lambder 1.0.144 → 1.0.146

package/dist/Lambder.d.ts

@@ -14,10 +14,10 @@ export type LambderRenderContext<TApiPayload = any> = {
     get: Record<string, any>;
     post: Record<string, any>;
     cookie: Record<string, any>;
+    session: null;
     apiName: string;
     apiPayload: TApiPayload;
     headers: APIGatewayProxyEventHeaders;
-    session: LambderSessionContext | null;
     event: APIGatewayProxyEvent;
     lambdaContext: Context;
     _otherInternal: {
@@ -34,9 +34,13 @@ export type LambderRenderContext<TApiPayload = any> = {
         logToApiResponseAccumulator: any[];
     };
 };
+export type LambderSessionRenderContext<TApiPayload = any, SessionData = any> = Omit<LambderRenderContext<TApiPayload>, 'session'> & {
+    session: LambderSessionContext<SessionData>;
+};
 type LambderModuleFunction = (lambderInstance: Lambder) => void | Promise<void>;
 type ConditionFunction = (ctx: LambderRenderContext<any>) => boolean;
 type ActionFunction = (ctx: LambderRenderContext<any>, resolver: LambderResolver) => LambderResolverResponse | Promise<LambderResolverResponse>;
+type SessionActionFunction<SessionData = any> = (ctx: LambderSessionRenderContext<any, SessionData>, resolver: LambderResolver) => LambderResolverResponse | Promise<LambderResolverResponse>;
 type HookCreatedFunction = (lambderInstance: Lambder) => Promise<void>;
 type HookBeforeRenderFunction = (ctx: LambderRenderContext<any>, resolver: LambderResolver) => LambderRenderContext<any> | Error | Promise<LambderRenderContext<any> | Error>;
 type HookAfterRenderFunction = (ctx: LambderRenderContext<any>, resolver: LambderResolver, response: LambderResolverResponse) => LambderResolverResponse | Error | Promise<LambderResolverResponse | Error>;
@@ -45,7 +49,7 @@ type GlobalErrorHandlerFunction = (err: Error, ctx: LambderRenderContext<any> |
 type RouteFallbackHandlerFunction = (ctx: LambderRenderContext<any>, resolver: LambderResolver) => LambderResolverResponse;
 type ApiFallbackHandlerFunction = (ctx: LambderRenderContext<any>, resolver: LambderResolver) => LambderResolverResponse;
 export declare const createContext: (event: APIGatewayProxyEvent, lambdaContext: Context, apiPath: string) => LambderRenderContext<any>;
-export default class Lambder<TContract extends ApiContractShape = any> {
+export default class Lambder<TContract extends ApiContractShape = any, TSessionData = any> {
     apiPath: string;
     apiVersion: null | string;
     isCorsEnabled: boolean;
@@ -88,18 +92,18 @@ export default class Lambder<TContract extends ApiContractShape = any> {
         default: LambderModuleFunction;
     }>): Promise<void>;
     addRoute(condition: Path | ConditionFunction | RegExp, actionFn: ActionFunction): void;
-    addSessionRoute(condition: Path | ConditionFunction | RegExp, actionFn: ActionFunction): void;
+    addSessionRoute(condition: Path | ConditionFunction | RegExp, actionFn: SessionActionFunction<TSessionData>): void;
     addApi(apiName: ConditionFunction | RegExp, actionFn: ActionFunction): void;
     addApi<TApiName extends keyof TContract & string>(apiName: TApiName, actionFn: (ctx: LambderRenderContext<TContract[TApiName]['input']>, resolver: LambderResolver<TContract, TApiName>) => LambderResolverResponse | Promise<LambderResolverResponse>): void;
     addApi(apiName: string, actionFn: ActionFunction): void;
-    addSessionApi(apiName: ConditionFunction | RegExp, actionFn: ActionFunction): void;
-    addSessionApi<TApiName extends keyof TContract & string>(apiName: TApiName, actionFn: (ctx: LambderRenderContext<TContract[TApiName]['input']>, resolver: LambderResolver<TContract, TApiName>) => LambderResolverResponse | Promise<LambderResolverResponse>): void;
-    addSessionApi(apiName: string, actionFn: ActionFunction): void;
+    addSessionApi(apiName: ConditionFunction | RegExp, actionFn: SessionActionFunction<TSessionData>): void;
+    addSessionApi<TApiName extends keyof TContract & string>(apiName: TApiName, actionFn: (ctx: LambderSessionRenderContext<TContract[TApiName]['input'], TSessionData>, resolver: LambderResolver<TContract, TApiName>) => LambderResolverResponse | Promise<LambderResolverResponse>): void;
+    addSessionApi(apiName: string, actionFn: SessionActionFunction<TSessionData>): void;
     addHook(hookEvent: 'created', hookFn: HookCreatedFunction, priority?: number): Promise<void>;
     addHook(hookEvent: 'beforeRender', hookFn: HookBeforeRenderFunction, priority?: number): Promise<void>;
     addHook(hookEvent: 'afterRender', hookFn: HookAfterRenderFunction, priority?: number): Promise<void>;
     addHook(hookEvent: 'fallback', hookFn: HookFallbackFunction, priority?: number): Promise<void>;
-    getSessionController(ctx: LambderRenderContext<any>): LambderSessionController;
+    getSessionController(ctx: LambderRenderContext<any> | LambderSessionRenderContext<any, TSessionData>): LambderSessionController<TSessionData>;
     getResponseBuilder(): LambderResponseBuilder<any>;
     private getResolver;
     render(event: APIGatewayProxyEvent, lambdaContext: Context): Promise<LambderResolverResponse>;

