h3 1.2.1 → 1.4.0

package/README.md

@@ -148,15 +148,19 @@ H3 has a concept of composable utilities that accept `event` (from `eventHandler
 - `createError({ statusCode, statusMessage, data? })`
 - `sendProxy(event, { target, headers?, fetchOptions?, fetch?, sendStream? })`
 - `proxyRequest(event, { target, headers?, fetchOptions?, fetch?, sendStream? })`
+- `fetchWithEvent(event, req, init, { fetch? }?)`
+- `getProxyRequestHeaders(event)`
 - `sendNoContent(event, code = 204)`
 - `setResponseStatus(event, status)`
 - `getResponseStatus(event)`
 - `getResponseStatusText(event)`
 - `readMultipartFormData(event)`
-- `useSession(event, { password, name?, cookie?, seal?, crypto? })`
-- `getSession(event, { password, name?, cookie?, seal?, crypto? })`
-- `updateSession(event, { password, name?, cookie?, seal?, crypto? }), update)`
-- `clearSession(event, { password, name?, cookie?, seal?, crypto? }))`
+- `useSession(event, config = { password, maxAge?, name?, cookie?, seal?, crypto? })`
+- `getSession(event, config)`
+- `updateSession(event, config, update)`
+- `clearSession(event, config)`
+- `sealSession(event, config)`
+- `unsealSession(event, config, sealed)`
 
 👉 You can learn more about usage in [JSDocs Documentation](https://www.jsdocs.io/package/h3#package-functions).
 

package/dist/index.cjs

@@ -5,6 +5,7 @@ const radix3 = require('radix3');
 const destr = require('destr');
 const cookieEs = require('cookie-es');
 const crypto = require('uncrypto');
+const ironWebcrypto = require('iron-webcrypto');
 
 function useBase(base, handler) {
   base = ufo.withoutTrailingSlash(base);
@@ -394,13 +395,7 @@ async function proxyRequest(event, target, opts = {}) {
   if (PayloadMethods.has(method)) {
     body = await readRawBody(event).catch(() => void 0);
   }
-  const headers = /* @__PURE__ */ Object.create(null);
-  const reqHeaders = getRequestHeaders(event);
-  for (const name in reqHeaders) {
-    if (!ignoredHeaders.has(name)) {
-      headers[name] = reqHeaders[name];
-    }
-  }
+  const headers = getProxyRequestHeaders(event);
   if (opts.fetchOptions?.headers) {
     Object.assign(headers, opts.fetchOptions.headers);
   }
@@ -418,13 +413,7 @@ async function proxyRequest(event, target, opts = {}) {
   });
 }
 async function sendProxy(event, target, opts = {}) {
-  const _fetch = opts.fetch || globalThis.fetch;
-  if (!_fetch) {
-    throw new Error(
-      "fetch is not available. Try importing `node-fetch-native/polyfill` for Node.js."
-    );
-  }
-  const response = await _fetch(target, {
+  const response = await _getFetch(opts.fetch)(target, {
     headers: opts.headers,
     ...opts.fetchOptions
   });
@@ -439,22 +428,49 @@ async function sendProxy(event, target, opts = {}) {
     }
     event.node.res.setHeader(key, value);
   }
-  try {
-    if (response.body) {
-      if (opts.sendStream === false) {
-        const data = new Uint8Array(await response.arrayBuffer());
-        event.node.res.end(data);
-      } else {
-        for await (const chunk of response.body) {
-          event.node.res.write(chunk);
-        }
-        event.node.res.end();
-      }
+  if (response._data !== void 0) {
+    return response._data;
+  }
+  if (opts.sendStream === false) {
+    const data = new Uint8Array(await response.arrayBuffer());
+    return event.node.res.end(data);
+  }
+  for await (const chunk of response.body) {
+    event.node.res.write(chunk);
+  }
+  return event.node.res.end();
+}
+function getProxyRequestHeaders(event) {
+  const headers = /* @__PURE__ */ Object.create(null);
+  const reqHeaders = getRequestHeaders(event);
+  for (const name in reqHeaders) {
+    if (!ignoredHeaders.has(name)) {
+      headers[name] = reqHeaders[name];
     }
-  } catch (error) {
-    event.node.res.end();
-    throw error;
   }
+  return headers;
+}
+function fetchWithEvent(event, req, init, options) {
+  return _getFetch(options?.fetch)(req, {
+    ...init,
+    // @ts-ignore (context is used for unenv and local fetch)
+    context: init.context || event.context,
+    headers: {
+      ...getProxyRequestHeaders(event),
+      ...init?.headers
+    }
+  });
+}
+function _getFetch(_fetch) {
+  if (_fetch) {
+    return _fetch;
+  }
+  if (globalThis.fetch) {
+    return globalThis.fetch;
+  }
+  throw new Error(
+    "fetch is not available. Try importing `node-fetch-native/polyfill` for Node.js."
+  );
 }
 
 const defer = typeof setImmediate !== "undefined" ? setImmediate : (fn) => fn();
@@ -589,296 +605,6 @@ ${header}: ${value}`;
   }
 }
 
