lambder 1.0.115 → 1.0.117

package/Readme.md

@@ -243,6 +243,10 @@ After you enable the session, you can access to the session controller:
         async fetchSession(): 
         // Fetch and validate if there is an existing session
         // This is automatically done for addSessionRoute and addSessionApi
+        // Throws if session not found
+
+        async fetchSessionIfExists(): 
+        // Runs fetchSession and returns the session if found. Otherwise return null
 
         async updateSessionData(updatedData): 
         // Updates the active sessions data and persist it to ddb.

package/dist/Lambder.d.ts

@@ -2,9 +2,10 @@ import type { APIGatewayProxyEvent, APIGatewayProxyEventHeaders, Context } from
 import LambderResolver from "./LambderResolver.js";
 import LambderResponseBuilder, { LambderResolverResponse } from "./LambderResponseBuilder.js";
 import LambderUtils from "./LambderUtils.js";
-import { type LambderSessionContext } from "./LambderSession.js";
+import { type LambderSessionContext } from "./LambderSessionManager.js";
+import LambderSessionController from "./LambderSessionController.js";
 type Path = `/${string}`;
-type LambderRenderContext = {
+export type LambderRenderContext = {
     host: string;
     path: string;
     pathParams: Record<string, any> | null;
@@ -17,6 +18,9 @@ type LambderRenderContext = {
     headers: APIGatewayProxyEventHeaders;
     session: LambderSessionContext | null;
     lambdaContext: Context;
+    _otherInternal: {
+        isApiCall: boolean;
+    };
 };
 type LambderModuleFunction = (lambderInstance: Lambder) => void | Promise<void>;
 type ConditionFunction = (ctx: LambderRenderContext) => boolean;
@@ -41,7 +45,7 @@ export default class Lambder {
     private routeFallbackHandler;
     private apiFallbackHandler;
     utils: LambderUtils;
-    private lambderSession?;
+    private lambderSessionManager?;
     private sessionTokenCookieKey;
     private sessionCsrfCookieKey;
     constructor({ publicPath, apiPath, ejsPath, apiVersion }: {
@@ -65,10 +69,6 @@ export default class Lambder {
     setGlobalErrorHandler(globalErrorHandler: GlobalErrorHandlerFunction): void;
     private getPatternMatch;
     private testPatternMatch;
-    fetchSessionIfExist(ctx: LambderRenderContext): Promise<LambderSessionContext | null>;
-    fetchSession(ctx: LambderRenderContext): Promise<LambderSessionContext>;
-    private areRequestSessionTokensValid;
-    private isSessionValid;
     private handleNoMatchedAction;
     addModule(moduleFn: LambderModuleFunction): Promise<void>;
     importModule(moduleImport: Promise<{
@@ -82,13 +82,7 @@ export default class Lambder {
     addHook(hookEvent: 'beforeRender', hookFn: HookBeforeRenderFunction, priority?: number): Promise<void>;
     addHook(hookEvent: 'afterRender', hookFn: HookAfterRenderFunction, priority?: number): Promise<void>;
     addHook(hookEvent: 'fallback', hookFn: HookFallbackFunction, priority?: number): Promise<void>;
-    getSessionController(ctx: LambderRenderContext): {
-        createSession: (sessionKey: string, data?: any, ttlInSeconds?: number) => Promise<LambderSessionContext>;
-        fetchSession: () => Promise<LambderSessionContext>;
-        updateSessionData: (newData: any) => Promise<LambderSessionContext>;
-        endSession: () => Promise<void>;
-        endSessionAll: () => Promise<void>;
-    };
+    getSessionController(ctx: LambderRenderContext): LambderSessionController;
     getResponseBuilder(): LambderResponseBuilder;
     private getResolver;
     render(event: APIGatewayProxyEvent, lambdaContext: Context): Promise<LambderResolverResponse>;