package/dist/Lambder.js

@@ -1,4 +1,3 @@
-import querystring from "querystring";
 import cookieParser from "cookie";
 import { match } from "path-to-regexp";
 import LambderResolver from "./LambderResolver.js";
@@ -14,7 +13,6 @@ export const createContext = (event, lambdaContext, apiPath) => {
     const method = event.httpMethod;
     const cookie = cookieParser.parse(event.headers.Cookie || event.headers.cookie || "");
     const headers = event.headers;
-    const session = null;
     // Decode body for the post
     let post = {};
     try {
@@ -23,7 +21,11 @@ export const createContext = (event, lambdaContext, apiPath) => {
             post = JSON.parse(decodedBody) || {};
         }
         catch (e) {
-            post = querystring.parse(decodedBody) || {};
+            const params = new URLSearchParams(decodedBody);
+            post = {};
+            for (const [key, value] of params.entries()) {
+                post[key] = value;
+            }
         }
     }
     catch (e) { }
@@ -35,8 +37,9 @@ export const createContext = (event, lambdaContext, apiPath) => {
     return {
         host, path, pathParams, method,
         get, post, cookie, event,
+        session: null,
         apiName, apiPayload,
-        headers, session, lambdaContext,
+        headers, lambdaContext,
         _otherInternal: {
             isApiCall, requestVersion,
             setHeaderFnAccumulator: [],
@@ -152,14 +155,18 @@ export default class Lambder {
                     (typeof condition === "function" && condition(ctx)) ||
                     (condition?.constructor == RegExp && condition.test(ctx.path)))),
             actionFn: async (ctx, resolver) => {
-                await this.getSessionController(ctx).fetchSession();
                 if (typeof condition === "string") {
                     ctx.pathParams = this.getPatternMatch(condition, ctx.path);
                 }
                 else if (condition?.constructor == RegExp) {
                     ctx.pathParams = ctx.path.match(condition);
                 }
-                return await actionFn(ctx, resolver);
+                const sessionCtx = ctx;
+                await this.getSessionController(ctx).fetchSession();
+                if (!sessionCtx.session) {
+                    throw new Error("Session not found.");
+                }
+                return await actionFn(sessionCtx, resolver);
             }
         });
     }
@@ -181,8 +188,12 @@ export default class Lambder {
                 (typeof apiName === "function" && apiName(ctx)) ||
                 (apiName?.constructor == RegExp && apiName.test(ctx.apiName)))),
             actionFn: async (ctx, resolver) => {
+                const sessionCtx = ctx;
                 await this.getSessionController(ctx).fetchSession();
-                return await actionFn(ctx, resolver);
+                if (!sessionCtx.session) {
+                    throw new Error("Session not found.");
+                }
+                return await actionFn(sessionCtx, resolver);
             }
         });
     }

