@server/next 0.20.6 → 0.20.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.20.6",
+  "version": "0.20.8",
   "description": "An experimental reimplementation of server.js focused on the DX",
   "homepage": "https://node-server.com/",
   "repository": "https://github.com/franciscop/server-next.git",
@@ -9,7 +9,7 @@
   "author": "Francisco Presencia <public@francisco.io> (https://francisco.io/)",
   "license": "UNLICENSED",
   "scripts": {
-    "demo": "nodemon ./demo/app.js",
+    "demo": "nodemon ./demo/src/index.js",
     "start": "bun test --watch",
     "test": "bun test",
     "test:jest": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
@@ -30,12 +30,15 @@
     "node": ">=20.0.0"
   },
   "engineStrict": true,
-  "dependencies": {},
   "devDependencies": {
-    "jest": "^29.7.0"
+    "jest": "^29.7.0",
+    "polystore": "^0.8.0"
   },
   "jest": {
     "testEnvironment": "jest-environment-node",
     "transform": {}
+  },
+  "dependencies": {
+    "argon2": "^0.40.3"
   }
 }

package/src/ServerError.js

@@ -0,0 +1,24 @@
+export default class ServerError extends Error {
+  constructor(code, status, message, vars = {}) {
+    if (typeof message === "function") {
+      message = message(vars);
+    }
+    for (let key in vars) {
+      message = message.replaceAll(`{${key}}`, vars[key]);
+    }
+
+    super(message);
+    this.code = code;
+    this.message = message;
+    this.status = status;
+  }
+  static extend(errors) {
+    for (let code in errors) {
+      const message = errors[code]?.message || errors[code];
+      const status = errors[code]?.status;
+      ServerError[code] = (vars) =>
+        new ServerError(code, status, message, vars);
+    }
+    return errors;
+  }
+}

package/src/auth.test.js

@@ -0,0 +1,78 @@
+import kv from "polystore";
+
+import server from "./index.js";
+
+const url = (token) =>
+  new Request("http://localhost:3000/", {
+    headers: { authorization: token },
+  });
+
+describe("auth", () => {
+  const store = kv(new Map());
+  const app = server({ store }).get("/", (ctx) => {
+    return ctx.headers.authorization;
+  });
+
+  it("should be Bearer", async () => {
+    const res = await app.fetch(url("Basic REqA2l022l8Q0tuIRtqLOPUy"));
+    expect(await res.text()).toBe("Invalid Authorization type, 'Basic'");
+  });
+
+  it("should have the proper token", async () => {
+    const res = await app.fetch(url("Bearer hola"));
+    expect(await res.text()).toBe("Invalid Authorization token");
+  });
+
+  it("can get the nested get", async () => {
+    const res = await app.fetch(url("Bearer REqA2l022l8Q0tuIRtqLOPUy"));
+    expect(await res.text()).toBe("Bearer REqA2l022l8Q0tuIRtqLOPUy");
+  });
+
+  describe("user creation flow", () => {
+    // These are obviously mock data
+    const EMAIL = "abc@test.com";
+    const PASS = "11111111";
+
+    const url = (path, body = {}, headers = {}) =>
+      new Request("http://localhost:3000" + path, {
+        headers: {
+          cookie: "session=REqA2l022l8Q0tuIRtqLOPUy",
+          "content-type": "application/json",
+          ...headers,
+        },
+        method: "POST",
+        body: JSON.stringify(body),
+      });
+
+    const store = kv(new Map());
+    const app = server({ auth: { type: "token", providers: "email" }, store });
+
+    it("can create a new user", async () => {
+      const regReq = await app.fetch(
+        url("/auth/register/email", { email: EMAIL, password: PASS })
+      );
+      const register = await regReq.json();
+      expect(regReq.status).toBe(201);
+      expect(await store.keys()).toEqual([
+        "auth:abc@test.com",
+        "session:" + register.token,
+      ]);
+
+      const logoutReq = await app.fetch(
+        url("/auth/logout", {}, { authorization: "Bearer " + register.token })
+      );
+      expect(logoutReq.status).toBe(200);
+      expect(await store.keys()).toEqual(["auth:abc@test.com"]);
+
+      const loginReq = await app.fetch(
+        url("/auth/login/email", { email: EMAIL, password: PASS })
+      );
+      const login = await loginReq.json();
+      expect(loginReq.status).toBe(200);
+      expect(await store.keys()).toEqual([
+        "auth:abc@test.com",
+        "session:" + login.token,
+      ]);
+    });
+  });
+});

