@server/next 0.20.5 → 0.20.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.20.5",
+  "version": "0.20.7",
   "description": "An experimental reimplementation of server.js focused on the DX",
   "homepage": "https://node-server.com/",
   "repository": "https://github.com/franciscop/server-next.git",
@@ -30,12 +30,15 @@
     "node": ">=20.0.0"
   },
   "engineStrict": true,
-  "dependencies": {},
   "devDependencies": {
-    "jest": "^29.7.0"
+    "jest": "^29.7.0",
+    "polystore": "^0.8.0"
   },
   "jest": {
     "testEnvironment": "jest-environment-node",
     "transform": {}
+  },
+  "dependencies": {
+    "argon2": "^0.40.3"
   }
 }

package/src/ServerError.js

@@ -0,0 +1,24 @@
+export default class ServerError extends Error {
+  constructor(code, status, message, vars = {}) {
+    if (typeof message === "function") {
+      message = message(vars);
+    }
+    for (let key in vars) {
+      message = message.replaceAll(`{${key}}`, vars[key]);
+    }
+
+    super(message);
+    this.code = code;
+    this.message = message;
+    this.status = status;
+  }
+  static extend(errors) {
+    for (let code in errors) {
+      const message = errors[code]?.message || errors[code];
+      const status = errors[code]?.status;
+      ServerError[code] = (vars) =>
+        new ServerError(code, status, message, vars);
+    }
+    return errors;
+  }
+}

package/src/auth.test.js

@@ -0,0 +1,69 @@
+import kv from "polystore";
+
+import server from "./index.js";
+
+const url = (token) =>
+  new Request("http://localhost:3000/", {
+    headers: { authorization: token },
+  });
+
+describe("auth", () => {
+  const store = kv(new Map());
+  const app = server({ store }).get("/", (ctx) => {
+    return ctx.headers.authorization;
+  });
+
+  it("should be Bearer", async () => {
+    const res = await app.fetch(url("Basic REqA2l022l8Q0tuIRtqLOPUy"));
+    expect(await res.text()).toBe("Invalid Authorization type, 'Basic'");
+  });
+
+  it("should have the proper token", async () => {
+    const res = await app.fetch(url("Bearer hola"));
+    expect(await res.text()).toBe("Invalid Authorization token");
+  });
+
+  it("can get the nested get", async () => {
+    const res = await app.fetch(url("Bearer REqA2l022l8Q0tuIRtqLOPUy"));
+    expect(await res.text()).toBe("Bearer REqA2l022l8Q0tuIRtqLOPUy");
+  });
+
+  describe.skip("user creation flow", () => {
+    const url = (path, options = {}) =>
+      new Request("http://localhost:3000" + path, {
+        headers: {
+          cookie: "session=REqA2l022l8Q0tuIRtqLOPUy",
+          "content-type": "application/json",
+        },
+        ...options,
+        body: JSON.stringify(options.body),
+      });
+
+    const store = kv(new Map());
+    const app = server({ auth: "email", store });
+
+    it("can create a new user", async () => {
+      const registered = await app.fetch(
+        url("/register", {
+          method: "POST",
+          body: { email: "abc@test.com", password: "11111111" },
+        })
+      );
+      console.log(registered);
+      console.log(Object.fromEntries(await store.entries()));
+      console.log(await registered.text());
+      expect(registered.status).toBe(201);
+
+      const login = await app.fetch(
+        url("/login", {
+          method: "POST",
+          body: { email: "abc@test.com", password: "11111111" },
+        })
+      );
+      console.log(login);
+      console.log(Object.fromEntries(await store.entries()));
+      console.log(await login.text());
+      expect(login.status).toBe(200);
+    });
+  });
+});

package/src/context/findAuth.js

@@ -0,0 +1,28 @@
+import { ServerError } from "../";
+
+export default async function findAuth(ctx) {
+  // NO AUTH AT ALL
+  // If there's no even auth option, nothing to do
+  const store = ctx.options.auth?.store;
+  if (!store) return;
+
+  // AUTHENTICATION IS AVAILABLE
+  ctx.auth = { type: ctx.options.auth.type, store };
+
+  // If the user is not authenticated, there's no auth to retrieve
+  if (!ctx.headers.authorization) return;
+
+  // AUTHENTICATED REQUEST
+  // Check the authentication header
+  const [type, id] = ctx.headers.authorization.trim().split(" ");
+  if (type.toLowerCase() !== "bearer") {
+    throw ServerError.AUTH_INVALID_TYPE({ type });
+  }
+  if (id.length !== 24) {
+    throw ServerError.AUTH_INVALID_TOKEN();
+  }
+
+  // Extend the basics
+  ctx.auth.id = id;
+  ctx.user = await store.get(id);
+}

