@spinajs/http 2.0.482 → 2.0.485

package/lib/cjs/config/http.d.ts

@@ -6,13 +6,6 @@ declare const http: {
             cli: string[];
         };
     };
-    cookie: {
-        secret: string;
-        options: {
-            maxAge: number;
-            httpOnly: boolean;
-        };
-    };
     fs: {
         providers: {
             service: string;
@@ -21,6 +14,21 @@ declare const http: {
         }[];
     };
     http: {
+        /**
+         * Cookie defaults. This MUST live under `http.` - every consumer reads
+         * `http.cookie.secret` ( responses, @FromCookie, the rbac session middleware ),
+         * and the parser that makes signed cookies work is bound to it.
+         *
+         * Override the secret per app: this default is public, and signed cookies are
+         * only as trustworthy as the key that signs them.
+         */
+        cookie: {
+            secret: string;
+            options: {
+                maxAge: number;
+                httpOnly: boolean;
+            };
+        };
         /**
          * File upload default middlewares
          */

package/lib/cjs/config/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/config/http.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AA0B9B,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;QAuCN;;WAEG;;;;;;;;;;;;;;;QAwCH;;WAEG;;YAGC;;eAEG;;YAGH;;eAEG;;;QAKP;;WAEG;;QAGH;;;WAGG;;;CAgBN,CAAC;AAEF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/config/http.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AA0B9B,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;QAgCN;;;;;;;WAOG;;;;;;;;QASH;;WAEG;;;;;;;;;;;;;;;QAwCH;;WAEG;;YAGC;;eAEG;;YAGH;;eAEG;;;QAKP;;WAEG;;QAGH;;;WAGG;;;CAgBN,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/lib/cjs/config/http.js

@@ -5,7 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = __importDefault(require("express"));
 const helmet_1 = __importDefault(require("helmet"));
-const cookie_parser_1 = __importDefault(require("cookie-parser"));
+const cookie_js_1 = require("../cookie.js");
 const compression_1 = __importDefault(require("compression"));
 const path_1 = require("path");
 const os_1 = __importDefault(require("os"));
@@ -30,13 +30,6 @@ const http = {
             cli: [...dir('cli')],
         },
     },
-    cookie: {
-        secret: '1234adreewD',
-        options: {
-            maxAge: 900000,
-            httpOnly: true,
-        },
-    },
     fs: {
         providers: [
             // formidable default file provider, incoming
@@ -60,6 +53,21 @@ const http = {
         ],
     },
     http: {
+        /**
+         * Cookie defaults. This MUST live under `http.` - every consumer reads
+         * `http.cookie.secret` ( responses, @FromCookie, the rbac session middleware ),
+         * and the parser that makes signed cookies work is bound to it.
+         *
+         * Override the secret per app: this default is public, and signed cookies are
+         * only as trustworthy as the key that signs them.
+         */
+        cookie: {
+            secret: '1234adreewD',
+            options: {
+                maxAge: 900000,
+                httpOnly: true,
+            },
+        },
         /**
          * File upload default middlewares
          */
@@ -96,7 +104,7 @@ const http = {
                 type: ['application/xml', 'text/xml', 'application/*+xml'],
                 limit: '5mb',
             }),
-            (0, cookie_parser_1.default)(),
+            cookie_js_1.configuredCookieParser,
             (0, compression_1.default)(),
         ],
         /**

