@thi.ng/server 0.11.12 → 0.12.2

package/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Change Log
 
-- **Last updated**: 2025-07-30T22:32:35Z
+- **Last updated**: 2025-08-06T18:02:31Z
 - **Generator**: [thi.ng/monopub](https://thi.ng/monopub)
 
 All notable changes to this project will be documented in this file.
@@ -11,6 +11,12 @@ See [Conventional Commits](https://conventionalcommits.org/) for commit guidelin
 **Note:** Unlisted _patch_ versions only involve non-code or otherwise excluded changes
 and/or version bumps of transitive dependencies.
 
+## [0.12.0](https://github.com/thi-ng/umbrella/tree/@thi.ng/server@0.12.0) (2025-08-04)
+
+#### 🚀 Features
+
+- add `SessionOpts.onInvalid` callback ([83c15ee](https://github.com/thi-ng/umbrella/commit/83c15ee))
+
 ## [0.11.0](https://github.com/thi-ng/umbrella/tree/@thi.ng/server@0.11.0) (2025-06-05)
 
 #### 🚀 Features

package/README.md

@@ -164,7 +164,7 @@ For Node.js REPL:
 const ser = await import("@thi.ng/server");
 ```
 
-Package sizes (brotli'd, pre-treeshake): ESM: 6.32 KB
+Package sizes (brotli'd, pre-treeshake): ESM: 6.33 KB
 
 ## Dependencies
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thi.ng/server",
-  "version": "0.11.12",
+  "version": "0.12.2",
   "description": "Minimal HTTP server with declarative routing, static file serving and freely extensible via pre/post interceptors",
   "type": "module",
   "module": "./index.js",
@@ -39,26 +39,26 @@
     "tool:tangle": "../../node_modules/.bin/tangle src/**/*.ts"
   },
   "dependencies": {
-    "@thi.ng/api": "^8.11.33",
-    "@thi.ng/arrays": "^2.13.6",
-    "@thi.ng/cache": "^2.3.44",
-    "@thi.ng/checks": "^3.7.13",
-    "@thi.ng/errors": "^2.5.39",
-    "@thi.ng/file-io": "^2.2.4",
-    "@thi.ng/leaky-bucket": "^0.2.11",
-    "@thi.ng/logger": "^3.1.14",
-    "@thi.ng/mime": "^2.7.15",
-    "@thi.ng/paths": "^5.2.16",
-    "@thi.ng/router": "^4.1.36",
-    "@thi.ng/strings": "^3.9.19",
-    "@thi.ng/timestamp": "^1.1.18",
-    "@thi.ng/uuid": "^1.1.30"
+    "@thi.ng/api": "^8.12.1",
+    "@thi.ng/arrays": "^2.13.8",
+    "@thi.ng/cache": "^2.3.46",
+    "@thi.ng/checks": "^3.7.15",
+    "@thi.ng/errors": "^2.5.41",
+    "@thi.ng/file-io": "^2.2.6",
+    "@thi.ng/leaky-bucket": "^0.2.13",
+    "@thi.ng/logger": "^3.1.16",
+    "@thi.ng/mime": "^2.7.17",
+    "@thi.ng/paths": "^5.2.18",
+    "@thi.ng/router": "^4.1.38",
+    "@thi.ng/strings": "^3.9.21",
+    "@thi.ng/timestamp": "^1.1.20",
+    "@thi.ng/uuid": "^1.1.32"
   },
   "devDependencies": {
-    "@types/node": "^24.0.15",
+    "@types/node": "^24.1.0",
     "esbuild": "^0.25.8",
-    "typedoc": "^0.28.7",
-    "typescript": "^5.8.3"
+    "typedoc": "^0.28.9",
+    "typescript": "^5.9.2"
   },
   "keywords": [
     "cookie",
@@ -167,5 +167,5 @@
     "status": "alpha",
     "year": 2024
   },
-  "gitHead": "1df8a3a9061257ea73ccf1ab9cdf63c81a9f519f\n"
+  "gitHead": "03e0d1024805407fbec5dde688b6178bbe0a2f3a\n"
 }

package/session/session.d.ts

@@ -1,4 +1,4 @@
-import type { Fn } from "@thi.ng/api";
+import type { Fn, Fn2 } from "@thi.ng/api";
 import { ServerResponse } from "node:http";
 import type { Interceptor, ISessionStore, RequestCtx, ServerSession } from "../api.js";
 /**
@@ -31,6 +31,16 @@ export interface SessionOpts<CTX extends RequestCtx = RequestCtx, SESSION extend
      * bytes. If given as number, generates N random bytes.
      */
     secret?: number | string | Buffer;
+    /**
+     * Callback if session cookie is present, but failed validation. When this
+     * function needs to be called, its result is used as the result of