-const base64urlEncode = (value) => (Buffer.isBuffer(value) ? value : Buffer.from(value)).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-const defaults = {
-  encryption: {
-    saltBits: 256,
-    algorithm: "aes-256-cbc",
-    iterations: 1,
-    minPasswordlength: 32
-  },
-  integrity: {
-    saltBits: 256,
-    algorithm: "sha256",
-    iterations: 1,
-    minPasswordlength: 32
-  },
-  ttl: 0,
-  timestampSkewSec: 60,
-  localtimeOffsetMsec: 0
-};
-const clone = (options) => ({
-  ...options,
-  encryption: { ...options.encryption },
-  integrity: { ...options.integrity }
-});
-const algorithms = {
-  "aes-128-ctr": { keyBits: 128, ivBits: 128, name: "AES-CTR" },
-  "aes-256-cbc": { keyBits: 256, ivBits: 128, name: "AES-CBC" },
-  sha256: { keyBits: 256, name: "SHA-256" }
-};
-const macFormatVersion = "2";
-const macPrefix = `Fe26.${macFormatVersion}`;
-const randomBytes = (_crypto, size) => {
-  const bytes = Buffer.allocUnsafe(size);
-  _crypto.getRandomValues(bytes);
-  return bytes;
-};
-const randomBits = (_crypto, bits) => {
-  if (bits < 1) {
-    throw new Error("Invalid random bits count");
-  }
-  const bytes = Math.ceil(bits / 8);
-  return randomBytes(_crypto, bytes);
-};
-const pbkdf2 = async (_crypto, password, salt, iterations, keyLength, hash) => {
-  const textEncoder = new TextEncoder();
-  const passwordBuffer = textEncoder.encode(password);
-  const importedKey = await _crypto.subtle.importKey(
-    "raw",
-    passwordBuffer,
-    "PBKDF2",
-    false,
-    ["deriveBits"]
-  );
-  const saltBuffer = textEncoder.encode(salt);
-  const params = { name: "PBKDF2", hash, salt: saltBuffer, iterations };
-  const derivation = await _crypto.subtle.deriveBits(
-    params,
-    importedKey,
-    keyLength * 8
-  );
-  return Buffer.from(derivation);
-};
-const generateKey = async (_crypto, password, options) => {
-  if (password == null || password.length === 0) {
-    throw new Error("Empty password");
-  }
-  if (options == null || typeof options !== "object") {
-    throw new Error("Bad options");
-  }
-  if (!(options.algorithm in algorithms)) {
-    throw new Error(`Unknown algorithm: ${options.algorithm}`);
-  }
-  const algorithm = algorithms[options.algorithm];
-  const result = {};
-  const hmac = options.hmac ?? false;
-  const id = hmac ? { name: "HMAC", hash: algorithm.name } : { name: algorithm.name };
-  const usage = hmac ? ["sign", "verify"] : ["encrypt", "decrypt"];
-  if (typeof password === "string") {
-    if (password.length < options.minPasswordlength) {
-      throw new Error(
-        `Password string too short (min ${options.minPasswordlength} characters required)`
-      );
-    }
-    let { salt = "" } = options;
-    if (!salt) {
-      const { saltBits = 0 } = options;
-      if (!saltBits) {
-        throw new Error("Missing salt and saltBits options");
-      }
-      const randomSalt = randomBits(_crypto, saltBits);
-      salt = randomSalt.toString("hex");
-    }
-    const derivedKey = await pbkdf2(
-      _crypto,
-      password,
-      salt,
-      options.iterations,
-      algorithm.keyBits / 8,
-      "SHA-1"
-    );
-    const importedEncryptionKey = await _crypto.subtle.importKey(
-      "raw",
-      derivedKey,
-      id,
-      false,
-      usage
-    );
-    result.key = importedEncryptionKey;
-    result.salt = salt;
-  } else {
-    if (password.length < algorithm.keyBits / 8) {
-      throw new Error("Key buffer (password) too small");
-    }
-    result.key = await _crypto.subtle.importKey(
-      "raw",
-      password,
-      id,
-      false,
-      usage
-    );
-    result.salt = "";
-  }
-  if (options.iv) {
-    result.iv = options.iv;
-  } else if ("ivBits" in algorithm) {
-    result.iv = randomBits(_crypto, algorithm.ivBits);
-  }
-  return result;
-};
-const encrypt = async (_crypto, password, options, data) => {
-  const key = await generateKey(_crypto, password, options);
-  const textEncoder = new TextEncoder();
-  const textBuffer = textEncoder.encode(data);
-  const encrypted = await _crypto.subtle.encrypt(
-    { name: algorithms[options.algorithm].name, iv: key.iv },
-    key.key,
-    textBuffer
-  );
-  return { encrypted: Buffer.from(encrypted), key };
-};
-const decrypt = async (_crypto, password, options, data) => {
-  const key = await generateKey(_crypto, password, options);
-  const decrypted = await _crypto.subtle.decrypt(
-    { name: algorithms[options.algorithm].name, iv: key.iv },
-    key.key,
-    Buffer.isBuffer(data) ? data : Buffer.from(data)
-  );
-  const textDecoder = new TextDecoder();
-  return textDecoder.decode(decrypted);
-};
-const hmacWithPassword = async (_crypto, password, options, data) => {
-  const key = await generateKey(_crypto, password, { ...options, hmac: true });
-  const textEncoder = new TextEncoder();
-  const textBuffer = textEncoder.encode(data);
-  const signed = await _crypto.subtle.sign(
-    { name: "HMAC" },
-    key.key,
-    textBuffer
-  );
-  const digest = base64urlEncode(Buffer.from(signed));
-  return { digest, salt: key.salt };
-};
-const normalizePassword = (password) => {
-  if (typeof password === "object" && !Buffer.isBuffer(password)) {
-    if ("secret" in password) {
-      return {
-        id: password.id,
-        encryption: password.secret,
-        integrity: password.secret
-      };
-    }
-    return {
-      id: password.id,
-      encryption: password.encryption,
-      integrity: password.integrity
-    };
-  }
-  return { encryption: password, integrity: password };
-};
-const seal = async (_crypto, object, password, options) => {
-  if (!password) {
-    throw new Error("Empty password");
-  }
-  const opts = clone(options);
-  const now = Date.now() + (opts.localtimeOffsetMsec || 0);
-  const objectString = JSON.stringify(object);
-  const pass = normalizePassword(password);
-  const { id = "" } = pass;
-  if (id && !/^\w+$/.test(id)) {
-    throw new Error("Invalid password id");
-  }
-  const { encrypted, key } = await encrypt(
-    _crypto,
-    pass.encryption,
-    opts.encryption,
-    objectString
-  );
-  const encryptedB64 = base64urlEncode(encrypted);
-  const iv = base64urlEncode(key.iv);
-  const expiration = opts.ttl ? now + opts.ttl : "";
-  const macBaseString = `${macPrefix}*${id}*${key.salt}*${iv}*${encryptedB64}*${expiration}`;
-  const mac = await hmacWithPassword(
-    _crypto,
-    pass.integrity,
-    opts.integrity,
-    macBaseString
-  );
-  const sealed = `${macBaseString}*${mac.salt}*${mac.digest}`;
-  return sealed;
-};
-const fixedTimeComparison = (a, b) => {
-  let mismatch = a.length === b.length ? 0 : 1;
-  if (mismatch) {
-    b = a;
-  }
-  for (let i = 0; i < a.length; i += 1) {
-    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return mismatch === 0;
-};
-const unseal = async (_crypto, sealed, password, options) => {
-  if (!password) {
-    throw new Error("Empty password");
-  }
-  const opts = clone(options);
-  const now = Date.now() + (opts.localtimeOffsetMsec || 0);
-  const parts = sealed.split("*");
-  if (parts.length !== 8) {
-    throw new Error("Incorrect number of sealed components");
-  }
-  const prefix = parts[0];
-  const passwordId = parts[1];
-  const encryptionSalt = parts[2];
-  const encryptionIv = parts[3];
-  const encryptedB64 = parts[4];
-  const expiration = parts[5];
-  const hmacSalt = parts[6];
-  const hmac = parts[7];
-  const macBaseString = `${prefix}*${passwordId}*${encryptionSalt}*${encryptionIv}*${encryptedB64}*${expiration}`;
-  if (macPrefix !== prefix) {
-    throw new Error("Wrong mac prefix");
-  }
-  if (expiration) {
-    if (!/^\d+$/.test(expiration)) {
-      throw new Error("Invalid expiration");
-    }
-    const exp = Number.parseInt(expiration, 10);
-    if (exp <= now - opts.timestampSkewSec * 1e3) {
-      throw new Error("Expired seal");
-    }
-  }
-  if (typeof password === "undefined" || typeof password === "string" && password.length === 0) {
-    throw new Error("Empty password");
-  }
-  let pass;
-  if (typeof password === "object" && !Buffer.isBuffer(password)) {
-    if (!((passwordId || "default") in password)) {
-      throw new Error(`Cannot find password: ${passwordId}`);
-    }
-    pass = password[passwordId || "default"];
-  } else {
-    pass = password;
-  }
-  pass = normalizePassword(pass);
-  const macOptions = opts.integrity;
-  macOptions.salt = hmacSalt;
-  const mac = await hmacWithPassword(
-    _crypto,
-    pass.integrity,
-    macOptions,
-    macBaseString
-  );
-  if (!fixedTimeComparison(mac.digest, hmac)) {
-    throw new Error("Bad hmac value");
-  }
-  const encrypted = Buffer.from(encryptedB64, "base64");
-  const decryptOptions = opts.encryption;
-  decryptOptions.salt = encryptionSalt;
-  decryptOptions.iv = Buffer.from(encryptionIv, "base64");
-  const decrypted = await decrypt(
-    _crypto,
-    pass.encryption,
-    decryptOptions,
-    encrypted
-  );
-  if (decrypted) {
-    return JSON.parse(decrypted);
-  }
-  return null;
-};
-
 const DEFAULT_NAME = "h3";
 const DEFAULT_COOKIE = {
   path: "/",
@@ -914,21 +640,35 @@ async function getSession(event, config) {
   if (event.context.sessions[sessionName]) {
     return event.context.sessions[sessionName];
   }
-  const session = { id: "", data: /* @__PURE__ */ Object.create(null) };
+  const session = {
+    id: "",
+    createdAt: 0,
+    data: /* @__PURE__ */ Object.create(null)
+  };
   event.context.sessions[sessionName] = session;
-  const reqCookie = getCookie(event, sessionName);
-  if (!reqCookie) {
-    session.id = (config.crypto || crypto).randomUUID();
-    await updateSession(event, config);
-  } else {
-    const unsealed = await unseal(
-      config.crypto || crypto,
-      reqCookie,
-      config.password,
-      config.seal || defaults
+  let sealedSession;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = event.node.req.headers[headerName];
+    if (typeof headerValue === "string") {
+      sealedSession = headerValue;
+    }
+  }
+  if (!sealedSession) {
+    sealedSession = getCookie(event, sessionName);
+  }
+  if (sealedSession) {
+    const unsealed = await unsealSession(event, config, sealedSession).catch(
+      () => {
+      }
     );
     Object.assign(session, unsealed);
   }
+  if (!session.id) {
+    session.id = (config.crypto || crypto).randomUUID();
+    session.createdAt = Date.now();
+    await updateSession(event, config);
+  }
   return session;
 }
 async function updateSession(event, config, update) {
@@ -940,21 +680,54 @@ async function updateSession(event, config, update) {
   if (update) {
     Object.assign(session.data, update);
   }
-  const sealed = await seal(
+  if (config.cookie !== false) {
+    const sealed = await sealSession(event, config);
+    setCookie(event, sessionName, sealed, {
+      ...DEFAULT_COOKIE,
+      expires: config.maxAge ? new Date(session.createdAt + config.maxAge * 1e3) : void 0,
+      ...config.cookie
+    });
+  }
+  return session;
+}
+async function sealSession(event, config) {
+  const sessionName = config.name || DEFAULT_NAME;
+  const session = event.context.sessions?.[sessionName] || await getSession(event, config);
+  const sealed = await ironWebcrypto.seal(config.crypto || crypto, session, config.password, {
+    ...ironWebcrypto.defaults,
+    ttl: config.maxAge ? config.maxAge * 1e3 : 0,
+    ...config.seal
+  });
+  return sealed;
+}
+async function unsealSession(_event, config, sealed) {
+  const unsealed = await ironWebcrypto.unseal(
     config.crypto || crypto,
-    session,
+    sealed,
     config.password,
-    config.seal || defaults
+    {
+      ...ironWebcrypto.defaults,
+      ttl: config.maxAge ? config.maxAge * 1e3 : 0,
+      ...config.seal
+    }
   );
-  setCookie(event, sessionName, sealed, config.cookie || DEFAULT_COOKIE);
-  return session;
+  if (config.maxAge) {
+    const age = Date.now() - (unsealed.createdAt || Number.NEGATIVE_INFINITY);
+    if (age > config.maxAge * 1e3) {
+      throw new Error("Session expired!");
+    }
+  }
+  return unsealed;
 }
 async function clearSession(event, config) {
   const sessionName = config.name || DEFAULT_NAME;
   if (event.context.sessions?.[sessionName]) {
     delete event.context.sessions[sessionName];
   }
-  await setCookie(event, sessionName, "", config.cookie || DEFAULT_COOKIE);
+  await setCookie(event, sessionName, "", {
+    ...DEFAULT_COOKIE,
+    ...config.cookie
+  });
 }
 