package/src/context/findSession.js

@@ -0,0 +1,34 @@
+import { ServerError } from "../";
+
+class NoSession {}
+
+export default async function findSession(ctx) {
+  const store = ctx.options.session?.store;
+
+  // If there's no store at all, we don't have session available;
+  // but that's okay, since it's only a problem if you try to use it
+  if (!store) {
+    return new Proxy(new NoSession(), {
+      get(target, key) {
+        if (target[key]) return target[key];
+        if (key === "then") return target[key];
+        throw ServerError.NO_STORE_READ({ key });
+      },
+      set(target, key, value) {
+        if (target[key] || key === "then") {
+          target[key] = value;
+        } else {
+          throw ServerError.NO_STORE_WRITE({ key });
+        }
+      },
+    });
+  }
+
+  // There's a session cookie; use it as the key to get the data
+  // from the store
+  if (ctx.cookies.session) {
+    return (await store.get(ctx.cookies.session)) || {};
+  }
+
+  return {};
+}

package/src/context/node.js

@@ -1,8 +1,10 @@
 import { define } from "../helpers/index.js";
+import findAuth from "./findAuth.js";
+import findSession from "./findSession.js";
 import parseBody from "./parseBody.js";
 import parseCookies from "./parseCookies.js";
 
-export default async (request, options = {}) => {
+export default async (request, options = {}, app) => {
   const ctx = {};
   ctx.options = options;
   ctx.req = request;
@@ -10,7 +12,9 @@ export default async (request, options = {}) => {
   ctx.method = request.method.toLowerCase();
 
   ctx.headers = request.headers;
-  define(ctx, "cookies", () => parseCookies(request.headers.cookie));
+  ctx.cookies = parseCookies(ctx.headers.cookie);
+  ctx.session = await findSession(ctx);
+  await findAuth(ctx);
 
   const https = request.connection.encrypted ? "https" : "http";
   const host = ctx.headers.host || "localhost" + options.port;
@@ -38,5 +42,8 @@ export default async (request, options = {}) => {
       .on("error", reject);
   });
 
+  ctx.app = app;
+  ctx.platform = app.platform;
+
   return ctx;
 };

package/src/context/parseBody.js

@@ -1,3 +1,5 @@
+import { createId } from "../helpers/index.js";
+
 function getBoundary(header) {
   if (!header) return null;
   var items = header.split(";");
@@ -21,17 +23,9 @@ function getMatching(string, regex) {
   return matches[1];
 }
 
-const nanoid = (size = 12) => {
-  let str = "";
-  while (str.length < size + 2) {
-    str += Math.round(Math.random() * 1000000).toString(16);
-  }
-  return str.slice(0, size);
-};
-
 const saveFile = async (name, value, bucket) => {
   const ext = name.split(".").pop();
-  const id = `file-${nanoid(12)}.${ext}`;
+  const id = `${createId()}.${ext}`;
   await bucket.write(id, value, "binary");
   return id;
 };

package/src/context/parseBody.test.js

@@ -48,8 +48,8 @@ describe("parseBody", () => {
       test: ["test message 123456", "test message number two"],
     });
 
-    const matchMd = expect.stringMatching(/^file-\w{12}.md$/);
-    const matchTxt = expect.stringMatching(/^file-\w{12}.txt$/);
+    const matchMd = expect.stringMatching(/^\w{24}.md$/);
+    const matchTxt = expect.stringMatching(/^\w{24}.txt$/);
     expect(body).toMatchObject({
       profile: matchMd,
       gallery: [matchTxt, matchTxt],

package/src/context/winter.js

@@ -1,16 +1,20 @@
 import { define } from "../helpers/index.js";
+import findAuth from "./findAuth.js";
+import findSession from "./findSession.js";
 import parseBody from "./parseBody.js";
 import parseCookies from "./parseCookies.js";
 
-export default async (request, options = {}) => {
+export default async (request, options = {}, app) => {
   const ctx = {};
   ctx.options = options;
   ctx.req = request;
   ctx.res = { status: null, headers: {}, cookies: {} };
   ctx.method = request.method.toLowerCase();
 