package/lib/cjs/config/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/config/http.ts"],"names":[],"mappings":";;;;;AAAA,sDAA8B;AAC9B,oDAA4B;AAC5B,kEAAyC;AACzC,8DAAsC;AACtC,+BAAgD;AAChD,4CAAoB;AAEpB,SAAS,GAAG,CAAC,GAAG,IAAe;IAC7B,OAAO,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,GAAG,CAAC,GAAG,IAAc;IAC5B,OAAO,IAAA,WAAI,EAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAEjE,4CAA4C;QAC5C,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC;AAGD,MAAM,IAAI,GAAG;IACX,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE;YACP,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,IAAI;SACf;KACF;IACD,EAAE,EAAE;QACF,SAAS,EAAE;YACT,6CAA6C;YAC7C,4CAA4C;YAC5C;gBACE,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,kCAAkC;gBACxC,QAAQ,EAAE,YAAE,CAAC,MAAM,EAAE;aACtB;YACD;gBACE,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,gCAAgC;gBACtC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC;aACpC;YACD;gBACE,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,yBAAyB;gBAE/B,iDAAiD;gBACjD,QAAQ,EAAE,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,iBAAiB,CAAC;aAC9D;SACF;KACF;IAED,IAAI,EAAE;QACJ;;WAEG;QACH,MAAM,EAAE;YACN,WAAW,EAAE,CAAC,oBAAoB,CAAC;SAEpC;QAED,GAAG,EAAE;YACH,GAAG,EAAE,EAAE;YACP,IAAI,EAAE,EAAE;SACT;QACD,WAAW,EAAE;YACX,KAAK,EAAE;gBACL,2CAA2C;gBAC3C,MAAM,EAAE,EAAE;aACX;SACF;QACD,IAAI,EAAE,IAAI;QACV,WAAW,EAAE;YACX,IAAA,gBAAM,GAAE;YACR,iBAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK;gBACZ,gEAAgE;gBAChE,8DAA8D;gBAC9D,MAAM,EAAE,CAAC,GAAQ,EAAE,IAAS,EAAE,GAAW,EAAE,EAAE;oBAC3C,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;gBACpB,CAAC;aACF,CAAC;YACF,iBAAO,CAAC,UAAU,CAAC;gBACjB,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,wEAAwE;YACxE,oEAAoE;YACpE,iBAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,mBAAmB,CAAC;gBAC1D,KAAK,EAAE,KAAK;aACb,CAAC;YACF,IAAA,uBAAY,GAAE;YACd,IAAA,qBAAW,GAAE;SACd;QAED;;WAEG;QACH,MAAM,EAAE;YACN;gBACE;;mBAEG;gBACH,KAAK,EAAE,UAAU;gBAEjB;;mBAEG;gBACH,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;aACpB;SACF;QAED;;WAEG;QACH,aAAa,EAAE,CAAC,GAAG,CAAC;QAEpB;;;WAGG;QACH,aAAa,EAAE;;;;;;;;;;;;;4BAaS;KACzB;CACF,CAAC;AAEF,kBAAe,IAAI,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/config/http.ts"],"names":[],"mappings":";;;;;AAAA,sDAA8B;AAC9B,oDAA4B;AAC5B,4CAAsD;AACtD,8DAAsC;AACtC,+BAAgD;AAChD,4CAAoB;AAEpB,SAAS,GAAG,CAAC,GAAG,IAAe;IAC7B,OAAO,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,GAAG,CAAC,GAAG,IAAc;IAC5B,OAAO,IAAA,WAAI,EAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAEjE,4CAA4C;QAC5C,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC;AAGD,MAAM,IAAI,GAAG;IACX,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;IACD,EAAE,EAAE;QACF,SAAS,EAAE;YACT,6CAA6C;YAC7C,4CAA4C;YAC5C;gBACE,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,kCAAkC;gBACxC,QAAQ,EAAE,YAAE,CAAC,MAAM,EAAE;aACtB;YACD;gBACE,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,gCAAgC;gBACtC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC;aACpC;YACD;gBACE,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,yBAAyB;gBAE/B,iDAAiD;gBACjD,QAAQ,EAAE,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,iBAAiB,CAAC;aAC9D;SACF;KACF;IAED,IAAI,EAAE;QACJ;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE;gBACP,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,IAAI;aACf;SACF;QAED;;WAEG;QACH,MAAM,EAAE;YACN,WAAW,EAAE,CAAC,oBAAoB,CAAC;SAEpC;QAED,GAAG,EAAE;YACH,GAAG,EAAE,EAAE;YACP,IAAI,EAAE,EAAE;SACT;QACD,WAAW,EAAE;YACX,KAAK,EAAE;gBACL,2CAA2C;gBAC3C,MAAM,EAAE,EAAE;aACX;SACF;QACD,IAAI,EAAE,IAAI;QACV,WAAW,EAAE;YACX,IAAA,gBAAM,GAAE;YACR,iBAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK;gBACZ,gEAAgE;gBAChE,8DAA8D;gBAC9D,MAAM,EAAE,CAAC,GAAQ,EAAE,IAAS,EAAE,GAAW,EAAE,EAAE;oBAC3C,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;gBACpB,CAAC;aACF,CAAC;YACF,iBAAO,CAAC,UAAU,CAAC;gBACjB,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,wEAAwE;YACxE,oEAAoE;YACpE,iBAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,mBAAmB,CAAC;gBAC1D,KAAK,EAAE,KAAK;aACb,CAAC;YACF,kCAAsB;YACtB,IAAA,qBAAW,GAAE;SACd;QAED;;WAEG;QACH,MAAM,EAAE;YACN;gBACE;;mBAEG;gBACH,KAAK,EAAE,UAAU;gBAEjB;;mBAEG;gBACH,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;aACpB;SACF;QAED;;WAEG;QACH,aAAa,EAAE,CAAC,GAAG,CAAC;QAEpB;;;WAGG;QACH,aAAa,EAAE;;;;;;;;;;;;;4BAaS;KACzB;CACF,CAAC;AAEF,kBAAe,IAAI,CAAC"}

