unjwt 0.5.21 → 0.5.22

package/README.md

@@ -20,11 +20,12 @@ A collection of low-level JWT ([RFC 7519](https://datatracker.ietf.org/doc/html/
 ## Table of Contents
 
 - [Usage](#usage)
-  - [Adapters](#adapters)
   - [JWS](#jws-json-web-signature-rfc-7515)
   - [JWE](#jwe-json-web-encryption-rfc-7516)
   - [JWK](#jwk-json-web-key-rfc-7517)
   - [Utility Functions](#utility-functions)
+  - [Adapters](#adapters)
+    - [H3 (Nuxt, Nitro)](#h3-nuxt-nitro)
 - [Development](#development)
 - [Credits](#credits)
 - [License](#license)

package/dist/h3.d.mts

@@ -23,6 +23,13 @@ interface SessionJWE<T extends SessionDataT$1 = SessionDataT$1> {
     data: SessionData<T>;
     [kGetSessionPromise$1]?: Promise<SessionJWE<T>>;
 }
+interface SessionHooksJWE {
+    onRead?: (session: SessionJWE, event: H3Event) => void | Promise<void>;
+    onUpdate?: (session: SessionJWE, event: H3Event) => void | Promise<void>;
+    onClear?: (event: H3Event) => void | Promise<void>;
+    onExpire?: (event: H3Event, error: any | undefined) => void | Promise<void>;
+    onError?: (event: H3Event, error: any) => void | Promise<void>;
+}
 interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
     readonly id: string | undefined;
     readonly createdAt: number;
@@ -31,7 +38,7 @@ interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
     update: (update: SessionUpdate$1<T>) => Promise<SessionManager<T>>;
     clear: () => Promise<SessionManager<T>>;
 }
-interface SessionJWEConfig {
+interface SessionConfigJWE {
     /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
     secret: string | JWK_Symmetric | {
         privateKey: JWK_Private | JWK_Symmetric;
@@ -54,7 +61,12 @@ interface SessionJWEConfig {
         encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
         decryptOptions?: JWTClaimValidationOptions;
     };
+    hooks?: SessionHooksJWE;
 }
+/**
+ * @deprecated use `SessionConfigJWE` instead
+ */
+type SessionJWEConfig = SessionConfigJWE;
 type CompatEvent$1 = {
     request: {
         headers: Headers;
@@ -68,15 +80,15 @@ type SessionUpdate$1<T extends SessionDataT$1 = SessionDataT$1> = Partial<Sessio
 /**
  * Create a session manager for the current request.
  */
-declare function useJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionJWEConfig): Promise<SessionManager<T>>;
+declare function useJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionConfigJWE): Promise<SessionManager<T>>;
 /**
  * Get (and lazily initialize) the session for the current request.
  */
-declare function getJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionJWEConfig): Promise<SessionJWE<T>>;
+declare function getJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionConfigJWE): Promise<SessionJWE<T>>;
 /**
  * Update the session (optionally mutating the session data) and re-issue the JWE token.
  */
-declare function updateJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event, config: SessionJWEConfig, update?: SessionUpdate$1<T>): Promise<SessionJWE<T>>;
+declare function updateJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event, config: SessionConfigJWE, update?: SessionUpdate$1<T>): Promise<SessionJWE<T>>;
 /**
  * Produce a JWE for the current session.
  * Payload structure:
@@ -87,15 +99,15 @@ declare function updateJWESession<T extends SessionDataT$1 = SessionDataT$1>(eve
  *   data: Record<string, any>;
  * }
  */
-declare function sealJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionJWEConfig): Promise<string>;
+declare function sealJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionConfigJWE): Promise<string>;
 /**
  * Decrypt the JWE and return a Session-compatible object.
  */
-declare function unsealJWESession(_event: H3Event | CompatEvent$1, config: SessionJWEConfig, sealed: string): Promise<Partial<SessionJWE>>;
+declare function unsealJWESession(_event: H3Event | CompatEvent$1, config: SessionConfigJWE, sealed: string): Promise<Partial<SessionJWE>>;
 /**
  * Clear the session (delete from context and drop cookie).
  */
-declare function clearJWESession(event: H3Event, config: Partial<SessionJWEConfig>): Promise<void>;
+declare function clearJWESession(event: H3Event, config: Partial<SessionConfigJWE>): Promise<void>;
 
