lambder 2.0.18 → 3.0.0

package/src/LambderSessionController.ts

@@ -1,114 +0,0 @@
-import { LambderRenderContext, LambderSessionRenderContext } from "./LambderContext.js";
-import type LambderSessionManager from "./LambderSessionManager.js";
-import type { LambderSessionContext } from "./LambderSessionManager.js";
-
-export default class LambderSessionController<TSessionData = any> {
-    lambderSessionManager: LambderSessionManager;
-    sessionTokenCookieKey: string;
-    sessionCsrfCookieKey: string;
-    ctx: LambderRenderContext<any> | LambderSessionRenderContext<any, TSessionData>; // Internal context with mutable session property
-
-    constructor(
-        { 
-            lambderSessionManager,
-            sessionTokenCookieKey,
-            sessionCsrfCookieKey,
-            ctx,
-        }: {
-            lambderSessionManager: LambderSessionManager,
-            sessionTokenCookieKey: string,
-            sessionCsrfCookieKey: string,
-            ctx: LambderRenderContext<any> | LambderSessionRenderContext<any, TSessionData>,
-        }
-    ){
-        this.lambderSessionManager = lambderSessionManager;
-        this.sessionTokenCookieKey = sessionTokenCookieKey;
-        this.sessionCsrfCookieKey = sessionCsrfCookieKey;
-        this.ctx = ctx;
-    };
-
-    private areRequestSessionTokensValid(): boolean {
-        const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
-        const isSessionTokenValid = sessionToken && sessionToken?.split(":")?.length === 2;
-
-        if(this.ctx._otherInternal.isApiCall){
-            const csrfToken = this.ctx.post?.token;
-            const isCsrfTokenValid = typeof csrfToken === "string" && csrfToken.length > 0
-            return isSessionTokenValid && isCsrfTokenValid;
-        }else{
-            return isSessionTokenValid;
-        }
-    };
-
-    async createSession (sessionKey: string, data?: TSessionData, ttlInSeconds?: number): Promise<LambderSessionContext<TSessionData>> {
-        const session = await this.lambderSessionManager.createSession(sessionKey, data, ttlInSeconds);
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=${session.sessionToken}; Expires=${new Date(session.expiresAt * 1000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionCsrfCookieKey}=${session.csrfToken}; Expires=${new Date(session.expiresAt * 1000).toUTCString()}; Path=/; SameSite=Lax; Secure` });
-        this.ctx.session = session;
-        return this.ctx.session;
-    };
-
-    async regenerateSession (): Promise<LambderSessionContext<TSessionData>> {
-        if(!this.ctx.session) throw new Error("Session not found.");
-        const newSession = await this.lambderSessionManager.regenerateSession(this.ctx.session);
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=${newSession.sessionToken}; Expires=${new Date(newSession.expiresAt * 1000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionCsrfCookieKey}=${newSession.csrfToken}; Expires=${new Date(newSession.expiresAt * 1000).toUTCString()}; Path=/; SameSite=Lax; Secure` });
-        this.ctx.session = newSession;
-        return this.ctx.session;
-    };
-
-    async fetchSession (): Promise<LambderSessionContext<TSessionData>>{
-        if(!this.areRequestSessionTokensValid()){ throw new Error("Session tokens are invalid"); }
-
-        const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
-        if(!sessionToken) throw new Error("Session token not found");
-        
-        const session = await this.lambderSessionManager.getSession(sessionToken);
-        if(!session) throw new Error("Session not found");
-        
-        if(!this.isSessionValid(session)) throw new Error("Invalid session");
-        this.ctx.session = session;
-        return session;
-    };
-
-    async fetchSessionIfExists (): Promise<LambderSessionContext|null> {
-        try {
-            return await this.fetchSession();
-        }catch(err){
-            return null;
-        }
-    };
-
-    isSessionValid(session: any): boolean {
-        if(this.ctx._otherInternal.isApiCall){
-            const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
-            const csrfToken = this.ctx.post?.token;
-            return this.lambderSessionManager.isSessionValid(session, sessionToken, csrfToken);
-        }else{
-            const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
-            return this.lambderSessionManager.isSessionValid(session, sessionToken, null, true);
-        }
-    };
-
-    async updateSessionData (newData: any): Promise<LambderSessionContext> {
-        if(!this.ctx.session) throw new Error("Session not found.");
-        this.ctx.session = await this.lambderSessionManager.updateSessionData(this.ctx.session, newData);
-        return this.ctx.session;
-    };
-
-    async endSession (){
-        if(!this.ctx.session) throw new Error("Session not found.");
-        await this.lambderSessionManager.deleteSession(this.ctx.session);
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionCsrfCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; SameSite=Lax; Secure` });
-        (this.ctx as any).session = null;
-    };
-
-    async endSessionAll (){
-        if(!this.ctx.session) throw new Error("Session not found.");
-        await this.lambderSessionManager.deleteSessionAll(this.ctx.session);
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionCsrfCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; SameSite=Lax; Secure` });
-        (this.ctx as any).session = null;
-    };
-};

