lambder 1.0.128 → 1.0.130

package/dist/LambderSessionManager.js

@@ -7,11 +7,13 @@ export default class LambderSessionManager {
     partitionKey;
     sortKey;
     ddbDocumentClient;
-    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, }) {
+    enableSlidingExpiration;
+    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, enableSlidingExpiration = true, }) {
         this.tableName = tableName;
         this.sessionSalt = sessionSalt;
         this.partitionKey = partitionKey;
         this.sortKey = sortKey;
+        this.enableSlidingExpiration = enableSlidingExpiration;
         const ddbClient = new DynamoDBClient({ region: tableRegion });
         this.ddbDocumentClient = DynamoDBDocumentClient.from(ddbClient);
     }
@@ -20,6 +22,13 @@ export default class LambderSessionManager {
             .update(`${password}${this.sessionSalt}`)
             .digest("hex");
     }
+    constantTimeCompare(a, b) {
+        if (a.length !== b.length)
+            return false;
+        const bufferA = Buffer.from(a, 'utf8');
+        const bufferB = Buffer.from(b, 'utf8');
+        return crypto.timingSafeEqual(new Uint8Array(bufferA), new Uint8Array(bufferB));
+    }
     async ddbGetItem(key) {
         const response = await this.ddbDocumentClient.send(new GetCommand({ TableName: this.tableName, Key: key, ConsistentRead: true }));
         if (response.Item)
@@ -67,15 +76,16 @@ export default class LambderSessionManager {
         const sessionKeyHash = this.sessionUserKeyHasher(sessionKey);
         const sessionSortKey = crypto.randomBytes(32).toString("hex");
         const sessionToken = `${sessionKeyHash}:${sessionSortKey}`;
-        const csrfToken = crypto.randomBytes(8).toString("hex");
+        const csrfToken = crypto.randomBytes(32).toString("hex");
         const createdAt = Math.floor(Date.now() / 1000);
+        const lastAccessedAt = createdAt;
         const expiresAt = Number(createdAt) + Number(ttlInSeconds);
         const session = {
             [this.partitionKey]: sessionKeyHash,
             [this.sortKey]: sessionSortKey,
             sessionToken, csrfToken,
             sessionKey, data,
-            createdAt, expiresAt, ttlInSeconds
+            createdAt, lastAccessedAt, expiresAt, ttlInSeconds
         };
         await this.ddbPutItem(session);
         return session;
@@ -84,6 +94,11 @@ export default class LambderSessionManager {
         if (!session)
             throw new Error("Invalid session");
         session.data = newData;
+        session.lastAccessedAt = Math.floor(Date.now() / 1000);
+        // Update expiration if sliding expiration is enabled
+        if (this.enableSlidingExpiration) {
+            session.expiresAt = session.lastAccessedAt + session.ttlInSeconds;
+        }
         await this.ddbPutItem(session);
         return session;
     }
@@ -96,18 +111,26 @@ export default class LambderSessionManager {
                 [this.partitionKey]: sessionKeyHash,
                 [this.sortKey]: sessionSortKey
             });
+            // Use constant error response to prevent timing attacks
             if (!session)
-                throw new Error("Session not found");
-            if (!session.sessionToken || session.sessionToken !== sessionToken)
-                throw new Error("Not found: session.sessionToken");
+                return null;
+            if (!session.sessionToken || !this.constantTimeCompare(session.sessionToken, sessionToken))
+                return null;
             if (!session.csrfToken)
-                throw new Error("Not found: session.csrfToken");
+                return null;
             if (!session.sessionKey)
-                throw new Error("Not found: session.sessionKey");
+                return null;
             if (!session.createdAt)
-                throw new Error("Not found: session.createdAt");
+                return null;
             if (!session.expiresAt || session.expiresAt < Date.now() / 1000)
-                throw new Error("Not found: session.expiresAt");
+                return null;
+            // Update last accessed time if sliding expiration is enabled
+            if (this.enableSlidingExpiration) {
+                session.lastAccessedAt = Math.floor(Date.now() / 1000);
+                session.expiresAt = session.lastAccessedAt + session.ttlInSeconds;
+                // Fire and forget - don't wait for the update
+                this.ddbPutItem(session).catch(() => { });
+            }
             return session;
         }
         catch (err) {
@@ -120,7 +143,7 @@ export default class LambderSessionManager {
             return false;
         if (!sessionToken || typeof sessionToken !== "string")
             return false;
-        if (session.sessionToken !== sessionToken)
+        if (!this.constantTimeCompare(session.sessionToken, sessionToken))
             return false;
         if (!session.csrfToken)
             return false;
@@ -133,7 +156,7 @@ export default class LambderSessionManager {
         if (!skipCsrfTokenCheck) {
             if (!csrfToken || typeof csrfToken !== "string")
                 return false;
-            if (session.csrfToken !== csrfToken)
+            if (!this.constantTimeCompare(session.csrfToken, csrfToken))
                 return false;
         }
         return true;
@@ -151,5 +174,13 @@ export default class LambderSessionManager {
         return true;
     }
     ;
+    async regenerateSession(session) {
+        if (!session)
+            throw new Error("Invalid session");
+        // Delete old session
+        await this.deleteSession(session);
+        // Create new session with same sessionKey and data but new tokens
+        return await this.createSession(session.sessionKey, session.data, session.ttlInSeconds);
+    }
 }
 ;