package/src/context/findAuth.js

@@ -0,0 +1,32 @@
+import { ServerError } from "../index.js";
+
+export default async function findAuth(ctx) {
+  // NO AUTH AT ALL
+  // If there's no even auth option, nothing to do
+  const store = ctx.options.auth?.store;
+  if (!store) return;
+
+  // AUTHENTICATION IS AVAILABLE
+  ctx.auth = {
+    type: ctx.options.auth.type,
+    providers: ctx.options.auth.providers,
+    store,
+  };
+
+  // If the user is not authenticated, there's no auth to retrieve
+  if (!ctx.headers.authorization) return;
+
+  // AUTHENTICATED REQUEST
+  // Check the authentication header
+  const [type, id] = ctx.headers.authorization.trim().split(" ");
+  if (type.toLowerCase() !== "bearer") {
+    throw ServerError.AUTH_INVALID_TYPE({ type });
+  }
+  if (id.length !== 24) {
+    throw ServerError.AUTH_INVALID_TOKEN();
+  }
+
+  // Extend the basics
+  ctx.auth.id = id;
+  ctx.user = await store.get(id);
+}

package/src/context/findSession.js

@@ -0,0 +1,34 @@
+import { ServerError } from "../index.js";
+
+class NoSession {}
+
+export default async function findSession(ctx) {
+  const store = ctx.options.session?.store;
+
+  // If there's no store at all, we don't have session available;
+  // but that's okay, since it's only a problem if you try to use it
+  if (!store) {
+    return new Proxy(new NoSession(), {
+      get(target, key) {
+        if (target[key]) return target[key];
+        if (key === "then") return target[key];
+        throw ServerError.NO_STORE_READ({ key });
+      },
+      set(target, key, value) {
+        if (target[key] || key === "then") {
+          target[key] = value;
+        } else {
+          throw ServerError.NO_STORE_WRITE({ key });
+        }
+      },
+    });
+  }
+
+  // There's a session cookie; use it as the key to get the data
+  // from the store
+  if (ctx.cookies.session) {
+    return (await store.get(ctx.cookies.session)) || {};
+  }
+
+  return {};
+}

package/src/context/node.js

@@ -1,8 +1,10 @@
 import { define } from "../helpers/index.js";
+import findAuth from "./findAuth.js";
+import findSession from "./findSession.js";
 import parseBody from "./parseBody.js";
 import parseCookies from "./parseCookies.js";
 
-export default async (request, options = {}) => {
+export default async (request, options = {}, app) => {
   const ctx = {};
   ctx.options = options;
   ctx.req = request;
@@ -10,7 +12,9 @@ export default async (request, options = {}) => {
   ctx.method = request.method.toLowerCase();
 
   ctx.headers = request.headers;
-  define(ctx, "cookies", () => parseCookies(request.headers.cookie));
+  ctx.cookies = parseCookies(ctx.headers.cookie);
+  ctx.session = await findSession(ctx);
+  await findAuth(ctx);
 
   const https = request.connection.encrypted ? "https" : "http";
   const host = ctx.headers.host || "localhost" + options.port;
@@ -38,5 +42,8 @@ export default async (request, options = {}) => {
       .on("error", reject);
   });
 
+  ctx.app = app;
+  ctx.platform = app.platform;
+
   return ctx;
 };

package/src/context/parseBody.js

@@ -1,3 +1,5 @@
+import { createId } from "../helpers/index.js";
+
 function getBoundary(header) {
   if (!header) return null;
   var items = header.split(";");
@@ -21,17 +23,9 @@ function getMatching(string, regex) {
   return matches[1];
 }
 