 class H3Headers {
@@ -1431,11 +1204,13 @@ exports.defineNodeMiddleware = defineNodeMiddleware;
 exports.deleteCookie = deleteCookie;
 exports.dynamicEventHandler = dynamicEventHandler;
 exports.eventHandler = eventHandler;
+exports.fetchWithEvent = fetchWithEvent;
 exports.fromNodeMiddleware = fromNodeMiddleware;
 exports.getCookie = getCookie;
 exports.getHeader = getHeader;
 exports.getHeaders = getHeaders;
 exports.getMethod = getMethod;
+exports.getProxyRequestHeaders = getProxyRequestHeaders;
 exports.getQuery = getQuery;
 exports.getRequestHeader = getRequestHeader;
 exports.getRequestHeaders = getRequestHeaders;
@@ -1459,6 +1234,7 @@ exports.proxyRequest = proxyRequest;
 exports.readBody = readBody;
 exports.readMultipartFormData = readMultipartFormData;
 exports.readRawBody = readRawBody;
+exports.sealSession = sealSession;
 exports.send = send;
 exports.sendError = sendError;
 exports.sendNoContent = sendNoContent;
@@ -1473,6 +1249,7 @@ exports.setResponseHeaders = setResponseHeaders;
 exports.setResponseStatus = setResponseStatus;
 exports.toEventHandler = toEventHandler;
 exports.toNodeListener = toNodeListener;
+exports.unsealSession = unsealSession;
 exports.updateSession = updateSession;
 exports.use = use;
 exports.useBase = useBase;

