unjwt 0.5.40 → 0.6.1

package/dist/{_chunks/jws2.mjs → adapters/h3v1/index.mjs}

@@ -1,4 +1,4 @@
-import { d as isSymmetricJWK, f as computeExpiresInSeconds, i as encrypt, l as isPrivateJWK, n as verify, r as decrypt, t as sign, u as isPublicJWK } from "./jws.mjs";
+import { a as deriveJWKFromPassword, c as importFromPEM, d as isSymmetricJWK, f as computeExpiresInSeconds, i as encrypt, l as isPrivateJWK, m as isJWTError, n as verify, o as exportToPEM, p as JWTError, r as decrypt, s as generateJWK, t as sign, u as isPublicJWK } from "../../_chunks/jws.mjs";
 import { isEvent, setCookie } from "h3";
 import { parse } from "cookie-es";
 //#region src/adapters/h3v1/session/jwe.ts
@@ -29,15 +29,13 @@ async function useJWESession(event, config) {
 			return event.context.sessions?.[sessionName]?.data || {};
 		},
 		get token() {
-			return getJWESessionToken(event, config);
+			return (event.context.sessions?.[sessionName])?.token ?? getJWESessionToken(event, config);
 		},
 		update: async (update) => {
-			if (!isEvent(event)) throw new Error("[h3] Cannot update read-only session.");
 			await updateJWESession(event, config, update);
 			return sessionManager;
 		},
 		clear: async () => {
-			if (!isEvent(event)) throw new Error("[h3] Cannot clear read-only session.");
 			await clearJWESession(event, config);
 			return sessionManager;
 		}
@@ -58,17 +56,44 @@ async function getJWESession(event, config) {
 		* unless we have a read-only event in which case we just return it as it was valid at the time of reading
 		* the cookie/header (like in a websocket upgrade)
 		*/
-		if (session.expiresAt !== void 0 && session.expiresAt < Date.now() && isEvent(event)) {
+		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
 			await config.hooks?.onExpire?.({
+				session: {
+					id: session.id,
+					createdAt: session.createdAt,
+					expiresAt: session.expiresAt,
+					token: session.token
+				},
 				event,
-				error: /* @__PURE__ */ new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`),
+				error: new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+					jti: session.id,
+					exp: session.expiresAt / 1e3
+				}),
 				config
 			});
-			return clearJWESession(event, config).then(() => getJWESession(event, config));
+			delete event.context.sessions[sessionName];
+			if (config.cookie !== false) if (isEvent(event)) setCookie(event, sessionName, "", {
+				...DEFAULT_COOKIE$1,
+				...config.cookie,
+				expires: /* @__PURE__ */ new Date(0),
+				maxAge: void 0
+			});
+			else console.warn("[unjwt/h3] Session expired but cookie cannot be cleared on a read-only event.");
+			const freshNow = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+			const freshCreatedAt = freshNow - freshNow % 1e3;
+			const freshSession = {
+				id: void 0,
+				createdAt: freshCreatedAt,
+				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+				data: Object.create(null),
+				token: void 0
+			};
+			event.context.sessions[sessionName] = freshSession;
+			return freshSession;
 		}
-		await config.hooks?.onRead?.({
-			event,
+		if (session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
 			session,
+			event,
 			config
 		});
 		return session;
@@ -79,23 +104,31 @@ async function getJWESession(event, config) {
 		id: void 0,
 		createdAt,
 		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
-		data: Object.create(null)
+		data: Object.create(null),
+		token: void 0
 	};
 	event.context.sessions[sessionName] = session;
 	const token = getJWESessionToken(event, config);
+	let exclusiveHookFired = false;
 	if (token) {
+		session.token = token;
 		const promise = unsealJWESession(event, config, token).catch(async (error_) => {
-			if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
-				await config.hooks?.onExpire?.({
-					event,
-					error: error_,
-					config
-				});
-				return;
-			}
-			await config.hooks?.onError?.({
+			exclusiveHookFired = true;
+			if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
+				session: {
+					id: error_.cause.jti,
+					createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
+					expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
+					token
+				},
+				error: error_,
 				event,
+				config
+			});
+			else await config.hooks?.onError?.({
+				session,
 				error: error_,
+				event,
 				config
 			});
 		}).then((unsealed) => {
@@ -106,9 +139,9 @@ async function getJWESession(event, config) {
 		event.context.sessions[sessionName][kGetSessionPromise$1] = promise;
 		await promise;
 	}
-	await config.hooks?.onRead?.({
-		event,
+	if (!exclusiveHookFired && session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
 		session,
+		event,
 		config
 	});
 	return session;
@@ -147,23 +180,16 @@ function _getResHeader$1(event, name) {
 * Update the session (optionally mutating the session data) and re-issue the JWE token.