-const nanoid = (size = 12) => {
-  let str = "";
-  while (str.length < size + 2) {
-    str += Math.round(Math.random() * 1000000).toString(16);
-  }
-  return str.slice(0, size);
-};
-
 const saveFile = async (name, value, bucket) => {
   const ext = name.split(".").pop();
-  const id = `file-${nanoid(12)}.${ext}`;
+  const id = `${createId()}.${ext}`;
   await bucket.write(id, value, "binary");
   return id;
 };

package/src/context/parseBody.test.js

@@ -48,8 +48,8 @@ describe("parseBody", () => {
       test: ["test message 123456", "test message number two"],
     });
 
-    const matchMd = expect.stringMatching(/^file-\w{12}.md$/);
-    const matchTxt = expect.stringMatching(/^file-\w{12}.txt$/);
+    const matchMd = expect.stringMatching(/^\w{24}.md$/);
+    const matchTxt = expect.stringMatching(/^\w{24}.txt$/);
     expect(body).toMatchObject({
       profile: matchMd,
       gallery: [matchTxt, matchTxt],

package/src/context/winter.js

@@ -1,16 +1,20 @@
 import { define } from "../helpers/index.js";
+import findAuth from "./findAuth.js";
+import findSession from "./findSession.js";
 import parseBody from "./parseBody.js";
 import parseCookies from "./parseCookies.js";
 
-export default async (request, options = {}) => {
+export default async (request, options = {}, app) => {
   const ctx = {};
   ctx.options = options;
   ctx.req = request;
   ctx.res = { status: null, headers: {}, cookies: {} };
   ctx.method = request.method.toLowerCase();
 
-  define(ctx, "headers", () => Object.fromEntries(request.headers.entries()));
-  define(ctx, "cookies", () => parseCookies(request.headers.get("cookie")));
+  ctx.headers = Object.fromEntries(request.headers.entries());
+  ctx.cookies = parseCookies(ctx.headers.cookie);
+  ctx.session = await findSession(ctx);
+  await findAuth(ctx);
 
   ctx.url = new URL(request.url.replace(/\/$/, ""));
   define(ctx.url, "query", (url) =>
@@ -22,5 +26,8 @@ export default async (request, options = {}) => {
     ctx.body = await parseBody(request, type, options.uploads);
   }
 
+  ctx.app = app;
+  ctx.platform = app.platform;
+
   return ctx;
 };

package/src/errors/index.js

@@ -0,0 +1,18 @@
+import ServerError from "../ServerError.js";
+
+ServerError.extend({
+  NO_STORE: `You need a 'store' to write 'ctx.session'`,
+  NO_STORE_WRITE: `You need a 'store' to write 'ctx.session.{key}'`,
+  NO_STORE_READ: `You need a 'store' to read 'ctx.session.{key}'`,
+  AUTH_INVALID_TYPE: `Invalid Authorization type, '{type}'`,
+  AUTH_INVALID_TOKEN: `Invalid Authorization token`,
+
+  LOGIN_NO_EMAIL: "The email is required to log in",
+  LOGIN_INVALID_EMAIL: "The email you wrote is not correct",
+  LOGIN_NO_PASSWORD: "The email is required to log in",
+  LOGIN_INVALID_PASSWORD: "The email you wrote is not correct",
+  LOGIN_WRONG_ACCOUNT: `That email does not correspond to any account`,
+  LOGIN_WRONG_PASSWORD: `That is not the valid password`,
+});
+
+export default ServerError;

package/src/helpers/createCookies.js

@@ -0,0 +1,13 @@
+// Takes an object and returns a string with the proper cookie values
+export default function createCookies(cookies) {
+  if (!cookies || !Object.keys(cookies).length) return "";
+  return Object.entries(cookies)
+    .map(([key, val]) => {
+      if (typeof val === "string") {
+        val = { value: val, path: "/" };
+      }
+      const { value, path } = val;
+      return `${key}=${value};Path=${path}`;
+    })
+    .join(";");
+}