package/dist/Lambder.js

@@ -4,10 +4,8 @@ import { match } from "path-to-regexp";
 import LambderResolver from "./LambderResolver.js";
 import LambderResponseBuilder from "./LambderResponseBuilder.js";
 import LambderUtils from "./LambderUtils.js";
-import LambderSession from "./LambderSession.js";
-const isApiCallChecker = (method, path, post, apiPath) => {
-    return method === "POST" && apiPath && path === apiPath && post.apiName;
-};
+import LambderSessionManager from "./LambderSessionManager.js";
+import LambderSessionController from "./LambderSessionController.js";
 export const createContext = (event, lambdaContext, apiPath) => {
     const host = event.headers.Host || event.headers.host || "";
     const path = event.path;
@@ -30,10 +28,16 @@ export const createContext = (event, lambdaContext, apiPath) => {
     }
     catch (e) { }
     // Parse api variables
-    const isApiCall = isApiCallChecker(method, path, post, apiPath);
+    const isApiCall = method === "POST" && apiPath && path === apiPath && post.apiName;
     const apiName = isApiCall ? post.apiName : null;
     const apiPayload = isApiCall ? post.payload : null;
-    return { host, path, pathParams, method, get, post, cookie, apiName, apiPayload, headers, session, lambdaContext };
+    return {
+        host, path, pathParams, method,
+        get, post, cookie,
+        apiName, apiPayload,
+        headers, session, lambdaContext,
+        _otherInternal: { isApiCall }
+    };
 };
 export default class Lambder {
     apiPath;
@@ -47,7 +51,7 @@ export default class Lambder {
     routeFallbackHandler = null;
     apiFallbackHandler = null;
     utils;
-    lambderSession;
+    lambderSessionManager;
     sessionTokenCookieKey = "LMDRSESSIONTKID";
     sessionCsrfCookieKey = "LMDRSESSIONCSTK";
     constructor({ publicPath, apiPath, ejsPath, apiVersion }) {
@@ -67,7 +71,7 @@ export default class Lambder {
         this.isCorsEnabled = isCorsEnabled;
     }
     enableDdbSession({ tableName, tableRegion, sessionSalt }, { partitionKey, sortKey } = { partitionKey: "pk", sortKey: "sk" }) {
-        this.lambderSession = new LambderSession({
+        this.lambderSessionManager = new LambderSessionManager({
             tableName, tableRegion, partitionKey, sortKey, sessionSalt
         });
     }
@@ -93,59 +97,6 @@ export default class Lambder {
     testPatternMatch(pattern, path) {
         return (match(pattern, { decode: decodeURIComponent }))(path) !== false;
     }
-    async fetchSessionIfExist(ctx) {
-        try {
-            return await this.fetchSession(ctx);
-        }
-        catch (err) {
-            return null;
-        }
-    }
-    async fetchSession(ctx) {
-        if (!this.lambderSession)
-            throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
-        if (!this.areRequestSessionTokensValid(ctx)) {
-            throw new Error("Session tokens are invalid");
-        }
-        const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-        if (!sessionToken)
-            throw new Error("Session token not found");
-        const session = await this.lambderSession.getSession(sessionToken);
-        if (!session)
-            throw new Error("Session not found");
-        if (!this.isSessionValid(ctx, session))
-            throw new Error("Invalid session");
-        ctx.session = session;
-        return session;
-    }
-    ;
-    areRequestSessionTokensValid(ctx) {
-        const isApiCall = isApiCallChecker(ctx.method, ctx.path, ctx.post, this.apiPath);
-        const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-        const isSessionTokenValid = sessionToken && sessionToken?.split(":")?.length === 2;
-        if (isApiCall) {
-            const csrfToken = ctx.post?.token;
-            const isCsrfTokenValid = typeof csrfToken === "string" && csrfToken.length > 0;
-            return isSessionTokenValid && isCsrfTokenValid;
-        }
-        else {
-            return isSessionTokenValid;
-        }
-    }
-    isSessionValid(ctx, session) {