 /**
  * This is a fork of h3 library's session utility functions.
@@ -112,7 +124,14 @@ interface SessionJWS<T extends SessionDataT = SessionDataT> {
     data: SessionData<T>;
     [kGetSessionPromise]?: Promise<SessionJWS<T>>;
 }
-interface SessionJWSConfig {
+interface SessionHooksJWS {
+    onRead?: (session: SessionJWS, event: H3Event) => void | Promise<void>;
+    onUpdate?: (session: SessionJWS, event: H3Event) => void | Promise<void>;
+    onClear?: (event: H3Event) => void | Promise<void>;
+    onExpire?: (event: H3Event, error: any | undefined) => void | Promise<void>;
+    onError?: (event: H3Event, error: any) => void | Promise<void>;
+}
+interface SessionConfigJWS {
     /**
      * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
      */
@@ -137,7 +156,12 @@ interface SessionJWSConfig {
         signOptions?: Omit<JWSSignOptions, "expiresIn">;
         verifyOptions?: JWTClaimValidationOptions;
     };
+    hooks?: SessionHooksJWS;
 }
+/**
+ * @deprecated use `SessionConfigJWS` instead
+ */
+type SessionJWSConfig = SessionConfigJWS;
 type CompatEvent = {
     request: {
         headers: Headers;
@@ -152,21 +176,21 @@ type SessionUpdate<T extends SessionDataT = SessionDataT> = Partial<SessionData<
  * Create a session manager for the current request using JWS (signed only, not encrypted).
  * NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
  */
-declare function useJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionJWSConfig): Promise<SessionManager<T>>;
+declare function useJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionConfigJWS): Promise<SessionManager<T>>;
 /**
  * Retrieve (and lazily initialize) the session.
  */
-declare function getJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionJWSConfig): Promise<SessionJWS<T>>;
+declare function getJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionConfigJWS): Promise<SessionJWS<T>>;
 /**
  * Update session data (if provided) and reissue JWS.
  */
-declare function updateJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event, config: SessionJWSConfig, update?: SessionUpdate<T>): Promise<SessionJWS<T>>;
+declare function updateJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event, config: SessionConfigJWS, update?: SessionUpdate<T>): Promise<SessionJWS<T>>;
 /**
  * Sign current session as a compact JWS.
  * Payload claims:
  *  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
  */
-declare function signJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionJWSConfig): Promise<string>;
+declare function signJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionConfigJWS): Promise<string>;
 /**
  * Verify and parse a compact JWS into a Session structure.
  * Performs:
@@ -175,11 +199,11 @@ declare function signJWSSession<T extends SessionDataT = SessionDataT>(event: H3
  *  - ensures jti & iat presence
  *  - enforces maxAge if provided
  */
-declare function verifyJWSSession(_event: H3Event | CompatEvent, config: SessionJWSConfig, token: string): Promise<Partial<SessionJWS>>;
+declare function verifyJWSSession(_event: H3Event | CompatEvent, config: SessionConfigJWS, token: string): Promise<Partial<SessionJWS>>;
 /**
  * Destroy the session (context + cookie).
  */
-declare function clearJWSSession(event: H3Event, config: Partial<SessionJWSConfig>): Promise<void>;
+declare function clearJWSSession(event: H3Event, config: Partial<SessionConfigJWS>): Promise<void>;
 
 export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
-export type { SessionData, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager };
+export type { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager };

