lambder 1.0.113 → 1.0.115

package/Readme.md

@@ -5,7 +5,7 @@ Lambder is a highly opinionated dynamic serverless framework designed to facilit
 ## Features
 
 - **Simple API & Route Declaration**: Define your APIs and routes using concise and expressive syntax.
-- **Session Management**: IN PROGRESS: Built-in session management to secure and personalize user experiences.
+- **Session Management**: Built-in session management to secure and personalize user experiences.
 - **Flexible Hooks System**: Employ hooks to execute code at different stages of the request lifecycle, enabling fine-grained control over the application flow.
 - **Error Handling**: Comprehensive error handling capabilities, including global error handlers and route-specific fallbacks.
 - **Seamless Integration**: Designed to work effortlessly with AWS Lambda and API Gateway, providing a straightforward path to deploy serverless applications.
@@ -30,11 +30,21 @@ import * as path from 'path';
 
 const lambder = new Lambder({
     apiPath: "/secure",
-    isCorsEnabled: true,
     publicPath: path.resolve(`./public`),
     // ejsPath: path.resolve(`./ejs-templates`),
 });
 
+
+// Enable session
+lambder.enableDdbSession({
+    tableName: "website-session",
+    tableRegion: "us-east-1",
+    sessionSalt: "8p6Vt+4b1w3N8d/dcJ47QF3DRkp9koFg0G" // Change salt
+});
+
+// Enable Cors
+lambder.setIsCorsEnabled(true);
+
 // Define a simple api
 lambder.addApi("getCompanyPage", async ({ apiPayload }, res) => {
     const companyName = apiPayload.companyName;
@@ -42,6 +52,13 @@ lambder.addApi("getCompanyPage", async ({ apiPayload }, res) => {
     return res.api(data);
 });
 
+// Start a session from an API
+lambder.addApi("loginUser", async (ctx, res) => {
+    const user = await fetchUserData();
+    await lambder.getSessionController(ctx).createSession(user.id);
+    return res.api({ success: true });
+});
+
 // Define a simple route
 lambder.addRoute("/hello-world", (ctx, res) => {
     return res.html("Hello World");
@@ -114,6 +131,29 @@ export const handler = (event, context) => {
 ### Adding APIs
 
 For more details on route matching, please check [path-to-regexp](https://www.npmjs.com/package/path-to-regexp) package.
+```typescript
+// Add routes
+lambder.addRoute(pathAsString, async (ctx, res) => {});
+lambder.addRoute(pathAsRegex, async (ctx, res) => {});
+lambder.addRoute(matchFunction, async (ctx, res) => {});
+
+// Add apis
+lambder.addApi(apiNameAsString, async (ctx, res) => {});
+lambder.addApi(apiNameAsRegex, async (ctx, res) => {});
+lambder.addApi(matchFunction, async (ctx, res) => {});
+
+// Add only session accessible routes
+lambder.addSessionRoute(pathAsString, async (ctx, res) => {});
+lambder.addSessionRoute(pathAsRegex, async (ctx, res) => {});
+lambder.addSessionRoute(matchFunction, async (ctx, res) => {});
+
+// Add only session accessible apis
+lambder.addSessionApi(apiNameAsString, async (ctx, res) => {});
+lambder.addSessionApi(apiNameAsRegex, async (ctx, res) => {});
+lambder.addSessionApi(matchFunction, async (ctx, res) => {});
+
+```
+
 
 ```typescript
 // Define a simple api
@@ -128,6 +168,21 @@ lambder.addApi("getCompanyPage", async (ctx, res) => {
 });
 ```
 
+```typescript
+// Define an only session accessible api
+lambder.addSessionApi("getCompanyPage", async (ctx, res) => {
+    const { 
+        host, path, get, post, cookie, headers, 
+        session, apiName, apiPayload
+    } = ctx;
+    
+    const companyName = session.data.companyName;
+    const data = await fetchDataSomehow(companyName);
+    return res.api(data);
+});
+```
+
+
 
 ### Adding Routes
 ```typescript
@@ -161,6 +216,84 @@ lambder.addModule(async (lambder: Lambder): Promise<void> => {
 });
 ```
 