-        if (!this.lambderSession)
-            return false;
-        const isApiCall = isApiCallChecker(ctx.method, ctx.path, ctx.post, this.apiPath);
-        if (isApiCall) {
-            const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-            const csrfToken = ctx.post?.token;
-            return this.lambderSession.isSessionValid(session, sessionToken, csrfToken);
-        }
-        else {
-            const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-            return this.lambderSession.isSessionValid(session, sessionToken, null, true);
-        }
-    }
     async handleNoMatchedAction(ctx, resolver) {
         for (const hook of this.hookList["fallback"]) {
             await hook.hookFn(ctx, resolver);
@@ -195,7 +146,7 @@ export default class Lambder {
                     (typeof condition === "function" && condition(ctx)) ||
                     (condition?.constructor == RegExp && condition.test(ctx.path)))),
             actionFn: async (ctx, resolver) => {
-                await this.fetchSession(ctx);
+                await this.getSessionController(ctx).fetchSession();
                 if (typeof condition === "string") {
                     ctx.pathParams = this.getPatternMatch(condition, ctx.path);
                 }
@@ -222,7 +173,7 @@ export default class Lambder {
                 (typeof apiName === "function" && apiName(ctx)) ||
                 (apiName?.constructor == RegExp && apiName.test(ctx.apiName)))),
             actionFn: async (ctx, resolver) => {
-                await this.fetchSession(ctx);
+                await this.getSessionController(ctx).fetchSession();
                 return await actionFn(ctx, resolver);
             }
         });
@@ -238,43 +189,13 @@ export default class Lambder {
         }
     }
     getSessionController(ctx) {
-        return {
-            createSession: async (sessionKey, data, ttlInSeconds) => {
-                if (!this.lambderSession)
-                    throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
-                ctx.session = await this.lambderSession.createSession(sessionKey, data, ttlInSeconds);
-                return ctx.session;
-            },
-            fetchSession: async () => {
-                if (!this.lambderSession)
-                    throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
-                return this.fetchSession(ctx);
-            },
-            updateSessionData: async (newData) => {
-                if (!this.lambderSession)
-                    throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
-                if (!ctx.session)
-                    throw new Error("Session not found.");
-                ctx.session = await this.lambderSession.updateSessionData(ctx.session, newData);
-                return ctx.session;
-            },
-            endSession: async () => {
-                if (!this.lambderSession)
-                    throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
-                if (!ctx.session)
-                    throw new Error("Session not found.");
-                await this.lambderSession.deleteSession(ctx.session);
-                ctx.session = null;
-            },
-            endSessionAll: async () => {
-                if (!this.lambderSession)
-                    throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
-                if (!ctx.session)
-                    throw new Error("Session not found.");
-                await this.lambderSession.deleteSessionAll(ctx.session);
-                ctx.session = null;
-            },
-        };
+        if (!this.lambderSessionManager)
+            throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
+        return new LambderSessionController({
+            lambderSessionManager: this.lambderSessionManager,
+            sessionTokenCookieKey: this.sessionTokenCookieKey,
+            ctx,
+        });
     }
     getResponseBuilder() {
         return new LambderResponseBuilder({

