Skip to content

Commit 608f50a

Browse files
committed
wip: look into adding type checking and types
1 parent 8e18762 commit 608f50a

File tree

11 files changed

+678
-243
lines changed

11 files changed

+678
-243
lines changed

.editorconfig

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@ charset = utf-8
66
insert_final_newline = true
77
trim_trailing_whitespace = true
88

9-
[{*.js,*.json,*.yml}]
9+
[{*.js,*.ts,*.json,*.yml}]
1010
indent_size = 2
1111
indent_style = space

package.json

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,24 @@
1919
"uid-safe": "~2.1.5"
2020
},
2121
"devDependencies": {
22+
"@types/cookie": "^0.6.0",
23+
"@types/cookie-signature": "^1.0.7",
24+
"@types/debug": "^4.1.12",
25+
"@types/depd": "^1.1.37",
26+
"@types/express": "^5.0.0",
27+
"@types/node": "^18.19.80",
28+
"@types/on-headers": "~1.0.2",
29+
"@types/parseurl": "~1.3.3",
30+
"@types/uid-safe": "~2.1.5",
2231
"after": "0.8.2",
2332
"cookie-parser": "1.4.6",
2433
"eslint": "8.56.0",
2534
"eslint-plugin-markdown": "3.0.1",
2635
"express": "4.17.3",
2736
"mocha": "10.2.0",
2837
"nyc": "15.1.0",
29-
"supertest": "6.3.4"
38+
"supertest": "6.3.4",
39+
"typescript": "5.8.2"
3040
},
3141
"files": [
3242
"session/",
@@ -38,6 +48,7 @@
3848
},
3949
"scripts": {
4050
"lint": "eslint . && node ./scripts/lint-readme.js",
51+
"check-types": "tsc --project ./tsconfig.json",
4152
"test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --no-exit --reporter spec test/",
4253
"test-ci": "nyc --reporter=lcov --reporter=text npm test",
4354
"test-cov": "nyc npm test",

