lambder 1.0.112 → 1.0.114

package/Readme.md

@@ -5,7 +5,7 @@ Lambder is a highly opinionated dynamic serverless framework designed to facilit
 ## Features
 
 - **Simple API & Route Declaration**: Define your APIs and routes using concise and expressive syntax.
-- **Session Management**: IN PROGRESS: Built-in session management to secure and personalize user experiences.
+- **Session Management**: Built-in session management to secure and personalize user experiences.
 - **Flexible Hooks System**: Employ hooks to execute code at different stages of the request lifecycle, enabling fine-grained control over the application flow.
 - **Error Handling**: Comprehensive error handling capabilities, including global error handlers and route-specific fallbacks.
 - **Seamless Integration**: Designed to work effortlessly with AWS Lambda and API Gateway, providing a straightforward path to deploy serverless applications.
@@ -30,11 +30,21 @@ import * as path from 'path';
 
 const lambder = new Lambder({
     apiPath: "/secure",
-    isCorsEnabled: true,
     publicPath: path.resolve(`./public`),
     // ejsPath: path.resolve(`./ejs-templates`),
 });
 
+
+// Enable session
+lambder.enableDdbSession({
+    tableName: "website-session",
+    tableRegion: "us-east-1",
+    sessionSalt: "8p6Vt+4b1w3N8d/dcJ47QF3DRkp9koFg0G" // Change salt
+});
+
+// Enable Cors
+lambder.setIsCorsEnabled(true);
+
 // Define a simple api
 lambder.addApi("getCompanyPage", async ({ apiPayload }, res) => {
     const companyName = apiPayload.companyName;
@@ -42,6 +52,13 @@ lambder.addApi("getCompanyPage", async ({ apiPayload }, res) => {
     return res.api(data);
 });
 
+// Start a session from an API
+lambder.addApi("loginUser", async (ctx, res) => {
+    const user = await fetchUserData();
+    await lambder.getSessionController(ctx).startSession(user.id);
+    return res.api({ success: true });
+});
+
 // Define a simple route
 lambder.addRoute("/hello-world", (ctx, res) => {
     return res.html("Hello World");
@@ -114,6 +131,29 @@ export const handler = (event, context) => {
 ### Adding APIs
 
 For more details on route matching, please check [path-to-regexp](https://www.npmjs.com/package/path-to-regexp) package.
+```typescript
+// Add routes
+lambder.addRoute(pathAsString, async (ctx, res) => {});
+lambder.addRoute(pathAsRegex, async (ctx, res) => {});
+lambder.addRoute(matchFunction, async (ctx, res) => {});
+
+// Add apis
+lambder.addApi(apiNameAsString, async (ctx, res) => {});
+lambder.addApi(apiNameAsRegex, async (ctx, res) => {});
+lambder.addApi(matchFunction, async (ctx, res) => {});
+
+// Add only session accessible routes
+lambder.addSessionRoute(pathAsString, async (ctx, res) => {});
+lambder.addSessionRoute(pathAsRegex, async (ctx, res) => {});
+lambder.addSessionRoute(matchFunction, async (ctx, res) => {});
+
+// Add only session accessible apis
+lambder.addSessionApi(apiNameAsString, async (ctx, res) => {});
+lambder.addSessionApi(apiNameAsRegex, async (ctx, res) => {});
+lambder.addSessionApi(matchFunction, async (ctx, res) => {});
+
+```
+
 
 ```typescript
 // Define a simple api
@@ -128,6 +168,21 @@ lambder.addApi("getCompanyPage", async (ctx, res) => {
 });
 ```
 
+```typescript
+// Define an only session accessible api
+lambder.addSessionApi("getCompanyPage", async (ctx, res) => {
+    const { 
+        host, path, get, post, cookie, headers, 
+        session, apiName, apiPayload
+    } = ctx;
+    
+    const companyName = session.data.companyName;
+    const data = await fetchDataSomehow(companyName);
+    return res.api(data);
+});
+```
+
+
 
