hono-sessions 0.3.4 → 0.3.6

package/README.md

@@ -169,6 +169,21 @@ import { sessionMiddleware, CookieStore, Session } from 'hono-sessions'
 export default app
 ```
 
+## Troubleshooting
+
+### TypeScript errors
+
+Hono has a high upgrade frequency, but the API for middleware this library relies on remains largely unchanged between Hono releases. You may experience a TypeScript error if you use this library with the latest version of Hono. In that case, before you load the middleware into your Hono app, you might want to have TypeScript ignore this error:
+
+```ts
+// @ts-ignore
+app.use('*', sessionMiddleware({
+  // ...
+}))
+```
+
+TypeScript should otherwise work normally.
+
 ## Contributing
 
 This package is built Deno-first, so you'll need to have Deno installed in your development environment. See their [website](https://deno.com/) for installation instructions specific to your platform.

package/esm/deps.d.ts

@@ -1,5 +1,6 @@
 export { nanoid } from 'nanoid/async';
-export type { MiddlewareHandler, Context } from 'hono';
+export type { Context, MiddlewareHandler } from 'hono';
+export { createMiddleware } from 'hono/factory';
 export { getCookie, setCookie } from 'hono/cookie';
 export type { CookieOptions } from 'hono/utils/cookie';
 export * as Iron from 'iron-webcrypto';

package/esm/deps.js

@@ -1,3 +1,4 @@
 export { nanoid } from 'nanoid/async';
+export { createMiddleware } from 'hono/factory';
 export { getCookie, setCookie } from 'hono/cookie';
 export * as Iron from 'iron-webcrypto';

package/esm/src/Middleware.d.ts

@@ -9,5 +9,5 @@ interface SessionOptions {
     cookieOptions?: CookieOptions;
     sessionCookieName?: string;
 }
-export declare function sessionMiddleware(options: SessionOptions): MiddlewareHandler;
+export declare function sessionMiddleware(options: SessionOptions): MiddlewareHandler<any, any, {}>;
 export {};

package/esm/src/Middleware.js

@@ -1,5 +1,5 @@
 import { nanoid } from '../deps.js';
-import { getCookie, setCookie } from '../deps.js';
+import { getCookie, setCookie, createMiddleware } from '../deps.js';
 import CookieStore from './store/CookieStore.js';
 import { Session, encrypt, decrypt } from '../mod.js';
 export function sessionMiddleware(options) {
@@ -20,7 +20,7 @@ export function sessionMiddleware(options) {
             store.cookieOptions = cookieOptions;
         }
     }
-    const middleware = async (c, next) => {
+    const middleware = createMiddleware(async (c, next) => {
         const session = new Session;
         let sid = '';
         let session_data;
@@ -78,16 +78,40 @@ export function sessionMiddleware(options) {
         session.updateAccess();
         c.set('session', session);
         await next();
-        if (c.get('session_key_rotation') === true && !(store instanceof CookieStore)) {
+        const shouldDelete = session.getCache()._delete;
+        const shouldRotateSessionKey = c.get("session_key_rotation") === true;
+        const storeIsCookieStore = store instanceof CookieStore;
+        if (shouldDelete) {
+            store instanceof CookieStore
+                ? await store.deleteSession(c)
+                : await store.deleteSession(sid);
+        }
+        /*
+         * Only update session data if we didn't just delete it.
+         * If session key rotation is enabled and the store is not a CookieStore,
+         * we need to roate the session key by deleting the old session and creating a new one.
+         */
+        const shouldRecreateSessionForNonCookieStore = !shouldDelete &&
+            !storeIsCookieStore &&
+            shouldRotateSessionKey;
+        if (shouldRecreateSessionForNonCookieStore) {
             await store.deleteSession(sid);
             sid = await nanoid(21);
             await store.createSession(sid, session.getCache());
             setCookie(c, sessionCookieName, encryptionKey ? await encrypt(encryptionKey, sid) : sid, cookieOptions);
         }
-        store instanceof CookieStore ? await store.persistSessionData(c, session.getCache()) : await store.persistSessionData(sid, session.getCache());
-        if (session.getCache()._delete) {
-            store instanceof CookieStore ? await store.deleteSession(c) : await store.deleteSession(sid);
+        /*
+         * We skip session data persistence if it was just deleted.
