jcc-express-mvc 1.8.7 → 1.8.21

package/lib/Security/CsrfMiddleware.js

@@ -0,0 +1,85 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.csrf = csrf;
+const crypto_1 = __importDefault(require("crypto"));
+const MissMatchTokenException_1 = require("../Error/MissMatchTokenException");
+const UNSAFE_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function generateToken(length) {
+    return crypto_1.default.randomBytes(length).toString("hex");
+}
+function isExcluded(path, except) {
+    for (const pattern of except) {
+        if (typeof pattern === "string") {
+            if (path === pattern || path.startsWith(pattern + "/"))
+                return true;
+        }
+        else if (pattern.test(path)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * CSRF protection middleware.
+ *
+ * Generates a per-session token and validates it on unsafe HTTP methods.
+ * The token is available via:
+ *   - `req.csrfToken()` (programmatic)
+ *   - `res.locals._token` (for templates / @csrf directive)
+ *
+ * Usage in Kernel:
+ * ```ts
+ * import { csrf } from "../../jcc-express-mvc";
+ * export class Kernel {
+ *   public middlewares = [
+ *     // ...session, cookieParser, etc.
+ *     csrf(),                // default options
+ *     csrf({ except: ["/webhooks"] }),  // with exclusions
+ *   ];
+ * }
+ * ```
+ */
+function csrf(options = {}) {
+    const { except = [], sessionKey = "_csrf_token", fieldName = "_token", headerName = "x-csrf-token", tokenLength = 32, skipApi = true, } = options;
+    return (req, res, next) => {
+        const session = req.session;
+        if (!session) {
+            console.warn("[CSRF] No session found – make sure express-session is registered before csrf().");
+            return next();
+        }
+        // Ensure a token exists in the session
+        if (!session[sessionKey]) {
+            session[sessionKey] = generateToken(tokenLength);
+        }
+        const token = session[sessionKey];
+        // Expose token to templates and programmatically
+        res.locals._token = token;
+        req.csrfToken = () => token;
+        // Read-safe methods pass through
+        if (!UNSAFE_METHODS.has(req.method.toUpperCase()))
+            return next();
+        // Skip API routes
+        if (skipApi && req.path.startsWith("/api"))
+            return next();
+        // Check exclusions
+        if (isExcluded(req.path, except))
+            return next();
+        // Validate token
+        const submitted = req.body?.[fieldName] ||
+            req.headers[headerName] ||
+            req.headers[headerName.toLowerCase()];
+        if (!submitted) {
+            throw new MissMatchTokenException_1.MissMatchTokenException("CSRF token mismatch.");
+        }
+        const submittedBuf = Buffer.from(String(submitted), "utf8");
+        const tokenBuf = Buffer.from(token, "utf8");
+        if (submittedBuf.length !== tokenBuf.length ||
+            !crypto_1.default.timingSafeEqual(submittedBuf, tokenBuf)) {
+            throw new MissMatchTokenException_1.MissMatchTokenException("CSRF token mismatch.");
+        }
+        next();
+    };
+}

package/lib/Security/MethodSpoofingMiddleware.d.ts

@@ -0,0 +1,36 @@
+import { AppNext, AppRequest, AppResponse } from "../Interface";
+export interface MethodSpoofingOptions {
+    /** Form field name that contains the spoofed method. Default: "_method" */
+    fieldName?: string;
+    /** Also check the X-HTTP-Method-Override header. Default: true */
+    checkHeader?: boolean;
+}
+/**
+ * Method spoofing middleware.
+ *
+ * HTML forms only support GET and POST. This middleware allows overriding
+ * the HTTP method via a hidden `_method` form field or the
+ * `X-HTTP-Method-Override` header.
+ *
+ * Usage in Kernel:
+ * ```ts
+ * import { methodSpoofing } from "../../jcc-express-mvc";
+ * export class Kernel {
+ *   public middlewares = [
+ *     // ...
+ *     methodSpoofing(),
+ *   ];
+ * }
+ * ```
+ *
+ * In a Blade template:
+ * ```html
+ * <form method="POST" action="/users/1">
+ *   @csrf
+ *   @method('DELETE')
+ *   <button type="submit">Delete</button>
+ * </form>
+ * ```
+ */
+export declare function methodSpoofing(options?: MethodSpoofingOptions): (req: AppRequest, _res: AppResponse, next: AppNext) => void;
+//# sourceMappingURL=MethodSpoofingMiddleware.d.ts.map