package/src/LambderSessionManager.ts

@@ -1,217 +0,0 @@
-import crypto from "crypto";
-import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
-import { DynamoDBDocumentClient, QueryCommand, DeleteCommand, PutCommand, GetCommand } from "@aws-sdk/lib-dynamodb";
-
-export type LambderSessionContext<SessionData = any> = {
-    [x: string]: any;
-    sessionToken: string;
-    csrfToken: string;
-    sessionKey: string;
-    data: SessionData;
-    createdAt: number;
-    expiresAt: number;
-    lastAccessedAt: number;
-    ttlInSeconds: number;
-};
-
-
-export default class LambderSessionManager{
-    private tableName: string;
-    private sessionSalt: string;
-    private partitionKey: string;
-    private sortKey: string;
-    private ddbDocumentClient: DynamoDBDocumentClient;
-    private enableSlidingExpiration: boolean;
-
-    constructor(
-        {
-            tableName, tableRegion,
-            partitionKey, sortKey,
-            sessionSalt,
-            enableSlidingExpiration = true,
-        }: {
-            tableName: string, tableRegion: string,
-            partitionKey: string, sortKey: string,
-            sessionSalt: string,
-            enableSlidingExpiration?: boolean,
-        }
-    ){
-        this.tableName = tableName;
-        this.sessionSalt = sessionSalt;
-        this.partitionKey = partitionKey;
-        this.sortKey = sortKey;
-        this.enableSlidingExpiration = enableSlidingExpiration;
-
-        const ddbClient = new DynamoDBClient({ region: tableRegion });
-        this.ddbDocumentClient = DynamoDBDocumentClient.from(ddbClient);
-    }
-
-    private sessionUserKeyHasher(password:string){
-        return crypto.createHash("sha256")
-                     .update(`${password}${this.sessionSalt}`)
-                     .digest("hex");
-    }
-
-    private constantTimeCompare(a: string, b: string): boolean {
-        if (a.length !== b.length) return false;
-        const bufferA = Buffer.from(a, 'utf8');
-        const bufferB = Buffer.from(b, 'utf8');
-        return crypto.timingSafeEqual(new Uint8Array(bufferA), new Uint8Array(bufferB));
-    }
-
-    private async ddbGetItem<T=any>(key:Record<string,string|number>){
-        const response = await this.ddbDocumentClient.send(
-            new GetCommand({ TableName: this.tableName, Key: key, ConsistentRead: true })
-        );
-        if(response.Item) return response.Item as T;
-        return null;
-    };
-    private async ddbPutItem(item: Record<string,any>){
-        return await this.ddbDocumentClient.send(
-            new PutCommand({ TableName: this.tableName, Item: item, })
-        );
-    };
-
-    private async ddbDeleteItem(key:Record<string,string|number>){
-        return await this.ddbDocumentClient.send(
-            new DeleteCommand({ TableName: this.tableName, Key: key, })
-        );
-    };
-
-    private async ddbQueryAllByPartitionKey (partitionValue: string){
-        const params: any = {
-            TableName: this.tableName,
-            KeyConditionExpression: "#pk = :pv",
-            ExpressionAttributeNames:{ "#pk": this.partitionKey },
-            ExpressionAttributeValues: { ":pv": partitionValue },
-        }
-        const queryResults: any[] = [];
-        do{
-            const {Items, LastEvaluatedKey} =  await this.ddbDocumentClient.send(new QueryCommand(params));
-            if(Items) queryResults.push(...Items);
-            params.ExclusiveStartKey  = LastEvaluatedKey;
-            if(typeof LastEvaluatedKey == "undefined") return queryResults;
-        // eslint-disable-next-line no-constant-condition
-        } while (true);
-    };
-
-    private async ddbDeleteAllByPartitionKey(partitionValue: string){
-        const queryResults = await this.ddbQueryAllByPartitionKey(partitionValue);
-        for(const item of queryResults){
-            await this.ddbDocumentClient.send(new DeleteCommand({
-                TableName: this.tableName,
-                Key: { [this.partitionKey]: partitionValue, [this.sortKey]: item[this.sortKey] }
-            }));
-        }
-    }
-
-    public async createSession(
-        sessionKey: string, 
-        data: any = {}, 
-        ttlInSeconds:number = 30*24*60*60
-    ): Promise<LambderSessionContext> {
-        const sessionKeyHash = this.sessionUserKeyHasher(sessionKey);
-        const sessionSortKey = crypto.randomBytes(32).toString("hex");