package/dist/LambderMSW.js

@@ -1,3 +1,5 @@
+import { createRequire } from 'module';
+const require = createRequire(import.meta.url);
 export default class LambderMSW {
     apiPath;
     apiVersion;

package/dist/LambderResponseBuilder.js

@@ -28,12 +28,12 @@ export default class LambderResponseBuilder {
             throw new Error("File system operations are not available in browser environment");
         }
         const publicPath = path.resolve(this.publicPath);
-        const absolutePath = path.join(publicPath, filePath);
+        const absolutePath = path.resolve(publicPath, filePath);
         console.log("readPublicFileSync", { filePath, publicPath, absolutePath });
-        if (!absolutePath.includes(publicPath)) {
+        if (!absolutePath.startsWith(publicPath)) {
             return "forbidden-public-path";
         }
-        return fs.readFileSync(absolutePath);
+        return await fs.promises.readFile(absolutePath);
     }
     ;
     async checkPublicFileExist(filePath) {
@@ -43,12 +43,18 @@ export default class LambderResponseBuilder {
             return false;
         }
         const publicPath = path.resolve(this.publicPath);
-        const absolutePath = path.join(this.publicPath, filePath);
+        const absolutePath = path.resolve(publicPath, filePath);
         console.log("checkPublicFileExist", { filePath, publicPath, absolutePath });
-        if (!absolutePath.includes(publicPath)) {
+        if (!absolutePath.startsWith(publicPath)) {
+            return false;
+        }
+        try {
+            const stat = await fs.promises.stat(absolutePath);
+            return stat.isFile();
+        }
+        catch {
             return false;
         }
-        return fs.existsSync(absolutePath) && fs.statSync(absolutePath).isFile();
     }
     ;
     addHeader(key, value) {

package/dist/LambderSessionController.d.ts

@@ -1,21 +1,21 @@
-import { LambderRenderContext } from "./Lambder.js";
+import { LambderRenderContext, LambderSessionRenderContext } from "./Lambder.js";
 import type LambderSessionManager from "./LambderSessionManager.js";
 import type { LambderSessionContext } from "./LambderSessionManager.js";
-export default class LambderSessionController {
+export default class LambderSessionController<TSessionData = any> {
     lambderSessionManager: LambderSessionManager;
     sessionTokenCookieKey: string;
     sessionCsrfCookieKey: string;
-    ctx: LambderRenderContext<any>;
+    ctx: LambderRenderContext<any> | LambderSessionRenderContext<any, TSessionData>;
     constructor({ lambderSessionManager, sessionTokenCookieKey, sessionCsrfCookieKey, ctx, }: {
         lambderSessionManager: LambderSessionManager;
         sessionTokenCookieKey: string;
         sessionCsrfCookieKey: string;
-        ctx: LambderRenderContext<any>;
+        ctx: LambderRenderContext<any> | LambderSessionRenderContext<any, TSessionData>;
     });
     private areRequestSessionTokensValid;
-    createSession(sessionKey: string, data?: any, ttlInSeconds?: number): Promise<LambderSessionContext>;
-    regenerateSession(): Promise<LambderSessionContext>;
-    fetchSession(): Promise<LambderSessionContext>;
+    createSession(sessionKey: string, data?: TSessionData, ttlInSeconds?: number): Promise<LambderSessionContext<TSessionData>>;
+    regenerateSession(): Promise<LambderSessionContext<TSessionData>>;
+    fetchSession(): Promise<LambderSessionContext<TSessionData>>;
     fetchSessionIfExists(): Promise<LambderSessionContext | null>;
     isSessionValid(session: any): boolean;
     updateSessionData(newData: any): Promise<LambderSessionContext>;

