@volter/world-ui 1.0.28 → 1.0.30

package/dist/src/session.d.ts

@@ -8,6 +8,6 @@ export declare function signedIn(ctx: HandlerContext, cookie: string, scope?: st
 export declare function redirect(location: string, cookie?: string): Response;
 /** The person signed in: a session recorded (in `scope`, when the vendor signs a person in apart per dashboard), its
  *  cookie set, and the page they asked for next. */
-export declare function startSession(ctx: HandlerContext, email: string, cookie: string, next: string, scope?: string): Promise<Response>;
+export declare function startSession(ctx: Pick<HandlerContext, 'record' | 'secret' | 'occurredAt'>, email: string, cookie: string, next: string, scope?: string): Promise<Response>;
 /** To the vendor's sign-in page, which returns the person to `path` (its parameter the vendor's: `next`, `return_to`). */
 export declare const toSignIn: (signIn: string, path: string, param?: string) => Response;

package/dist/src/session.js

@@ -2,7 +2,7 @@
 // knows who is signed in, the same way in every pack. A person is the kernel's (`recordPerson`, `personWith`); signing
 // in records a `_web_session` row and sets the vendor's session cookie on the answer; a page asks who the request's
 // cookie names. Everything is written and read through the screen's context.
-import { personOf } from '@volter/world-core';
+import { startBrowserSession, personOf } from '@volter/world-core';
 import { cookieOf } from "../client/sign-in.js";
 const SESSION = '_web_session';
 /** A form a page posted, by field. */
@@ -24,10 +24,7 @@ export function redirect(location, cookie) {
 /** The person signed in: a session recorded (in `scope`, when the vendor signs a person in apart per dashboard), its
  *  cookie set, and the page they asked for next. */
 export async function startSession(ctx, email, cookie, next, scope) {
-    const issued = await ctx.record('_web_session_issue', { email, ...(scope !== undefined ? { scope } : {}) });
-    const token = await ctx.secret(`web-session:${issued}`);
-    await ctx.record(SESSION, { token, email, ...(scope !== undefined ? { scope } : {}), created_at: ctx.occurredAt }, `websession:${token}`);
-    return redirect(next, `${cookie}=${token}; path=/; HttpOnly; Secure; SameSite=Lax`);
+    return redirect(next, await startBrowserSession(ctx, email, cookie, scope));
 }
 /** To the vendor's sign-in page, which returns the person to `path` (its parameter the vendor's: `next`, `return_to`). */
 export const toSignIn = (signIn, path, param = 'next') => redirect(`${signIn}?${param}=${encodeURIComponent(path)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-ui",
-  "version": "1.0.28",
+  "version": "1.0.30",
   "description": "Shared pieces and serving for derived packs' screens (hosted flows and workspaces), through each pack's own API; see docs/contributing/architecture.md, Screens.",
   "license": "Apache-2.0",
   "author": "Volter (https://github.com/volter-ai)",
@@ -28,7 +28,7 @@
     "dist"
   ],
   "peerDependencies": {
-    "@volter/world-core": "3.0.28",
+    "@volter/world-core": "3.0.30",
     "react": "^19.2.7",
     "react-dom": "^19.2.7"
   },

package/src/session.ts

@@ -2,7 +2,7 @@
 // knows who is signed in, the same way in every pack. A person is the kernel's (`recordPerson`, `personWith`); signing
 // in records a `_web_session` row and sets the vendor's session cookie on the answer; a page asks who the request's
 // cookie names. Everything is written and read through the screen's context.
-import { personOf, type HandlerContext, type Person } from '@volter/world-core';
+import { startBrowserSession, personOf, type HandlerContext, type Person } from '@volter/world-core';
 import { cookieOf } from '../client/sign-in.tsx';
 
 const SESSION = '_web_session';
@@ -27,11 +27,8 @@ export function redirect(location: string, cookie?: string): Response {
 
 /** The person signed in: a session recorded (in `scope`, when the vendor signs a person in apart per dashboard), its
  *  cookie set, and the page they asked for next. */
-export async function startSession(ctx: HandlerContext, email: string, cookie: string, next: string, scope?: string): Promise<Response> {
-  const issued = await ctx.record('_web_session_issue', { email, ...(scope !== undefined ? { scope } : {}) });
-  const token = await ctx.secret(`web-session:${issued}`);
-  await ctx.record(SESSION, { token, email, ...(scope !== undefined ? { scope } : {}), created_at: ctx.occurredAt }, `websession:${token}`);
-  return redirect(next, `${cookie}=${token}; path=/; HttpOnly; Secure; SameSite=Lax`);
+export async function startSession(ctx: Pick<HandlerContext, 'record' | 'secret' | 'occurredAt'>, email: string, cookie: string, next: string, scope?: string): Promise<Response> {
+  return redirect(next, await startBrowserSession(ctx, email, cookie, scope));
 }
 
 /** To the vendor's sign-in page, which returns the person to `path` (its parameter the vendor's: `next`, `return_to`). */