-        const sessionToken = `${sessionKeyHash}:${sessionSortKey}`;
-        const csrfToken = crypto.randomBytes(32).toString("hex");
-        const createdAt = Math.floor(Date.now()/1000);
-        const lastAccessedAt = createdAt;
-        const expiresAt = Number(createdAt) + Number(ttlInSeconds);
-    
-        const session = {
-            [this.partitionKey]: sessionKeyHash, 
-            [this.sortKey]: sessionSortKey,
-            sessionToken, csrfToken,
-            sessionKey, data, 
-            createdAt, lastAccessedAt, expiresAt, ttlInSeconds
-        };
-        await this.ddbPutItem(session);
-        return session;
-    }
-
-    public async updateSessionData(
-        session: LambderSessionContext,
-        newData?: any
-    ): Promise<LambderSessionContext> {
-        if(!session) throw new Error("Invalid session");
-        session.data = newData;
-        session.lastAccessedAt = Math.floor(Date.now()/1000);
-        
-        // Update expiration if sliding expiration is enabled
-        if(this.enableSlidingExpiration){
-            session.expiresAt = session.lastAccessedAt + session.ttlInSeconds;
-        }
-        
-        await this.ddbPutItem(session);
-        return session;
-    }
-
-    public async getSession(sessionToken: string): Promise<LambderSessionContext|null>{
-        const [ sessionKeyHash, sessionSortKey ] = sessionToken.split(":");
-        if(!sessionKeyHash || !sessionSortKey) return null;
-        try{
-            let session = await this.ddbGetItem({ 
-                [this.partitionKey]: sessionKeyHash, 
-                [this.sortKey]: sessionSortKey
-            });
-            
-            // Use constant error response to prevent timing attacks
-            if(!session) return null;
-            if(!session.sessionToken || !this.constantTimeCompare(session.sessionToken, sessionToken)) return null;
-            if(!session.csrfToken) return null;
-            if(!session.sessionKey) return null;
-            if(!session.createdAt) return null;
-            if(!session.expiresAt || session.expiresAt < Date.now()/1000) return null;
-            
-            // Update last accessed time if sliding expiration is enabled
-            if(this.enableSlidingExpiration){
-                session.lastAccessedAt = Math.floor(Date.now()/1000);
-                session.expiresAt = session.lastAccessedAt + session.ttlInSeconds;
-                // Wait for the update to ensure it persists before Lambda freezes
-                await this.ddbPutItem(session).catch(() => {});
-            }
-            
-            return session;
-        }catch(err){
-            return null;
-        }
-    };
-
-    public isSessionValid(session: any, sessionToken: any, csrfToken: any, skipCsrfTokenCheck = false){
-        if(!session) return false;
-        if(!sessionToken || typeof sessionToken !== "string") return false;
-        if(!this.constantTimeCompare(session.sessionToken, sessionToken)) return false;
-        if(!session.csrfToken) return false;
-        if(!session.sessionKey) return false;
-        if(!session.createdAt) return false;
-        if(!session.expiresAt || session.expiresAt < Date.now()/1000) return false;
-        if(!skipCsrfTokenCheck){
-            if(!csrfToken || typeof csrfToken !== "string") return false;
-            if(!this.constantTimeCompare(session.csrfToken, csrfToken)) return false;
-        }
-        return true;
-    }
-
-    public async deleteSession(session: Record<string, any>): Promise<boolean>{
-        await this.ddbDeleteItem({ 
-            [this.partitionKey]: session[this.partitionKey],
-            [this.sortKey]: session[this.sortKey],
-        });
-        return true;
-    };
-
-    public async deleteSessionAll (session: Record<string, any>): Promise<boolean>{
-        await this.ddbDeleteAllByPartitionKey(session[this.partitionKey])
-        return true;
-    };
-
-    public async regenerateSession(session: LambderSessionContext): Promise<LambderSessionContext> {
-        if(!session) throw new Error("Invalid session");
-        
-        // Delete old session
-        await this.deleteSession(session);
-        
-        // Create new session with same sessionKey and data but new tokens
-        return await this.createSession(session.sessionKey, session.data, session.ttlInSeconds);
-    }
-};