+### Session Management
+
+You can enable session tracking by:
+
+```typescript
+// Enable session
+lambder.enableDdbSession({
+    tableName: "website-session",
+    tableRegion: "us-east-1",
+    sessionSalt: "8p6Vt+4b1w3N8d/dcJ47QF3DRkp9koFg0G" // Change salt
+});
+```
+
+After you enable the session, you can access to the session controller:
+
+```typescript
+    // Create session controller:
+    const sessionController = lambder.getSessionController(ctx);
+
+    /*
+    sessionController: {
+        async createSession(sessionKey, data, ttlInSeconds): 
+        // Starts a new session and persists the session data to DDB.
+
+        async fetchSession(): 
+        // Fetch and validate if there is an existing session
+        // This is automatically done for addSessionRoute and addSessionApi
+
+        async updateSessionData(updatedData): 
+        // Updates the active sessions data and persist it to ddb.
+
+        async endSession(): Start a new session
+        // End session and delete from DDB.
+
+        async endSessionAll(): Start a new session
+        // Ends and deletes all registered sessions for this sessionKey across all devices
+    }
+    */
+```
+
+
+
+#### Session Examples
+```typescript
+lambder.addApi("getCompanyPage", async (ctx, res) => {
+    
+    // createSession: Start a new session
+    const userId = "37234";
+    await lambder.getSessionController(ctx)
+        .createSession(userId, { "business": "Session data goes here"  });
+    console.log(ctx.session?.sessionKey); // "37234"
+    console.log(ctx.session?.data?.business); // "Session data goes here"
+
+    // fetchSession: Fetch and validate if there is an existing session
+    // This is automatically done for addSessionRoute and addSessionApi
+    await lambder.getSessionController(ctx).fetchSession();
+    console.log(ctx.session?.sessionKey); // "37234"
+    
+    // updateSessionData: Updates the active sessions data and persist it to ddb.
+    await lambder.getSessionController(ctx)
+        .updateSessionData({ "business2": "Session data updated"  });
+    console.log(ctx.session?.sessionKey); // "37234"
+    console.log(ctx.session?.data?.business); // undefined
+    console.log(ctx.session?.data?.business2); // "Session data updated"
+    
+    // endSession: Ends the session and removes it from ddb
+    await lambder.getSessionController(ctx).endSession(); // End session
+    console.log(ctx.session?.sessionKey); // undefined
+    console.log(ctx.session?.data?.business); // undefined
+    
+    // endSessionAll: Ends all registered sessions for this user in all devices.
+    await lambder.getSessionController(ctx).endSessionAll(); 
+    console.log(ctx.session?.sessionKey); // undefined
+    console.log(ctx.session?.data?.business); // undefined
+
+});
+```
+
 ### EJS Templates: 
 
 EJS templates have the variables `page` and `partial` available:
@@ -215,6 +348,7 @@ lambder.addApi("getCompanyName", async (ctx, res) => {
         headers, // Request Headers in an object. Exp: { "User-Agent": "....", ... }
         apiName, // In this function it would return "getCompanyName"
         apiPayload, // Same as post.payload 
+        session, // Stores session. Only available in addSessionRoute and addSessionApi, otherwise null.
     } = ctx;
     return res.json({});
 });

package/dist/Lambder.d.ts

@@ -49,9 +49,8 @@ export default class Lambder {
         apiPath?: string;
         ejsPath?: string;
         apiVersion?: string;
-        isCorsEnabled?: boolean;
     });
-    enableCORS(isCorsEnabled: boolean): void;
+    setIsCorsEnabled(isCorsEnabled: boolean): void;
     enableDdbSession({ tableName, tableRegion, sessionSalt }: {
         tableName: string;
         tableRegion: string;
@@ -64,11 +63,12 @@ export default class Lambder {
     setRouteFallbackHandler(routeFallbackHandler: RouteFallbackHandlerFunction): void;
     setApiFallbackHandler(apiFallbackHandler: ApiFallbackHandlerFunction): void;
     setGlobalErrorHandler(globalErrorHandler: GlobalErrorHandlerFunction): void;
-    getPatternMatch(pattern: string, path: string): Record<string, any>;
-    testPatternMatch(pattern: string, path: string): boolean;
-    private fetchSession;
-    private validateSessionForRoute;
-    private validateSessionForAPI;
+    private getPatternMatch;
+    private testPatternMatch;
+    fetchSessionIfExist(ctx: LambderRenderContext): Promise<LambderSessionContext | null>;
+    fetchSession(ctx: LambderRenderContext): Promise<LambderSessionContext>;
+    private areRequestSessionTokensValid;
+    private isSessionValid;
     private handleNoMatchedAction;
     addModule(moduleFn: LambderModuleFunction): Promise<void>;
     importModule(moduleImport: Promise<{
@@ -83,10 +83,11 @@ export default class Lambder {
     addHook(hookEvent: 'afterRender', hookFn: HookAfterRenderFunction, priority?: number): Promise<void>;
     addHook(hookEvent: 'fallback', hookFn: HookFallbackFunction, priority?: number): Promise<void>;
     getSessionController(ctx: LambderRenderContext): {
-        startSession: (userKey: string, data?: any, ttlInSeconds?: number) => Promise<LambderSessionContext>;
-        editSession: (newData: any) => Promise<LambderSessionContext>;
-        deleteSession: () => Promise<void>;
-        deleteSessionAll: () => Promise<void>;
+        createSession: (sessionKey: string, data?: any, ttlInSeconds?: number) => Promise<LambderSessionContext>;
+        fetchSession: () => Promise<LambderSessionContext>;
+        updateSessionData: (newData: any) => Promise<LambderSessionContext>;
+        endSession: () => Promise<void>;
+        endSessionAll: () => Promise<void>;
     };
     getResponseBuilder(): LambderResponseBuilder;
     private getResolver;