-  define(ctx, "headers", () => Object.fromEntries(request.headers.entries()));
-  define(ctx, "cookies", () => parseCookies(request.headers.get("cookie")));
+  ctx.headers = Object.fromEntries(request.headers.entries());
+  ctx.cookies = parseCookies(ctx.headers.cookie);
+  ctx.session = await findSession(ctx);
+  await findAuth(ctx);
 
   ctx.url = new URL(request.url.replace(/\/$/, ""));
   define(ctx.url, "query", (url) =>
@@ -22,5 +26,8 @@ export default async (request, options = {}) => {
     ctx.body = await parseBody(request, type, options.uploads);
   }
 
+  ctx.app = app;
+  ctx.platform = app.platform;
+
   return ctx;
 };

package/src/errors/index.js

@@ -0,0 +1,10 @@
+import ServerError from "../ServerError";
+
+ServerError.extend({
+  NO_STORE_WRITE: `You need a 'store' to write 'ctx.session.{key}'`,
+  NO_STORE_READ: `You need a 'store' to read 'ctx.session.{key}'`,
+  AUTH_INVALID_TYPE: `Invalid Authorization type, '{type}'`,
+  AUTH_INVALID_TOKEN: `Invalid Authorization token`,
+});
+
+export default ServerError;

package/src/helpers/createCookies.js

@@ -0,0 +1,13 @@
+// Takes an object and returns a string with the proper cookie values
+export default function createCookies(cookies) {
+  if (!cookies || !Object.keys(cookies).length) return "";
+  return Object.entries(cookies)
+    .map(([key, val]) => {
+      if (typeof val === "string") {
+        val = { value: val, path: "/" };
+      }
+      const { value, path } = val;
+      return `${key}=${value};Path=${path}`;
+    })
+    .join(";");
+}

package/src/helpers/createId.js

@@ -0,0 +1,17 @@
+const urlAlphabet =
+  "useandom26T198340PX75pxJACKVERYMINDBUSHWOLFGQZbfghjklqvwyzrict";
+
+export let random = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
+
+export default function createId() {
+  let size = 24;
+  let id = "";
+  let bytes = crypto.getRandomValues(new Uint8Array(size));
+  while (size--) {
+    // Using the bitwise AND operator to "cap" the value of
+    // the random byte from 255 to 63, in that way we can make sure
+    // that the value will be a valid index for the "chars" string.
+    id += urlAlphabet[bytes[size] & 61];
+  }
+  return id;
+}

package/src/helpers/handleRequest.js

@@ -12,15 +12,11 @@ export default async function handleRequest(handlers, ctx) {
     define(ctx.url, "params", () => match);
 
     for (let cb of cbs) {
-      try {
-        validate(ctx, cb);
-        if (typeof cb === "function") {
-          const res = await cb(ctx);
-          const out = await parseResponse(res, ctx);
-          if (out) return out;
-        }
-      } catch (error) {
-        return new Response(error.message, { status: error.status || 500 });
+      validate(ctx, cb);
+      if (typeof cb === "function") {
+        const res = await cb(ctx);
+        const out = await parseResponse(res, ctx);
+        if (out) return out;
       }
     }
 

package/src/helpers/index.js

@@ -1,3 +1,5 @@
+export { default as createId } from "./createId.js";
+export { default as createCookies } from "./createCookies.js";
 export { default as define } from "./define.js";
 export { default as getMachine } from "./getMachine.js";
 export { default as handleRequest } from "./handleRequest.js";

package/src/helpers/validate.js

@@ -23,7 +23,6 @@ export default function (ctx, schema) {
     }
   } catch (error) {
     if (error.constructor.name === "ZodError") {
-      console.log(error);
       const message = error.issues
         .map(({ path, message }) => `[${base}.${path.join(".")}]: ${message}`)
         .sort()

package/src/index.js

@@ -1,16 +1,85 @@
 import "./polyfill.js";
+// Define the errors for ServerError
+import "./errors/index.js";
 
 import Bucket from "./bucket.js";
 import createNodeContext from "./context/node.js";
 import createWinterContext from "./context/winter.js";
-import { getMachine, handleRequest, iterate } from "./helpers/index.js";
+import {
+  createId,
+  getMachine,
+  handleRequest,
+  iterate,
+} from "./helpers/index.js";
+import middle from "./middle/index.js";
 
