gina 0.5.26 → 0.6.0

package/framework/{v0.5.26 → v0.6.0}/core/connectors/couchbase/lib/session-store.v3.js

@@ -55,23 +55,30 @@ module.exports = function(session, bundle){
     /**
      * Initialize CouchbaseStore with the given `options`.
      *
-     * @param {Object} options
-     *      {
-     *          host: 127.0.0.1:8091 (default) -- Can be one or more address:ports, separated by semi-colon, or an array
-     *          username: '',   -- Should be same as bucket name, if provided
-     *          password: '',
-     *          bucket: 'default' (default)
-     *          cachefile: ''
-     *          ttl: 86400,
-     *          prefix: 'sess',
-     *          operationTimeout:2000,
-                connectionTimeout:2000,
-     *      }
+     * The store does not open its own connection. `options.db` is REQUIRED and
+     * must be the already-open Couchbase bucket the model layer created from
+     * the bundle's `session` connector entry — obtained with
+     * `getModel('session').getConnection()`. Session documents go through the
+     * bucket's default collection.
+     *
+     * #B167 — the former self-connect fallback (host/hosts/username/password/
+     * bucket/cachefile options) was removed: it called `cluster.openBucket()`,
+     * an SDK v2 API that does not exist on the supported v3/v4 SDKs, so
+     * reaching it always threw at bundle init. The options that only fed that
+     * path were removed with it.
+     *
+     * @class CouchbaseStore
+     * @constructor
+     * @param {object}  options
+     * @param {object}  options.db                        - Open Couchbase bucket (required).
+     * @param {number}  [options.ttl=null]                - Expiry in seconds. Unset, the cookie's maxAge applies, then one day.
+     * @param {string}  [options.prefix='sess:']          - Document key prefix.
+     * @param {number}  [options.connectionTimeout=10000] - Connect-time timeout in ms.
+     * @param {number}  [options.operationTimeout=10000]  - Per-operation timeout in ms.
      * @api public
      */
 
     function CouchbaseStore(options) {
-        var self = this;
 
         options = options || {};
         Store.call(this, options);
@@ -79,66 +86,18 @@ module.exports = function(session, bundle){
             ? 'sess:'
             : options.prefix;
 
-        var connectOptions = {};
-        if (options.hasOwnProperty("host")) {
-            connectOptions.host = options.host;
-        } else if (options.hasOwnProperty("hosts")) {
-            connectOptions.host = options.hosts;
-        }
-
-        if (options.hasOwnProperty("username")) {
-            connectOptions.username = options.username;
-        }
-
-        if (options.hasOwnProperty("password")) {
-            connectOptions.password = options.password;
+        if ( !options.db || typeof(options.db.defaultCollection) != 'function' ) {
+            throw new Error('['+ bundle +'][SessionStore v3] `options.db` is required and must be an already-open '
+                + 'Couchbase bucket: new CouchbaseStore({ db: getModel(\'session\').getConnection() }) — the '
+                + 'zero-argument getConnection() on the model, not an entity\'s getConnection(scope, collection), '
+                + 'which returns a collection. The former self-connect fallback (host/bucket/username/password '
+                + 'options) was removed: it relied on the SDK v2 openBucket() API, absent from SDK v3/v4 (#B167).');
         }
 
-        if (options.hasOwnProperty("bucket")) {
-            connectOptions.bucket = options.bucket;
-        }
-
-        if (options.hasOwnProperty("cachefile")) {
-            connectOptions.cachefile = options.cachefile;
-        }
+        this.client = options.db.defaultCollection();
 