package/lib/Security/MethodSpoofingMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MethodSpoofingMiddleware.d.ts","sourceRoot":"","sources":["../../../jcc-express-mvc/lib/Security/MethodSpoofingMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,qBAA0B,IAGxD,KAAK,UAAU,EAAE,MAAM,WAAW,EAAE,MAAM,OAAO,UAoB1D"}

package/lib/Security/MethodSpoofingMiddleware.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.methodSpoofing = methodSpoofing;
+const ALLOWED_METHODS = new Set(["PUT", "PATCH", "DELETE"]);
+/**
+ * Method spoofing middleware.
+ *
+ * HTML forms only support GET and POST. This middleware allows overriding
+ * the HTTP method via a hidden `_method` form field or the
+ * `X-HTTP-Method-Override` header.
+ *
+ * Usage in Kernel:
+ * ```ts
+ * import { methodSpoofing } from "../../jcc-express-mvc";
+ * export class Kernel {
+ *   public middlewares = [
+ *     // ...
+ *     methodSpoofing(),
+ *   ];
+ * }
+ * ```
+ *
+ * In a Blade template:
+ * ```html
+ * <form method="POST" action="/users/1">
+ *   @csrf
+ *   @method('DELETE')
+ *   <button type="submit">Delete</button>
+ * </form>
+ * ```
+ */
+function methodSpoofing(options = {}) {
+    const { fieldName = "_method", checkHeader = true } = options;
+    return (req, _res, next) => {
+        if (req.method.toUpperCase() !== "POST")
+            return next();
+        const override = req.body?.[fieldName] ||
+            (checkHeader && req.headers["x-http-method-override"]);
+        if (override) {
+            const method = String(override).toUpperCase();
+            if (ALLOWED_METHODS.has(method)) {
+                req.method = method;
+                // Clean up the _method field so it doesn't leak into controller data
+                if (req.body?.[fieldName]) {
+                    delete req.body[fieldName];
+                }
+            }
+        }
+        next();
+    };
+}

package/lib/Security/index.d.ts

@@ -0,0 +1,5 @@
+export { csrf } from "./CsrfMiddleware";
+export type { CsrfOptions } from "./CsrfMiddleware";
+export { methodSpoofing } from "./MethodSpoofingMiddleware";
+export type { MethodSpoofingOptions } from "./MethodSpoofingMiddleware";
+//# sourceMappingURL=index.d.ts.map

package/lib/Security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../jcc-express-mvc/lib/Security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC"}

package/lib/Security/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.methodSpoofing = exports.csrf = void 0;
+var CsrfMiddleware_1 = require("./CsrfMiddleware");
+Object.defineProperty(exports, "csrf", { enumerable: true, get: function () { return CsrfMiddleware_1.csrf; } });
+var MethodSpoofingMiddleware_1 = require("./MethodSpoofingMiddleware");
+Object.defineProperty(exports, "methodSpoofing", { enumerable: true, get: function () { return MethodSpoofingMiddleware_1.methodSpoofing; } });

package/lib/Session/DatabaseSession.d.ts

@@ -1,11 +1,17 @@
 import { SessionData, SessionStore } from "../Interface";
+/**
+ * Database session store (Laravel-style `sessions` table).
+ * Requires Jcc-eloquent / Knex (`DB`) to be configured. Not for Sequelize-only apps.
+ *
+ * Expected columns: `id` (varchar, session id), `payload` (longtext), `last_activity` (int, unix).
+ */
 export declare class DatabaseSessionStore implements SessionStore {
-    private tableName;
-    createTable(): Promise<void>;
+    private readonly tableName;
+    constructor(tableName?: string);
     get(sessionId: string): Promise<SessionData | null>;
     set(sessionId: string, data: SessionData, maxAge?: number): Promise<void>;
     destroy(sessionId: string): Promise<void>;
     touch(sessionId: string, maxAge?: number): Promise<void>;
-    clear(): Promise<any>;
+    clear(): Promise<void>;
 }
 //# sourceMappingURL=DatabaseSession.d.ts.map

package/lib/Session/DatabaseSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DatabaseSession.d.ts","sourceRoot":"","sources":["../../../jcc-express-mvc/lib/Session/DatabaseSession.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEzD,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,SAAS,CAAsB;IAE1B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBnC,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAcnD,GAAG,CACP,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAcV,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxD,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC;CAO5B"}
+{"version":3,"file":"DatabaseSession.d.ts","sourceRoot":"","sources":["../../../jcc-express-mvc/lib/Session/DatabaseSession.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,GAAE,MAAmB;IAErD,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAenD,GAAG,CACP,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IA2BV,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAO7B"}