package/src/LambderUtils.ts

@@ -1,75 +0,0 @@
-import ejs from "ejs";
-import { getFS, getPath } from "./node-polyfills.js";
-
-export default class LambderUtils {
-    private ejsPath?: string;
-
-    constructor(
-        { ejsPath }: {
-            ejsPath?: string
-        } = {}
-    ){
-        this.ejsPath = ejsPath;
-    };
-
-    private async readEjsFileSync(filePath: string){
-        const fs = await getFS();
-        const path = await getPath();
-        
-        if (!fs || !path) {
-            throw new Error("File system operations are not available in browser environment");
-        }
-        if(!this.ejsPath){ return "EJS PATH NOT SET!"; }
-        const ejsPath = path.resolve(this.ejsPath);
-        const normalizedFilePath = filePath.startsWith('/') ? filePath.slice(1) : filePath;
-        const absolutePath = path.resolve(ejsPath, normalizedFilePath);
-        if(!absolutePath.startsWith(ejsPath)){ return "forbidden-ejs-path"; }
-        return await fs.promises.readFile(absolutePath, 'utf-8');
-    };
-
-    private async checkEjsFileExist(filePath: string){
-        const fs = await getFS();
-        const path = await getPath();
-        
-        if (!fs || !path) {
-            return false;
-        }
-        if(!this.ejsPath){ return "EJS PATH NOT SET!"; }
-        const ejsPath = path.resolve(this.ejsPath);
-        const normalizedFilePath = filePath.startsWith('/') ? filePath.slice(1) : filePath;
-        const absolutePath = path.resolve(ejsPath, normalizedFilePath);
-        if(!absolutePath.startsWith(ejsPath)){ return false; }
-        try {
-            const stat = await fs.promises.stat(absolutePath);
-            return stat.isFile();
-        } catch {
-            return false;
-        }
-    };
-
-	async renderEjs(
-        template: string, 
-        pageData: Record<string, any>,
-    ):Promise<string>{
-        const includeRenderedFile = async (filePath: string, partialData: Record<string, any>) => {
-            const template = await this.readEjsFileSync(filePath);
-            return await ejs.render(template, { page: pageData, partial: partialData, include: includeRenderedFile }, { async: true });
-        }
-        const renderedResult = await ejs.render(template, { page: pageData, include: includeRenderedFile }, { async: true });
-
-        return renderedResult;
-    };
-
-	async renderEjsFile(
-        filePath: string, 
-        pageData: Record<string, any>,
-    ):Promise<string>{
-        const doesFileExist = await this.checkEjsFileExist(filePath);
-        if(!doesFileExist){
-            return "File not found: " + filePath;
-        }
-        const template = await this.readEjsFileSync(filePath);
-        return this.renderEjs(template, pageData);
-    };
-
-};

package/src/index.ts

@@ -1,17 +0,0 @@
-import Lambder from './Lambder.js';
-
-export default Lambder;
-export { default as LambderCaller } from "./LambderCaller.js";
-export { default as LambderResponseBuilder } from "./LambderResponseBuilder.js";
-export { default as LambderResolver } from "./LambderResolver.js";
-export { default as LambderSessionManager } from "./LambderSessionManager.js";
-export { default as LambderMSW } from "./LambderMSW.js";
-
-// Type-safe API contract utilities
-export { 
-    type ApiContractShape,
-} from "./LambderApiContract.js";
-
-// Context types and utilities
-export type { LambderRenderContext, LambderSessionRenderContext } from "./LambderContext.js";
-export { createContext } from "./LambderContext.js";

package/src/node-polyfills.ts

@@ -1,27 +0,0 @@
-// Node.js polyfills for browser compatibility
-// This file provides optional Node.js modules that fail gracefully in browser environments
-
-let fs: any = null;
-let path: any = null;
-
-export async function getFS(): Promise<any> {
-    try {
-        if(fs){ return fs; }
-        fs = await import('fs');
-        return fs;
-    } catch (e) {
-        // Silently fail - we're in a browser environment
-        return null;
-    }
-}
-
-export async function getPath(): Promise<any> {
-    try {
-        if(path){ return path; }
-        path = await import('path');
-        return path;
-    } catch (e) {
-        // Silently fail - we're in a browser environment
-        return null;
-    }
-}