package/dist/LambderSessionController.d.ts

@@ -0,0 +1,21 @@
+import { LambderRenderContext } from "./Lambder.js";
+import type LambderSessionManager from "./LambderSessionManager.js";
+import type { LambderSessionContext } from "./LambderSessionManager.js";
+export default class LambderSessionController {
+    lambderSessionManager: LambderSessionManager;
+    sessionTokenCookieKey: string;
+    ctx: LambderRenderContext;
+    constructor({ lambderSessionManager, sessionTokenCookieKey, ctx, }: {
+        lambderSessionManager: LambderSessionManager;
+        sessionTokenCookieKey: string;
+        ctx: LambderRenderContext;
+    });
+    private areRequestSessionTokensValid;
+    createSession(sessionKey: string, data?: any, ttlInSeconds?: number): Promise<LambderSessionContext>;
+    fetchSession(): Promise<LambderSessionContext>;
+    fetchSessionIfExists(): Promise<LambderSessionContext | null>;
+    isSessionValid(session: any): boolean;
+    updateSessionData(newData: any): Promise<LambderSessionContext>;
+    endSession(): Promise<void>;
+    endSessionAll(): Promise<void>;
+}

package/dist/LambderSessionController.js

@@ -0,0 +1,88 @@
+export default class LambderSessionController {
+    lambderSessionManager;
+    sessionTokenCookieKey;
+    ctx;
+    constructor({ lambderSessionManager, sessionTokenCookieKey, ctx, }) {
+        this.ctx = ctx;
+        this.sessionTokenCookieKey = sessionTokenCookieKey;
+        this.lambderSessionManager = lambderSessionManager;
+    }
+    ;
+    areRequestSessionTokensValid() {
+        const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
+        const isSessionTokenValid = sessionToken && sessionToken?.split(":")?.length === 2;
+        if (this.ctx._otherInternal.isApiCall) {
+            const csrfToken = this.ctx.post?.token;
+            const isCsrfTokenValid = typeof csrfToken === "string" && csrfToken.length > 0;
+            return isSessionTokenValid && isCsrfTokenValid;
+        }
+        else {
+            return isSessionTokenValid;
+        }
+    }
+    ;
+    async createSession(sessionKey, data, ttlInSeconds) {
+        this.ctx.session = await this.lambderSessionManager.createSession(sessionKey, data, ttlInSeconds);
+        return this.ctx.session;
+    }
+    ;
+    async fetchSession() {
+        if (!this.areRequestSessionTokensValid()) {
+            throw new Error("Session tokens are invalid");
+        }
+        const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
+        if (!sessionToken)
+            throw new Error("Session token not found");
+        const session = await this.lambderSessionManager.getSession(sessionToken);
+        if (!session)
+            throw new Error("Session not found");
+        if (!this.isSessionValid(session))
+            throw new Error("Invalid session");
+        this.ctx.session = session;
+        return session;
+    }
+    ;
+    async fetchSessionIfExists() {
+        try {
+            return await this.fetchSession();
+        }
+        catch (err) {
+            return null;
+        }
+    }
+    ;
+    isSessionValid(session) {
+        if (this.ctx._otherInternal.isApiCall) {
+            const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
+            const csrfToken = this.ctx.post?.token;
+            return this.lambderSessionManager.isSessionValid(session, sessionToken, csrfToken);
+        }
+        else {
+            const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
+            return this.lambderSessionManager.isSessionValid(session, sessionToken, null, true);
+        }
+    }
+    ;
+    async updateSessionData(newData) {
+        if (!this.ctx.session)
+            throw new Error("Session not found.");
+        this.ctx.session = await this.lambderSessionManager.updateSessionData(this.ctx.session, newData);
+        return this.ctx.session;
+    }
+    ;
+    async endSession() {
+        if (!this.ctx.session)
+            throw new Error("Session not found.");
+        await this.lambderSessionManager.deleteSession(this.ctx.session);
+        this.ctx.session = null;
+    }
+    ;
+    async endSessionAll() {
+        if (!this.ctx.session)
+            throw new Error("Session not found.");
+        await this.lambderSessionManager.deleteSessionAll(this.ctx.session);
+        this.ctx.session = null;
+    }
+    ;
+}
+;

package/dist/{LambderSession.d.ts → LambderSessionManager.d.ts}

@@ -8,7 +8,7 @@ export type LambderSessionContext = {
     expiresAt: number;
     ttlInSeconds: number;
 };
-export default class LambderSession {
+export default class LambderSessionManager {
     private tableName;
     private sessionSalt;
     private partitionKey;

package/dist/{LambderSession.js → LambderSessionManager.js}

@@ -1,7 +1,7 @@
 import crypto from "crypto";
 import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
 import { DynamoDBDocumentClient, QueryCommand, DeleteCommand, PutCommand, GetCommand } from "@aws-sdk/lib-dynamodb";
-export default class LambderSession {
+export default class LambderSessionManager {
     tableName;
     sessionSalt;
     partitionKey;

package/dist/index.d.ts

@@ -3,4 +3,4 @@ export default Lambder;
 export { default as LambderCaller } from "./LambderCaller.js";
 export { default as LambderResponseBuilder } from "./LambderResponseBuilder.js";
 export { default as LambderResolver } from "./LambderResolver.js";
-export { default as LambderSession } from "./LambderSession.js";
+export { default as LambderSessionManager } from "./LambderSessionManager.js";

package/dist/index.js

@@ -3,4 +3,4 @@ export default Lambder;
 export { default as LambderCaller } from "./LambderCaller.js";
 export { default as LambderResponseBuilder } from "./LambderResponseBuilder.js";
 export { default as LambderResolver } from "./LambderResolver.js";
-export { default as LambderSession } from "./LambderSession.js";
+export { default as LambderSessionManager } from "./LambderSessionManager.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "1.0.115",
+  "version": "1.0.117",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/Lambder.ts