 ### Adding Routes
 ```typescript
@@ -161,6 +216,32 @@ lambder.addModule(async (lambder: Lambder): Promise<void> => {
 });
 ```
 
+### Session Management
+
+```typescript
+lambder.addApi("getCompanyPage", async (ctx, res) => {
+    const sessionController = lambder.getSessionController(ctx);
+    const userId = "37234";
+    await sessionController.startSession(userId, { "business": "Session data goes here"  });
+    console.log(ctx.session?.userKey); // "37234"
+    console.log(ctx.session?.data?.business); // "Session data goes here"
+
+    await sessionController.updateSessionData({ "business2": "Session data updated"  });
+    console.log(ctx.session?.userKey); // "37234"
+    console.log(ctx.session?.data?.business); // undefined
+    console.log(ctx.session?.data?.business2); // "Session data updated"
+    
+    await sessionController.deleteSession(); // End session
+    console.log(ctx.session?.userKey); // undefined
+    console.log(ctx.session?.data?.business); // undefined
+    
+    await sessionController.deleteSessionAll(); // End session for this user in all devices
+    console.log(ctx.session?.userKey); // undefined
+    console.log(ctx.session?.data?.business); // undefined
+
+});
+```
+
 ### EJS Templates: 
 
 EJS templates have the variables `page` and `partial` available:

package/dist/Lambder.d.ts

@@ -49,9 +49,8 @@ export default class Lambder {
         apiPath?: string;
         ejsPath?: string;
         apiVersion?: string;
-        isCorsEnabled?: boolean;
     });
-    enableCORS(isCorsEnabled: boolean): void;
+    setIsCorsEnabled(isCorsEnabled: boolean): void;
     enableDdbSession({ tableName, tableRegion, sessionSalt }: {
         tableName: string;
         tableRegion: string;
@@ -84,7 +83,7 @@ export default class Lambder {
     addHook(hookEvent: 'fallback', hookFn: HookFallbackFunction, priority?: number): Promise<void>;
     getSessionController(ctx: LambderRenderContext): {
         startSession: (userKey: string, data?: any, ttlInSeconds?: number) => Promise<LambderSessionContext>;
-        editSession: (newData: any) => Promise<LambderSessionContext>;
+        updateSessionData: (newData: any) => Promise<LambderSessionContext>;
         deleteSession: () => Promise<void>;
         deleteSessionAll: () => Promise<void>;
     };

package/dist/Lambder.js

@@ -60,7 +60,7 @@ export default class Lambder {
         };
         this.utils = new LambderUtils({ ejsPath });
     }
-    enableCORS(isCorsEnabled) {
+    setIsCorsEnabled(isCorsEnabled) {
         this.isCorsEnabled = isCorsEnabled;
     }
     enableDdbSession({ tableName, tableRegion, sessionSalt }, { partitionKey, sortKey } = { partitionKey: "pk", sortKey: "sk" }) {
@@ -221,12 +221,12 @@ export default class Lambder {
                 ctx.session = await this.lambderSession.createSession(userKey, data, ttlInSeconds);
                 return ctx.session;
             },
-            editSession: async (newData) => {
+            updateSessionData: async (newData) => {
                 if (!this.lambderSession)
                     throw "Session is not enabled. Use lambder.enableDdbSession(...) to configure.";
                 if (!ctx.session)
                     throw "Session not found.";
-                ctx.session = await this.lambderSession.editSession(ctx.session, newData);
+                ctx.session = await this.lambderSession.updateSessionData(ctx.session, newData);
                 return ctx.session;
             },
             deleteSession: async () => {
@@ -303,7 +303,7 @@ export default class Lambder {
                                 response.multiValueHeaders = {
                                     ...(response.multiValueHeaders || {}),
                                     "Set-Cookie": [
-                                        `${this.sessionTokenCookieKey}=${ctx.session.sessionToken}; Expires=${new Date(ctx.session.expiresAt * 1000).toUTCString()}; Path=/; SameSite=Lax; Secure`,
+                                        `${this.sessionTokenCookieKey}=${ctx.session.sessionToken}; Expires=${new Date(ctx.session.expiresAt * 1000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure`,
                                         `${this.sessionCsrfCookieKey}=${ctx.session.csrfToken}; Expires=${new Date(ctx.session.expiresAt * 1000).toUTCString()}; Path=/; SameSite=Lax; Secure`,
                                     ],
                                 };
@@ -313,7 +313,7 @@ export default class Lambder {
                                 response.multiValueHeaders = {
                                     ...(response.multiValueHeaders || {}),
                                     "Set-Cookie": [
-                                        `${this.sessionTokenCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; SameSite=Lax; Secure`,
+                                        `${this.sessionTokenCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure`,
                                         `${this.sessionCsrfCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; SameSite=Lax; Secure`,
                                     ],
                                 };