package/lib/Session/DatabaseSession.js

@@ -2,36 +2,25 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DatabaseSessionStore = void 0;
 const Jcc_eloquent_1 = require("../Jcc-eloquent");
+/**
+ * Database session store (Laravel-style `sessions` table).
+ * Requires Jcc-eloquent / Knex (`DB`) to be configured. Not for Sequelize-only apps.
+ *
+ * Expected columns: `id` (varchar, session id), `payload` (longtext), `last_activity` (int, unix).
+ */
 class DatabaseSessionStore {
-    constructor() {
-        this.tableName = "sessions";
-    }
-    async createTable() {
-        const sqlQuery = Jcc_eloquent_1.Schema.create("sessions", function (table) {
-            table.id();
-            table.string("uuid");
-            table.foreignId("user_id").nullable().index();
-            table.string("ip_address", 45).nullable();
-            table.text("user_agent").nullable();
-            table.text("payload");
-            table.integer("last_activity").index();
-            table.timestamps();
-        });
-        try {
-            await Jcc_eloquent_1.DB.runQuery(sqlQuery);
-        }
-        catch (error) {
-            console.error("Failed to create sessions table:", error);
-        }
+    constructor(tableName = "sessions") {
+        this.tableName = tableName;
     }
     async get(sessionId) {
         try {
-            const result = (await Jcc_eloquent_1.DB.table(this.tableName)
+            const row = (await Jcc_eloquent_1.DB.table(this.tableName)
                 .select("payload")
-                .where("uuid", sessionId)
-                .where("expires", ">", Date.now())
+                .where("id", sessionId)
                 .first());
-            return JSON.parse(result?.payload);
+            if (!row?.payload)
+                return null;
+            return JSON.parse(row.payload);
         }
         catch (error) {
             console.error("Failed to get session from database:", error);
@@ -40,13 +29,25 @@ class DatabaseSessionStore {
     }
     async set(sessionId, data, maxAge) {
         try {
-            const expires = maxAge ? Date.now() + maxAge : null;
-            const payload = {
-                data: JSON.stringify(data),
-                expires,
-                uuid: sessionId,
-            };
-            await Jcc_eloquent_1.DB.table(this.tableName).insert(payload);
+            const payload = JSON.stringify(data);
+            const lastActivity = Math.floor(Date.now() / 1000);
+            const existing = await Jcc_eloquent_1.DB.table(this.tableName)
+                .where("id", sessionId)
+                .first();
+            if (existing) {
+                await Jcc_eloquent_1.DB.table(this.tableName).where("id", sessionId).update({
+                    payload,
+                    last_activity: lastActivity,
+                });
+            }
+            else {
+                await Jcc_eloquent_1.DB.table(this.tableName).insert({
+                    id: sessionId,
+                    payload,
+                    last_activity: lastActivity,
+                });
+            }
+            void maxAge;
         }
         catch (error) {
             console.error("Failed to set session in database:", error);
@@ -54,7 +55,7 @@ class DatabaseSessionStore {
     }
     async destroy(sessionId) {
         try {
-            await Jcc_eloquent_1.DB.table(this.tableName).where("uuid", sessionId).delete();
+            await Jcc_eloquent_1.DB.table(this.tableName).where("id", sessionId).delete();
         }
         catch (error) {
             console.error("Failed to destroy session in database:", error);
@@ -62,10 +63,11 @@ class DatabaseSessionStore {
     }
     async touch(sessionId, maxAge) {
         try {
-            const expires = maxAge ? Date.now() + maxAge : null;
+            const lastActivity = Math.floor(Date.now() / 1000);
             await Jcc_eloquent_1.DB.table(this.tableName)
-                .where("uuid", sessionId)
-                .update({ expires });
+                .where("id", sessionId)
+                .update({ last_activity: lastActivity });
+            void maxAge;
         }
         catch (error) {
             console.error("Failed to touch session in database:", error);
@@ -73,7 +75,7 @@ class DatabaseSessionStore {
     }
     async clear() {
         try {
-            return Jcc_eloquent_1.DB.table(this.tableName).delete();
+            await Jcc_eloquent_1.DB.table(this.tableName).delete();
         }
         catch (error) {
             console.error("Failed to clear sessions from database:", error);