package/src/helpers/createId.js

@@ -0,0 +1,17 @@
+const urlAlphabet =
+  "useandom26T198340PX75pxJACKVERYMINDBUSHWOLFGQZbfghjklqvwyzrict";
+
+export let random = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
+
+export default function createId() {
+  let size = 24;
+  let id = "";
+  let bytes = crypto.getRandomValues(new Uint8Array(size));
+  while (size--) {
+    // Using the bitwise AND operator to "cap" the value of
+    // the random byte from 255 to 63, in that way we can make sure
+    // that the value will be a valid index for the "chars" string.
+    id += urlAlphabet[bytes[size] & 61];
+  }
+  return id;
+}

package/src/helpers/handleRequest.js

@@ -12,15 +12,11 @@ export default async function handleRequest(handlers, ctx) {
     define(ctx.url, "params", () => match);
 
     for (let cb of cbs) {
-      try {
-        validate(ctx, cb);
-        if (typeof cb === "function") {
-          const res = await cb(ctx);
-          const out = await parseResponse(res, ctx);
-          if (out) return out;
-        }
-      } catch (error) {
-        return new Response(error.message, { status: error.status || 500 });
+      validate(ctx, cb);
+      if (typeof cb === "function") {
+        const res = await cb(ctx);
+        const out = await parseResponse(res, ctx);
+        if (out) return out;
       }
     }
 

package/src/helpers/index.js

@@ -1,3 +1,5 @@
+export { default as createId } from "./createId.js";
+export { default as createCookies } from "./createCookies.js";
 export { default as define } from "./define.js";
 export { default as getMachine } from "./getMachine.js";
 export { default as handleRequest } from "./handleRequest.js";

package/src/helpers/validate.js

@@ -23,7 +23,6 @@ export default function (ctx, schema) {
     }
   } catch (error) {
     if (error.constructor.name === "ZodError") {
-      console.log(error);
       const message = error.issues
         .map(({ path, message }) => `[${base}.${path.join(".")}]: ${message}`)
         .sort()

package/src/index.js

@@ -1,16 +1,85 @@
 import "./polyfill.js";
+// Define the errors for ServerError
+import "./errors/index.js";
 
 import Bucket from "./bucket.js";
 import createNodeContext from "./context/node.js";
 import createWinterContext from "./context/winter.js";
-import { getMachine, handleRequest, iterate } from "./helpers/index.js";
+import {
+  createId,
+  getMachine,
+  handleRequest,
+  iterate,
+} from "./helpers/index.js";
+import middle from "./middle/index.js";
 
 // Export the reply helpers
 export * from "./reply.js";
 
+export { default as ServerError } from "./ServerError.js";
+
 // Allow to create a sub-router
 export { default as router } from "./router.js";
 
+const createNodeServer = async (app, options) => {
+  const http = await import("http");
+  http
+    .createServer(async (request, response) => {
+      try {
+        const ctx = await createNodeContext(request, options, app);
+        extendWithDefaults(ctx);
+        const out = await handleRequest(app.handlers, ctx);
+
+        response.writeHead(out.status || 200, out.headers);
+        if (out.body instanceof ReadableStream) {
+          await iterate(out.body, (chunk) => response.write(chunk));
+        } else {
+          response.write(out.body || "");
+        }
+        response.end();
+      } catch (error) {
+        response.writeHead(error.status || 500);
+        response.write(error.message || "");
+        response.end();
+      }
+    })
+    .listen(options.port);
+};
+
+const validateOptions = (options, env = {}) => {
+  options.port = options.port || env.PORT || 3000;
+  options.secret = options.secret || env.SECRET || "unsafe-" + createId();
+
+  options.views = options.views ? Bucket(options.views) : null;
+  options.public = options.public ? Bucket(options.public) : null;
+  options.uploads = options.uploads ? Bucket(options.uploads) : null;
+
+  options.store = options.store ?? null;
+  options.cookies = options.cookies ?? {};
+  if (options.store && options.cookies) {
+    options.session = { store: options.store.prefix("session:") };
+  }
+  options.auth = options.auth || {};
+  if (options.auth) {
+    if (typeof options.auth !== "object") {
+      options.auth = { type: options.auth };
+    }
+    if (!options.auth.store && options.store) {
+      options.auth.store = options.store.prefix("auth:");
+    }
+  }
+
+  return options;
+};
+
+const extendWithDefaults = (ctx) => {
+  // Only want to execute it once; it needs to happen on a per-request
+  // basis since we only have full access to the options there
+  if (ctx.app.extended) return;
+  middle(ctx);
+  ctx.app.extended = true;
+};
+
 // Export the main server()
 export default function server(options = {}) {
   if (!(this instanceof server)) {
@@ -29,12 +98,9 @@ export default function server(options = {}) {
     options: [],
   };
 