package/dist/Lambder.js

@@ -5,6 +5,9 @@ import LambderResolver from "./LambderResolver.js";
 import LambderResponseBuilder from "./LambderResponseBuilder.js";
 import LambderUtils from "./LambderUtils.js";
 import LambderSession from "./LambderSession.js";
+const isApiCallChecker = (method, path, post, apiPath) => {
+    return method === "POST" && apiPath && path === apiPath && post.apiName;
+};
 export const createContext = (event, lambdaContext, apiPath) => {
     const host = event.headers.Host || event.headers.host || "";
     const path = event.path;
@@ -27,9 +30,9 @@ export const createContext = (event, lambdaContext, apiPath) => {
     }
     catch (e) { }
     // Parse api variables
-    const isAPICall = method === "POST" && apiPath && path === apiPath && post.apiName;
-    const apiName = isAPICall ? post.apiName : null;
-    const apiPayload = isAPICall ? post.payload : null;
+    const isApiCall = isApiCallChecker(method, path, post, apiPath);
+    const apiName = isApiCall ? post.apiName : null;
+    const apiPayload = isApiCall ? post.payload : null;
     return { host, path, pathParams, method, get, post, cookie, apiName, apiPayload, headers, session, lambdaContext };
 };
 export default class Lambder {
@@ -60,7 +63,7 @@ export default class Lambder {
         };
         this.utils = new LambderUtils({ ejsPath });
     }
-    enableCORS(isCorsEnabled) {
+    setIsCorsEnabled(isCorsEnabled) {
         this.isCorsEnabled = isCorsEnabled;
     }
     enableDdbSession({ tableName, tableRegion, sessionSalt }, { partitionKey, sortKey } = { partitionKey: "pk", sortKey: "sk" }) {
@@ -90,32 +93,59 @@ export default class Lambder {
     testPatternMatch(pattern, path) {
         return (match(pattern, { decode: decodeURIComponent }))(path) !== false;
     }
+    async fetchSessionIfExist(ctx) {
+        try {
+            return await this.fetchSession(ctx);
+        }
+        catch (err) {
+            return null;
+        }
+    }
     async fetchSession(ctx) {
         if (!this.lambderSession)
-            throw "Session not found";
+            throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
+        if (!this.areRequestSessionTokensValid(ctx)) {
+            throw new Error("Session tokens are invalid");
+        }
         const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
         if (!sessionToken)
-            throw "Session not found";
+            throw new Error("Session token not found");
         const session = await this.lambderSession.getSession(sessionToken);
+        if (!session)
+            throw new Error("Session not found");
+        if (!this.isSessionValid(ctx, session))
+            throw new Error("Invalid session");
         ctx.session = session;
-        return true;
+        return session;
     }
     ;
-    validateSessionForRoute(ctx) {
-        if (!this.lambderSession)
-            return false;
+    areRequestSessionTokensValid(ctx) {
+        const isApiCall = isApiCallChecker(ctx.method, ctx.path, ctx.post, this.apiPath);
         const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-        return this.lambderSession.isSessionValid(ctx.session, sessionToken, null, true);
+        const isSessionTokenValid = sessionToken && sessionToken?.split(":")?.length === 2;
+        if (isApiCall) {
+            const csrfToken = ctx.post?.token;
+            const isCsrfTokenValid = typeof csrfToken === "string" && csrfToken.length > 0;
+            return isSessionTokenValid && isCsrfTokenValid;
+        }
+        else {
+            return isSessionTokenValid;
+        }
     }
-    ;
-    validateSessionForAPI(ctx) {
+    isSessionValid(ctx, session) {
         if (!this.lambderSession)
             return false;
-        const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-        const csrfToken = ctx.post?.token;
-        return this.lambderSession.isSessionValid(ctx.session, sessionToken, csrfToken);
+        const isApiCall = isApiCallChecker(ctx.method, ctx.path, ctx.post, this.apiPath);
+        if (isApiCall) {
+            const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
+            const csrfToken = ctx.post?.token;
+            return this.lambderSession.isSessionValid(session, sessionToken, csrfToken);