package/dist/index.d.ts

@@ -1,65 +1,27 @@
 import { CookieSerializeOptions } from 'cookie-es';
+import { SealOptions } from 'iron-webcrypto';
 import { IncomingMessage, ServerResponse, OutgoingMessage } from 'node:http';
 export { IncomingMessage as NodeIncomingMessage, ServerResponse as NodeServerResponse } from 'node:http';
 import * as ufo from 'ufo';
 
-/**
- * seal() method options.
- */
-interface SealOptionsSub {
-    /**
-     * The length of the salt (random buffer used to ensure that two identical objects will generate a different encrypted result). Defaults to 256.
-     */
-    saltBits: number;
-    /**
-     * The algorithm used. Defaults to 'aes-256-cbc' for encryption and 'sha256' for integrity.
-     */
-    algorithm: "aes-128-ctr" | "aes-256-cbc" | "sha256";
-    /**
-     * The number of iterations used to derive a key from the password. Defaults to 1.
-     */
-    iterations: number;
-    /**
-     * Minimum password size. Defaults to 32.
-     */
-    minPasswordlength: number;
-}
-/**
- * Options for customizing the key derivation algorithm used to generate encryption and integrity verification keys as well as the algorithms and salt sizes used.
- */
-interface SealOptions {
-    /**
-     * Encryption step options.
-     */
-    encryption: SealOptionsSub;
-    /**
-     * Integrity step options.
-     */
-    integrity: SealOptionsSub;
-    /**
-     * Sealed object lifetime in milliseconds where 0 means forever. Defaults to 0.
-     */
-    ttl: number;
-    /**
-     * Number of seconds of permitted clock skew for incoming expirations. Defaults to 60 seconds.
-     */
-    timestampSkewSec: number;
-    /**
-     * Local clock time offset, expressed in number of milliseconds (positive or negative). Defaults to 0.
-     */
-    localtimeOffsetMsec: number;
-}
-
-type SessionDataT = Record<string, string | number | boolean>;
+type SessionDataT = Record<string, any>;
 type SessionData<T extends SessionDataT = SessionDataT> = T;
 interface Session<T extends SessionDataT = SessionDataT> {
     id: string;
+    createdAt: number;
     data: SessionData<T>;
 }
 interface SessionConfig {
+    /** Private key used to encrypt session tokens */
     password: string;
+    /** Session expiration time in seconds */
+    maxAge?: number;
+    /** default is h3 */
     name?: string;
-    cookie?: CookieSerializeOptions;
+    /** Default is secure, httpOnly, / */
+    cookie?: false | CookieSerializeOptions;
+    /** Default is x-h3-session / x-{name}-session */
+    sessionHeader?: false | string;
     seal?: SealOptions;
     crypto?: Crypto;
 }
@@ -72,6 +34,8 @@ declare function useSession<T extends SessionDataT = SessionDataT>(event: H3Even
 declare function getSession<T extends SessionDataT = SessionDataT>(event: H3Event, config: SessionConfig): Promise<Session<T>>;
 type SessionUpdate<T extends SessionDataT = SessionDataT> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
 declare function updateSession<T extends SessionDataT = SessionDataT>(event: H3Event, config: SessionConfig, update?: SessionUpdate<T>): Promise<Session<T>>;
+declare function sealSession<T extends SessionDataT = SessionDataT>(event: H3Event, config: SessionConfig): Promise<string>;
+declare function unsealSession(_event: H3Event, config: SessionConfig, sealed: string): Promise<Partial<Session<SessionDataT>>>;
 declare function clearSession(event: H3Event, config: SessionConfig): Promise<void>;
 
 type HTTPMethod = "GET" | "HEAD" | "PATCH" | "POST" | "PUT" | "DELETE" | "CONNECT" | "OPTIONS" | "TRACE";
@@ -338,8 +302,12 @@ interface ProxyOptions {
     fetch?: typeof fetch;
     sendStream?: boolean;
 }
-declare function proxyRequest(event: H3Event, target: string, opts?: ProxyOptions): Promise<void>;
-declare function sendProxy(event: H3Event, target: string, opts?: ProxyOptions): Promise<void>;
+declare function proxyRequest(event: H3Event, target: string, opts?: ProxyOptions): Promise<any>;
+declare function sendProxy(event: H3Event, target: string, opts?: ProxyOptions): Promise<any>;
+declare function getProxyRequestHeaders(event: H3Event): any;
+declare function fetchWithEvent(event: H3Event, req: RequestInfo | URL, init?: RequestInit, options?: {
+    fetch: typeof fetch;
+}): Promise<Response>;
 
 declare function getQuery(event: H3Event): ufo.QueryObject;
 declare function getRouterParams(event: H3Event): H3Event["context"];
@@ -395,4 +363,4 @@ interface CreateRouterOptions {
 }
 declare function createRouter(opts?: CreateRouterOptions): Router;
 
