-formatter-gitlab": "5.1.0",
-    "h3": "1.13.0",
-    "typescript": "5.7.2",
-    "unbuild": "3.2.0",
-    "vitest": "2.1.8"
+    "@arethetypeswrong/cli": "0.17.4",
+    "@scayle/eslint-config-storefront": "4.5.0",
+    "cookie-es": "2.0.0",
+    "dprint": "0.49.1",
+    "eslint": "9.25.1",
+    "eslint-formatter-gitlab": "6.0.0",
+    "h3": "1.15.1",
+    "typescript": "5.8.3",
+    "unbuild": "3.5.0",
+    "vitest": "3.1.2"
   },
   "volta": {
-    "node": "22.12.0"
+    "node": "22.14.0"
   }
 }