+        }
+        else {
+            const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
+            return this.lambderSession.isSessionValid(session, sessionToken, null, true);
+        }
     }
-    ;
     async handleNoMatchedAction(ctx, resolver) {
         for (const hook of this.hookList["fallback"]) {
             await hook.hookFn(ctx, resolver);
@@ -166,9 +196,6 @@ export default class Lambder {
                     (condition?.constructor == RegExp && condition.test(ctx.path)))),
             actionFn: async (ctx, resolver) => {
                 await this.fetchSession(ctx);
-                const isSessionValid = this.validateSessionForRoute(ctx);
-                if (!isSessionValid)
-                    throw new Error("Session not found");
                 if (typeof condition === "string") {
                     ctx.pathParams = this.getPatternMatch(condition, ctx.path);
                 }
@@ -196,9 +223,6 @@ export default class Lambder {
                 (apiName?.constructor == RegExp && apiName.test(ctx.apiName)))),
             actionFn: async (ctx, resolver) => {
                 await this.fetchSession(ctx);
-                const isSessionValid = this.validateSessionForAPI(ctx);
-                if (!isSessionValid)
-                    throw new Error("Session not found");
                 return await actionFn(ctx, resolver);
             }
         });
@@ -215,33 +239,38 @@ export default class Lambder {
     }
     getSessionController(ctx) {
         return {
-            startSession: async (userKey, data, ttlInSeconds) => {
+            createSession: async (sessionKey, data, ttlInSeconds) => {
                 if (!this.lambderSession)
-                    throw "Session is not enabled. Use lambder.enableDdbSession(...) to configure.";
-                ctx.session = await this.lambderSession.createSession(userKey, data, ttlInSeconds);
+                    throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
+                ctx.session = await this.lambderSession.createSession(sessionKey, data, ttlInSeconds);
                 return ctx.session;
             },
-            editSession: async (newData) => {
+            fetchSession: async () => {
+                if (!this.lambderSession)
+                    throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
+                return this.fetchSession(ctx);
+            },
+            updateSessionData: async (newData) => {
                 if (!this.lambderSession)
-                    throw "Session is not enabled. Use lambder.enableDdbSession(...) to configure.";
+                    throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
                 if (!ctx.session)
-                    throw "Session not found.";
-                ctx.session = await this.lambderSession.editSession(ctx.session, newData);
+                    throw new Error("Session not found.");
+                ctx.session = await this.lambderSession.updateSessionData(ctx.session, newData);
                 return ctx.session;
             },
-            deleteSession: async () => {
+            endSession: async () => {
                 if (!this.lambderSession)
-                    throw "Session is not enabled. Use lambder.enableDdbSession(...) to configure.";
+                    throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
                 if (!ctx.session)
-                    throw "Session not found.";
+                    throw new Error("Session not found.");
                 await this.lambderSession.deleteSession(ctx.session);
                 ctx.session = null;
             },
-            deleteSessionAll: async () => {
+            endSessionAll: async () => {
                 if (!this.lambderSession)
-                    throw "Session is not enabled. Use lambder.enableDdbSession(...) to configure.";
+                    throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
                 if (!ctx.session)
-                    throw "Session not found.";
+                    throw new Error("Session not found.");
                 await this.lambderSession.deleteSessionAll(ctx.session);
                 ctx.session = null;
             },