-export { AddRouteShortcuts, App, AppOptions, AppUse, CacheConditions, CreateRouterOptions, DynamicEventHandler, Encoding, EventHandler, EventHandlerResponse, H3Error, H3Event, H3EventContext, H3Headers, H3Response, HTTPMethod, InputLayer, InputStack, Layer, LazyEventHandler, MIMES, Matcher, NodeEventContext, NodeListener, NodeMiddleware, NodePromisifiedHandler, ProxyOptions, RequestHeaders, Router, RouterMethod, RouterUse, Session, SessionConfig, SessionData, Stack, appendHeader, appendHeaders, appendResponseHeader, appendResponseHeaders, assertMethod, callNodeListener, clearSession, createApp, createAppEventHandler, createError, createEvent, createRouter, defaultContentType, defineEventHandler, defineLazyEventHandler, defineNodeListener, defineNodeMiddleware, deleteCookie, dynamicEventHandler, eventHandler, fromNodeMiddleware, getCookie, getHeader, getHeaders, getMethod, getQuery, getRequestHeader, getRequestHeaders, getResponseHeader, getResponseHeaders, getResponseStatus, getResponseStatusText, getRouterParam, getRouterParams, getSession, handleCacheHeaders, isError, isEvent, isEventHandler, isMethod, isStream, lazyEventHandler, parseCookies, promisifyNodeListener, proxyRequest, readBody, readMultipartFormData, readRawBody, send, sendError, sendNoContent, sendProxy, sendRedirect, sendStream, setCookie, setHeader, setHeaders, setResponseHeader, setResponseHeaders, setResponseStatus, toEventHandler, toNodeListener, updateSession, use, useBase, useSession, writeEarlyHints };
+export { AddRouteShortcuts, App, AppOptions, AppUse, CacheConditions, CreateRouterOptions, DynamicEventHandler, Encoding, EventHandler, EventHandlerResponse, H3Error, H3Event, H3EventContext, H3Headers, H3Response, HTTPMethod, InputLayer, InputStack, Layer, LazyEventHandler, MIMES, Matcher, NodeEventContext, NodeListener, NodeMiddleware, NodePromisifiedHandler, ProxyOptions, RequestHeaders, Router, RouterMethod, RouterUse, Session, SessionConfig, SessionData, Stack, appendHeader, appendHeaders, appendResponseHeader, appendResponseHeaders, assertMethod, callNodeListener, clearSession, createApp, createAppEventHandler, createError, createEvent, createRouter, defaultContentType, defineEventHandler, defineLazyEventHandler, defineNodeListener, defineNodeMiddleware, deleteCookie, dynamicEventHandler, eventHandler, fetchWithEvent, fromNodeMiddleware, getCookie, getHeader, getHeaders, getMethod, getProxyRequestHeaders, getQuery, getRequestHeader, getRequestHeaders, getResponseHeader, getResponseHeaders, getResponseStatus, getResponseStatusText, getRouterParam, getRouterParams, getSession, handleCacheHeaders, isError, isEvent, isEventHandler, isMethod, isStream, lazyEventHandler, parseCookies, promisifyNodeListener, proxyRequest, readBody, readMultipartFormData, readRawBody, sealSession, send, sendError, sendNoContent, sendProxy, sendRedirect, sendStream, setCookie, setHeader, setHeaders, setResponseHeader, setResponseHeaders, setResponseStatus, toEventHandler, toNodeListener, unsealSession, updateSession, use, useBase, useSession, writeEarlyHints };

package/dist/index.mjs

@@ -3,6 +3,7 @@ import { createRouter as createRouter$1 } from 'radix3';
 import destr from 'destr';
 import { parse as parse$1, serialize } from 'cookie-es';
 import crypto from 'uncrypto';
+import { seal, defaults, unseal } from 'iron-webcrypto';
 
 function useBase(base, handler) {
   base = withoutTrailingSlash(base);
@@ -392,13 +393,7 @@ async function proxyRequest(event, target, opts = {}) {
   if (PayloadMethods.has(method)) {
     body = await readRawBody(event).catch(() => void 0);
   }
-  const headers = /* @__PURE__ */ Object.create(null);
-  const reqHeaders = getRequestHeaders(event);
-  for (const name in reqHeaders) {
-    if (!ignoredHeaders.has(name)) {
-      headers[name] = reqHeaders[name];
-    }
-  }
+  const headers = getProxyRequestHeaders(event);
   if (opts.fetchOptions?.headers) {
     Object.assign(headers, opts.fetchOptions.headers);
   }
@@ -416,13 +411,7 @@ async function proxyRequest(event, target, opts = {}) {
   });
 }
 async function sendProxy(event, target, opts = {}) {
-  const _fetch = opts.fetch || globalThis.fetch;
-  if (!_fetch) {
-    throw new Error(
-      "fetch is not available. Try importing `node-fetch-native/polyfill` for Node.js."
-    );
-  }
-  const response = await _fetch(target, {
+  const response = await _getFetch(opts.fetch)(target, {
     headers: opts.headers,
     ...opts.fetchOptions
   });
@@ -437,22 +426,49 @@ async function sendProxy(event, target, opts = {}) {
     }
     event.node.res.setHeader(key, value);
   }
-  try {
-    if (response.body) {
-      if (opts.sendStream === false) {
-        const data = new Uint8Array(await response.arrayBuffer());
-        event.node.res.end(data);
-      } else {
-        for await (const chunk of response.body) {
-          event.node.res.write(chunk);
-        }
-        event.node.res.end();
-      }
+  if (response._data !== void 0) {
+    return response._data;
+  }
+  if (opts.sendStream === false) {
+    const data = new Uint8Array(await response.arrayBuffer());
+    return event.node.res.end(data);
+  }
+  for await (const chunk of response.body) {
+    event.node.res.write(chunk);
+  }
+  return event.node.res.end();
+}
+function getProxyRequestHeaders(event) {
+  const headers = /* @__PURE__ */ Object.create(null);
+  const reqHeaders = getRequestHeaders(event);
+  for (const name in reqHeaders) {
+    if (!ignoredHeaders.has(name)) {
+      headers[name] = reqHeaders[name];
     }
-  } catch (error) {
-    event.node.res.end();
-    throw error;
   }
+  return headers;
+}
+function fetchWithEvent(event, req, init, options) {
+  return _getFetch(options?.fetch)(req, {
+    ...init,
+    // @ts-ignore (context is used for unenv and local fetch)
+    context: init.context || event.context,
+    headers: {
+      ...getProxyRequestHeaders(event),
+      ...init?.headers
+    }
+  });
+}
+function _getFetch(_fetch) {
+  if (_fetch) {
+    return _fetch;
+  }
+  if (globalThis.fetch) {
+    return globalThis.fetch;
+  }
+  throw new Error(
+    "fetch is not available. Try importing `node-fetch-native/polyfill` for Node.js."
+  );
 }
 