package/lib/Session/ExpressJccSession.d.ts

@@ -0,0 +1,23 @@
+import type { AppRequest } from "../Interface";
+import type { SessionData } from "../Interface";
+import type { Session } from "./index";
+export declare class ExpressJccSession {
+    private readonly req;
+    constructor(req: AppRequest);
+    flash(key: string, value: any): void;
+    getFlash(key: string, defaultValue?: any): any;
+    get(key: string, defaultValue?: any): any;
+    put(key: string, value: any): void;
+    has(key: string): boolean;
+    forget(key: string): void;
+    all(): SessionData;
+    only(keys: string[]): SessionData;
+    except(keys: string[]): SessionData;
+    flush(): void;
+    load(): Promise<void>;
+    save(): Promise<void>;
+    regenerate(): Promise<void>;
+    getId(): string;
+}
+export declare function createExpressJccSession(req: AppRequest): Session;
+//# sourceMappingURL=ExpressJccSession.d.ts.map

package/lib/Session/ExpressJccSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExpressJccSession.d.ts","sourceRoot":"","sources":["../../../jcc-express-mvc/lib/Session/ExpressJccSession.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAWvC,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,UAAU;IAE5C,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI;IAIpC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,GAAG,GAAG,GAAG;IAO9C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,GAAG,GAAG,GAAG;IAOzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI;IAMlC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAKzB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKzB,GAAG,IAAI,WAAW;IAKlB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,WAAW;IAQjC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,WAAW;IAUnC,KAAK,IAAI,IAAI;IASP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQrB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAUjC,KAAK,IAAI,MAAM;CAGhB;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEhE"}

package/lib/Session/ExpressJccSession.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExpressJccSession = void 0;
+exports.createExpressJccSession = createExpressJccSession;
+/**
+ * Bridges `req.jccSession` to the same underlying store as `express-session` +
+ * `connect-flash`, so flash messages set via `res.with()` or `req.flash()` stay
+ * in sync with `jccSession.flash()` / `getFlash()`.
+ */
+function sessionRecord(req) {
+    return req.session;
+}
+class ExpressJccSession {
+    constructor(req) {
+        this.req = req;
+    }
+    flash(key, value) {
+        this.req.flash(key, value);
+    }
+    getFlash(key, defaultValue) {
+        const raw = this.req.flash(key);
+        if (raw === undefined || raw === null)
+            return defaultValue;
+        if (Array.isArray(raw))
+            return raw.length ? raw[0] : defaultValue;
+        return raw;
+    }
+    get(key, defaultValue) {
+        const s = sessionRecord(this.req);
+        if (!s)
+            return defaultValue;
+        const v = s[key];
+        return v !== undefined ? v : defaultValue;
+    }
+    put(key, value) {
+        const s = sessionRecord(this.req);
+        if (!s)
+            return;
+        s[key] = value;
+    }
+    has(key) {
+        const s = sessionRecord(this.req);
+        return s != null && s[key] !== undefined;
+    }
+    forget(key) {
+        const s = sessionRecord(this.req);
+        if (s && key in s)
+            delete s[key];
+    }
+    all() {
+        const s = sessionRecord(this.req);
+        return s ? { ...s } : {};
+    }
+    only(keys) {
+        const out = {};
+        for (const key of keys) {
+            if (this.has(key))
+                out[key] = this.get(key);
+        }
+        return out;
+    }
+    except(keys) {
+        const full = this.all();
+        const skip = new Set(keys);
+        const out = {};
+        for (const k of Object.keys(full)) {
+            if (!skip.has(k))
+                out[k] = full[k];
+        }
+        return out;
+    }
+    flush() {
+        const s = sessionRecord(this.req);
+        if (!s)
+            return;
+        const keep = new Set(["cookie"]);
+        for (const k of Object.keys(s)) {
+            if (!keep.has(k))
+                delete s[k];
+        }
+    }
+    async load() {
+        /* express-session already populated req.session */
+    }
+    async save() {
+        return new Promise((resolve, reject) => {
+            const s = this.req.session;
+            if (s?.save)
+                s.save((err) => (err ? reject(err) : resolve()));
+            else
+                resolve();
+        });
+    }
+    async regenerate() {
+        return new Promise((resolve, reject) => {
+            const s = this.req.session;
+            if (s?.regenerate)
+                s.regenerate((err) => (err ? reject(err) : resolve()));
+            else
+                resolve();
+        });
+    }
+    getId() {
+        return this.req.sessionID ?? "";
+    }
+}
+exports.ExpressJccSession = ExpressJccSession;
+function createExpressJccSession(req) {
+    return new ExpressJccSession(req);
+}

package/lib/Session/RedisSession.d.ts

@@ -1,7 +1,7 @@
 import { SessionData, SessionStore } from "../Interface";
 export declare class RedisSessionStore implements SessionStore {
-    private client;
-    private prefix;
+    private readonly client;
+    private readonly prefix;
     constructor(redisUrl: string, prefix?: string);
     private getKey;
     get(sessionId: string): Promise<SessionData | null>;