 // Export the reply helpers
 export * from "./reply.js";
 
+export { default as ServerError } from "./ServerError.js";
+
 // Allow to create a sub-router
 export { default as router } from "./router.js";
 
+const createNodeServer = async (app, options) => {
+  const http = await import("http");
+  http
+    .createServer(async (request, response) => {
+      try {
+        const ctx = await createNodeContext(request, options, app);
+        extendWithDefaults(ctx);
+        const out = await handleRequest(app.handlers, ctx);
+
+        response.writeHead(out.status || 200, out.headers);
+        if (out.body instanceof ReadableStream) {
+          await iterate(out.body, (chunk) => response.write(chunk));
+        } else {
+          response.write(out.body || "");
+        }
+        response.end();
+      } catch (error) {
+        response.writeHead(error.status || 500);
+        response.write(error.message || "");
+        response.end();
+      }
+    })
+    .listen(options.port);
+};
+
+const validateOptions = (options, env = {}) => {
+  options.port = options.port || env.PORT || 3000;
+  options.secret = options.secret || env.SECRET || "unsafe-" + createId();
+
+  options.views = options.views ? Bucket(options.views) : null;
+  options.public = options.public ? Bucket(options.public) : null;
+  options.uploads = options.uploads ? Bucket(options.uploads) : null;
+
+  options.store = options.store ?? null;
+  options.cookies = options.cookies ?? {};
+  if (options.store && options.cookies) {
+    options.session = { store: options.store.prefix("session:") };
+  }
+  options.auth = options.auth || {};
+  if (options.auth) {
+    if (typeof options.auth !== "object") {
+      options.auth = { type: options.auth };
+    }
+    if (!options.auth.store && options.store) {
+      options.auth.store = options.store.prefix("auth:");
+    }
+  }
+
+  return options;
+};
+
+const extendWithDefaults = (ctx) => {
+  // Only want to execute it once; it needs to happen on a per-request
+  // basis since we only have full access to the options there
+  if (ctx.app.extended) return;
+  middle(ctx);
+  ctx.app.extended = true;
+};
+
 // Export the main server()
 export default function server(options = {}) {
   if (!(this instanceof server)) {
@@ -29,12 +98,9 @@ export default function server(options = {}) {
     options: [],
   };
 
-  const platform = getMachine();
-  options.port = options.port || process.env.PORT || 3000;
+  this.extended = false;
 
-  options.views = options.views ? Bucket(options.views) : null;
-  options.public = options.public ? Bucket(options.public) : null;
-  options.uploads = options.uploads ? Bucket(options.uploads) : null;
+  this.platform = getMachine();
 
   // WEBSOCKETS stuff
   const sockets = [];
@@ -48,37 +114,24 @@ export default function server(options = {}) {
     close: (ws) => sockets.splice(sockets.indexOf(ws), 1),
   };
 
-  if (platform.runtime === "node") {
-    (async () => {
-      const http = await import("http");
-      http
-        .createServer(async (request, response) => {
-          const ctx = await createNodeContext(request, options);
-          ctx.app = this;
-          ctx.platform = platform;
-
-          const out = await handleRequest(this.handlers, ctx);
-
-          response.writeHead(out.status || 200, { header: out.headers });
-          if (out.body instanceof ReadableStream) {
-            await iterate(out.body, (chunk) => response.write(chunk));
-          } else {
-            response.write(out.body || "");
-          }
-          response.end();
-        })
-        .listen(options.port);
-    })();
+  // Starting stuff
+  if (this.platform.runtime === "node") {
+    options = validateOptions(options, process.env);
+
+    createNodeServer(this, options);
   }
 
   this.fetch = async (request, env, fetchCtx) => {
     if (env?.upgrade(request)) return;
 
-    const ctx = await createWinterContext(request, options);
-    ctx.app = this;
-    ctx.platform = platform;
-
-    return await handleRequest(this.handlers, ctx);
+    try {
+      options = validateOptions(options, env);
+      const ctx = await createWinterContext(request, options, this);
+      extendWithDefaults(ctx);
+      return await handleRequest(this.handlers, ctx);
+    } catch (error) {
+      return new Response(error.message, { status: error.status || 500 });
+    }
   };
 }
 