@@ -6,11 +6,12 @@ import type { APIGatewayProxyEvent, APIGatewayProxyEventHeaders, Context } from
 import LambderResolver from "./LambderResolver.js";
 import LambderResponseBuilder, { LambderResolverResponse } from "./LambderResponseBuilder.js";
 import LambderUtils from "./LambderUtils.js";
-import LambderSession, { type LambderSessionContext } from "./LambderSession.js";
+import LambderSessionManager, { type LambderSessionContext } from "./LambderSessionManager.js";
+import LambderSessionController from "./LambderSessionController.js";
 
 type Path = `/${string}`;
 
-type LambderRenderContext = {
+export type LambderRenderContext = {
     host: string;
     path: string;
     pathParams: Record<string, any> | null;
@@ -23,6 +24,7 @@ type LambderRenderContext = {
     headers: APIGatewayProxyEventHeaders;
     session: LambderSessionContext|null;
     lambdaContext: Context;
+    _otherInternal: { isApiCall: boolean };
 };
 
 type LambderModuleFunction = (lambderInstance: Lambder) => void | Promise<void>;
@@ -41,9 +43,6 @@ type GlobalErrorHandlerFunction = (err: Error, ctx: LambderRenderContext|null, r
 type RouteFallbackHandlerFunction = (ctx:LambderRenderContext, resolver: LambderResolver) => LambderResolverResponse;
 type ApiFallbackHandlerFunction = (ctx:LambderRenderContext, resolver: LambderResolver) => LambderResolverResponse;
 
-const isApiCallChecker = (method: string, path: string, post: Record<any,any>, apiPath: string): boolean => {
-    return method === "POST" && apiPath && path === apiPath && post.apiName;
-}
 
 export const createContext = (
     event: APIGatewayProxyEvent, 
@@ -58,6 +57,7 @@ export const createContext = (
     const cookie = cookieParser.parse(event.headers.Cookie || event.headers.cookie || "");
     const headers = event.headers;
     const session = null;
+    
     // Decode body for the post
     let post: Record<string, any> = {};
     try {
@@ -66,11 +66,18 @@ export const createContext = (
         catch(e){ post = querystring.parse(decodedBody) || {}; }
     }catch(e){}
     // Parse api variables
-    const isApiCall = isApiCallChecker(method, path, post, apiPath);
+
+    const isApiCall = method === "POST" && apiPath && path === apiPath && post.apiName;
     const apiName:string = isApiCall ? post.apiName : null;
     const apiPayload:string = isApiCall ? post.payload : null;
 
-    return { host, path, pathParams, method, get, post, cookie, apiName, apiPayload, headers, session, lambdaContext };
+    return { 
+        host, path, pathParams, method, 
+        get, post, cookie, 
+        apiName, apiPayload, 
+        headers, session, lambdaContext, 
+        _otherInternal: { isApiCall } 
+    };
 }
 
 
@@ -93,7 +100,7 @@ export default class Lambder {
 
     public utils: LambderUtils;
 
-    private lambderSession?: LambderSession;
+    private lambderSessionManager?: LambderSessionManager;
     private sessionTokenCookieKey = "LMDRSESSIONTKID";
     private sessionCsrfCookieKey = "LMDRSESSIONCSTK";
     