 */
 async function updateJWESession(event, config, update) {
-	if (!isEvent(event)) throw new Error("Cannot update a new session. Use `useSession(event)` within the main handler.");
+	const canWriteCookie = isEvent(event);
+	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
 	const sessionName = config.name || DEFAULT_NAME$1;
 	const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
 	if (typeof update === "function") update = update(session.data);
-	if (update) {
-		const oldSession = {
-			...session,
-			data: { ...session.data }
-		};
-		Object.assign(session.data, update);
-		await config.hooks?.onUpdate?.({
-			session,
-			oldSession,
-			event,
-			config
-		});
-	}
+	const oldSession = {
+		...session,
+		data: { ...session.data }
+	};
+	if (update) Object.assign(session.data, update);
 	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
 	const createdAt = now - now % 1e3;
 	Object.assign(session, {
@@ -171,11 +197,36 @@ async function updateJWESession(event, config, update) {
 		createdAt,
 		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
 	});
-	if (config.cookie !== false) setCookie(event, sessionName, await sealJWESession(event, config), {
+	let sealed;
+	try {
+		sealed = await sealJWESession(event, config);
+	} catch (error_) {
+		Object.assign(session, {
+			id: oldSession.id,
+			createdAt: oldSession.createdAt,
+			expiresAt: oldSession.expiresAt
+		});
+		session.token = oldSession.token;
+		await config.hooks?.onError?.({
+			session,
+			event,
+			error: error_,
+			config
+		});
+		throw error_;
+	}
+	session.token = sealed;
+	if (config.cookie !== false && canWriteCookie) setCookie(event, sessionName, sealed, {
 		...DEFAULT_COOKIE$1,
 		...config.cookie,
 		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3)
 	});
+	await config.hooks?.onUpdate?.({
+		session,
+		oldSession,
+		event,
+		config
+	});
 	return session;
 }
 /**
@@ -189,7 +240,7 @@ async function updateJWESession(event, config, update) {
 * }
 */
 async function sealJWESession(event, config) {
-	const key = getEncryptKey(config.key || config.secret);
+	const key = getEncryptKey(config.key);
 	const sessionName = config.name || DEFAULT_NAME$1;
 	const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
 	const iat = Math.floor(session.createdAt / 1e3);
@@ -221,7 +272,7 @@ async function unsealJWESession(event, config, sealed) {
 		header,
 		event,
 		config
-	}) : getDecryptKey(config.key || config.secret);
+	}) : getDecryptKey(config.key);
 	const alg = config.jwe?.encryptOptions?.alg;
 	const enc = config.jwe?.encryptOptions?.enc;
 	let typ = void 0;
@@ -240,13 +291,11 @@ async function unsealJWESession(event, config, sealed) {
 		unwrappedKeyAlgorithm: void 0,
 		keyUsage: void 0,
 		forceUint8Array: false,
-		validateJWT: true
+		validateClaims: true
 	}).catch((error_) => {
-		if (error_ instanceof Error) {
-			const message = error_.message;
-			throw new Error(`Invalid session token: ${message}`);
-		}
-		throw new Error(error_);
+		if (isJWTError(error_, "ERR_JWT_EXPIRED")) throw error_;
+		const message = error_ instanceof Error ? error_.message : String(error_);
+		throw new Error(`Invalid session token: ${message}`);
 	});
 	const { jti, iat, exp, ...data } = payload;
 	return {
@@ -260,18 +309,24 @@ async function unsealJWESession(event, config, sealed) {
 * Clear the session (delete from context and drop cookie).