package/dist/LambderSession.d.ts

@@ -2,7 +2,7 @@ export type LambderSessionContext = {
     [x: string]: any;
     sessionToken: string;
     csrfToken: string;
-    userKey: string;
+    sessionKey: string;
     data: any;
     createdAt: number;
     expiresAt: number;
@@ -27,8 +27,8 @@ export default class LambderSession {
     private ddbDeleteItem;
     private ddbQueryAllByPartitionKey;
     private ddbDeleteAllByPartitionKey;
-    createSession(userKey: string, data?: any, ttlInSeconds?: number): Promise<LambderSessionContext>;
-    editSession(session: LambderSessionContext, newData?: any): Promise<LambderSessionContext>;
+    createSession(sessionKey: string, data?: any, ttlInSeconds?: number): Promise<LambderSessionContext>;
+    updateSessionData(session: LambderSessionContext, newData?: any): Promise<LambderSessionContext>;
     getSession(sessionToken: string): Promise<LambderSessionContext | null>;
     isSessionValid(session: any, sessionToken: any, csrfToken: any, skipCsrfTokenCheck?: boolean): boolean;
     deleteSession(session: Record<string, any>): Promise<boolean>;

package/dist/LambderSession.js

@@ -63,51 +63,51 @@ export default class LambderSession {
             }));
         }
     }
-    async createSession(userKey, data = {}, ttlInSeconds = 30 * 24 * 60 * 60) {
-        const userKeyHash = this.sessionUserKeyHasher(userKey);
+    async createSession(sessionKey, data = {}, ttlInSeconds = 30 * 24 * 60 * 60) {
+        const sessionKeyHash = this.sessionUserKeyHasher(sessionKey);
         const sessionSortKey = crypto.randomBytes(32).toString("hex");
-        const sessionToken = `${userKeyHash}:${sessionSortKey}`;
+        const sessionToken = `${sessionKeyHash}:${sessionSortKey}`;
         const csrfToken = crypto.randomBytes(8).toString("hex");
         const createdAt = Math.floor(Date.now() / 1000);
         const expiresAt = Number(createdAt) + Number(ttlInSeconds);
         const session = {
-            [this.partitionKey]: userKeyHash,
+            [this.partitionKey]: sessionKeyHash,
             [this.sortKey]: sessionSortKey,
             sessionToken, csrfToken,
-            userKey, data,
+            sessionKey, data,
             createdAt, expiresAt, ttlInSeconds
         };
         await this.ddbPutItem(session);
         return session;
     }
-    async editSession(session, newData) {
+    async updateSessionData(session, newData) {
         if (!session)
-            throw "Invalid session";
+            throw new Error("Invalid session");
         session.data = newData;
         await this.ddbPutItem(session);
         return session;
     }
     async getSession(sessionToken) {
-        const [userKeyHash, sessionSortKey] = sessionToken.split(":");
-        if (!userKeyHash || !sessionSortKey)
+        const [sessionKeyHash, sessionSortKey] = sessionToken.split(":");
+        if (!sessionKeyHash || !sessionSortKey)
             return null;
         try {
             let session = await this.ddbGetItem({
-                [this.partitionKey]: userKeyHash,
+                [this.partitionKey]: sessionKeyHash,
                 [this.sortKey]: sessionSortKey
             });
             if (!session)
-                throw "Session not found";
+                throw new Error("Session not found");
             if (!session.sessionToken || session.sessionToken !== sessionToken)
-                throw "Not found: session.sessionToken";
+                throw new Error("Not found: session.sessionToken");
             if (!session.csrfToken)
-                throw "Not found: session.csrfToken";
-            if (!session.userKey)
-                throw "Not found: session.userKey";
+                throw new Error("Not found: session.csrfToken");
+            if (!session.sessionKey)
+                throw new Error("Not found: session.sessionKey");
             if (!session.createdAt)
-                throw "Not found: session.createdAt";
+                throw new Error("Not found: session.createdAt");
             if (!session.expiresAt || session.expiresAt < Date.now() / 1000)
-                throw "Not found: session.expiresAt";
+                throw new Error("Not found: session.expiresAt");
             return session;
         }
         catch (err) {
@@ -124,7 +124,7 @@ export default class LambderSession {
             return false;
         if (!session.csrfToken)
             return false;
-        if (!session.userKey)
+        if (!session.sessionKey)
             return false;
         if (!session.createdAt)
             return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "1.0.113",
+  "version": "1.0.115",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/Lambder.ts