package/dist/LambderSessionController.js

@@ -2,7 +2,7 @@ export default class LambderSessionController {
     lambderSessionManager;
     sessionTokenCookieKey;
     sessionCsrfCookieKey;
-    ctx;
+    ctx; // Internal context with mutable session property
     constructor({ lambderSessionManager, sessionTokenCookieKey, sessionCsrfCookieKey, ctx, }) {
         this.lambderSessionManager = lambderSessionManager;
         this.sessionTokenCookieKey = sessionTokenCookieKey;

package/dist/LambderSessionManager.d.ts

@@ -1,9 +1,9 @@
-export type LambderSessionContext = {
+export type LambderSessionContext<SessionData = any> = {
     [x: string]: any;
     sessionToken: string;
     csrfToken: string;
     sessionKey: string;
-    data: any;
+    data: SessionData;
     createdAt: number;
     expiresAt: number;
     lastAccessedAt: number;

package/dist/LambderSessionManager.js

@@ -128,8 +128,8 @@ export default class LambderSessionManager {
             if (this.enableSlidingExpiration) {
                 session.lastAccessedAt = Math.floor(Date.now() / 1000);
                 session.expiresAt = session.lastAccessedAt + session.ttlInSeconds;
-                // Fire and forget - don't wait for the update
-                this.ddbPutItem(session).catch(() => { });
+                // Wait for the update to ensure it persists before Lambda freezes
+                await this.ddbPutItem(session).catch(() => { });
             }
             return session;
         }

package/dist/LambderUtils.js

@@ -16,12 +16,12 @@ export default class LambderUtils {
             return "EJS PATH NOT SET!";
         }
         const ejsPath = path.resolve(this.ejsPath);
-        const absolutePath = path.join(ejsPath, filePath);
+        const absolutePath = path.resolve(ejsPath, filePath);
         console.log("readEjsFileSync", { filePath, ejsPath, absolutePath });
-        if (!absolutePath.includes(ejsPath)) {
+        if (!absolutePath.startsWith(ejsPath)) {
             return "forbidden-ejs-path";
         }
-        return String(fs.readFileSync(absolutePath));
+        return String(await fs.promises.readFile(absolutePath));
     }
     ;
     async checkEjsFileExist(filePath) {
@@ -34,12 +34,18 @@ export default class LambderUtils {
             return "EJS PATH NOT SET!";
         }
         const ejsPath = path.resolve(this.ejsPath);
-        const absolutePath = path.join(this.ejsPath, filePath);
+        const absolutePath = path.resolve(ejsPath, filePath);
         console.log("checkEjsFileExist", { filePath, ejsPath, absolutePath });
-        if (!absolutePath.includes(ejsPath)) {
+        if (!absolutePath.startsWith(ejsPath)) {
+            return false;
+        }
+        try {
+            const stat = await fs.promises.stat(absolutePath);
+            return stat.isFile();
+        }
+        catch {
             return false;
         }
-        return fs.existsSync(absolutePath) && fs.statSync(absolutePath).isFile();
     }
     ;
     async renderEjs(template, pageData) {

package/examples/secure-session-example.ts

@@ -31,7 +31,7 @@ lambder.addApi("user.login", async (ctx, resolver) => {
 
     // Create new session
     const sessionController = lambder.getSessionController(ctx);
-    await sessionController.createSession(user.id, {
+    const session = await sessionController.createSession(user.id, {
         userId: user.id,
         username: user.username,
         role: user.role,
@@ -39,14 +39,14 @@ lambder.addApi("user.login", async (ctx, resolver) => {
 
     return resolver.api({
         success: true,
-        csrfToken: ctx.session?.csrfToken,
+        csrfToken: session.csrfToken,
     });
 });
 
 // Example: Protected API that requires session
 lambder.addSessionApi("user.profile", async (ctx, resolver) => {
     // Session is automatically fetched and validated
-    const sessionData = ctx.session?.data;
+    const sessionData = ctx.session.data;
 
     return resolver.api({
         userId: sessionData.userId,
@@ -62,7 +62,7 @@ lambder.addSessionApi("user.changePassword", async (ctx, resolver) => {
 