+         * Only persist if we didn't just rotate the session key,
+         * or the store is a CookieStore (which does not have its session key rotated)
+         */
+        const shouldPersistSession = !shouldDelete &&
+            (!shouldRotateSessionKey || storeIsCookieStore);
+        if (shouldPersistSession) {
+            store instanceof CookieStore
+                ? await store.persistSessionData(c, session.getCache())
+                : await store.persistSessionData(sid, session.getCache());
         }
-    };
+    });
     return middleware;
 }

package/package.json

@@ -2,7 +2,7 @@
   "module": "./esm/mod.js",
   "main": "./script/mod.js",
   "name": "hono-sessions",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Cookie-based sessions for Hono web framework",
   "license": "MIT",
   "repository": {

package/script/deps.d.ts

@@ -1,5 +1,6 @@
 export { nanoid } from 'nanoid/async';
-export type { MiddlewareHandler, Context } from 'hono';
+export type { Context, MiddlewareHandler } from 'hono';
+export { createMiddleware } from 'hono/factory';
 export { getCookie, setCookie } from 'hono/cookie';
 export type { CookieOptions } from 'hono/utils/cookie';
 export * as Iron from 'iron-webcrypto';

package/script/deps.js

@@ -23,9 +23,11 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Iron = exports.setCookie = exports.getCookie = exports.nanoid = void 0;
+exports.Iron = exports.setCookie = exports.getCookie = exports.createMiddleware = exports.nanoid = void 0;
 var async_1 = require("nanoid/async");
 Object.defineProperty(exports, "nanoid", { enumerable: true, get: function () { return async_1.nanoid; } });
+var factory_1 = require("hono/factory");
+Object.defineProperty(exports, "createMiddleware", { enumerable: true, get: function () { return factory_1.createMiddleware; } });
 var cookie_1 = require("hono/cookie");
 Object.defineProperty(exports, "getCookie", { enumerable: true, get: function () { return cookie_1.getCookie; } });
 Object.defineProperty(exports, "setCookie", { enumerable: true, get: function () { return cookie_1.setCookie; } });

package/script/src/Middleware.d.ts

@@ -9,5 +9,5 @@ interface SessionOptions {
     cookieOptions?: CookieOptions;
     sessionCookieName?: string;
 }
-export declare function sessionMiddleware(options: SessionOptions): MiddlewareHandler;
+export declare function sessionMiddleware(options: SessionOptions): MiddlewareHandler<any, any, {}>;
 export {};

package/script/src/Middleware.js

@@ -26,7 +26,7 @@ function sessionMiddleware(options) {
             store.cookieOptions = cookieOptions;
         }
     }
-    const middleware = async (c, next) => {
+    const middleware = (0, deps_js_2.createMiddleware)(async (c, next) => {
         const session = new mod_js_1.Session;
         let sid = '';
         let session_data;
@@ -84,17 +84,41 @@ function sessionMiddleware(options) {
         session.updateAccess();
         c.set('session', session);
         await next();
-        if (c.get('session_key_rotation') === true && !(store instanceof CookieStore_js_1.default)) {
+        const shouldDelete = session.getCache()._delete;
+        const shouldRotateSessionKey = c.get("session_key_rotation") === true;
+        const storeIsCookieStore = store instanceof CookieStore_js_1.default;
+        if (shouldDelete) {
+            store instanceof CookieStore_js_1.default
+                ? await store.deleteSession(c)
+                : await store.deleteSession(sid);
+        }
+        /*
+         * Only update session data if we didn't just delete it.
+         * If session key rotation is enabled and the store is not a CookieStore,
+         * we need to roate the session key by deleting the old session and creating a new one.
+         */
+        const shouldRecreateSessionForNonCookieStore = !shouldDelete &&
+            !storeIsCookieStore &&
+            shouldRotateSessionKey;
+        if (shouldRecreateSessionForNonCookieStore) {
             await store.deleteSession(sid);
             sid = await (0, deps_js_1.nanoid)(21);
             await store.createSession(sid, session.getCache());
             (0, deps_js_2.setCookie)(c, sessionCookieName, encryptionKey ? await (0, mod_js_1.encrypt)(encryptionKey, sid) : sid, cookieOptions);
         }
-        store instanceof CookieStore_js_1.default ? await store.persistSessionData(c, session.getCache()) : await store.persistSessionData(sid, session.getCache());
-        if (session.getCache()._delete) {
-            store instanceof CookieStore_js_1.default ? await store.deleteSession(c) : await store.deleteSession(sid);
+        /*
+         * We skip session data persistence if it was just deleted.
+         * Only persist if we didn't just rotate the session key,
+         * or the store is a CookieStore (which does not have its session key rotated)
+         */
+        const shouldPersistSession = !shouldDelete &&
+            (!shouldRotateSessionKey || storeIsCookieStore);
+        if (shouldPersistSession) {
+            store instanceof CookieStore_js_1.default
+                ? await store.persistSessionData(c, session.getCache())
+                : await store.persistSessionData(sid, session.getCache());
         }
-    };
+    });
     return middleware;
 }
 exports.sessionMiddleware = sessionMiddleware;