@@ -124,7 +131,7 @@ export default class Lambder {
         { tableName, tableRegion, sessionSalt }: { tableName: string; tableRegion: string; sessionSalt: string; }, 
         { partitionKey, sortKey }: { partitionKey: string, sortKey: string } = { partitionKey: "pk", sortKey: "sk" }
     ){
-        this.lambderSession = new LambderSession({
+        this.lambderSessionManager = new LambderSessionManager({
             tableName, tableRegion, partitionKey, sortKey, sessionSalt
         });
     }
@@ -151,56 +158,6 @@ export default class Lambder {
     private testPatternMatch(pattern: string, path: string): boolean{
         return (match(pattern, { decode: decodeURIComponent }))(path) !== false;
     }
-
-    async fetchSessionIfExist(ctx: LambderRenderContext): Promise<LambderSessionContext|null>{
-        try {
-            return await this.fetchSession(ctx);
-        }catch(err){
-            return null;
-        }
-    }
-
-    async fetchSession (ctx: LambderRenderContext): Promise<LambderSessionContext>{
-        if(!this.lambderSession) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
-        if(!this.areRequestSessionTokensValid(ctx)){ throw new Error("Session tokens are invalid"); }
-
-        const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-        if(!sessionToken) throw new Error("Session token not found");
-        
-        const session = await this.lambderSession.getSession(sessionToken);
-        if(!session) throw new Error("Session not found");
-        
-        if(!this.isSessionValid(ctx, session)) throw new Error("Invalid session");
-        ctx.session = session;
-        return session;
-    };
-
-    private areRequestSessionTokensValid(ctx: LambderRenderContext): boolean {
-        const isApiCall = isApiCallChecker(ctx.method, ctx.path, ctx.post, this.apiPath);
-        const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-        const isSessionTokenValid = sessionToken && sessionToken?.split(":")?.length === 2;
-
-        if(isApiCall){
-            const csrfToken = ctx.post?.token;
-            const isCsrfTokenValid = typeof csrfToken === "string" && csrfToken.length > 0
-            return isSessionTokenValid && isCsrfTokenValid;
-        }else{
-            return isSessionTokenValid;
-        }
-    }
-    
-    private isSessionValid(ctx: LambderRenderContext, session: any): boolean {
-        if(!this.lambderSession) return false;
-        const isApiCall = isApiCallChecker(ctx.method, ctx.path, ctx.post, this.apiPath);
-        if(isApiCall){
-            const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-            const csrfToken = ctx.post?.token;
-            return this.lambderSession.isSessionValid(session, sessionToken, csrfToken);
-        }else{
-            const sessionToken = ctx.cookie?.[this.sessionTokenCookieKey];
-            return this.lambderSession.isSessionValid(session, sessionToken, null, true);
-        }
-    }
     
     private async handleNoMatchedAction(ctx: LambderRenderContext, resolver: LambderResolver){
         for(const hook of this.hookList["fallback"]){  await hook.hookFn(ctx, resolver); }
@@ -258,7 +215,8 @@ export default class Lambder {
                 )
             ), 
             actionFn: async (ctx:LambderRenderContext, resolver: LambderResolver) => {
-                await this.fetchSession(ctx);
+                await this.getSessionController(ctx).fetchSession();
+
                 if(typeof condition === "string"){
                     ctx.pathParams = this.getPatternMatch(condition, ctx.path);
                 }else if(condition?.constructor == RegExp){
@@ -292,7 +250,7 @@ export default class Lambder {
                 )
             ), 
             actionFn: async (ctx:LambderRenderContext, resolver: LambderResolver) => {
-                await this.fetchSession(ctx);
+                await this.getSessionController(ctx).fetchSession();
                 return await actionFn(ctx, resolver);
             }
         });
@@ -315,36 +273,14 @@ export default class Lambder {
         }
     }
 
-    getSessionController(ctx: LambderRenderContext){
-        return {
-            createSession: async (sessionKey: string, data?: any, ttlInSeconds?: number): Promise<LambderSessionContext> => {
-                if(!this.lambderSession) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
-                ctx.session = await this.lambderSession.createSession(sessionKey, data, ttlInSeconds);
-                return ctx.session;
-            },
-            fetchSession: async (): Promise<LambderSessionContext> => {
-                if(!this.lambderSession) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
-                return this.fetchSession(ctx);
-            },
-            updateSessionData: async (newData: any): Promise<LambderSessionContext> => {
-                if(!this.lambderSession) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
-                if(!ctx.session) throw new Error("Session not found.");
-                ctx.session = await this.lambderSession.updateSessionData(ctx.session, newData);
-                return ctx.session;
-            },
-            endSession: async () => {
-                if(!this.lambderSession) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
-                if(!ctx.session) throw new Error("Session not found.");
-                await this.lambderSession.deleteSession(ctx.session);
-                ctx.session = null
-            },
-            endSessionAll: async () => {
-                if(!this.lambderSession) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
-                if(!ctx.session) throw new Error("Session not found.");
-                await this.lambderSession.deleteSessionAll(ctx.session);
-                ctx.session = null
-            },
-        }
+    getSessionController(ctx: LambderRenderContext): LambderSessionController{
+        if(!this.lambderSessionManager) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
+
+        return new LambderSessionController({
+            lambderSessionManager: this.lambderSessionManager,
+            sessionTokenCookieKey: this.sessionTokenCookieKey,
+            ctx, 
+        });
     }
 