package/lib/cjs/cookie.d.ts

@@ -0,0 +1,8 @@
+import type express from 'express';
+export declare const configuredCookieParser: express.RequestHandler;
+/**
+ * Drops the memoised parser. Only needed where the configured secret can change
+ * within one process, ie. tests.
+ */
+export declare function resetCookieParser(): void;
+//# sourceMappingURL=cookie.d.ts.map

package/lib/cjs/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../src/cookie.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAoBnC,eAAO,MAAM,sBAAsB,EAAE,OAAO,CAAC,cAO5C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC"}

package/lib/cjs/cookie.js

@@ -0,0 +1,40 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configuredCookieParser = void 0;
+exports.resetCookieParser = resetCookieParser;
+const cookie_parser_1 = __importDefault(require("cookie-parser"));
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+/**
+ * cookie-parser bound to the configured `http.cookie.secret`.
+ *
+ * It MUST be constructed with the secret: that is what puts `req.secret` in place,
+ * and without it express throws `cookieParser("secret") required for signed cookies`
+ * from any `res.cookie(..., { signed: true })`. Logging in sets a signed `ssid`
+ * cookie, so a secretless parser breaks authentication outright.
+ *
+ * The secret is read on FIRST REQUEST rather than when this module is evaluated,
+ * because the config file that installs this middleware is itself loaded before the
+ * Configuration service exists. Capturing the value at module scope would freeze the
+ * shipped default and silently ignore whatever the app configured.
+ */
+let parser;
+const configuredCookieParser = (req, res, next) => {
+    if (!parser) {
+        const secret = di_1.DI.get(configuration_1.Configuration)?.get('http.cookie.secret');
+        parser = (0, cookie_parser_1.default)(secret);
+    }
+    return parser(req, res, next);
+};
+exports.configuredCookieParser = configuredCookieParser;
+/**
+ * Drops the memoised parser. Only needed where the configured secret can change
+ * within one process, ie. tests.
+ */
+function resetCookieParser() {
+    parser = undefined;
+}
+//# sourceMappingURL=cookie.js.map

package/lib/cjs/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/cookie.ts"],"names":[],"mappings":";;;;;;AAiCA,8CAEC;AAlCD,kEAAyC;AACzC,oCAAiC;AACjC,0DAAuD;AAEvD;;;;;;;;;;;;GAYG;AACH,IAAI,MAA0C,CAAC;AAExC,MAAM,sBAAsB,GAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,OAAE,CAAC,GAAG,CAAC,6BAAa,CAAC,EAAE,GAAG,CAAS,oBAAoB,CAAC,CAAC;QACxE,MAAM,GAAG,IAAA,uBAAY,EAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC,CAAC;AAPW,QAAA,sBAAsB,0BAOjC;AAEF;;;GAGG;AACH,SAAgB,iBAAiB;IAC/B,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC"}

package/lib/mjs/config/http.d.ts

@@ -6,13 +6,6 @@ declare const http: {
             cli: string[];
         };
     };
-    cookie: {
-        secret: string;
-        options: {
-            maxAge: number;
-            httpOnly: boolean;
-        };
-    };
     fs: {
         providers: {
             service: string;
@@ -21,6 +14,21 @@ declare const http: {
         }[];
     };
     http: {
+        /**
+         * Cookie defaults. This MUST live under `http.` - every consumer reads
+         * `http.cookie.secret` ( responses, @FromCookie, the rbac session middleware ),
+         * and the parser that makes signed cookies work is bound to it.
+         *
+         * Override the secret per app: this default is public, and signed cookies are
+         * only as trustworthy as the key that signs them.
+         */
+        cookie: {
+            secret: string;
+            options: {
+                maxAge: number;
+                httpOnly: boolean;
+            };
+        };
         /**
          * File upload default middlewares
          */

package/lib/mjs/config/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/config/http.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AA0B9B,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;QAuCN;;WAEG;;;;;;;;;;;;;;;QAwCH;;WAEG;;YAGC;;eAEG;;YAGH;;eAEG;;;QAKP;;WAEG;;QAGH;;;WAGG;;;CAgBN,CAAC;AAEF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/config/http.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AA0B9B,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;QAgCN;;;;;;;WAOG;;;;;;;;QASH;;WAEG;;;;;;;;;;;;;;;QAwCH;;WAEG;;YAGC;;eAEG;;YAGH;;eAEG;;;QAKP;;WAEG;;QAGH;;;WAGG;;;CAgBN,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/lib/mjs/config/http.js