@@ -135,7 +188,7 @@ server.prototype.use = function (...middleware) {
 };
 
 server.prototype.router = function (basePath, router) {
-  basePath = "/" + basePath.replace(/^\//, "").replace(/\/$/, "") + "/";
+  basePath = ("/" + basePath + "/").replace(/^\/+/, "/").replace(/\/+$/, "/");
   for (const method in router.handlers) {
     router.handlers[method].forEach(([method, path, ...callbacks]) => {
       this.handle(method, basePath + path.replace(/^\//, ""), ...callbacks);

package/src/middle/index.js

@@ -0,0 +1,40 @@
+import argon2 from "argon2";
+
+import { createId } from "../helpers";
+import { status } from "../reply";
+
+export default function middle(ctx) {
+  // if (ctx.auth?.type?.includes("email")) {
+  //   ctx.app.post("/register", async (ctx) => {
+  //     const { email, password, ...data } = ctx.body;
+  //     if (!email || !/@/.test(email)) throw new Error("Email needed");
+  //     if (!password || password.length < 8) throw new Error("Password needed");
+  //     const id = createId();
+  //     const time = new Date().toISOString();
+  //     const pass = await argon2.hash(password);
+  //     await ctx.auth.store.set(email, { id, email, password: pass, ...data });
+  //     const token = await ctx.options.session.store.add({ id, email, time });
+  //     return status(201).send({ id, token, email, ...data });
+  //   });
+  //
+  //   ctx.app.post("/login", async (ctx) => {
+  //     const { email, password } = ctx.body;
+  //     if (!email || !/@/.test(email)) throw new Error("Email needed");
+  //     if (!password || password.length < 8) throw new Error("Password needed");
+  //     const time = new Date().toISOString();
+  //     const user = await ctx.auth.store.get(email);
+  //     if (!user) {
+  //       return status(400).send("Invalid email");
+  //     }
+  //     if (!(await argon2.verify(user.password, password))) {
+  //       return status(400).send("Invalid password");
+  //     }
+  //     const token = await ctx.options.session.store.add({
+  //       id: user.id,
+  //       email,
+  //       time,
+  //     });
+  //     return { id: user.id, token, email };
+  //   });
+  // }
+}

package/src/parseResponse.js

@@ -1,6 +1,8 @@
 // import { Readable } from "node:stream";
 
+import { createCookies, createId } from "./helpers/index.js";
 import { json } from "./reply.js";
+import ServerError from "./ServerError.js";
 
 export default async function parseResponse(out, ctx) {
   // undefined || null || 0 || false || ~""~ -> empty string is still 200
@@ -36,6 +38,39 @@ export default async function parseResponse(out, ctx) {
   }
 
   // Here it should be a Response
+
+  // If we have a session, we need to persist it into a cookie
+  if (Object.keys(ctx.session || {}).length) {
+    if (!ctx.options.session?.store) {
+      throw ServerError.NO_STORE_WRITE({});
+    }
+
+    let id;
+    // Persistence is based on the Token
+    if (ctx.auth) {
+      id = ctx.auth.id;
+    } else {
+      // Persistence is based on the Cookies
+      // No session cookies, generate a _persistent_ cookie
+      if (!ctx.cookies.session) {
+        ctx.res.cookies.session = createId();
+      }
+      id = ctx.cookies.session;
+    }
+
+    // Saves the session in the session store
+    // Note that this is async but we are totally fine deferring it
+    ctx.options.session.store.set(id, ctx.session);
+  }
+
+  // Cookies to headers
+  if (ctx.options.cookies) {
+    if (Object.keys(ctx.res.cookies).length) {
+      ctx.res.headers["set-cookie"] = createCookies(ctx.res.cookies);
+    }
+  }
+
+  // Add the headers that are neeeded
   if (ctx?.res?.headers) {
     for (let key in ctx.res.headers) {
       out.headers[key] = ctx.res.headers[key];

package/src/reply.js

@@ -1,6 +1,6 @@
 import fs from "fs/promises";
 
-import { types } from "./helpers/index.js";
+import { createCookies, types } from "./helpers/index.js";
 
 function Reply() {}
 
@@ -8,9 +8,7 @@ Reply.prototype.res = { headers: {}, cookies: {} };
 