package/dist/LambderCaller.d.ts

@@ -35,10 +35,12 @@ export default class LambderCaller {
     private errorHandler?;
     private fetchStartedHandler?;
     private fetchEndedHandler?;
-    constructor({ isCorsEnabled, apiPath, apiVersion, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, }: {
-        isCorsEnabled: boolean;
+    private sessionTokenCookieKey;
+    private sessionCsrfCookieKey;
+    constructor({ apiPath, apiVersion, isCorsEnabled, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, }: {
         apiPath: string;
         apiVersion?: string;
+        isCorsEnabled: boolean;
         versionExpiredHandler?: VoidFunction;
         sessionExpiredHandler?: VoidFunction;
         messageHandler?: MessageHandler;
@@ -48,6 +50,7 @@ export default class LambderCaller {
         fetchStartedHandler?: FetchStartEventHandler;
         fetchEndedHandler?: FetchEndEventHandler;
     });
+    setSessionCookieKey(sessionTokenCookieKey: string, sessionCsrfCookieKey: string): void;
     apiRaw<T = any>(apiName: string, payload?: any, options?: {
         headers?: Record<string, any>;
         versionExpiredHandler?: VoidFunction;

package/dist/LambderCaller.js

@@ -13,10 +13,12 @@ export default class LambderCaller {
     errorHandler;
     fetchStartedHandler;
     fetchEndedHandler;
-    constructor({ isCorsEnabled = false, apiPath, apiVersion, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, }) {
-        this.isCorsEnabled = isCorsEnabled;
+    sessionTokenCookieKey = "LMDRSESSIONTKID";
+    sessionCsrfCookieKey = "LMDRSESSIONCSTK";
+    constructor({ apiPath, apiVersion, isCorsEnabled = false, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, }) {
         this.apiPath = apiPath ?? "/api";
         this.apiVersion = apiVersion;
+        this.isCorsEnabled = isCorsEnabled;
         this.versionExpiredHandler = versionExpiredHandler;
         this.sessionExpiredHandler = sessionExpiredHandler;
         this.messageHandler = messageHandler;
@@ -27,6 +29,10 @@ export default class LambderCaller {
         this.fetchEndedHandler = fetchEndedHandler;
     }
     ;
+    setSessionCookieKey(sessionTokenCookieKey, sessionCsrfCookieKey) {
+        this.sessionTokenCookieKey = sessionTokenCookieKey;
+        this.sessionCsrfCookieKey = sessionCsrfCookieKey;
+    }
     async apiRaw(apiName, payload, options) {
         const headers = options?.headers;
         const fetchTracker = { apiName, done: false, fetchEndCalled: false };
@@ -38,7 +44,7 @@ export default class LambderCaller {
                     activeFetchList: this.fetchTrackerList.filter(v => !v.done)
                 });
             const version = this.apiVersion;
-            const token = Cookies.get("LMDRSESSIONCSTK") || "";
+            const token = Cookies.get(this.sessionCsrfCookieKey) || "";
             const siteHost = window.location.hostname;
             let data = await fetch(this.apiPath, {
                 method: 'POST', mode: 'same-origin', cache: 'no-cache',
@@ -69,8 +75,8 @@ export default class LambderCaller {
                 return null;
             }
             if (data && data.sessionExpired) {
-                Cookies.set('LMBDRAUTHID', '', { expires: -1 });
-                Cookies.set('LMBDRTOKEN', '', { expires: -1 });
+                Cookies.set(this.sessionTokenCookieKey, '', { expires: -1 });
+                Cookies.set(this.sessionCsrfCookieKey, '', { expires: -1 });
                 if (this.sessionExpiredHandler) {
                     await this.sessionExpiredHandler();
                 }