     // Validate old password
     const isValid = await validatePassword(
-        ctx.session?.data.userId,
+        ctx.session.data.userId,
         oldPassword
     );
     if (!isValid) {
@@ -70,10 +70,10 @@ lambder.addSessionApi("user.changePassword", async (ctx, resolver) => {
     }
 
     // Update password
-    await updatePassword(ctx.session?.data.userId, newPassword);
+    await updatePassword(ctx.session.data.userId, newPassword);
 
     // IMPORTANT: Regenerate session after password change to prevent session fixation
-    await sessionController.regenerateSession();
+    const newSession = await sessionController.regenerateSession();
 
     // OPTIONAL: End all other sessions for this user
     await sessionController.endSessionAll();
@@ -81,7 +81,7 @@ lambder.addSessionApi("user.changePassword", async (ctx, resolver) => {
     return resolver.api({
         success: true,
         message: "Password changed successfully",
-        csrfToken: ctx.session?.csrfToken, // Send new CSRF token
+        csrfToken: newSession.csrfToken, // Send new CSRF token
     });
 });
 
@@ -92,7 +92,7 @@ lambder.addSessionApi("user.updatePreferences", async (ctx, resolver) => {
 
     // Update session data (also extends expiration if sliding is enabled)
     await sessionController.updateSessionData({
-        ...ctx.session?.data,
+        ...ctx.session.data,
         preferences: { theme, language },
     });
 
@@ -151,11 +151,11 @@ lambder.addApi("user.checkAuth", async (ctx, resolver) => {
 // Example: Route with session
 lambder.addSessionRoute("/dashboard", async (ctx, resolver) => {
     // Session is automatically fetched and validated
-    const userData = ctx.session?.data;
+    const userData = ctx.session.data;
 
     return resolver.ejsFile("dashboard.ejs", {
         user: userData,
-        csrfToken: ctx.session?.csrfToken,
+        csrfToken: ctx.session.csrfToken,
     });
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "1.0.144",
+  "version": "1.0.146",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -55,6 +55,7 @@
     "@types/path-to-regexp": "^1.7.0",
     "@typescript-eslint/eslint-plugin": "^7.2.0",
     "@typescript-eslint/parser": "^7.2.0",
+    "aws-sdk-client-mock": "^4.1.0",
     "eslint": "^8.57.0",
     "typescript": "^5.9.3",
     "vitest": "^3.2.4"

package/src/Lambder.ts

@@ -1,4 +1,3 @@
-import querystring from "querystring";
 import cookieParser from "cookie";
 import { match } from "path-to-regexp";
 
@@ -20,10 +19,10 @@ export type LambderRenderContext<TApiPayload = any> = {
     get: Record<string, any>;
     post: Record<string, any>;
     cookie: Record<string, any>;
+    session: null;
     apiName: string;
     apiPayload: TApiPayload;
     headers: APIGatewayProxyEventHeaders;
-    session: LambderSessionContext|null;
     event: APIGatewayProxyEvent;
     lambdaContext: Context;
     _otherInternal: { 
@@ -35,11 +34,17 @@ export type LambderRenderContext<TApiPayload = any> = {
     };
 };
 
+export type LambderSessionRenderContext<
+    TApiPayload = any, SessionData = any
+> = Omit<LambderRenderContext<TApiPayload>, 'session'> & { session: LambderSessionContext<SessionData> };
+
 type LambderModuleFunction = (lambderInstance: Lambder) => void | Promise<void>;
 
 type ConditionFunction = (ctx: LambderRenderContext<any>) => boolean;
 type ActionFunction = (ctx: LambderRenderContext<any>, resolver: LambderResolver) => LambderResolverResponse|Promise<LambderResolverResponse>;
-type ActionObject = { conditionFn: ConditionFunction, actionFn: ActionFunction };
+type SessionActionFunction<SessionData = any> = (ctx: LambderSessionRenderContext<any, SessionData>, resolver: LambderResolver) => LambderResolverResponse|Promise<LambderResolverResponse>;
+
+type ActionObject = { conditionFn: ConditionFunction, actionFn: ActionFunction | SessionActionFunction };
 