session/cookie-options.d.ts

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
export declare interface CookieOptions {
2+
/**
3+
* Specifies the number (in milliseconds) to use when calculating the `Expires Set-Cookie` attribute.
4+
* This is done by taking the current server time and adding `maxAge` milliseconds to the value to calculate an `Expires` datetime. By default, no maximum age is set.
5+
*
6+
* If both `expires` and `maxAge` are set in the options, then the last one defined in the object is what is used.
7+
* `maxAge` should be preferred over `expires`.
8+
*
9+
* @see expires
10+
*/
11+
maxAge?: number | undefined;
12+
13+
/**
14+
* Specifies the `boolean` value for the [`Partitioned` `Set-Cookie`](https://tools.ietf.org/html/draft-cutler-httpbis-partitioned-cookies/)
15+
* attribute. When truthy, the `Partitioned` attribute is set, otherwise it is not.
16+
* By default, the `Partitioned` attribute is not set.
17+
*
18+
* **Note** This is an attribute that has not yet been fully standardized, and may
19+
* change in the future. This also means many clients may ignore this attribute until
20+
* they understand it.
21+
*/
22+
partitioned?: boolean | undefined;
23+
24+
/**
25+
* Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute](https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1).
26+
*
27+
* - `'low'` will set the `Priority` attribute to `Low`.
28+
* - `'medium'` will set the `Priority` attribute to `Medium`, the default priority when not set.
29+
* - `'high'` will set the `Priority` attribute to `High`.
30+
*
31+
* More information about the different priority levels can be found in
32+
* [the specification](https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1).
33+
*
34+
* **Note** This is an attribute that has not yet been fully standardized, and may change in the future.
35+
* This also means many clients may ignore this attribute until they understand it.
36+
*/
37+
priority?: "low" | "medium" | "high" | undefined;
38+
39+
signed?: boolean | undefined;
40+
41+
/**
42+
* Specifies the boolean value for the `HttpOnly Set-Cookie` attribute. When truthy, the `HttpOnly` attribute is set, otherwise it is not.
43+
* By default, the `HttpOnly` attribute is set.
44+
*
45+
* Be careful when setting this to `true`, as compliant clients will not allow client-side JavaScript to see the cookie in `document.cookie`.
46+
*/
47+
httpOnly?: boolean | undefined;
48+
49+
/**
50+
* Specifies the value for the `Path Set-Cookie` attribute.
51+
* By default, this is set to '/', which is the root path of the domain.
52+
*/
53+
path?: string | undefined;
54+
55+
/**
56+
* Specifies the value for the `Domain Set-Cookie` attribute.
57+
* By default, no domain is set, and most clients will consider the cookie to apply to only the current domain.
58+
*/
59+
domain?: string | undefined;
60+
61+
/**
62+
* Specifies the boolean value for the `Secure Set-Cookie` attribute. When truthy, the `Secure` attribute is set, otherwise it is not. By default, the `Secure` attribute is not set.
63+
* Be careful when setting this to true, as compliant clients will not send the cookie back to the server in the future if the browser does not have an HTTPS connection.
64+
*
65+
* Please note that `secure: true` is a **recommended option**.
66+
* However, it requires an https-enabled website, i.e., HTTPS is necessary for secure cookies.
67+
* If `secure` is set, and you access your site over HTTP, **the cookie will not be set**.
68+
*
69+
* The cookie.secure option can also be set to the special value `auto` to have this setting automatically match the determined security of the connection.
70+
* Be careful when using this setting if the site is available both as HTTP and HTTPS, as once the cookie is set on HTTPS, it will no longer be visible over HTTP.
71+
* This is useful when the Express "trust proxy" setting is properly setup to simplify development vs production configuration.
72+
*
73+
* If you have your node.js behind a proxy and are using `secure: true`, you need to set "trust proxy" in express. Please see the [README](https://github.com/expressjs/session) for details.
74+
*
75+
* Please see the [README](https://github.com/expressjs/session) for an example of using secure cookies in production, but allowing for testing in development based on NODE_ENV.
76+
*/
77+
secure?: boolean | "auto" | undefined;
78+
79+
encode?: ((val: string) => string) | undefined;
80+
81+
/**
82+
* Specifies the boolean or string to be the value for the `SameSite Set-Cookie` attribute.
83+
* - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
84+
* - `false` will not set the `SameSite` attribute.
85+
* - `lax` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
86+
* - `none` will set the `SameSite` attribute to `None` for an explicit cross-site cookie.
87+
* - `strict` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
88+
*
89+
* More information about the different enforcement levels can be found in the specification.
90+
*
91+
* **Note:** This is an attribute that has not yet been fully standardized, and may change in the future.
92+
* This also means many clients may ignore this attribute until they understand it.
93+
*/
94+
sameSite?: boolean | "lax" | "strict" | "none" | undefined;
95+
}

session/cookie.js

Lines changed: 114 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -8,145 +8,181 @@
88
'use strict';
99

1010
/**
11-
* Module dependencies.
11+
* @import { CookieSerializeOptions } from "cookie"
12+
* @import { CookieOptions } from "./cookie-options"
1213
*/
1314

14-
var cookie = require('cookie')
15-
var deprecate = require('depd')('express-session')
16-
1715
/**
18-
* Initialize a new `Cookie` with the given `options`.
19-
*
20-
* @param {IncomingMessage} req
21-
* @param {Object} options
22-
* @api private
16+
* Cookie TODO: add description
17+
* @class
18+
* @implements CookieOptions
2319
*/
2420

25-
var Cookie = module.exports = function Cookie(options) {
26-
this.path = '/';
27-
this.maxAge = null;
28-
this.httpOnly = true;
29-
30-
if (options) {
31-
if (typeof options !== 'object') {
32-
throw new TypeError('argument options must be a object')
33-
}
21+
class Cookie {
22+
/** @type {Date | undefined} @private */
23+
_expires;
24+
/** @type {number | undefined} */
25+
originalMaxAge;
26+
/** @type {boolean | undefined} */
27+
partitioned;
28+
/** @type { "low" | "medium" | "high" | undefined} */
29+
priority;
30+
/** @type {boolean | undefined} */
31+
signed; // FIXME: how this is used??
32+
/** @type {boolean} */
33+
httpOnly;
34+
/** @type {string} */
35+
path;
36+
/** @type {string | undefined} */
37+
domain;
38+
/** @type {boolean | "auto" | undefined} */
39+
secure;
40+
/** @type {((val: string) => string) | undefined} */
41+
encode;
42+
/** @type {boolean | "lax" | "strict" | "none" | undefined} */
43+
sameSite;
3444