package/dist/LambderSession.d.ts

@@ -28,7 +28,7 @@ export default class LambderSession {
     private ddbQueryAllByPartitionKey;
     private ddbDeleteAllByPartitionKey;
     createSession(userKey: string, data?: any, ttlInSeconds?: number): Promise<LambderSessionContext>;
-    editSession(session: LambderSessionContext, newData?: any): Promise<LambderSessionContext>;
+    updateSessionData(session: LambderSessionContext, newData?: any): Promise<LambderSessionContext>;
     getSession(sessionToken: string): Promise<LambderSessionContext | null>;
     isSessionValid(session: any, sessionToken: any, csrfToken: any, skipCsrfTokenCheck?: boolean): boolean;
     deleteSession(session: Record<string, any>): Promise<boolean>;

package/dist/LambderSession.js

@@ -80,7 +80,7 @@ export default class LambderSession {
         await this.ddbPutItem(session);
         return session;
     }
-    async editSession(session, newData) {
+    async updateSessionData(session, newData) {
         if (!session)
             throw "Invalid session";
         session.data = newData;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "1.0.112",
+  "version": "1.0.114",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/Lambder.ts

@@ -96,7 +96,7 @@ export default class Lambder {
     
     constructor(
         { publicPath, apiPath, ejsPath, apiVersion }: 
-        { publicPath: string, apiPath?: string, ejsPath?: string, apiVersion?: string, isCorsEnabled?: boolean, }
+        { publicPath: string, apiPath?: string, ejsPath?: string, apiVersion?: string }
     ){
         this.publicPath = publicPath || "/incorrect-path-not-found";
         this.ejsPath = ejsPath || "/incorrect-ejs-path-not-found";
@@ -113,7 +113,7 @@ export default class Lambder {
         this.utils = new LambderUtils({ ejsPath });
     }
 
-    enableCORS(isCorsEnabled: boolean){
+    setIsCorsEnabled(isCorsEnabled: boolean){
         this.isCorsEnabled = isCorsEnabled;
     }
 
@@ -295,10 +295,10 @@ export default class Lambder {
                 ctx.session = await this.lambderSession.createSession(userKey, data, ttlInSeconds);
                 return ctx.session;
             },
-            editSession: async (newData: any): Promise<LambderSessionContext> => {
+            updateSessionData: async (newData: any): Promise<LambderSessionContext> => {
                 if(!this.lambderSession) throw "Session is not enabled. Use lambder.enableDdbSession(...) to configure.";
                 if(!ctx.session) throw "Session not found.";
-                ctx.session = await this.lambderSession.editSession(ctx.session, newData);
+                ctx.session = await this.lambderSession.updateSessionData(ctx.session, newData);
                 return ctx.session;
             },
             deleteSession: async () => {
@@ -377,7 +377,7 @@ export default class Lambder {
                                 response.multiValueHeaders = {
                                     ...(response.multiValueHeaders || {}),
                                     "Set-Cookie": [
-                                        `${this.sessionTokenCookieKey}=${ctx.session.sessionToken}; Expires=${new Date(ctx.session.expiresAt * 1000).toUTCString()}; Path=/; SameSite=Lax; Secure`,
+                                        `${this.sessionTokenCookieKey}=${ctx.session.sessionToken}; Expires=${new Date(ctx.session.expiresAt * 1000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure`,
                                         `${this.sessionCsrfCookieKey}=${ctx.session.csrfToken}; Expires=${new Date(ctx.session.expiresAt * 1000).toUTCString()}; Path=/; SameSite=Lax; Secure`,
                                     ],
                                 };
@@ -386,7 +386,7 @@ export default class Lambder {
                                 response.multiValueHeaders = {
                                     ...(response.multiValueHeaders || {}),
                                     "Set-Cookie": [
-                                        `${this.sessionTokenCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; SameSite=Lax; Secure`,
+                                        `${this.sessionTokenCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure`,
                                         `${this.sessionCsrfCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; SameSite=Lax; Secure`,
                                     ],
                                 };