 // INTERNAL
 Reply.prototype.generateHeaders = function () {
-  const cookies = Object.entries(this.res.cookies)
-    .map(([k, { value, path = "/" }]) => `${k}=${value};Path=${path}`)
-    .join(";");
+  const cookies = createCookies(this.res.cookies);
   return { ...this.res.headers, "set-cookie": cookies };
 };
 

package/src/router.test.js

@@ -0,0 +1,47 @@
+import server, { router } from "./index.js";
+
+const url = (path, options = {}) =>
+  new Request("http://localhost:3000" + path, options);
+
+describe("can route properly", () => {
+  const api = router()
+    .get("/hello", (ctx) => "Hello " + ctx.url.pathname)
+    .put("/hello", (ctx) => "Hello " + ctx.url.pathname)
+    .post("/hello", (ctx) => "Hello " + ctx.url.pathname);
+
+  const app = server()
+    .router("/", api)
+    .router("/api/", api)
+    .get("/", () => "Fallback");
+
+  // INTERNAL - so this might change in the future
+  it("has the correct structure", () => {
+    const registeredPaths = app.handlers.get.map((h) => h[1]);
+    expect(registeredPaths).toEqual(["/hello", "/api/hello", "/"]);
+  });
+
+  it("can get fallback when nothing matches", async () => {
+    const res = await app.fetch(url("/"));
+    expect(await res.text()).toBe("Fallback");
+  });
+
+  it("can get the base get", async () => {
+    const res = await app.fetch(url("/hello"));
+    expect(await res.text()).toBe("Hello /hello");
+  });
+
+  it("can get the nested get", async () => {
+    const res = await app.fetch(url("/api/hello"));
+    expect(await res.text()).toBe("Hello /api/hello");
+  });
+
+  it("can post to the base get", async () => {
+    const res = await app.fetch(url("/hello", { method: "POST" }));
+    expect(await res.text()).toBe("Hello /hello");
+  });
+
+  it("can post to the nested get", async () => {
+    const res = await app.fetch(url("/api/hello", { method: "POST" }));
+    expect(await res.text()).toBe("Hello /api/hello");
+  });
+});

package/src/session.test.js

@@ -0,0 +1,65 @@
+import kv from "polystore";
+
+import server from "./index.js";
+
+const url = (path, options = {}) =>
+  new Request("http://localhost:3000" + path, {
+    headers: { cookie: "session=REqA2l022l8Q0tuIRtqLOPUy" },
+    ...options,
+  });
+
+describe("session", () => {
+  const store = kv(new Map());
+  const app = server({ store })
+    .get("/hello", (ctx) => "Hello " + ctx.session.a)
+    .post("/hello", (ctx) => {
+      if (!ctx.session.a) ctx.session.a = 0;
+      ctx.session.a += 1;
+      return "Bye " + ctx.session.a;
+    })
+    .get("/", () => "Fallback");
+
+  it("can get the nested get", async () => {
+    await store.set("session:REqA2l022l8Q0tuIRtqLOPUy", { a: 0 });
+
+    const res = await app.fetch(url("/hello"));
+    expect(await res.text()).toBe("Hello 0");
+
+    const res2 = await app.fetch(url("/hello", { method: "POST" }));
+    expect(await res2.text()).toBe("Bye 1");
+    const res3 = await app.fetch(url("/hello"));
+    expect(await res3.text()).toBe("Hello 1");
+    expect(await store.get("session:REqA2l022l8Q0tuIRtqLOPUy")).toEqual({
+      a: 1,
+    });
+
+    const res4 = await app.fetch(url("/hello", { method: "POST" }));
+    expect(await res4.text()).toBe("Bye 2");
+    const res5 = await app.fetch(url("/hello"));
+    expect(await res5.text()).toBe("Hello 2");
+    expect(await store.get("session:REqA2l022l8Q0tuIRtqLOPUy")).toEqual({
+      a: 2,
+    });
+  });
+
+  const missingStore = server({ store: null })
+    .get("/read", (ctx) => "Bye " + ctx.session.a)
+    .get("/write", (ctx) => {
+      ctx.session.a = "hello";
+      return "All good";
+    });
+
+  it("cannot read a session without a store", async () => {
+    const res = await missingStore.fetch(url("/read"));
+    const body = await res.text();
+    expect(res.status).toBe(500);
+    expect(body).toBe("You need a 'store' to read 'ctx.session.a'");
+  });
+
+  it("cannot write a session without a store", async () => {
+    const res = await missingStore.fetch(url("/write"));
+    const body = await res.text();
+    expect(res.status).toBe(500);
+    expect(body).toBe("You need a 'store' to write 'ctx.session.a'");
+  });
+});