@@ -1,6 +1,6 @@
 import express from 'express';
 import helmet from 'helmet';
-import cookieParser from 'cookie-parser';
+import { configuredCookieParser } from '../cookie.js';
 import compression from 'compression';
 import { join, normalize, resolve } from 'path';
 import os from 'os';
@@ -25,13 +25,6 @@ const http = {
             cli: [...dir('cli')],
         },
     },
-    cookie: {
-        secret: '1234adreewD',
-        options: {
-            maxAge: 900000,
-            httpOnly: true,
-        },
-    },
     fs: {
         providers: [
             // formidable default file provider, incoming
@@ -55,6 +48,21 @@ const http = {
         ],
     },
     http: {
+        /**
+         * Cookie defaults. This MUST live under `http.` - every consumer reads
+         * `http.cookie.secret` ( responses, @FromCookie, the rbac session middleware ),
+         * and the parser that makes signed cookies work is bound to it.
+         *
+         * Override the secret per app: this default is public, and signed cookies are
+         * only as trustworthy as the key that signs them.
+         */
+        cookie: {
+            secret: '1234adreewD',
+            options: {
+                maxAge: 900000,
+                httpOnly: true,
+            },
+        },
         /**
          * File upload default middlewares
          */
@@ -91,7 +99,7 @@ const http = {
                 type: ['application/xml', 'text/xml', 'application/*+xml'],
                 limit: '5mb',
             }),
-            cookieParser(),
+            configuredCookieParser,
             compression(),
         ],
         /**

package/lib/mjs/config/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/config/http.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,WAAW,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,SAAS,GAAG,CAAC,GAAG,IAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,GAAG,CAAC,GAAG,IAAc;IAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAEjE,4CAA4C;QAC5C,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC;AAGD,MAAM,IAAI,GAAG;IACX,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE;YACP,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,IAAI;SACf;KACF;IACD,EAAE,EAAE;QACF,SAAS,EAAE;YACT,6CAA6C;YAC7C,4CAA4C;YAC5C;gBACE,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,kCAAkC;gBACxC,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE;aACtB;YACD;gBACE,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,gCAAgC;gBACtC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC;aACpC;YACD;gBACE,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,yBAAyB;gBAE/B,iDAAiD;gBACjD,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,iBAAiB,CAAC;aAC9D;SACF;KACF;IAED,IAAI,EAAE;QACJ;;WAEG;QACH,MAAM,EAAE;YACN,WAAW,EAAE,CAAC,oBAAoB,CAAC;SAEpC;QAED,GAAG,EAAE;YACH,GAAG,EAAE,EAAE;YACP,IAAI,EAAE,EAAE;SACT;QACD,WAAW,EAAE;YACX,KAAK,EAAE;gBACL,2CAA2C;gBAC3C,MAAM,EAAE,EAAE;aACX;SACF;QACD,IAAI,EAAE,IAAI;QACV,WAAW,EAAE;YACX,MAAM,EAAE;YACR,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK;gBACZ,gEAAgE;gBAChE,8DAA8D;gBAC9D,MAAM,EAAE,CAAC,GAAQ,EAAE,IAAS,EAAE,GAAW,EAAE,EAAE;oBAC3C,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;gBACpB,CAAC;aACF,CAAC;YACF,OAAO,CAAC,UAAU,CAAC;gBACjB,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,wEAAwE;YACxE,oEAAoE;YACpE,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,mBAAmB,CAAC;gBAC1D,KAAK,EAAE,KAAK;aACb,CAAC;YACF,YAAY,EAAE;YACd,WAAW,EAAE;SACd;QAED;;WAEG;QACH,MAAM,EAAE;YACN;gBACE;;mBAEG;gBACH,KAAK,EAAE,UAAU;gBAEjB;;mBAEG;gBACH,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;aACpB;SACF;QAED;;WAEG;QACH,aAAa,EAAE,CAAC,GAAG,CAAC;QAEpB;;;WAGG;QACH,aAAa,EAAE;;;;;;;;;;;;;4BAaS;KACzB;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/config/http.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,WAAW,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,SAAS,GAAG,CAAC,GAAG,IAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,GAAG,CAAC,GAAG,IAAc;IAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAEjE,4CAA4C;QAC5C,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC;AAGD,MAAM,IAAI,GAAG;IACX,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;IACD,EAAE,EAAE;QACF,SAAS,EAAE;YACT,6CAA6C;YAC7C,4CAA4C;YAC5C;gBACE,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,kCAAkC;gBACxC,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE;aACtB;YACD;gBACE,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,gCAAgC;gBACtC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC;aACpC;YACD;gBACE,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,yBAAyB;gBAE/B,iDAAiD;gBACjD,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,iBAAiB,CAAC;aAC9D;SACF;KACF;IAED,IAAI,EAAE;QACJ;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE;gBACP,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,IAAI;aACf;SACF;QAED;;WAEG;QACH,MAAM,EAAE;YACN,WAAW,EAAE,CAAC,oBAAoB,CAAC;SAEpC;QAED,GAAG,EAAE;YACH,GAAG,EAAE,EAAE;YACP,IAAI,EAAE,EAAE;SACT;QACD,WAAW,EAAE;YACX,KAAK,EAAE;gBACL,2CAA2C;gBAC3C,MAAM,EAAE,EAAE;aACX;SACF;QACD,IAAI,EAAE,IAAI;QACV,WAAW,EAAE;YACX,MAAM,EAAE;YACR,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK;gBACZ,gEAAgE;gBAChE,8DAA8D;gBAC9D,MAAM,EAAE,CAAC,GAAQ,EAAE,IAAS,EAAE,GAAW,EAAE,EAAE;oBAC3C,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;gBACpB,CAAC;aACF,CAAC;YACF,OAAO,CAAC,UAAU,CAAC;gBACjB,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,wEAAwE;YACxE,oEAAoE;YACpE,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,mBAAmB,CAAC;gBAC1D,KAAK,EAAE,KAAK;aACb,CAAC;YACF,sBAAsB;YACtB,WAAW,EAAE;SACd;QAED;;WAEG;QACH,MAAM,EAAE;YACN;gBACE;;mBAEG;gBACH,KAAK,EAAE,UAAU;gBAEjB;;mBAEG;gBACH,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;aACpB;SACF;QAED;;WAEG;QACH,aAAa,EAAE,CAAC,GAAG,CAAC;QAEpB;;;WAGG;QACH,aAAa,EAAE;;;;;;;;;;;;;4BAaS;KACzB;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/lib/mjs/cookie.d.ts