-        if (options.hasOwnProperty("connectionTimeout")) {
-            connectOptions.connectionTimeout = options.connectionTimeout;
-        }
-
-        if (options.hasOwnProperty("operationTimeout")) {
-            connectOptions.operationTimeout = options.operationTimeout;
-        }
-
-        if (options.hasOwnProperty("db")) {
-            connectOptions.db = options.db; // DB Instance
-        }
-
-        if ( typeof(connectOptions.db) != 'undefined' ) {
-            var conn = connectOptions.db;
-            var scope = conn.scope(conn.name);
-            // var coll  = ( typeof(bundle) != 'undefined' ) ? scope.collection(bundle) :  scope._bucket.defaultCollection();
-            //var coll = connectOptions.db.collection(bundle);
-            var coll = connectOptions.db.defaultCollection();
-            //var coll  = ( typeof(bundle) != 'undefined' ) ? bucket.collection(bundle) : bucket.defaultCollection();
-
-            this.client = coll;
-        } else {
-            var Couchbase = require('couchbase');
-            var cluster = new Couchbase.Cluster(connectOptions.host);
-
-            this.client = cluster.openBucket(connectOptions.bucket, connectOptions.password, function(err) {
-                if (err) {
-                    console.log("Could not connect to couchbase with bucket: " + connectOptions.bucket);
-                    self.emit('disconnect');
-                } else {
-                    self.emit('connect');
-                }
-            });
-        }
-
-        this.client.connectionTimeout = connectOptions.connectionTimeout || 10000;
-        this.client.operationTimeout = connectOptions.operationTimeout || 10000;
+        this.client.connectionTimeout = options.connectionTimeout || 10000;
+        this.client.operationTimeout = options.operationTimeout || 10000;
 
         this.ttl = options.ttl || null;
     }
@@ -211,6 +170,9 @@ module.exports = function(session, bundle){
     /**
      * Commit the given `sess` object associated with the given `sid`.
      *
+     * Stamps `sess.lastModified` (ISO 8601, UTC) when `ttl > 0`, matching the
+     * redis / sqlite / mongodb / scylladb session stores.
+     *
      * @param {String} sid
      * @param {Session} sess
      * @param {Function} fn
@@ -229,7 +191,7 @@ module.exports = function(session, bundle){
                 ;
 
             if (ttl > 0) {
-                sess.lastModified = new Date();
+                sess.lastModified = new Date().toISOString();
             }
 
             sess = JSON.stringify(sess);
@@ -276,6 +238,11 @@ module.exports = function(session, bundle){
     /**
      * Refresh the time-to-live for the session with the given `sid`.
      *
+     * Also re-stamps `sess.lastModified` (ISO 8601, UTC) whenever `ttl > 0`.
+     * The stamp is unconditional by design: the `upsert` extends the document's
+     * expiry on every call, and the client-side session countdown derives its
+     * origin from that stamp, so it must track every extension (#B165).
+     *
      * @param {String} sid
      * @param {Session} sess
      * @param {Function} fn
@@ -290,19 +257,20 @@ module.exports = function(session, bundle){
             , ttl = this.ttl || ('number' == typeof maxAge
                 ? maxAge / 1000 | 0
                 : oneDay)
-            , currentDate = new Date()
-            , lastModified = sess.lastModified ? new Date(sess.lastModified).getTime() : 0;
-
-        // if the given options has a touchAfter property, check if the
-        // current timestamp - lastModified timestamp is bigger than
-        // the specified, if it's not, don't touch the session
-        if (ttl > 0 && lastModified > 0) {
-
-            var timeElapsed = currentDate.getTime() - lastModified;
-
-            if (timeElapsed > ttl) {
-                sess.lastModified = currentDate;
-            }
+            ;
+
+        // #B165 — an idle-check used to gate this stamp. It compared an elapsed
+        // value in MILLISECONDS against `ttl` in SECONDS, so it fired ~1000x too
+        // eagerly (86.4s idle on the 86400s default). Correcting only the units
+        // would have been worse: the `upsert` below refreshes expiry on EVERY
+        // touch, so `lastModified` must track every extension. Gating it on `ttl`
+        // seconds idle would freeze the stamp at the first `set()`, and the
+        // client-side countdown (`expiresAt = lastModified + maxAge`, see
+        // core/asset/plugin/src/vendor/gina/utils/loader.js) would then inflate
+        // from a stale origin. The `touchAfter` option the old comment referenced
+        // never existed in this codebase.
+        if (ttl > 0) {
+            sess.lastModified = new Date().toISOString();
         }
 
         sess = JSON.stringify(sess);

package/framework/{v0.5.26 → v0.6.0}/core/connectors/couchbase/lib/session-store.v4.js