-  const platform = getMachine();
-  options.port = options.port || process.env.PORT || 3000;
+  this.extended = false;
 
-  options.views = options.views ? Bucket(options.views) : null;
-  options.public = options.public ? Bucket(options.public) : null;
-  options.uploads = options.uploads ? Bucket(options.uploads) : null;
+  this.platform = getMachine();
 
   // WEBSOCKETS stuff
   const sockets = [];
@@ -48,37 +114,24 @@ export default function server(options = {}) {
     close: (ws) => sockets.splice(sockets.indexOf(ws), 1),
   };
 
-  if (platform.runtime === "node") {
-    (async () => {
-      const http = await import("http");
-      http
-        .createServer(async (request, response) => {
-          const ctx = await createNodeContext(request, options);
-          ctx.app = this;
-          ctx.platform = platform;
-
-          const out = await handleRequest(this.handlers, ctx);
-
-          response.writeHead(out.status || 200, { header: out.headers });
-          if (out.body instanceof ReadableStream) {
-            await iterate(out.body, (chunk) => response.write(chunk));
-          } else {
-            response.write(out.body || "");
-          }
-          response.end();
-        })
-        .listen(options.port);
-    })();
+  // Starting stuff
+  if (this.platform.runtime === "node") {
+    options = validateOptions(options, process.env);
+
+    createNodeServer(this, options);
   }
 
   this.fetch = async (request, env, fetchCtx) => {
     if (env?.upgrade(request)) return;
 
-    const ctx = await createWinterContext(request, options);
-    ctx.app = this;
-    ctx.platform = platform;
-
-    return await handleRequest(this.handlers, ctx);
+    try {
+      options = validateOptions(options, env);
+      const ctx = await createWinterContext(request, options, this);
+      extendWithDefaults(ctx);
+      return await handleRequest(this.handlers, ctx);
+    } catch (error) {
+      return new Response(error.message, { status: error.status || 500 });
+    }
   };
 }
 