@@ -41,6 +41,9 @@ type GlobalErrorHandlerFunction = (err: Error, ctx: LambderRenderContext|null, r
 type RouteFallbackHandlerFunction = (ctx:LambderRenderContext, resolver: LambderResolver) => LambderResolverResponse;
 type ApiFallbackHandlerFunction = (ctx:LambderRenderContext, resolver: LambderResolver) => LambderResolverResponse;
 
+const isApiCallChecker = (method: string, path: string, post: Record<any,any>, apiPath: string): boolean => {
+    return method === "POST" && apiPath && path === apiPath && post.apiName;
+}
 
 export const createContext = (
     event: APIGatewayProxyEvent, 
@@ -63,9 +66,9 @@ export const createContext = (
         catch(e){ post = querystring.parse(decodedBody) || {}; }
     }catch(e){}
     // Parse api variables
-    const isAPICall = method === "POST" && apiPath && path === apiPath && post.apiName;
-    const apiName:string = isAPICall ? post.apiName : null;
-    const apiPayload:string = isAPICall ? post.payload : null;
+    const isApiCall = isApiCallChecker(method, path, post, apiPath);
+    const apiName:string = isApiCall ? post.apiName : null;
+    const apiPayload:string = isApiCall ? post.payload : null;
 
     return { host, path, pathParams, method, get, post, cookie, apiName, apiPayload, headers, session, lambdaContext };
 }
@@ -96,7 +99,7 @@ export default class Lambder {
     
     constructor(
         { publicPath, apiPath, ejsPath, apiVersion }: 
-        { publicPath: string, apiPath?: string, ejsPath?: string, apiVersion?: string, isCorsEnabled?: boolean, }
+        { publicPath: string, apiPath?: string, ejsPath?: string, apiVersion?: string }
     ){
         this.publicPath = publicPath || "/incorrect-path-not-found";
         this.ejsPath = ejsPath || "/incorrect-ejs-path-not-found";
@@ -113,7 +116,7 @@ export default class Lambder {
         this.utils = new LambderUtils({ ejsPath });
     }
 
-    enableCORS(isCorsEnabled: boolean){
+    setIsCorsEnabled(isCorsEnabled: boolean){
         this.isCorsEnabled = isCorsEnabled;
     }
 
@@ -140,37 +143,65 @@ export default class Lambder {
     setGlobalErrorHandler(globalErrorHandler: GlobalErrorHandlerFunction){
         this.globalErrorHandler = globalErrorHandler;
     }
-    getPatternMatch(pattern: string, path: string): Record<string, any> {
+    private getPatternMatch(pattern: string, path: string): Record<string, any> {
         const result = (match(pattern, { decode: decodeURIComponent }))(path);
         if(!result) return {};
         return result?.params || {};
     }
-    testPatternMatch(pattern: string, path: string): boolean{
+    private testPatternMatch(pattern: string, path: string): boolean{
         return (match(pattern, { decode: decodeURIComponent }))(path) !== false;
     }
 
-    private async fetchSession (ctx: LambderRenderContext): Promise<boolean>{
-        if(!this.lambderSession) throw "Session not found";
+    async fetchSessionIfExist(ctx: LambderRenderContext): Promise<LambderSessionContext|null>{
+        try {
+            return await this.fetchSession(ctx);
+        }catch(err){
+            return null;
+        }
+    }
+
+    async fetchSession (ctx: LambderRenderContext): Promise<LambderSessionContext>{
+        if(!this.lambderSession) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
+        if(!this.areRequestSessionTokensValid(ctx)){ throw new Error("Session tokens are invalid"); }
+
         const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-        if(!sessionToken) throw "Session not found";
+        if(!sessionToken) throw new Error("Session token not found");
+        
         const session = await this.lambderSession.getSession(sessionToken);
+        if(!session) throw new Error("Session not found");
+        
+        if(!this.isSessionValid(ctx, session)) throw new Error("Invalid session");
         ctx.session = session;
-        return true;
+        return session;
     };
 
-    private validateSessionForRoute (ctx: LambderRenderContext): boolean{
-        if(!this.lambderSession) return false;
+    private areRequestSessionTokensValid(ctx: LambderRenderContext): boolean {
+        const isApiCall = isApiCallChecker(ctx.method, ctx.path, ctx.post, this.apiPath);
         const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-        return this.lambderSession.isSessionValid(ctx.session, sessionToken, null, true);
-    };
+        const isSessionTokenValid = sessionToken && sessionToken?.split(":")?.length === 2;
 