 const defer = typeof setImmediate !== "undefined" ? setImmediate : (fn) => fn();
@@ -587,296 +603,6 @@ ${header}: ${value}`;
   }
 }
 
-const base64urlEncode = (value) => (Buffer.isBuffer(value) ? value : Buffer.from(value)).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-const defaults = {
-  encryption: {
-    saltBits: 256,
-    algorithm: "aes-256-cbc",
-    iterations: 1,
-    minPasswordlength: 32
-  },
-  integrity: {
-    saltBits: 256,
-    algorithm: "sha256",
-    iterations: 1,
-    minPasswordlength: 32
-  },
-  ttl: 0,
-  timestampSkewSec: 60,
-  localtimeOffsetMsec: 0
-};
-const clone = (options) => ({
-  ...options,
-  encryption: { ...options.encryption },
-  integrity: { ...options.integrity }
-});
-const algorithms = {
-  "aes-128-ctr": { keyBits: 128, ivBits: 128, name: "AES-CTR" },
-  "aes-256-cbc": { keyBits: 256, ivBits: 128, name: "AES-CBC" },
-  sha256: { keyBits: 256, name: "SHA-256" }
-};
-const macFormatVersion = "2";
-const macPrefix = `Fe26.${macFormatVersion}`;
-const randomBytes = (_crypto, size) => {
-  const bytes = Buffer.allocUnsafe(size);
-  _crypto.getRandomValues(bytes);
-  return bytes;
-};
-const randomBits = (_crypto, bits) => {
-  if (bits < 1) {
-    throw new Error("Invalid random bits count");
-  }
-  const bytes = Math.ceil(bits / 8);
-  return randomBytes(_crypto, bytes);
-};
-const pbkdf2 = async (_crypto, password, salt, iterations, keyLength, hash) => {
-  const textEncoder = new TextEncoder();
-  const passwordBuffer = textEncoder.encode(password);
-  const importedKey = await _crypto.subtle.importKey(
-    "raw",
-    passwordBuffer,
-    "PBKDF2",
-    false,
-    ["deriveBits"]
-  );
-  const saltBuffer = textEncoder.encode(salt);
-  const params = { name: "PBKDF2", hash, salt: saltBuffer, iterations };
-  const derivation = await _crypto.subtle.deriveBits(
-    params,
-    importedKey,
-    keyLength * 8
-  );
-  return Buffer.from(derivation);
-};
-const generateKey = async (_crypto, password, options) => {
-  if (password == null || password.length === 0) {
-    throw new Error("Empty password");
-  }
-  if (options == null || typeof options !== "object") {
-    throw new Error("Bad options");
-  }
-  if (!(options.algorithm in algorithms)) {
-    throw new Error(`Unknown algorithm: ${options.algorithm}`);
-  }
-  const algorithm = algorithms[options.algorithm];
-  const result = {};
-  const hmac = options.hmac ?? false;
-  const id = hmac ? { name: "HMAC", hash: algorithm.name } : { name: algorithm.name };
-  const usage = hmac ? ["sign", "verify"] : ["encrypt", "decrypt"];
-  if (typeof password === "string") {
-    if (password.length < options.minPasswordlength) {
-      throw new Error(
-        `Password string too short (min ${options.minPasswordlength} characters required)`
-      );
-    }
-    let { salt = "" } = options;
-    if (!salt) {
-      const { saltBits = 0 } = options;
-      if (!saltBits) {
-        throw new Error("Missing salt and saltBits options");
-      }
-      const randomSalt = randomBits(_crypto, saltBits);
-      salt = randomSalt.toString("hex");
-    }
-    const derivedKey = await pbkdf2(
-      _crypto,
-      password,
-      salt,
-      options.iterations,
-      algorithm.keyBits / 8,
-      "SHA-1"
-    );
-    const importedEncryptionKey = await _crypto.subtle.importKey(
-      "raw",
-      derivedKey,
-      id,
-      false,
-      usage
-    );
-    result.key = importedEncryptionKey;
-    result.salt = salt;
-  } else {
-    if (password.length < algorithm.keyBits / 8) {
-      throw new Error("Key buffer (password) too small");
-    }
-    result.key = await _crypto.subtle.importKey(
-      "raw",
-      password,
-      id,
-      false,
-      usage
-    );
-    result.salt = "";
-  }
-  if (options.iv) {
-    result.iv = options.iv;
-  } else if ("ivBits" in algorithm) {
-    result.iv = randomBits(_crypto, algorithm.ivBits);
-  }
-  return result;
-};
-const encrypt = async (_crypto, password, options, data) => {
-  const key = await generateKey(_crypto, password, options);
-  const textEncoder = new TextEncoder();
-  const textBuffer = textEncoder.encode(data);
-  const encrypted = await _crypto.subtle.encrypt(
-    { name: algorithms[options.algorithm].name, iv: key.iv },
-    key.key,
-    textBuffer
-  );
-  return { encrypted: Buffer.from(encrypted), key };
-};
-const decrypt = async (_crypto, password, options, data) => {
-  const key = await generateKey(_crypto, password, options);
-  const decrypted = await _crypto.subtle.decrypt(
-    { name: algorithms[options.algorithm].name, iv: key.iv },
-    key.key,
-    Buffer.isBuffer(data) ? data : Buffer.from(data)
-  );
-  const textDecoder = new TextDecoder();
-  return textDecoder.decode(decrypted);
-};
-const hmacWithPassword = async (_crypto, password, options, data) => {
-  const key = await generateKey(_crypto, password, { ...options, hmac: true });
-  const textEncoder = new TextEncoder();
-  const textBuffer = textEncoder.encode(data);
-  const signed = await _crypto.subtle.sign(
-    { name: "HMAC" },
-    key.key,
-    textBuffer
-  );
-  const digest = base64urlEncode(Buffer.from(signed));
-  return { digest, salt: key.salt };
-};
-const normalizePassword = (password) => {
-  if (typeof password === "object" && !Buffer.isBuffer(password)) {
-    if ("secret" in password) {
-      return {
-        id: password.id,
-        encryption: password.secret,
-        integrity: password.secret
-      };
-    }
-    return {
-      id: password.id,
-      encryption: password.encryption,
-      integrity: password.integrity
-    };
-  }
-  return { encryption: password, integrity: password };
-};
-const seal = async (_crypto, object, password, options) => {
-  if (!password) {
-    throw new Error("Empty password");
-  }
-  const opts = clone(options);
-  const now = Date.now() + (opts.localtimeOffsetMsec || 0);
-  const objectString = JSON.stringify(object);
-  const pass = normalizePassword(password);
-  const { id = "" } = pass;
-  if (id && !/^\w+$/.test(id)) {
-    throw new Error("Invalid password id");
-  }
-  const { encrypted, key } = await encrypt(
-    _crypto,
-    pass.encryption,
-    opts.encryption,
-    objectString
-  );
-  const encryptedB64 = base64urlEncode(encrypted);