     getResponseBuilder(){

package/src/LambderSessionController.ts

@@ -0,0 +1,94 @@
+import { LambderRenderContext } from "./Lambder.js";
+import type LambderSessionManager from "./LambderSessionManager.js";
+import type { LambderSessionContext } from "./LambderSessionManager.js";
+
+export default class LambderSessionController {
+    lambderSessionManager: LambderSessionManager;
+    sessionTokenCookieKey: string;
+    ctx: LambderRenderContext;
+
+    constructor(
+        { 
+            lambderSessionManager,
+            sessionTokenCookieKey,
+            ctx,
+        }: {
+            lambderSessionManager: LambderSessionManager,
+            sessionTokenCookieKey: string,
+            ctx: LambderRenderContext,
+        }
+    ){
+        this.ctx = ctx;
+        this.sessionTokenCookieKey = sessionTokenCookieKey;
+        this.lambderSessionManager = lambderSessionManager;
+    };
+
+    private areRequestSessionTokensValid(): boolean {
+        const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
+        const isSessionTokenValid = sessionToken && sessionToken?.split(":")?.length === 2;
+
+        if(this.ctx._otherInternal.isApiCall){
+            const csrfToken = this.ctx.post?.token;
+            const isCsrfTokenValid = typeof csrfToken === "string" && csrfToken.length > 0
+            return isSessionTokenValid && isCsrfTokenValid;
+        }else{
+            return isSessionTokenValid;
+        }
+    };
+
+    async createSession (sessionKey: string, data?: any, ttlInSeconds?: number): Promise<LambderSessionContext> {
+        this.ctx.session = await this.lambderSessionManager.createSession(sessionKey, data, ttlInSeconds);
+        return this.ctx.session;
+    };
+
+    async fetchSession (): Promise<LambderSessionContext>{
+        if(!this.areRequestSessionTokensValid()){ throw new Error("Session tokens are invalid"); }
+
+        const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
+        if(!sessionToken) throw new Error("Session token not found");
+        
+        const session = await this.lambderSessionManager.getSession(sessionToken);
+        if(!session) throw new Error("Session not found");
+        
+        if(!this.isSessionValid(session)) throw new Error("Invalid session");
+        this.ctx.session = session;
+        return session;
+    };
+
+    async fetchSessionIfExists (): Promise<LambderSessionContext|null> {
+        try {
+            return await this.fetchSession();
+        }catch(err){
+            return null;
+        }
+    };
+
+    isSessionValid(session: any): boolean {
+        if(this.ctx._otherInternal.isApiCall){
+            const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
+            const csrfToken = this.ctx.post?.token;
+            return this.lambderSessionManager.isSessionValid(session, sessionToken, csrfToken);
+        }else{
+            const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
+            return this.lambderSessionManager.isSessionValid(session, sessionToken, null, true);
+        }
+    };
+
+    async updateSessionData (newData: any): Promise<LambderSessionContext> {
+        if(!this.ctx.session) throw new Error("Session not found.");
+        this.ctx.session = await this.lambderSessionManager.updateSessionData(this.ctx.session, newData);
+        return this.ctx.session;
+    };
+
+    async endSession (){
+        if(!this.ctx.session) throw new Error("Session not found.");
+        await this.lambderSessionManager.deleteSession(this.ctx.session);
+        this.ctx.session = null
+    };
+
+    async endSessionAll (){
+        if(!this.ctx.session) throw new Error("Session not found.");
+        await this.lambderSessionManager.deleteSessionAll(this.ctx.session);
+        this.ctx.session = null
+    };
+};

package/src/{LambderSession.ts → LambderSessionManager.ts}

@@ -14,7 +14,7 @@ export type LambderSessionContext = {
 };
 
 
-export default class LambderSession{
+export default class LambderSessionManager{
     private tableName: string;
     private sessionSalt: string;
     private partitionKey: string;

package/src/index.ts

@@ -4,4 +4,4 @@ export default Lambder;
 export { default as LambderCaller } from "./LambderCaller.js";
 export { default as LambderResponseBuilder } from "./LambderResponseBuilder.js";
 export { default as LambderResolver } from "./LambderResolver.js";
-export { default as LambderSession } from "./LambderSession.js";
+export { default as LambderSessionManager } from "./LambderSessionManager.js";