-    private validateSessionForAPI (ctx: LambderRenderContext): boolean{
+        if(isApiCall){
+            const csrfToken = ctx.post?.token;
+            const isCsrfTokenValid = typeof csrfToken === "string" && csrfToken.length > 0
+            return isSessionTokenValid && isCsrfTokenValid;
+        }else{
+            return isSessionTokenValid;
+        }
+    }
+    
+    private isSessionValid(ctx: LambderRenderContext, session: any): boolean {
         if(!this.lambderSession) return false;
-        const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-        const csrfToken = ctx.post?.token;
-        return this.lambderSession.isSessionValid(ctx.session, sessionToken, csrfToken);
-    };
-
+        const isApiCall = isApiCallChecker(ctx.method, ctx.path, ctx.post, this.apiPath);
+        if(isApiCall){
+            const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
+            const csrfToken = ctx.post?.token;
+            return this.lambderSession.isSessionValid(session, sessionToken, csrfToken);
+        }else{
+            const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
+            return this.lambderSession.isSessionValid(session, sessionToken, null, true);
+        }
+    }
+    
     private async handleNoMatchedAction(ctx: LambderRenderContext, resolver: LambderResolver){
         for(const hook of this.hookList["fallback"]){  await hook.hookFn(ctx, resolver); }
 
@@ -228,8 +259,6 @@ export default class Lambder {
             ), 
             actionFn: async (ctx:LambderRenderContext, resolver: LambderResolver) => {
                 await this.fetchSession(ctx);
-                const isSessionValid = this.validateSessionForRoute(ctx);
-                if(!isSessionValid) throw new Error("Session not found");
                 if(typeof condition === "string"){
                     ctx.pathParams = this.getPatternMatch(condition, ctx.path);
                 }else if(condition?.constructor == RegExp){
@@ -264,8 +293,6 @@ export default class Lambder {
             ), 
             actionFn: async (ctx:LambderRenderContext, resolver: LambderResolver) => {
                 await this.fetchSession(ctx);
-                const isSessionValid = this.validateSessionForAPI(ctx);
-                if(!isSessionValid) throw new Error("Session not found");
                 return await actionFn(ctx, resolver);
             }
         });
@@ -288,35 +315,39 @@ export default class Lambder {
         }
     }
 
-    public getSessionController(ctx: LambderRenderContext){
+    getSessionController(ctx: LambderRenderContext){
         return {
-            startSession: async (userKey: string, data?: any, ttlInSeconds?: number): Promise<LambderSessionContext> => {
-                if(!this.lambderSession) throw "Session is not enabled. Use lambder.enableDdbSession(...) to configure.";
-                ctx.session = await this.lambderSession.createSession(userKey, data, ttlInSeconds);
+            createSession: async (sessionKey: string, data?: any, ttlInSeconds?: number): Promise<LambderSessionContext> => {
+                if(!this.lambderSession) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
+                ctx.session = await this.lambderSession.createSession(sessionKey, data, ttlInSeconds);
                 return ctx.session;
             },
-            editSession: async (newData: any): Promise<LambderSessionContext> => {
-                if(!this.lambderSession) throw "Session is not enabled. Use lambder.enableDdbSession(...) to configure.";
-                if(!ctx.session) throw "Session not found.";
-                ctx.session = await this.lambderSession.editSession(ctx.session, newData);
+            fetchSession: async (): Promise<LambderSessionContext> => {
+                if(!this.lambderSession) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
+                return this.fetchSession(ctx);
+            },
+            updateSessionData: async (newData: any): Promise<LambderSessionContext> => {
+                if(!this.lambderSession) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
+                if(!ctx.session) throw new Error("Session not found.");
+                ctx.session = await this.lambderSession.updateSessionData(ctx.session, newData);
                 return ctx.session;
             },
-            deleteSession: async () => {
-                if(!this.lambderSession) throw "Session is not enabled. Use lambder.enableDdbSession(...) to configure.";
-                if(!ctx.session) throw "Session not found.";
+            endSession: async () => {
+                if(!this.lambderSession) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
+                if(!ctx.session) throw new Error("Session not found.");
                 await this.lambderSession.deleteSession(ctx.session);
                 ctx.session = null
             },
-            deleteSessionAll: async () => {
-                if(!this.lambderSession) throw "Session is not enabled. Use lambder.enableDdbSession(...) to configure.";
-                if(!ctx.session) throw "Session not found.";
+            endSessionAll: async () => {
+                if(!this.lambderSession) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
+                if(!ctx.session) throw new Error("Session not found.");
                 await this.lambderSession.deleteSessionAll(ctx.session);
                 ctx.session = null
             },
         }
     }
 