 type HookEventType = "created"|"beforeRender"|"afterRender"|"fallback";
 type HookCreatedFunction = (lambderInstance: Lambder) => Promise<void>;
@@ -64,14 +69,19 @@ export const createContext = (
     const method = event.httpMethod;
     const cookie = cookieParser.parse(event.headers.Cookie || event.headers.cookie || "");
     const headers = event.headers;
-    const session = null;
     
     // Decode body for the post
     let post: Record<string, any> = {};
     try {
         const decodedBody = event.isBase64Encoded ? ( event.body ? Buffer.from(event.body,"base64").toString() : "{}" ) : ( event.body || "{}" );
         try { post = JSON.parse(decodedBody) || {}; }
-        catch(e){ post = querystring.parse(decodedBody) || {}; }
+        catch(e){ 
+            const params = new URLSearchParams(decodedBody);
+            post = {};
+            for(const [key, value] of params.entries()){
+                post[key] = value;
+            }
+        }
     }catch(e){}
     // Parse api variables
 
@@ -83,8 +93,9 @@ export const createContext = (
     return { 
         host, path, pathParams, method, 
         get, post, cookie, event,
+        session: null,
         apiName, apiPayload, 
-        headers, session, lambdaContext, 
+        headers, lambdaContext, 
         _otherInternal: { 
             isApiCall, requestVersion,
             setHeaderFnAccumulator: [], 
@@ -95,7 +106,7 @@ export const createContext = (
 }
 
 
-export default class Lambder<TContract extends ApiContractShape = any> {
+export default class Lambder<TContract extends ApiContractShape = any, TSessionData = any> {
     public apiPath: string;
     public apiVersion: null|string;
     public isCorsEnabled: boolean = false;
@@ -218,7 +229,7 @@ export default class Lambder<TContract extends ApiContractShape = any> {
         });
     };
 
-    addSessionRoute(condition: Path|ConditionFunction|RegExp, actionFn: ActionFunction):void{
+    addSessionRoute(condition: Path|ConditionFunction|RegExp, actionFn: SessionActionFunction<TSessionData>):void{
         this.actionList.push({ 
             conditionFn: (ctx:LambderRenderContext<any>) => (
                 ctx.method === "GET" &&
@@ -229,14 +240,17 @@ export default class Lambder<TContract extends ApiContractShape = any> {
                 )
             ), 
             actionFn: async (ctx:LambderRenderContext<any>, resolver: LambderResolver) => {
-                await this.getSessionController(ctx).fetchSession();
-
                 if(typeof condition === "string"){
                     ctx.pathParams = this.getPatternMatch(condition, ctx.path);
                 }else if(condition?.constructor == RegExp){
                     ctx.pathParams = ctx.path.match(condition);
                 }
-                return await actionFn(ctx, resolver);
+
+                const sessionCtx = ctx as unknown as LambderSessionRenderContext<any, TSessionData>;
+                await this.getSessionController(ctx).fetchSession();
+                if(!sessionCtx.session){ throw new Error("Session not found."); }
+
+                return await actionFn(sessionCtx, resolver);
             }
         });
     };
@@ -276,23 +290,23 @@ export default class Lambder<TContract extends ApiContractShape = any> {
     // Overload for untyped session API with RegExp or function
     addSessionApi(
         apiName: ConditionFunction|RegExp,
-        actionFn: ActionFunction
+        actionFn: SessionActionFunction<TSessionData>
     ):void;
     // Overload for typed session API with string name (must come before untyped string overload)
     addSessionApi<TApiName extends keyof TContract & string>(
         apiName: TApiName,
         actionFn: (
-            ctx: LambderRenderContext<TContract[TApiName]['input']>,
+            ctx: LambderSessionRenderContext<TContract[TApiName]['input'], TSessionData>,
             resolver: LambderResolver<TContract, TApiName>
         ) => LambderResolverResponse|Promise<LambderResolverResponse>
     ):void;
     // Overload for untyped session API with string (backward compatibility, must be last)
     addSessionApi(
         apiName: string,
-        actionFn: ActionFunction
+        actionFn: SessionActionFunction<TSessionData>
     ):void;
     // Implementation
-    addSessionApi(apiName: string|ConditionFunction|RegExp, actionFn: ActionFunction):void{
+    addSessionApi(apiName: string|ConditionFunction|RegExp, actionFn: SessionActionFunction<TSessionData>):void{
         this.actionList.push({ 
             conditionFn: (ctx:LambderRenderContext<any>) =>  (
                 !!ctx.apiName && (
@@ -302,8 +316,10 @@ export default class Lambder<TContract extends ApiContractShape = any> {
                 )
             ), 
             actionFn: async (ctx:LambderRenderContext<any>, resolver: LambderResolver) => {
+                const sessionCtx = ctx as unknown as LambderSessionRenderContext<any, TSessionData>;
                 await this.getSessionController(ctx).fetchSession();
-                return await actionFn(ctx, resolver);
+                if(!sessionCtx.session){ throw new Error("Session not found."); }
+                return await actionFn(sessionCtx, resolver);
             }
         });
     };
@@ -325,10 +341,10 @@ export default class Lambder<TContract extends ApiContractShape = any> {
         }
     }
 