@@ -0,0 +1,8 @@
+import type express from 'express';
+export declare const configuredCookieParser: express.RequestHandler;
+/**
+ * Drops the memoised parser. Only needed where the configured secret can change
+ * within one process, ie. tests.
+ */
+export declare function resetCookieParser(): void;
+//# sourceMappingURL=cookie.d.ts.map

package/lib/mjs/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../src/cookie.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAoBnC,eAAO,MAAM,sBAAsB,EAAE,OAAO,CAAC,cAO5C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC"}

package/lib/mjs/cookie.js

@@ -0,0 +1,32 @@
+import cookieParser from 'cookie-parser';
+import { DI } from '@spinajs/di';
+import { Configuration } from '@spinajs/configuration';
+/**
+ * cookie-parser bound to the configured `http.cookie.secret`.
+ *
+ * It MUST be constructed with the secret: that is what puts `req.secret` in place,
+ * and without it express throws `cookieParser("secret") required for signed cookies`
+ * from any `res.cookie(..., { signed: true })`. Logging in sets a signed `ssid`
+ * cookie, so a secretless parser breaks authentication outright.
+ *
+ * The secret is read on FIRST REQUEST rather than when this module is evaluated,
+ * because the config file that installs this middleware is itself loaded before the
+ * Configuration service exists. Capturing the value at module scope would freeze the
+ * shipped default and silently ignore whatever the app configured.
+ */
+let parser;
+export const configuredCookieParser = (req, res, next) => {
+    if (!parser) {
+        const secret = DI.get(Configuration)?.get('http.cookie.secret');
+        parser = cookieParser(secret);
+    }
+    return parser(req, res, next);
+};
+/**
+ * Drops the memoised parser. Only needed where the configured secret can change
+ * within one process, ie. tests.
+ */
+export function resetCookieParser() {
+    parser = undefined;
+}
+//# sourceMappingURL=cookie.js.map

package/lib/mjs/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/cookie.ts"],"names":[],"mappings":"AACA,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,IAAI,MAA0C,CAAC;AAE/C,MAAM,CAAC,MAAM,sBAAsB,GAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAS,oBAAoB,CAAC,CAAC;QACxE,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC"}