@@ -58,23 +58,30 @@ module.exports = function(session, bundle){
     /**
      * Initialize CouchbaseStore with the given `options`.
      *
-     * @param {Object} options
-     *      {
-     *          host: 127.0.0.1:8091 (default) -- Can be one or more address:ports, separated by semi-colon, or an array
-     *          username: '',   -- Should be same as bucket name, if provided
-     *          password: '',
-     *          bucket: 'default' (default)
-     *          cachefile: ''
-     *          ttl: 86400,
-     *          prefix: 'sess',
-     *          operationTimeout:2000,
-                connectionTimeout:2000,
-     *      }
+     * The store does not open its own connection. `options.db` is REQUIRED and
+     * must be the already-open Couchbase bucket the model layer created from
+     * the bundle's `session` connector entry — obtained with
+     * `getModel('session').getConnection()`. Session documents go through the
+     * bucket's default collection.
+     *
+     * #B167 — the former self-connect fallback (host/hosts/username/password/
+     * bucket/cachefile options) was removed: it called `cluster.openBucket()`,
+     * an SDK v2 API that does not exist on the supported v3/v4 SDKs, so
+     * reaching it always threw at bundle init. The options that only fed that
+     * path were removed with it.
+     *
+     * @class CouchbaseStore
+     * @constructor
+     * @param {object}  options
+     * @param {object}  options.db                        - Open Couchbase bucket (required).
+     * @param {number}  [options.ttl=null]                - Expiry in seconds. Unset, the cookie's maxAge applies, then one day.
+     * @param {string}  [options.prefix='sess:']          - Document key prefix.
+     * @param {number}  [options.connectionTimeout=10000] - Connect-time timeout in ms.
+     * @param {number}  [options.operationTimeout=10000]  - Per-operation timeout in ms.
      * @api public
      */
 
     function CouchbaseStore(options) {
-        var self = this;
 
         options = options || {};
         Store.call(this, options);
@@ -82,66 +89,18 @@ module.exports = function(session, bundle){
             ? 'sess:'
             : options.prefix;
 
-        var connectOptions = {};
-        if (options.hasOwnProperty("host")) {
-            connectOptions.host = options.host;
-        } else if (options.hasOwnProperty("hosts")) {
-            connectOptions.host = options.hosts;
-        }
-
-        if (options.hasOwnProperty("username")) {
-            connectOptions.username = options.username;
-        }
-
-        if (options.hasOwnProperty("password")) {
-            connectOptions.password = options.password;
-        }
-
-        if (options.hasOwnProperty("bucket")) {
-            connectOptions.bucket = options.bucket;
-        }
-
-        if (options.hasOwnProperty("cachefile")) {
-            connectOptions.cachefile = options.cachefile;
-        }
-
-        if (options.hasOwnProperty("connectionTimeout")) {
-            connectOptions.connectionTimeout = options.connectionTimeout;
-        }
-
-        if (options.hasOwnProperty("operationTimeout")) {
-            connectOptions.operationTimeout = options.operationTimeout;
+        if ( !options.db || typeof(options.db.defaultCollection) != 'function' ) {
+            throw new Error('['+ bundle +'][SessionStore v4] `options.db` is required and must be an already-open '
+                + 'Couchbase bucket: new CouchbaseStore({ db: getModel(\'session\').getConnection() }) — the '
+                + 'zero-argument getConnection() on the model, not an entity\'s getConnection(scope, collection), '
+                + 'which returns a collection. The former self-connect fallback (host/bucket/username/password '
+                + 'options) was removed: it relied on the SDK v2 openBucket() API, absent from SDK v3/v4 (#B167).');
         }
 