 */
 async function clearJWESession(event, config) {
+	const canWriteCookie = isEvent(event);
+	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
 	const sessionName = config.name || DEFAULT_NAME$1;
 	let session = event.context.sessions?.[sessionName];
 	if (session && session[kGetSessionPromise$1]) session = await session[kGetSessionPromise$1];
+	const oldSession = session ? {
+		...session,
+		data: { ...session.data }
+	} : void 0;
 	if (event.context.sessions?.[sessionName]) delete event.context.sessions[sessionName];
-	setCookie(event, sessionName, "", {
+	if (config.cookie !== false && canWriteCookie) setCookie(event, sessionName, "", {
 		...DEFAULT_COOKIE$1,
 		...config.cookie,
 		expires: /* @__PURE__ */ new Date(0),
 		maxAge: void 0
 	});
 	await config.hooks?.onClear?.({
-		session,
+		oldSession,
 		event,
 		config
 	});
@@ -330,15 +385,13 @@ async function useJWSSession(event, config) {
 			return event.context.sessions?.[sessionName]?.data || {};
 		},
 		get token() {
-			return getJWSSessionToken(event, config);
+			return (event.context.sessions?.[sessionName])?.token ?? getJWSSessionToken(event, config);
 		},
 		update: async (update) => {
-			if (!isEvent(event)) throw new Error("[h3] Cannot update read-only session.");
 			await updateJWSSession(event, config, update);
 			return sessionManager;
 		},
 		clear: async () => {
-			if (!isEvent(event)) throw new Error("[h3] Cannot clear read-only session.");
 			await clearJWSSession(event, config);
 			return sessionManager;
 		}
@@ -359,17 +412,44 @@ async function getJWSSession(event, config) {
 		* unless we have a read-only event in which case we just return it as it was valid at the time of reading
 		* the cookie/header (like in a websocket upgrade)
 		*/
-		if (session.expiresAt !== void 0 && session.expiresAt < Date.now() && isEvent(event)) {
+		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
 			await config.hooks?.onExpire?.({
+				session: {
+					id: session.id,
+					createdAt: session.createdAt,
+					expiresAt: session.expiresAt,
+					token: session.token
+				},
 				event,
-				error: /* @__PURE__ */ new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`),
+				error: new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+					jti: session.id,
+					exp: session.expiresAt / 1e3
+				}),
 				config
 			});
-			return clearJWSSession(event, config).then(() => getJWSSession(event, config));
+			delete event.context.sessions[sessionName];
+			if (config.cookie !== false) if (isEvent(event)) setCookie(event, sessionName, "", {
+				...DEFAULT_COOKIE,
+				...config.cookie,
+				expires: /* @__PURE__ */ new Date(0),
+				maxAge: void 0
+			});
+			else console.warn("[unjwt/h3] Session expired but cookie cannot be cleared on a read-only event.");
+			const freshNow = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+			const freshCreatedAt = freshNow - freshNow % 1e3;
+			const freshSession = {
+				id: void 0,
+				createdAt: freshCreatedAt,
+				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+				data: Object.create(null),
+				token: void 0
+			};
+			event.context.sessions[sessionName] = freshSession;
+			return freshSession;
 		}
-		await config.hooks?.onRead?.({
-			event,
+		if (session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
 			session,
+			event,
 			config
 		});
 		return session;
@@ -380,23 +460,31 @@ async function getJWSSession(event, config) {
 		id: void 0,
 		createdAt,
 		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
-		data: Object.create(null)
+		data: Object.create(null),
+		token: void 0
 	};
 	event.context.sessions[sessionName] = session;
 	const token = getJWSSessionToken(event, config);
+	let exclusiveHookFired = false;
 	if (token) {
+		session.token = token;
 		const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
-			if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
-				await config.hooks?.onExpire?.({
-					event,
-					error: error_,
-					config
-				});
-				return;
-			}
-			await config.hooks?.onError?.({
+			exclusiveHookFired = true;
+			if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
+				session: {
+					id: error_.cause.jti,
+					createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
+					expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
+					token
+				},
+				error: error_,
 				event,
+				config
+			});
+			else await config.hooks?.onError?.({
+				session,
 				error: error_,
+				event,
 				config
 			});
 		}).then((unsealed) => {
@@ -407,9 +495,9 @@ async function getJWSSession(event, config) {
 		session[kGetSessionPromise] = promise;
 		await promise;
 	}
-	await config.hooks?.onRead?.({
-		event,
+	if (!exclusiveHookFired && session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
 		session,
+		event,
 		config
 	});
 	return session;
@@ -448,23 +536,16 @@ function _getResHeader(event, name) {
 * Update session data (if provided) and reissue JWS.