-  const iv = base64urlEncode(key.iv);
-  const expiration = opts.ttl ? now + opts.ttl : "";
-  const macBaseString = `${macPrefix}*${id}*${key.salt}*${iv}*${encryptedB64}*${expiration}`;
-  const mac = await hmacWithPassword(
-    _crypto,
-    pass.integrity,
-    opts.integrity,
-    macBaseString
-  );
-  const sealed = `${macBaseString}*${mac.salt}*${mac.digest}`;
-  return sealed;
-};
-const fixedTimeComparison = (a, b) => {
-  let mismatch = a.length === b.length ? 0 : 1;
-  if (mismatch) {
-    b = a;
-  }
-  for (let i = 0; i < a.length; i += 1) {
-    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return mismatch === 0;
-};
-const unseal = async (_crypto, sealed, password, options) => {
-  if (!password) {
-    throw new Error("Empty password");
-  }
-  const opts = clone(options);
-  const now = Date.now() + (opts.localtimeOffsetMsec || 0);
-  const parts = sealed.split("*");
-  if (parts.length !== 8) {
-    throw new Error("Incorrect number of sealed components");
-  }
-  const prefix = parts[0];
-  const passwordId = parts[1];
-  const encryptionSalt = parts[2];
-  const encryptionIv = parts[3];
-  const encryptedB64 = parts[4];
-  const expiration = parts[5];
-  const hmacSalt = parts[6];
-  const hmac = parts[7];
-  const macBaseString = `${prefix}*${passwordId}*${encryptionSalt}*${encryptionIv}*${encryptedB64}*${expiration}`;
-  if (macPrefix !== prefix) {
-    throw new Error("Wrong mac prefix");
-  }
-  if (expiration) {
-    if (!/^\d+$/.test(expiration)) {
-      throw new Error("Invalid expiration");
-    }
-    const exp = Number.parseInt(expiration, 10);
-    if (exp <= now - opts.timestampSkewSec * 1e3) {
-      throw new Error("Expired seal");
-    }
-  }
-  if (typeof password === "undefined" || typeof password === "string" && password.length === 0) {
-    throw new Error("Empty password");
-  }
-  let pass;
-  if (typeof password === "object" && !Buffer.isBuffer(password)) {
-    if (!((passwordId || "default") in password)) {
-      throw new Error(`Cannot find password: ${passwordId}`);
-    }
-    pass = password[passwordId || "default"];
-  } else {
-    pass = password;
-  }
-  pass = normalizePassword(pass);
-  const macOptions = opts.integrity;
-  macOptions.salt = hmacSalt;
-  const mac = await hmacWithPassword(
-    _crypto,
-    pass.integrity,
-    macOptions,
-    macBaseString
-  );
-  if (!fixedTimeComparison(mac.digest, hmac)) {
-    throw new Error("Bad hmac value");
-  }
-  const encrypted = Buffer.from(encryptedB64, "base64");
-  const decryptOptions = opts.encryption;
-  decryptOptions.salt = encryptionSalt;
-  decryptOptions.iv = Buffer.from(encryptionIv, "base64");
-  const decrypted = await decrypt(
-    _crypto,
-    pass.encryption,
-    decryptOptions,
-    encrypted
-  );
-  if (decrypted) {
-    return JSON.parse(decrypted);
-  }
-  return null;
-};
-
 const DEFAULT_NAME = "h3";
 const DEFAULT_COOKIE = {
   path: "/",
@@ -912,21 +638,35 @@ async function getSession(event, config) {
   if (event.context.sessions[sessionName]) {
     return event.context.sessions[sessionName];
   }
-  const session = { id: "", data: /* @__PURE__ */ Object.create(null) };
+  const session = {
+    id: "",
+    createdAt: 0,
+    data: /* @__PURE__ */ Object.create(null)
+  };
   event.context.sessions[sessionName] = session;
-  const reqCookie = getCookie(event, sessionName);
-  if (!reqCookie) {
-    session.id = (config.crypto || crypto).randomUUID();
-    await updateSession(event, config);
-  } else {
-    const unsealed = await unseal(
-      config.crypto || crypto,
-      reqCookie,
-      config.password,
-      config.seal || defaults
+  let sealedSession;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = event.node.req.headers[headerName];
+    if (typeof headerValue === "string") {
+      sealedSession = headerValue;
+    }
+  }
+  if (!sealedSession) {
+    sealedSession = getCookie(event, sessionName);
+  }
+  if (sealedSession) {
+    const unsealed = await unsealSession(event, config, sealedSession).catch(
+      () => {
+      }
     );
     Object.assign(session, unsealed);
   }
+  if (!session.id) {
+    session.id = (config.crypto || crypto).randomUUID();
+    session.createdAt = Date.now();
+    await updateSession(event, config);
+  }
   return session;
 }
 async function updateSession(event, config, update) {
@@ -938,21 +678,54 @@ async function updateSession(event, config, update) {
   if (update) {
     Object.assign(session.data, update);
   }
-  const sealed = await seal(
+  if (config.cookie !== false) {
+    const sealed = await sealSession(event, config);
+    setCookie(event, sessionName, sealed, {
+      ...DEFAULT_COOKIE,
+      expires: config.maxAge ? new Date(session.createdAt + config.maxAge * 1e3) : void 0,
+      ...config.cookie
+    });
+  }
+  return session;
+}
+async function sealSession(event, config) {
+  const sessionName = config.name || DEFAULT_NAME;
+  const session = event.context.sessions?.[sessionName] || await getSession(event, config);
+  const sealed = await seal(config.crypto || crypto, session, config.password, {
+    ...defaults,
+    ttl: config.maxAge ? config.maxAge * 1e3 : 0,
+    ...config.seal
+  });
+  return sealed;
+}
+async function unsealSession(_event, config, sealed) {
+  const unsealed = await unseal(
     config.crypto || crypto,
-    session,
+    sealed,
     config.password,
-    config.seal || defaults
+    {
+      ...defaults,
+      ttl: config.maxAge ? config.maxAge * 1e3 : 0,
+      ...config.seal
+    }
   );
-  setCookie(event, sessionName, sealed, config.cookie || DEFAULT_COOKIE);
-  return session;
+  if (config.maxAge) {
+    const age = Date.now() - (unsealed.createdAt || Number.NEGATIVE_INFINITY);
+    if (age > config.maxAge * 1e3) {
+      throw new Error("Session expired!");
+    }
+  }
+  return unsealed;
 }
 async function clearSession(event, config) {
   const sessionName = config.name || DEFAULT_NAME;
   if (event.context.sessions?.[sessionName]) {
     delete event.context.sessions[sessionName];
   }
-  await setCookie(event, sessionName, "", config.cookie || DEFAULT_COOKIE);
+  await setCookie(event, sessionName, "", {
+    ...DEFAULT_COOKIE,
+    ...config.cookie
+  });
 }
 