package/dist/index.d.ts

@@ -5,3 +5,4 @@ export { default as LambderResponseBuilder } from "./LambderResponseBuilder.js";
 export { default as LambderResolver } from "./LambderResolver.js";
 export { default as LambderSessionManager } from "./LambderSessionManager.js";
 export { type ApiContractShape, type ApiContract, type ApiInput, type ApiOutput, } from "./LambderApiContract.js";
+export { mockLambderApi, mockLambderApiError, mockLambderSessionExpired, mockLambderNotAuthorized, mockLambderVersionExpired, createLambderApiHandler, type HttpHandler, } from "./LambderMSW.js";

package/dist/index.js

@@ -4,3 +4,5 @@ export { default as LambderCaller } from "./LambderCaller.js";
 export { default as LambderResponseBuilder } from "./LambderResponseBuilder.js";
 export { default as LambderResolver } from "./LambderResolver.js";
 export { default as LambderSessionManager } from "./LambderSessionManager.js";
+// MSW mocking utilities (optional - requires msw to be installed)
+export { mockLambderApi, mockLambderApiError, mockLambderSessionExpired, mockLambderNotAuthorized, mockLambderVersionExpired, createLambderApiHandler, } from "./LambderMSW.js";

package/docs/DYNAMODB_SETUP.md

@@ -0,0 +1,96 @@
+# DynamoDB Session Table Setup Guide
+
+This guide helps you set up a DynamoDB table for Lambder session management with all security features enabled.
+
+## Table Creation
+
+### Using Terraform
+
+```hcl
+resource "aws_dynamodb_table" "lambder_sessions" {
+  name           = "lambder-sessions"
+  billing_mode   = "PAY_PER_REQUEST"
+  hash_key       = "pk"
+  range_key      = "sk"
+
+  attribute {
+    name = "pk"
+    type = "S"
+  }
+
+  attribute {
+    name = "sk"
+    type = "S"
+  }
+
+  ttl {
+    enabled        = true
+    attribute_name = "expiresAt"
+  }
+
+  tags = {
+    Purpose = "Session Management"
+  }
+}
+```
+
+## Enable Time to Live (TTL)
+
+TTL automatically removes expired sessions from DynamoDB, saving storage costs.
+
+### Using AWS Console
+
+1. Go to DynamoDB Console
+2. Select your table (`lambder-sessions`)
+3. Navigate to **Additional settings** tab
+4. Click **Edit** under **Time to Live (TTL)**
+5. Enable TTL
+6. Set **TTL attribute** to: `expiresAt`
+7. Save changes
+
+## IAM Permissions
+
+Your Lambda function needs these permissions:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "dynamodb:GetItem",
+        "dynamodb:PutItem",
+        "dynamodb:DeleteItem",
+        "dynamodb:Query"
+      ],
+      "Resource": [
+        "arn:aws:dynamodb:us-east-1:123456789012:table/lambder-sessions"
+      ]
+    }
+  ]
+}
+```
+
+## Session Data Structure
+
+Each session is stored as:
+
+```json
+{
+  "pk": "hash_of_user_id",
+  "sk": "random_64_char_hex",
+  "sessionToken": "hash_of_user_id:random_64_char_hex",
+  "csrfToken": "random_64_char_hex",
+  "sessionKey": "user_123",
+  "data": {
+    "userId": "user_123",
+    "username": "john_doe",
+    "role": "admin"
+  },
+  "createdAt": 1697712000,
+  "lastAccessedAt": 1697712300,
+  "expiresAt": 1700304000,
+  "ttlInSeconds": 2592000
+}
+```