-        if (options.hasOwnProperty("db")) {
-            connectOptions.db = options.db; // DB Instance
-        }
-
-        if ( typeof(connectOptions.db) != 'undefined' ) {
-            // var conn = connectOptions.db;
-            // var scope = conn.scope(conn.name);
-            // var coll  = ( typeof(bundle) != 'undefined' ) ? scope.collection(bundle) :  scope._bucket.defaultCollection();
-            //var coll = connectOptions.db.collection(bundle);
-            var coll = connectOptions.db.defaultCollection();
-            //var coll  = ( typeof(bundle) != 'undefined' ) ? bucket.collection(bundle) : bucket.defaultCollection();
-
-            this.client = coll;
-        } else {
-            var Couchbase = require('couchbase');
-            var cluster = new Couchbase.Cluster(connectOptions.host);
-
-            this.client = cluster.openBucket(connectOptions.bucket, connectOptions.password, function(err) {
-                if (err) {
-                    console.log("Could not connect to couchbase with bucket: " + connectOptions.bucket);
-                    self.emit('disconnect');
-                } else {
-                    self.emit('connect');
-                }
-            });
-        }
+        this.client = options.db.defaultCollection();
 
-        this.client.connectionTimeout = connectOptions.connectionTimeout || 10000;
-        this.client.operationTimeout = connectOptions.operationTimeout || 10000;
+        this.client.connectionTimeout = options.connectionTimeout || 10000;
+        this.client.operationTimeout = options.operationTimeout || 10000;
 
         this.ttl = options.ttl || null;
     }
@@ -263,6 +222,9 @@ module.exports = function(session, bundle){
     /**
      * Commit the given `sess` object associated with the given `sid`.
      *
+     * Stamps `sess.lastModified` (ISO 8601, UTC) when `ttl > 0`, matching the
+     * redis / sqlite / mongodb / scylladb session stores.
+     *
      * @param {String} sid
      * @param {Session} sess
      * @param {Function} fn
@@ -281,7 +243,13 @@ module.exports = function(session, bundle){
                 ;
 
             if (ttl > 0) {
-                sess.lastModified = new Date().format('isoDateTime');
+                // #B165 — was `.format('isoDateTime')`, a zone-less local-time
+                // string ("yyyy-mm-dd'T'HH:MM:ss", helpers/dateFormat.js). The
+                // browser re-parses this stamp (utils/loader.js getTimeout) and
+                // a zone-less form is read as BROWSER-local, so the session
+                // countdown skewed by the server/browser offset. `toISOString()`
+                // is unambiguous UTC and matches the other four session stores.
+                sess.lastModified = new Date().toISOString();
             }
 
             sess = JSON.stringify(sess);
@@ -345,6 +313,11 @@ module.exports = function(session, bundle){
     /**
      * Refresh the time-to-live for the session with the given `sid`.
      *
+     * Also re-stamps `sess.lastModified` (ISO 8601, UTC) whenever `ttl > 0`.
+     * The stamp is unconditional by design: the `upsert` extends the document's
+     * expiry on every call, and the client-side session countdown derives its
+     * origin from that stamp, so it must track every extension (#B165).
+     *
      * @param {String} sid
      * @param {Session} sess
      * @param {Function} fn
@@ -359,19 +332,20 @@ module.exports = function(session, bundle){
             , ttl = this.ttl || ('number' == typeof maxAge
                 ? maxAge / 1000 | 0
                 : oneDay)
-            , currentDate = new Date()
-            , lastModified = sess.lastModified ? new Date(sess.lastModified).getTime() : 0;
-
-        // if the given options has a touchAfter property, check if the
-        // current timestamp - lastModified timestamp is bigger than
-        // the specified, if it's not, don't touch the session
-        if (ttl > 0 && lastModified > 0) {
-
-            var timeElapsed = currentDate.getTime() - lastModified;
-
-            if (timeElapsed > ttl) {
-                sess.lastModified = currentDate.format('isoDateTime');
-            }
+            ;
+
+        // #B165 — an idle-check used to gate this stamp. It compared an elapsed
+        // value in MILLISECONDS against `ttl` in SECONDS, so it fired ~1000x too
+        // eagerly (86.4s idle on the 86400s default). Correcting only the units
+        // would have been worse: the `upsert` below refreshes expiry on EVERY
+        // touch, so `lastModified` must track every extension. Gating it on `ttl`
+        // seconds idle would freeze the stamp at the first `set()`, and the
+        // client-side countdown (`expiresAt = lastModified + maxAge`, see
+        // core/asset/plugin/src/vendor/gina/utils/loader.js) would then inflate
+        // from a stale origin. The `touchAfter` option the old comment referenced
+        // never existed in this codebase.
+        if (ttl > 0) {
+            sess.lastModified = new Date().toISOString();
         }
 