-    getSessionController(ctx: LambderRenderContext<any>): LambderSessionController{
+    getSessionController(ctx: LambderRenderContext<any> | LambderSessionRenderContext<any, TSessionData>): LambderSessionController<TSessionData>{
         if(!this.lambderSessionManager) throw new Error("Session is not enabled. Use lambder.enableDdbSession(...) to enable.");
 
-        return new LambderSessionController({
+        return new LambderSessionController<TSessionData>({
             lambderSessionManager: this.lambderSessionManager,
             sessionTokenCookieKey: this.sessionTokenCookieKey,
             sessionCsrfCookieKey: this.sessionCsrfCookieKey,
@@ -393,7 +409,7 @@ export default class Lambder<TContract extends ApiContractShape = any> {
                             ctx = hookCtx;
                         }
                         // Run matched action
-                        let response = await firstMatchedAction.actionFn(ctx, resolver);
+                        let response = await firstMatchedAction.actionFn(ctx as any, resolver);
                         // Run afterRender hooks
                         for(const hook of this.hookList["afterRender"]){ 
                             const hookResponse = await hook.hookFn(ctx, resolver, response);

package/src/LambderMSW.ts

@@ -1,6 +1,9 @@
+import { createRequire } from 'module';
 import type { ApiContractShape } from './LambderApiContract';
 import type { LambderApiResponse } from './LambderResponseBuilder';
 
+const require = createRequire(import.meta.url);
+
 // MSW types - these will be resolved at runtime when msw is installed
 type RequestHandler = any;
 

package/src/LambderResponseBuilder.ts

@@ -70,10 +70,10 @@ export default class LambderResponseBuilder<TContract extends ApiContractShape =
         }
         
         const publicPath = path.resolve(this.publicPath);
-        const absolutePath = path.join(publicPath, filePath);
+        const absolutePath = path.resolve(publicPath, filePath);
         console.log("readPublicFileSync", { filePath, publicPath, absolutePath });
-        if(!absolutePath.includes(publicPath)){ return "forbidden-public-path"; }
-        return fs.readFileSync(absolutePath);
+        if(!absolutePath.startsWith(publicPath)){ return "forbidden-public-path"; }
+        return await fs.promises.readFile(absolutePath);
     };
 
     private async checkPublicFileExist(filePath: string){
@@ -83,10 +83,15 @@ export default class LambderResponseBuilder<TContract extends ApiContractShape =
         if (!fs || !path) { return false; }
         