package/src/middle/index.js

@@ -0,0 +1,71 @@
+import argon2 from "argon2";
+
+import { createId } from "../helpers/index.js";
+import { status, type } from "../reply.js";
+import ServerError from "../ServerError.js";
+
+export default function middle(ctx) {
+  if (ctx.options.public) {
+    ctx.app.handlers.get.unshift([
+      "*",
+      "*",
+      async function publicFolder(ctx) {
+        try {
+          const asset = await ctx.options.public.read(ctx.url.pathname);
+          if (asset) {
+            return type(ctx.url.pathname.split(".").pop()).send(asset);
+          }
+        } catch (error) {}
+      },
+    ]);
+  }
+
+  if (!ctx.auth) return;
+  if (ctx.auth?.providers?.includes("email")) {
+    ctx.app.post("/auth/register/email", async (ctx) => {
+      const { email, password, ...data } = ctx.body;
+      if (!email || !/@/.test(email)) throw new Error("Email needed");
+      if (!password || password.length < 8) throw new Error("Password needed");
+      if (await ctx.auth.store.has(email)) {
+        throw new Error("Email is already registered");
+      }
+      const id = createId();
+      const time = new Date().toISOString();
+      const pass = await argon2.hash(password);
+      await ctx.auth.store.set(email, { id, email, password: pass, ...data });
+
+      // TYPE GOES HERE
+      const token = await ctx.options.session.store.add({ id, email, time });
+      return status(201).json({ id, token, email, ...data });
+    });
+
+    ctx.app.post("/auth/logout", async (ctx) => {
+      if (ctx.auth.id) {
+        await ctx.options.session.store.del(ctx.auth.id);
+      }
+      return status(200).send();
+    });
+
+    ctx.app.post("/auth/login/email", async (ctx) => {
+      const { email, password } = ctx.body;
+      if (!email) throw ServerError.LOGIN_NO_EMAIL();
+      if (!/@/.test(email)) throw ServerError.LOGIN_INVALID_EMAIL();
+      if (!password) throw ServerError.LOGIN_NO_PASSWORD();
+      if (password.length < 8) throw ServerError.LOGIN_INVALID_PASSWORD();
+
+      const time = new Date().toISOString();
+      const user = await ctx.auth.store.get(email);
+      if (!user) throw ServerError.LOGIN_WRONG_EMAIL();
+      const isValid = await argon2.verify(user.password, password);
+      if (!isValid) throw ServerError.LOGIN_WRONG_PASSWORD();
+
+      // TYPE GOES HERE
+      const token = await ctx.options.session.store.add({
+        id: user.id,
+        email,
+        time,
+      });
+      return { id: user.id, token, email };
+    });
+  }
+}

package/src/parseResponse.js

@@ -1,6 +1,8 @@
 // import { Readable } from "node:stream";
 
+import { createCookies, createId } from "./helpers/index.js";
 import { json } from "./reply.js";
+import ServerError from "./ServerError.js";
 
 export default async function parseResponse(out, ctx) {
   // undefined || null || 0 || false || ~""~ -> empty string is still 200
@@ -36,6 +38,34 @@ export default async function parseResponse(out, ctx) {
   }
 
   // Here it should be a Response
+
+  // If we have a session, we need to persist it into a cookie
+  if (Object.keys(ctx.session || {}).length) {
+    if (!ctx.options.session?.store) {
+      throw ServerError.NO_STORE({});
+    }
+
+    // Persistence is based on the Token
+    // Persistence is based on the Cookies
+    // No session cookies, generate a _persistent_ cookie
+    if (!ctx.cookies.session) {
+      ctx.res.cookies.session = createId();
+    }
+    const id = ctx.cookies.session;
+
+    // Saves the session in the session store
+    // Note that this is async but we are totally fine deferring it
+    ctx.options.session.store.set(id, ctx.session);
+  }
+
+  // Cookies to headers
+  if (ctx.options.cookies) {
+    if (Object.keys(ctx.res.cookies).length) {
+      ctx.res.headers["set-cookie"] = createCookies(ctx.res.cookies);
+    }
+  }
+
+  // Add the headers that are neeeded
   if (ctx?.res?.headers) {
     for (let key in ctx.res.headers) {
       out.headers[key] = ctx.res.headers[key];

package/src/reply.js

@@ -1,16 +1,17 @@
 import fs from "fs/promises";
 
-import { types } from "./helpers/index.js";
+import { createCookies, types } from "./helpers/index.js";
 
-function Reply() {}
-
-Reply.prototype.res = { headers: {}, cookies: {} };
+function Reply() {
+  this.res = {
+    headers: {},
+    cookies: {},
+  };
+}
 
 // INTERNAL
 Reply.prototype.generateHeaders = function () {
-  const cookies = Object.entries(this.res.cookies)
-    .map(([k, { value, path = "/" }]) => `${k}=${value};Path=${path}`)
-    .join(";");
+  const cookies = createCookies(this.res.cookies);
   return { ...this.res.headers, "set-cookie": cookies };
 };
 