         sess = JSON.stringify(sess);

package/framework/{v0.5.26 → v0.6.0}/core/connectors/mongodb/lib/session-store.js

@@ -136,7 +136,8 @@ module.exports = function(session, bundle) {
      * @param {string} [options.replicaSet] - Replica set name.
      * @param {object|boolean} [options.ssl]- TLS configuration.
      * @param {string} [options.collection] - Sessions collection (default 'sessions').
-     * @param {number} [options.ttl]        - Default TTL seconds (default 86400).
+     * @param {number} [options.ttl]        - Default TTL seconds (default: connectors.json ttl;
+     *                                        unset → cookie maxAge drives expiry, else 86400).
      * @throws {Error} when `database` is missing.
      */
     function MongodbStore(options) {
@@ -144,7 +145,9 @@ module.exports = function(session, bundle) {
         Store.call(this, options);
 
         this.collection = (options.collection != null) ? options.collection : (connConf.collection || 'sessions');
-        this.ttl        = (options.ttl        != null) ? options.ttl        : (connConf.ttl        || oneDay);
+        // #B163 — was `connConf.ttl || oneDay`: the implicit one-day default made the
+        // cookie-maxAge fallback in set()/touch() unreachable; unset now stays null (couchbase parity).
+        this.ttl        = (options.ttl        != null) ? options.ttl        : (connConf.ttl        || null);
 
         this._ttlReady   = false;
         this._ttlPromise = null;

package/framework/{v0.5.26 → v0.6.0}/core/connectors/redis/lib/session-store.js

@@ -71,7 +71,8 @@ module.exports = function(session, bundle) {
      * @param {string}  [options.password]  - Redis AUTH password.
      * @param {boolean} [options.tls]       - Enable TLS (required for managed providers with TLS).
      * @param {string}  [options.prefix]    - Session key prefix (default: connectors.json → 'sess:').
-     * @param {number}  [options.ttl]       - Session TTL in seconds (default: connectors.json → 86400).
+     * @param {number}  [options.ttl]       - Session TTL in seconds (default: connectors.json ttl;
+     *                                        unset → cookie maxAge drives expiry, else 86400).
      */
     function RedisStore(options) {
         var self = this;
@@ -79,7 +80,9 @@ module.exports = function(session, bundle) {
         Store.call(this, options);
 
         this.prefix = (options.prefix != null) ? options.prefix : (connConf.prefix || 'sess:');
-        this.ttl    = (options.ttl    != null) ? options.ttl    : (connConf.ttl    || oneDay);
+        // #B163 — was `connConf.ttl || oneDay`: the implicit one-day default made the
+        // cookie-maxAge fallback in set()/touch() unreachable; unset now stays null (couchbase parity).
+        this.ttl    = (options.ttl    != null) ? options.ttl    : (connConf.ttl    || null);
 
         // Require ioredis at instantiation time so the error message is clear
         // and the framework can still boot if Redis is not configured.

package/framework/{v0.5.26 → v0.6.0}/core/connectors/scylladb/lib/session-store.js