package/dist/h3.mjs

@@ -57,9 +57,22 @@ async function getJWESession(event, config) {
   }
   const existingSession = event.context.sessions[sessionName];
   if (existingSession) {
-    return existingSession.expiresAt === void 0 ? existingSession[kGetSessionPromise$1] || existingSession : existingSession.expiresAt < Date.now() && isEvent(event) ? clearJWESession(event, config).then(
-      () => getJWESession(event, config)
-    ) : existingSession[kGetSessionPromise$1] || existingSession;
+    if (existingSession.expiresAt === void 0) {
+      const session2 = existingSession[kGetSessionPromise$1] || existingSession;
+      await config.hooks?.onRead?.(await session2, event);
+      return session2;
+    } else {
+      if (existingSession.expiresAt < Date.now() && isEvent(event)) {
+        await config.hooks?.onExpire?.(event, void 0);
+        return clearJWESession(event, config).then(
+          () => getJWESession(event, config)
+        );
+      } else {
+        const session2 = existingSession[kGetSessionPromise$1] || existingSession;
+        await config.hooks?.onRead?.(await session2, event);
+        return session2;
+      }
+    }
   }
   const session = {
     id: "",
@@ -83,7 +96,16 @@ async function getJWESession(event, config) {
     }
   }
   if (jweToken) {
-    const promise = unsealJWESession(event, config, jweToken).catch(() => {
+    const promise = unsealJWESession(event, config, jweToken).catch(async (error_) => {
+      if (error_ instanceof Error) {
+        const message = error_.message;
+        if (message.includes("Token has expired") || message.includes("Token is too old")) {
+          await config.hooks?.onExpire?.(event, error_);
+          return void 0;
+        }
+      }
+      await config.hooks?.onError?.(event, error_);
+      return void 0;
     }).then((unsealed) => {
       if (unsealed) {
         Object.assign(session, unsealed);
@@ -106,6 +128,7 @@ async function getJWESession(event, config) {
     session.data = /* @__PURE__ */ Object.create(null);
     await updateJWESession(event, config);
   }
+  await config.hooks?.onRead?.(session, event);
   return session;
 }
 function _getReqHeader$1(event, name) {
@@ -127,6 +150,7 @@ async function updateJWESession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
+    await config.hooks?.onUpdate?.(session, event);
   }
   if (config.cookie !== false) {
     const sealed = await sealJWESession(event, config);
@@ -211,7 +235,7 @@ async function unsealJWESession(_event, config, sealed) {
     data: data && typeof data === "object" ? data : /* @__PURE__ */ Object.create(null)
   };
 }
-function clearJWESession(event, config) {
+async function clearJWESession(event, config) {
   const sessionName = config.name || DEFAULT_NAME$1;
   if (event.context.sessions?.[sessionName]) {
     delete event.context.sessions[sessionName];
@@ -220,9 +244,10 @@ function clearJWESession(event, config) {
     ...DEFAULT_COOKIE$1,
     ...config.cookie,
     // Optionally set expires in the past
-    expires: /* @__PURE__ */ new Date(0)
+    expires: /* @__PURE__ */ new Date(0),
+    maxAge: void 0
   });
-  return Promise.resolve();
+  await config.hooks?.onClear?.(event);
 }
 function getEncryptKey(secret) {
   if (typeof secret === "string") {
@@ -293,9 +318,22 @@ async function getJWSSession(event, config) {
   }
   const existingSession = event.context.sessions[sessionName];
   if (existingSession) {
-    return existingSession.expiresAt === void 0 ? existingSession[kGetSessionPromise] || existingSession : existingSession.expiresAt < Date.now() && isEvent(event) ? clearJWSSession(event, config).then(
-      () => getJWSSession(event, config)
-    ) : existingSession[kGetSessionPromise] || existingSession;
+    if (existingSession.expiresAt === void 0) {
+      const session2 = existingSession[kGetSessionPromise] || existingSession;
+      await config.hooks?.onRead?.(await session2, event);
+      return session2;
+    } else {
+      if (existingSession.expiresAt < Date.now() && isEvent(event)) {
+        await config.hooks?.onExpire?.(event, void 0);
+        return clearJWSSession(event, config).then(
+          () => getJWSSession(event, config)
+        );
+      } else {
+        const session2 = existingSession[kGetSessionPromise] || existingSession;
+        await config.hooks?.onRead?.(await session2, event);
+        return session2;
+      }
+    }
   }
   const session = {
     id: "",
@@ -319,7 +357,16 @@ async function getJWSSession(event, config) {
     }
   }
   if (token) {
-    const promise = verifyJWSSession(event, config, token).catch(() => {
+    const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
+      if (error_ instanceof Error) {
+        const message = error_.message;
+        if (message.includes("Token has expired") || message.includes("Token is too old")) {
+          await config.hooks?.onExpire?.(event, error_);
+          return void 0;
+        }
+      }
+      await config.hooks?.onError?.(event, error_);
+      return void 0;
     }).then((unsealed) => {
       if (unsealed) {
         Object.assign(session, unsealed);
@@ -342,6 +389,7 @@ async function getJWSSession(event, config) {
     session.data = /* @__PURE__ */ Object.create(null);
     await updateJWSSession(event, config);
   }
+  await config.hooks?.onRead?.(session, event);
   return session;
 }
 function _getReqHeader(event, name) {
@@ -363,6 +411,7 @@ async function updateJWSSession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
+    await config.hooks?.onUpdate?.(session, event);
   }
   if (config.cookie !== false) {
     const token = await signJWSSession(event, config);
@@ -432,7 +481,7 @@ async function verifyJWSSession(_event, config, token) {
     data: data && typeof data === "object" ? data : /* @__PURE__ */ Object.create(null)
   };
 }
-function clearJWSSession(event, config) {
+async function clearJWSSession(event, config) {
   const sessionName = config.name || DEFAULT_NAME;
   if (event.context.sessions?.[sessionName]) {
     delete event.context.sessions[sessionName];
@@ -440,9 +489,10 @@ function clearJWSSession(event, config) {
   setCookie(event, sessionName, "", {
     ...DEFAULT_COOKIE,
     ...config.cookie,
-    expires: /* @__PURE__ */ new Date(0)
+    expires: /* @__PURE__ */ new Date(0),
+    maxAge: void 0
   });
-  return Promise.resolve();
+  await config.hooks?.onClear?.(event);
 }
 function getSignKey(key) {
   if ("privateKey" in key) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.21",
+  "version": "0.5.22",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",