 class H3Headers {
@@ -1404,4 +1177,4 @@ function createRouter(opts = {}) {
   return router;
 }
 
-export { H3Error, H3Event, H3Headers, H3Response, MIMES, appendHeader, appendHeaders, appendResponseHeader, appendResponseHeaders, assertMethod, callNodeListener, clearSession, createApp, createAppEventHandler, createError, createEvent, createRouter, defaultContentType, defineEventHandler, defineLazyEventHandler, defineNodeListener, defineNodeMiddleware, deleteCookie, dynamicEventHandler, eventHandler, fromNodeMiddleware, getCookie, getHeader, getHeaders, getMethod, getQuery, getRequestHeader, getRequestHeaders, getResponseHeader, getResponseHeaders, getResponseStatus, getResponseStatusText, getRouterParam, getRouterParams, getSession, handleCacheHeaders, isError, isEvent, isEventHandler, isMethod, isStream, lazyEventHandler, parseCookies, promisifyNodeListener, proxyRequest, readBody, readMultipartFormData, readRawBody, send, sendError, sendNoContent, sendProxy, sendRedirect, sendStream, setCookie, setHeader, setHeaders, setResponseHeader, setResponseHeaders, setResponseStatus, toEventHandler, toNodeListener, updateSession, use, useBase, useSession, writeEarlyHints };
+export { H3Error, H3Event, H3Headers, H3Response, MIMES, appendHeader, appendHeaders, appendResponseHeader, appendResponseHeaders, assertMethod, callNodeListener, clearSession, createApp, createAppEventHandler, createError, createEvent, createRouter, defaultContentType, defineEventHandler, defineLazyEventHandler, defineNodeListener, defineNodeMiddleware, deleteCookie, dynamicEventHandler, eventHandler, fetchWithEvent, fromNodeMiddleware, getCookie, getHeader, getHeaders, getMethod, getProxyRequestHeaders, getQuery, getRequestHeader, getRequestHeaders, getResponseHeader, getResponseHeaders, getResponseStatus, getResponseStatusText, getRouterParam, getRouterParams, getSession, handleCacheHeaders, isError, isEvent, isEventHandler, isMethod, isStream, lazyEventHandler, parseCookies, promisifyNodeListener, proxyRequest, readBody, readMultipartFormData, readRawBody, sealSession, send, sendError, sendNoContent, sendProxy, sendRedirect, sendStream, setCookie, setHeader, setHeaders, setResponseHeader, setResponseHeaders, setResponseStatus, toEventHandler, toNodeListener, unsealSession, updateSession, use, useBase, useSession, writeEarlyHints };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "h3",
-  "version": "1.2.1",
+  "version": "1.4.0",
   "description": "Tiny JavaScript Server",
   "repository": "unjs/h3",
   "license": "MIT",
@@ -22,16 +22,17 @@
   "dependencies": {
     "cookie-es": "^0.5.0",
     "destr": "^1.2.2",
+    "iron-webcrypto": "^0.4.0",
     "radix3": "^1.0.0",
     "ufo": "^1.0.1",
     "uncrypto": "^0.1.2"
   },
   "devDependencies": {
     "0x": "^5.4.1",
-    "@types/express": "^4.17.16",
-    "@types/node": "^18.11.18",
+    "@types/express": "^4.17.17",
+    "@types/node": "^18.13.0",
     "@types/supertest": "^2.0.12",
-    "@vitest/coverage-c8": "^0.28.3",
+    "@vitest/coverage-c8": "^0.28.4",
     "autocannon": "^7.10.0",
     "changelogen": "^0.4.1",
     "connect": "^3.7.0",
@@ -42,11 +43,11 @@
     "jiti": "^1.16.2",
     "listhen": "^1.0.2",
     "node-fetch-native": "^1.0.1",
-    "prettier": "^2.8.3",
+    "prettier": "^2.8.4",
     "supertest": "^6.3.3",
     "typescript": "^4.9.5",
     "unbuild": "^1.1.1",
-    "vitest": "^0.28.3"
+    "vitest": "^0.28.4"
   },
   "packageManager": "pnpm@7.26.3",
   "scripts": {