         const publicPath = path.resolve(this.publicPath);
-        const absolutePath = path.join(this.publicPath, filePath);
+        const absolutePath = path.resolve(publicPath, filePath);
         console.log("checkPublicFileExist", { filePath, publicPath, absolutePath });
-        if(!absolutePath.includes(publicPath)){ return false; }
-        return fs.existsSync(absolutePath) && fs.statSync(absolutePath).isFile();
+        if(!absolutePath.startsWith(publicPath)){ return false; }
+        try {
+            const stat = await fs.promises.stat(absolutePath);
+            return stat.isFile();
+        } catch {
+            return false;
+        }
     };
 
     addHeader(key: string, value: string){

package/src/LambderSessionController.ts

@@ -1,12 +1,12 @@
-import { LambderRenderContext } from "./Lambder.js";
+import { LambderRenderContext, LambderSessionRenderContext } from "./Lambder.js";
 import type LambderSessionManager from "./LambderSessionManager.js";
 import type { LambderSessionContext } from "./LambderSessionManager.js";
 
-export default class LambderSessionController {
+export default class LambderSessionController<TSessionData = any> {
     lambderSessionManager: LambderSessionManager;
     sessionTokenCookieKey: string;
     sessionCsrfCookieKey: string;
-    ctx: LambderRenderContext<any>;
+    ctx: LambderRenderContext<any> | LambderSessionRenderContext<any, TSessionData>; // Internal context with mutable session property
 
     constructor(
         { 
@@ -18,7 +18,7 @@ export default class LambderSessionController {
             lambderSessionManager: LambderSessionManager,
             sessionTokenCookieKey: string,
             sessionCsrfCookieKey: string,
-            ctx: LambderRenderContext<any>,
+            ctx: LambderRenderContext<any> | LambderSessionRenderContext<any, TSessionData>,
         }
     ){
         this.lambderSessionManager = lambderSessionManager;
@@ -40,7 +40,7 @@ export default class LambderSessionController {
         }
     };
 
-    async createSession (sessionKey: string, data?: any, ttlInSeconds?: number): Promise<LambderSessionContext> {
+    async createSession (sessionKey: string, data?: TSessionData, ttlInSeconds?: number): Promise<LambderSessionContext<TSessionData>> {
         const session = await this.lambderSessionManager.createSession(sessionKey, data, ttlInSeconds);
         this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=${session.sessionToken}; Expires=${new Date(session.expiresAt * 1000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
         this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionCsrfCookieKey}=${session.csrfToken}; Expires=${new Date(session.expiresAt * 1000).toUTCString()}; Path=/; SameSite=Lax; Secure` });
@@ -48,7 +48,7 @@ export default class LambderSessionController {
         return this.ctx.session;
     };
 
-    async regenerateSession (): Promise<LambderSessionContext> {
+    async regenerateSession (): Promise<LambderSessionContext<TSessionData>> {
         if(!this.ctx.session) throw new Error("Session not found.");
         const newSession = await this.lambderSessionManager.regenerateSession(this.ctx.session);
         this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=${newSession.sessionToken}; Expires=${new Date(newSession.expiresAt * 1000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
@@ -57,7 +57,7 @@ export default class LambderSessionController {
         return this.ctx.session;
     };
 
-    async fetchSession (): Promise<LambderSessionContext>{
+    async fetchSession (): Promise<LambderSessionContext<TSessionData>>{
         if(!this.areRequestSessionTokensValid()){ throw new Error("Session tokens are invalid"); }
 
         const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
@@ -101,7 +101,7 @@ export default class LambderSessionController {
         await this.lambderSessionManager.deleteSession(this.ctx.session);
         this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
         this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionCsrfCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; SameSite=Lax; Secure` });
-        this.ctx.session = null
+        (this.ctx as any).session = null;
     };
 
     async endSessionAll (){
@@ -109,6 +109,6 @@ export default class LambderSessionController {
         await this.lambderSessionManager.deleteSessionAll(this.ctx.session);
         this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
         this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionCsrfCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; SameSite=Lax; Secure` });
-        this.ctx.session = null
+        (this.ctx as any).session = null;
     };
 };