@@ -132,14 +132,17 @@ module.exports = function(session, bundle) {
      * @param {object}   [options.credentials]     - { username, password }.
      * @param {object}   [options.ssl]             - sslOptions passthrough.
      * @param {string}   [options.table]           - Sessions table name (default: connectors.json → 'sessions').
-     * @param {number}   [options.ttl]             - Default TTL seconds (default: connectors.json → 86400).
+     * @param {number}   [options.ttl]             - Default TTL seconds (default: connectors.json ttl;
+     *                                              unset → cookie maxAge drives expiry, else 86400).
      */
     function ScylladbStore(options) {
         options = options || {};
         Store.call(this, options);
 
         this.table = (options.table != null) ? options.table : (connConf.table || 'sessions');
-        this.ttl   = (options.ttl   != null) ? options.ttl   : (connConf.ttl   || oneDay);
+        // #B163 — was `connConf.ttl || oneDay`: the implicit one-day default made the
+        // cookie-maxAge fallback in set()/touch() unreachable; unset now stays null (couchbase parity).
+        this.ttl   = (options.ttl   != null) ? options.ttl   : (connConf.ttl   || null);
 
         var cassandra = loadDriver();
 

package/framework/{v0.5.26 → v0.6.0}/core/connectors/sqlite/lib/session-store.js

@@ -71,7 +71,8 @@ module.exports = function(session, bundle) {
      *                                                 Defaults to connectors.json `database`, then
      *                                                 `~/.gina/{version}/sessions-{bundle}.db`.
      * @param {string}  [options.prefix]             - Session key prefix (default: `'sess:'`).
-     * @param {number}  [options.ttl]                - Session TTL in seconds (default: 86400).
+     * @param {number}  [options.ttl]                - Session TTL in seconds (default: connectors.json ttl;
+     *                                                 unset → cookie maxAge drives expiry, else 86400).
      * @param {number}  [options.cleanupInterval]    - Expired-session purge interval in seconds.
      *                                                 Set to 0 to disable. (default: 900).
      */
@@ -81,7 +82,9 @@ module.exports = function(session, bundle) {
         Store.call(this, options);
 
         this.prefix          = (options.prefix          != null) ? options.prefix          : (connConf.prefix          || 'sess:');
-        this.ttl             = (options.ttl             != null) ? options.ttl             : (connConf.ttl             || oneDay);
+        // #B163 — was `connConf.ttl || oneDay`: the implicit one-day default made the
+        // cookie-maxAge fallback in set()/touch() unreachable; unset now stays null (couchbase parity).
+        this.ttl             = (options.ttl             != null) ? options.ttl             : (connConf.ttl             || null);
         this.cleanupInterval = (options.cleanupInterval != null) ? options.cleanupInterval : (connConf.cleanupInterval || 900);
 
         // Resolve DB path: option > connectors.json > default per-bundle file
@@ -241,14 +244,25 @@ module.exports = function(session, bundle) {
     /**
      * Refresh the expiry timestamp for an existing session without modifying its data.
      *
+     * A non-positive resolved ttl is a no-op: express-session's `cookie.maxAge`
+     * is a decaying remainder, so it truncates to zero in the session's final
+     * second and turns negative once expired. Stamping `now + ttl` from such a
+     * value would write an already-past expiry — expiring the very session the
+     * caller asked to refresh (#B166). Matches the mongodb / scylladb guard,
+     * and redis's inverted `if (ttl > 0)` spelling.
+     *
      * @param {string}   sid  - Session ID (without prefix).
      * @param {object}   sess - Session data (used to read `cookie.maxAge`).
-     * @param {function} fn   - Callback `fn(err)`.
+     * @param {function} fn   - Callback `fn(err)`. Invoked with `null` and no
+     *                          write performed when the resolved ttl is <= 0.
      */
     SqliteStore.prototype.touch = function(sid, sess, fn) {
         if ('function' !== typeof fn) fn = noop;
         var maxAge  = sess.cookie && sess.cookie.maxAge;
         var ttl     = this.ttl || ('number' === typeof maxAge ? maxAge / 1000 | 0 : oneDay);
+        // #B166 — never stamp a past expiry; siblings guard identically.
+        if (ttl <= 0) return fn(null);
+
         var expires = Math.floor(Date.now() / 1000) + ~~ttl;
         try {
             this._stmtTouch.run(expires, this.prefix + sid);