+     * {@link SessionInterceptor.pre}.
+     *
+     * @remarks
+     * The default implementation simply expires the cookie in the response and
+     * terminates the interceptor chain with a 403.
+     */
+    onInvalid?: Fn2<CTX, SessionInterceptor<CTX, SESSION>, Promise<boolean>>;
 }
 /**
  * Cached session metadata, stored in a WeakMap.
@@ -50,12 +60,13 @@ export interface SessionMeta {
  */
 export declare class SessionInterceptor<CTX extends RequestCtx = RequestCtx, SESSION extends ServerSession = ServerSession> implements Interceptor<CTX> {
     factory: SessionOpts<CTX, SESSION>["factory"];
+    onInvalid: Fn2<CTX, SessionInterceptor<CTX, SESSION>, Promise<boolean>>;
     store: ISessionStore<SESSION>;
     meta: WeakMap<SESSION, SessionMeta>;
     secret: Buffer;
     cookieName: string;
     cookieOpts: string;
-    constructor({ factory, store, cookieName, cookieOpts, secret, }: SessionOpts<CTX, SESSION>);
+    constructor({ factory, store, cookieName, cookieOpts, secret, onInvalid, }: SessionOpts<CTX, SESSION>);
     pre(ctx: CTX): Promise<boolean>;
     /**
      * Attempts to delete session for given ID and if successful also sets
@@ -70,9 +81,10 @@ export declare class SessionInterceptor<CTX extends RequestCtx = RequestCtx, SES
      */
     deleteSession(ctx: CTX, sessionID: string): Promise<void>;
     /**
-     * Creates a new session object (via configured {@link SessionOpts.factory}), pre-computes HMAC
-     * and submits it to configured {@link SessionOpts.store}. If successful, Returns session
-     * , otherwise returns `undefined`.
+     * Creates a new session object (via configured
+     * {@link SessionOpts.factory}), pre-computes HMAC and submits it to
+     * configured {@link SessionOpts.store}. If successful, Returns session ,
+     * otherwise returns `undefined`.
      *
      * @param ctx
      */

package/session/session.js

@@ -5,6 +5,7 @@ import { ServerResponse } from "node:http";
 import { inMemorySessionStore } from "./memory.js";
 class SessionInterceptor {
   factory;
+  onInvalid;
   store;
   meta = /* @__PURE__ */ new WeakMap();
   secret;
@@ -15,9 +16,15 @@ class SessionInterceptor {
     store = inMemorySessionStore(),
     cookieName = "__sid",
     cookieOpts = "Secure;HttpOnly;SameSite=Strict;Path=/",
-    secret = 32
+    secret = 32,
+    onInvalid = async (ctx, session) => {
+      session.expireCookie(ctx);
+      ctx.res.forbidden();
+      return false;
+    }
   }) {
     this.factory = factory;
+    this.onInvalid = onInvalid;
     this.store = store;
     this.secret = isNumber(secret) ? randomBytes(secret) : isString(secret) ? Buffer.from(secret) : secret;
     this.cookieName = cookieName;
@@ -29,9 +36,7 @@ class SessionInterceptor {
     if (cookie) {
       session = await this.validateSession(cookie);
       if (!session) {
-        this.expireCookie(ctx);
-        ctx.res.forbidden();
-        return false;
+        return await this.onInvalid(ctx, this);
       }
     }
     if (!session || session.ip !== ctx.req.socket.remoteAddress) {
@@ -61,9 +66,10 @@ class SessionInterceptor {
     }
   }
   /**
-   * Creates a new session object (via configured {@link SessionOpts.factory}), pre-computes HMAC
-   * and submits it to configured {@link SessionOpts.store}. If successful, Returns session
-   * , otherwise returns `undefined`.
+   * Creates a new session object (via configured
+   * {@link SessionOpts.factory}), pre-computes HMAC and submits it to
+   * configured {@link SessionOpts.store}. If successful, Returns session ,
+   * otherwise returns `undefined`.
    *
    * @param ctx
    */