package/lib/Session/RedisSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RedisSession.d.ts","sourceRoot":"","sources":["../../../jcc-express-mvc/lib/Session/RedisSession.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEzD,qBAAa,iBAAkB,YAAW,YAAY;IACpD,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,MAAM,CAAS;gBAEX,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAE,MAAmB;IAMzD,OAAO,CAAC,MAAM;IAIR,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAgBnD,GAAG,CACP,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAeV,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAU7B"}
+{"version":3,"file":"RedisSession.d.ts","sourceRoot":"","sources":["../../../jcc-express-mvc/lib/Session/RedisSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA6BzD,qBAAa,iBAAkB,YAAW,YAAY;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAE,MAAmB;IAOzD,OAAO,CAAC,MAAM;IAIR,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAgBnD,GAAG,CACP,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAeV,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAU7B"}

package/lib/Session/RedisSession.js

@@ -1,12 +1,26 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RedisSessionStore = void 0;
-const redis_1 = require("redis");
+function loadRedisCreateClient() {
+    try {
+        // Optional peer dependency — only required when SESSION_DRIVER=redis
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const redis = require("redis");
+        if (typeof redis.createClient !== "function") {
+            throw new Error("invalid redis module");
+        }
+        return redis.createClient;
+    }
+    catch {
+        throw new Error('Session driver "redis" needs the optional package: npm install redis');
+    }
+}
 class RedisSessionStore {
     constructor(redisUrl, prefix = "session:") {
-        this.client = (0, redis_1.createClient)({ url: redisUrl });
+        const createClient = loadRedisCreateClient();
+        this.client = createClient({ url: redisUrl });
         this.prefix = prefix;
-        this.client.connect();
+        void this.client.connect();
     }
     getKey(sessionId) {
         return `${this.prefix}${sessionId}`;
@@ -46,7 +60,7 @@ class RedisSessionStore {
             await this.client.del(key);
         }
         catch (error) {
-            console.error("Failed to destroy session in Redis:", error);
+            console.error("Failed to destroy session from Redis:", error);
         }
     }
     async touch(sessionId, maxAge) {
@@ -64,7 +78,7 @@ class RedisSessionStore {
         try {
             const keys = await this.client.keys(`${this.prefix}*`);
             if (keys.length > 0) {
-                await this.client.del(keys);
+                await this.client.del(...keys);
             }
         }
         catch (error) {

package/lib/Session/SessionManager.d.ts

@@ -1,12 +1,26 @@
+import type { RequestHandler } from "express";
 import { Session } from "./index";
 import { SessionConfig } from "../Interface";
+/**
+ * Laravel-style session manager: resolves a store by `driver` and exposes
+ * `express-session` middleware backed by that store.
+ */
 export declare class SessionManager {
-    private config;
-    private store;
+    private readonly store;
+    private readonly expressStore;
+    private readonly config;
     constructor(config: SessionConfig);
+    getConfig(): SessionConfig;
     private createStore;
-    getExpressMiddleware(): import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
-    private createExpressStore;
+    static buildRedisUrl(r: NonNullable<SessionConfig["redis"]>): string;
+    /**
+     * `express-session` middleware using the configured driver store.
+     */
+    getExpressMiddleware(): RequestHandler;
+    private buildExpressStore;
+    /**
+     * Optional: standalone {@link Session} instances backed by the same store (advanced use).
+     */
     createSession(sessionId: string): Promise<Session>;
 }
 //# sourceMappingURL=SessionManager.d.ts.map

package/lib/Session/SessionManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../../jcc-express-mvc/lib/Session/SessionManager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,aAAa,EAAgB,MAAM,cAAc,CAAC;AAK3D,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,KAAK,CAAe;gBAEhB,MAAM,EAAE,aAAa;IAKjC,OAAO,CAAC,WAAW;IAgBnB,oBAAoB;IAcpB,OAAO,CAAC,kBAAkB;IAqDpB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CASzD"}
+{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../../jcc-express-mvc/lib/Session/SessionManager.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,aAAa,EAA6B,MAAM,cAAc,CAAC;AAIxE;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;gBAE3B,MAAM,EAAE,aAAa;IAMjC,SAAS,IAAI,aAAa;IAI1B,OAAO,CAAC,WAAW;IA0BnB,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM;IAUpE;;OAEG;IACH,oBAAoB,IAAI,cAAc;IAqBtC,OAAO,CAAC,iBAAiB;IAsDzB;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAKzD"}