package/src/LambderCaller.ts

@@ -42,18 +42,22 @@ export default class LambderCaller {
     private fetchStartedHandler?: FetchStartEventHandler;
     private fetchEndedHandler?: FetchEndEventHandler;
 
+    private sessionTokenCookieKey = "LMDRSESSIONTKID";
+    private sessionCsrfCookieKey = "LMDRSESSIONCSTK";
+
     constructor(
         { 
-            isCorsEnabled = false, apiPath, apiVersion, 
+            apiPath, apiVersion, 
+            isCorsEnabled = false, 
             versionExpiredHandler, sessionExpiredHandler, 
             messageHandler, errorMessageHandler,
             notAuthorizedHandler, errorHandler,
             fetchStartedHandler, fetchEndedHandler,
         }: 
         { 
-            isCorsEnabled: boolean, 
             apiPath: string,
             apiVersion?: string,
+            isCorsEnabled: boolean, 
             versionExpiredHandler?: VoidFunction, 
             sessionExpiredHandler?: VoidFunction, 
             messageHandler?: MessageHandler,
@@ -64,9 +68,9 @@ export default class LambderCaller {
             fetchEndedHandler?: FetchEndEventHandler,
         }
     ){
-        this.isCorsEnabled = isCorsEnabled;
         this.apiPath = apiPath ?? "/api";
         this.apiVersion = apiVersion;
+        this.isCorsEnabled = isCorsEnabled;
 
         this.versionExpiredHandler = versionExpiredHandler;
         this.sessionExpiredHandler = sessionExpiredHandler;
@@ -81,6 +85,11 @@ export default class LambderCaller {
 
     };
 
+    setSessionCookieKey(sessionTokenCookieKey: string, sessionCsrfCookieKey: string){
+        this.sessionTokenCookieKey = sessionTokenCookieKey;
+        this.sessionCsrfCookieKey = sessionCsrfCookieKey;
+    }
+    
     async apiRaw<T=any>(apiName: string, payload?: any, options?: {
         headers?: Record<string, any>
         versionExpiredHandler?: VoidFunction, 
@@ -101,7 +110,7 @@ export default class LambderCaller {
                 activeFetchList: this.fetchTrackerList.filter(v=>!v.done)
             });
             const version = this.apiVersion;
-            const token = Cookies.get("LMDRSESSIONCSTK") || "";
+            const token = Cookies.get(this.sessionCsrfCookieKey) || "";
             const siteHost = window.location.hostname;
             let data = await fetch(this.apiPath, {
                 method: 'POST', mode: 'same-origin', cache: 'no-cache',
@@ -130,8 +139,8 @@ export default class LambderCaller {
                 return null;
             }
             if(data && data.sessionExpired){ 
-                Cookies.set('LMBDRAUTHID', '', { expires: -1 });
-                Cookies.set('LMBDRTOKEN', '', { expires: -1 });
+                Cookies.set(this.sessionTokenCookieKey, '', { expires: -1 });
+                Cookies.set(this.sessionCsrfCookieKey, '', { expires: -1 });
                 if(this.sessionExpiredHandler){
                     await this.sessionExpiredHandler();
                 }else if(this.errorHandler){

package/src/LambderSession.ts

@@ -116,7 +116,7 @@ export default class LambderSession{
         return session;
     }
 
-    public async editSession(
+    public async updateSessionData(
         session: LambderSessionContext,
         newData?: any
     ): Promise<LambderSessionContext> {