 */
 async function updateJWSSession(event, config, update) {
-	if (!isEvent(event)) throw new Error("Cannot update a new session. Use `useSession(event)` within the main handler.");
+	const canWriteCookie = isEvent(event);
+	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
 	const sessionName = config.name || DEFAULT_NAME;
 	const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
 	if (typeof update === "function") update = update(session.data);
-	if (update) {
-		const oldSession = {
-			...session,
-			data: { ...session.data }
-		};
-		Object.assign(session.data, update);
-		await config.hooks?.onUpdate?.({
-			session,
-			oldSession,
-			event,
-			config
-		});
-	}
+	const oldSession = {
+		...session,
+		data: { ...session.data }
+	};
+	if (update) Object.assign(session.data, update);
 	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
 	const createdAt = now - now % 1e3;
 	Object.assign(session, {
@@ -472,11 +553,36 @@ async function updateJWSSession(event, config, update) {
 		createdAt,
 		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
 	});
-	if (config.cookie !== false) setCookie(event, sessionName, await signJWSSession(event, config), {
+	let token;
+	try {
+		token = await signJWSSession(event, config);
+	} catch (error_) {
+		Object.assign(session, {
+			id: oldSession.id,
+			createdAt: oldSession.createdAt,
+			expiresAt: oldSession.expiresAt
+		});
+		session.token = oldSession.token;
+		await config.hooks?.onError?.({
+			session,
+			event,
+			error: error_,
+			config
+		});
+		throw error_;
+	}
+	session.token = token;
+	if (config.cookie !== false && canWriteCookie) setCookie(event, sessionName, token, {
 		...DEFAULT_COOKIE,
 		...config.cookie,
 		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3)
 	});
+	await config.hooks?.onUpdate?.({
+		session,
+		oldSession,
+		event,
+		config
+	});
 	return session;
 }
 /**
@@ -536,8 +642,9 @@ async function verifyJWSSession(event, config, token) {
 		typ: typ || "JWT",
 		algorithms: alg ? [alg] : void 0,
 		forceUint8Array: false,
-		validateJWT: true
+		validateClaims: true
 	}).catch((error_) => {
+		if (isJWTError(error_, "ERR_JWT_EXPIRED")) throw error_;
 		const message = error_ instanceof Error ? error_.message : String(error_);
 		throw new Error(`Invalid session token: ${message}`);
 	});
@@ -553,18 +660,24 @@ async function verifyJWSSession(event, config, token) {
 * Destroy the session (context + cookie).
 */
 async function clearJWSSession(event, config) {
+	const canWriteCookie = isEvent(event);
+	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
 	const sessionName = config.name || DEFAULT_NAME;
 	let session = event.context.sessions?.[sessionName];
 	if (session && session[kGetSessionPromise]) session = await session[kGetSessionPromise];
+	const oldSession = session ? {
+		...session,
+		data: { ...session.data }
+	} : void 0;
 	if (event.context.sessions?.[sessionName]) delete event.context.sessions[sessionName];
-	setCookie(event, sessionName, "", {
+	if (config.cookie !== false && canWriteCookie) setCookie(event, sessionName, "", {
 		...DEFAULT_COOKIE,
 		...config.cookie,
 		expires: /* @__PURE__ */ new Date(0),
 		maxAge: void 0
 	});
 	await config.hooks?.onClear?.({
-		session,
+		oldSession,
 		event,
 		config
 	});
@@ -595,4 +708,4 @@ function findSetCookie(setCookie, name) {
 	return match ? match[1] : void 0;
 }
 //#endregion
-export { useJWSSession as a, getJWESession as c, unsealJWESession as d, updateJWESession as f, updateJWSSession as i, getJWESessionToken as l, getJWSSession as n, verifyJWSSession as o, useJWESession as p, signJWSSession as r, clearJWESession as s, clearJWSSession as t, sealJWESession as u };
+export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };