lambder 3.3.0 → 3.3.1

package/dist/Lambder.d.ts

@@ -130,7 +130,7 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
         enableSlidingExpiration?: boolean;
         /** Min seconds between sliding-expiration writes. Default: max(60, 5% of TTL). */
         slidingWriteIntervalSeconds?: number;
-        /** Session cookie attributes, e.g. { domain: ".example.com" } for cross-subdomain sessions. */
+        /** Session cookie attributes, e.g. { domain: ".example.com" } for cross-subdomain sessions. `domain` may be a (hostname) => string function for multi-domain deployments. */
         cookie?: LambderSessionCookieOptions;
         partitionKey?: string;
         sortKey?: string;

package/dist/LambderCaller.d.ts

@@ -41,7 +41,8 @@ export default class LambderCaller<TContract extends ApiContractShape = any> {
     private fetchEndedHandler?;
     private sessionTokenCookieKey;
     private sessionCsrfCookieKey;
-    constructor({ apiPath, apiVersion, isCorsEnabled, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, apiInputValidationErrorHandler, }: {
+    private sessionCookieDomain?;
+    constructor({ apiPath, apiVersion, isCorsEnabled, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, apiInputValidationErrorHandler, sessionCookieDomain, }: {
         apiPath: string;
         apiVersion?: string;
         isCorsEnabled: boolean;
@@ -54,8 +55,11 @@ export default class LambderCaller<TContract extends ApiContractShape = any> {
         fetchStartedHandler?: FetchStartEventHandler;
         fetchEndedHandler?: FetchEndEventHandler;
         apiInputValidationErrorHandler?: ValidationErrorHandler;
+        /** Must mirror the server's session cookie Domain, otherwise expired cookies cannot be cleared. */
+        sessionCookieDomain?: string | ((hostname: string) => string | undefined | null);
     });
     setSessionCookieKey(sessionTokenCookieKey: string, sessionCsrfCookieKey: string): void;
+    private clearSessionCookies;
     apiRaw<TApiName extends keyof TContract & string = string, TOutput = TApiName extends keyof TContract ? TContract[TApiName]['output'] : any>(apiName: TApiName, payload?: TApiName extends keyof TContract ? TContract[TApiName]['input'] : any, options?: {
         headers?: Record<string, any>;
         versionExpiredHandler?: VoidFunction;

package/dist/LambderCaller.js

@@ -16,10 +16,12 @@ export default class LambderCaller {
     fetchEndedHandler;
     sessionTokenCookieKey = "LMDRSESSIONTKID";
     sessionCsrfCookieKey = "LMDRSESSIONCSTK";
-    constructor({ apiPath, apiVersion, isCorsEnabled = false, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, apiInputValidationErrorHandler, }) {
+    sessionCookieDomain;
+    constructor({ apiPath, apiVersion, isCorsEnabled = false, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, apiInputValidationErrorHandler, sessionCookieDomain, }) {
         this.apiPath = apiPath ?? "/api";
         this.apiVersion = apiVersion;
         this.isCorsEnabled = isCorsEnabled;
+        this.sessionCookieDomain = sessionCookieDomain;
         this.versionExpiredHandler = versionExpiredHandler;
         this.sessionExpiredHandler = sessionExpiredHandler;
         this.messageHandler = messageHandler;
@@ -35,6 +37,17 @@ export default class LambderCaller {
         this.sessionTokenCookieKey = sessionTokenCookieKey;
         this.sessionCsrfCookieKey = sessionCsrfCookieKey;
     }
+    clearSessionCookies() {
+        const domainOption = this.sessionCookieDomain;
+        const hostname = typeof window !== "undefined" ? window.location.hostname : "";
+        const resolvedDomain = typeof domainOption === "function" ? domainOption(hostname) : domainOption;
+        for (const key of [this.sessionTokenCookieKey, this.sessionCsrfCookieKey]) {
+            // Host-only and domain-scoped cookies are distinct entries; clear both.
+            Cookies.remove(key);
+            if (resolvedDomain)
+                Cookies.remove(key, { domain: resolvedDomain, path: "/" });
+        }
+    }
     async apiRaw(apiName, payload, options) {
         const headers = options?.headers;
         const fetchTracker = { apiName, done: false, fetchEndCalled: false };
@@ -102,8 +115,7 @@ export default class LambderCaller {
                 return null;
             }
             if (data && data.sessionExpired) {
-                Cookies.set(this.sessionTokenCookieKey, '', { expires: -1 });
-                Cookies.set(this.sessionCsrfCookieKey, '', { expires: -1 });
+                this.clearSessionCookies();
                 if (this.sessionExpiredHandler) {
                     await this.sessionExpiredHandler();
                 }

package/dist/LambderSessionController.d.ts

@@ -2,8 +2,12 @@ import { LambderRenderContext, LambderSessionRenderContext } from "./LambderCont
 import type LambderSessionManager from "./LambderSessionManager.js";
 import type { LambderSessionContext } from "./LambderSessionManager.js";
 export type LambderSessionCookieOptions = {
-    /** e.g. ".example.com" to share sessions across subdomains. */
-    domain?: string;
+    /**
+     * e.g. ".example.com" to share sessions across subdomains. Pass a function to
+     * derive it from the request hostname when one deployment serves several
+     * apex domains; return undefined for a host-only cookie.
+     */
+    domain?: string | ((hostname: string) => string | undefined | null);
     path?: string;
     sameSite?: "Strict" | "Lax" | "None";
     secure?: boolean;

package/dist/LambderSessionController.js

@@ -14,11 +14,14 @@ export default class LambderSessionController {
     ;
     buildCookie(key, value, expiresAtMs, httpOnly) {
         const { domain, path = "/", sameSite = "Lax", secure = true } = this.cookieOptions;
+        // Host header can carry a port; browsers match the Domain attribute on hostname only.
+        const hostname = (this.ctx.host || "").split(":")[0];
+        const resolvedDomain = typeof domain === "function" ? domain(hostname) : domain;
         const parts = [
             `${key}=${value}`,
             `Expires=${new Date(expiresAtMs).toUTCString()}`,
             `Path=${path}`,
-            ...(domain ? [`Domain=${domain}`] : []),
+            ...(resolvedDomain ? [`Domain=${resolvedDomain}`] : []),
             ...(httpOnly ? ["HttpOnly"] : []),
             `SameSite=${sameSite}`,
             ...(secure ? ["Secure"] : []),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",