-    public getResponseBuilder(){
+    getResponseBuilder(){
         return new LambderResponseBuilder({
             isCorsEnabled: this.isCorsEnabled, 
             publicPath: this.publicPath,

package/src/LambderSession.ts

@@ -6,7 +6,7 @@ export type LambderSessionContext = {
     [x: string]: any;
     sessionToken: string;
     csrfToken: string;
-    userKey: string;
+    sessionKey: string;
     data: any;
     createdAt: number;
     expiresAt: number;
@@ -94,52 +94,52 @@ export default class LambderSession{
     }
 
     public async createSession(
-        userKey: string, 
+        sessionKey: string, 
         data: any = {}, 
         ttlInSeconds:number = 30*24*60*60
     ): Promise<LambderSessionContext> {
-        const userKeyHash = this.sessionUserKeyHasher(userKey);
+        const sessionKeyHash = this.sessionUserKeyHasher(sessionKey);
         const sessionSortKey = crypto.randomBytes(32).toString("hex");
-        const sessionToken = `${userKeyHash}:${sessionSortKey}`;
+        const sessionToken = `${sessionKeyHash}:${sessionSortKey}`;
         const csrfToken = crypto.randomBytes(8).toString("hex");
         const createdAt = Math.floor(Date.now()/1000);
         const expiresAt = Number(createdAt) + Number(ttlInSeconds);
     
         const session = {
-            [this.partitionKey]: userKeyHash, 
+            [this.partitionKey]: sessionKeyHash, 
             [this.sortKey]: sessionSortKey,
             sessionToken, csrfToken,
-            userKey, data, 
+            sessionKey, data, 
             createdAt, expiresAt, ttlInSeconds
         };
         await this.ddbPutItem(session);
         return session;
     }
 
-    public async editSession(
+    public async updateSessionData(
         session: LambderSessionContext,
         newData?: any
     ): Promise<LambderSessionContext> {
-        if(!session) throw "Invalid session";
+        if(!session) throw new Error("Invalid session");
         session.data = newData;
         await this.ddbPutItem(session);
         return session;
     }
 
     public async getSession(sessionToken: string): Promise<LambderSessionContext|null>{
-        const [ userKeyHash, sessionSortKey ] = sessionToken.split(":");
-        if(!userKeyHash || !sessionSortKey) return null;
+        const [ sessionKeyHash, sessionSortKey ] = sessionToken.split(":");
+        if(!sessionKeyHash || !sessionSortKey) return null;
         try{
             let session = await this.ddbGetItem({ 
-                [this.partitionKey]: userKeyHash, 
+                [this.partitionKey]: sessionKeyHash, 
                 [this.sortKey]: sessionSortKey
             });
-            if(!session) throw "Session not found";
-            if(!session.sessionToken || session.sessionToken !== sessionToken) throw "Not found: session.sessionToken";
-            if(!session.csrfToken) throw "Not found: session.csrfToken";
-            if(!session.userKey) throw "Not found: session.userKey";
-            if(!session.createdAt) throw "Not found: session.createdAt";
-            if(!session.expiresAt || session.expiresAt < Date.now()/1000) throw "Not found: session.expiresAt";
+            if(!session) throw new Error("Session not found");
+            if(!session.sessionToken || session.sessionToken !== sessionToken) throw new Error("Not found: session.sessionToken");
+            if(!session.csrfToken) throw new Error("Not found: session.csrfToken");
+            if(!session.sessionKey) throw new Error("Not found: session.sessionKey");
+            if(!session.createdAt) throw new Error("Not found: session.createdAt");
+            if(!session.expiresAt || session.expiresAt < Date.now()/1000) throw new Error("Not found: session.expiresAt");
             return session;
         }catch(err){
             return null;
@@ -151,7 +151,7 @@ export default class LambderSession{
         if(!sessionToken || typeof sessionToken !== "string") return false;
         if(session.sessionToken !== sessionToken) return false;
         if(!session.csrfToken) return false;
-        if(!session.userKey) return false;
+        if(!session.sessionKey) return false;
         if(!session.createdAt) return false;
         if(!session.expiresAt || session.expiresAt < Date.now()/1000) return false;
         if(!skipCsrfTokenCheck){