@@ -51,7 +52,7 @@ Reply.prototype.cookies = function (cookies) {
 
 // FINAL
 Reply.prototype.json = function (body) {
-  return headers({ "content-type": "application/json" }).send(
+  return this.headers({ "content-type": "application/json" }).send(
     JSON.stringify(body)
   );
 };
@@ -76,7 +77,7 @@ Reply.prototype.view = async function (path) {
     }
     const data = await ctx.options.views.read(path);
     if (data) return this.type(path.split(".").pop()).send(data);
-    return status(404).send();
+    return this.status(404).send();
   };
 };
 

package/src/router.test.js

@@ -1,4 +1,4 @@
-import server, { router } from "./index.js";
+import server, { router, status } from "./index.js";
 
 const url = (path, options = {}) =>
   new Request("http://localhost:3000" + path, options);
@@ -44,4 +44,15 @@ describe("can route properly", () => {
     const res = await app.fetch(url("/api/hello", { method: "POST" }));
     expect(await res.text()).toBe("Hello /api/hello");
   });
+
+  it("no status reuse", async () => {
+    const app = server()
+      .get("/a", () => status(201).send("hello"))
+      .get("/b", () => ({ hello: "bye" }))
+      .get("/", () => "Fallback");
+    const resA = await app.fetch(url("/a"));
+    expect(resA.status).toBe(201);
+    const resB = await app.fetch(url("/b"));
+    expect(resB.status).toBe(200);
+  });
 });

package/src/session.test.js

@@ -0,0 +1,65 @@
+import kv from "polystore";
+
+import server from "./index.js";
+
+const url = (path, options = {}) =>
+  new Request("http://localhost:3000" + path, {
+    headers: { cookie: "session=REqA2l022l8Q0tuIRtqLOPUy" },
+    ...options,
+  });
+
+describe("session", () => {
+  const store = kv(new Map());
+  const app = server({ store })
+    .get("/hello", (ctx) => "Hello " + ctx.session.a)
+    .post("/hello", (ctx) => {
+      if (!ctx.session.a) ctx.session.a = 0;
+      ctx.session.a += 1;
+      return "Bye " + ctx.session.a;
+    })
+    .get("/", () => "Fallback");
+
+  it("can get the nested get", async () => {
+    await store.set("session:REqA2l022l8Q0tuIRtqLOPUy", { a: 0 });
+
+    const res = await app.fetch(url("/hello"));
+    expect(await res.text()).toBe("Hello 0");
+
+    const res2 = await app.fetch(url("/hello", { method: "POST" }));
+    expect(await res2.text()).toBe("Bye 1");
+    const res3 = await app.fetch(url("/hello"));
+    expect(await res3.text()).toBe("Hello 1");
+    expect(await store.get("session:REqA2l022l8Q0tuIRtqLOPUy")).toEqual({
+      a: 1,
+    });
+
+    const res4 = await app.fetch(url("/hello", { method: "POST" }));
+    expect(await res4.text()).toBe("Bye 2");
+    const res5 = await app.fetch(url("/hello"));
+    expect(await res5.text()).toBe("Hello 2");
+    expect(await store.get("session:REqA2l022l8Q0tuIRtqLOPUy")).toEqual({
+      a: 2,
+    });
+  });
+
+  const missingStore = server({ store: null })
+    .get("/read", (ctx) => "Bye " + ctx.session.a)
+    .get("/write", (ctx) => {
+      ctx.session.a = "hello";
+      return "All good";
+    });
+
+  it("cannot read a session without a store", async () => {
+    const res = await missingStore.fetch(url("/read"));
+    const body = await res.text();
+    expect(res.status).toBe(500);
+    expect(body).toBe("You need a 'store' to read 'ctx.session.a'");
+  });
+
+  it("cannot write a session without a store", async () => {
+    const res = await missingStore.fetch(url("/write"));
+    const body = await res.text();
+    expect(res.status).toBe(500);
+    expect(body).toBe("You need a 'store' to write 'ctx.session.a'");
+  });
+});