35-
for (var key in options) {
36-
if (key !== 'data') {
37-
this[key] = options[key]
45+
/**
46+
* Initialize a new `Cookie` with the given `options`.
47+
* @param {CookieOptions} options
48+
* @private
49+
*/
50+
constructor(options) {
51+
if (options) {
52+
if (typeof options !== 'object') {
53+
throw new TypeError('argument options must be a object')
3854
}
55+
console.log(`CookieOptions: ${JSON.stringify(options)}`)
56+
this.maxAge = options.maxAge
57+
this.originalMaxAge ??= options.maxAge // FIXME: rethink this
58+
59+
this.partitioned = options.partitioned
60+
this.priority = options.priority
61+
this.secure = options.secure
62+
this.httpOnly = options.httpOnly ?? true
63+
this.domain = options.domain
64+
this.path = options.path || '/'
65+
this.sameSite = options.sameSite
66+
67+
this.signed = options.signed // FIXME: how this is used??
68+
this.encode = options.encode // FIXME: is this used / real ??
69+
} else {
70+
this.path = '/'
71+
this.httpOnly = true
3972
}
4073
}
4174

42-
if (this.originalMaxAge === undefined || this.originalMaxAge === null) {
43-
this.originalMaxAge = this.maxAge
75+
/**
76+
* Initialize a new `Cookie` using stored cookie data.
77+
* @param {CookieOptions & {expires?: string, originalMaxAge?: number}} data
78+
* @returns {Cookie}
79+
* @protected
80+
*/
81+
static fromJSON(data) {
82+
console.log(`Cookie.fromJSON: ${JSON.stringify(data)}`)
83+
const { expires, originalMaxAge, ...options } = data
84+
const cookie = new Cookie(options)
85+
cookie.expires = expires ? new Date(expires) : undefined
86+
cookie.originalMaxAge = originalMaxAge
87+
return cookie
4488
}
45-
};
46-
47-
/*!
48-
* Prototype.
49-
*/
50-
51-
Cookie.prototype = {
5289

5390
/**
5491
* Set expires `date`.
5592
*
56-
* @param {Date} date
57-
* @api public
93+
* @param {Date | null | undefined} date
94+
* @public
5895
*/
5996

6097
set expires(date) {
61-
this._expires = date;
62-
this.originalMaxAge = this.maxAge;
63-
},
98+
this._expires = date || undefined
99+
this.originalMaxAge = this.maxAge
100+
}
64101

65102
/**
66-
* Get expires `date`.
103+
* Get expires `Date` object to be the value for the `Expires Set-Cookie` attribute.
104+
* By default, no expiration is set, and most clients will consider this a "non-persistent cookie" and will delete it on a condition like exiting a web browser application.
67105
*
68-
* @return {Date}
69-
* @api public
106+
* @return {Date | undefined}
107+
* @public
70108
*/
71109

72110
get expires() {
73-
return this._expires;
74-
},
111+
return this._expires
112+
}
75113

76114
/**
77115
* Set expires via max-age in `ms`.
78116
*
79-
* @param {Number} ms
80-
* @api public
117+
* @param {number | undefined} ms
118+
* @public
81119
*/
82120

83121
set maxAge(ms) {
84-
if (ms && typeof ms !== 'number' && !(ms instanceof Date)) {
85-
throw new TypeError('maxAge must be a number or Date')
86-
}
87-
88-
if (ms instanceof Date) {
89-
deprecate('maxAge as Date; pass number of milliseconds instead')
122+
if (ms !== undefined) {
123+
if (typeof ms !== 'number') {
124+
throw new TypeError('maxAge must be a number')
125+
}
126+
this.expires = new Date(Date.now() + ms)
127+
} else {
128+
this.expires = undefined
90129
}
91-
92-
this.expires = typeof ms === 'number'
93-
? new Date(Date.now() + ms)
94-
: ms;
95-
},
130+
}
96131

97132
/**
98133
* Get expires max-age in `ms`.
99134
*
100-
* @return {Number}
101-
* @api public
135+
* @return {number | undefined}
136+
* @public
102137
*/
103138

104139
get maxAge() {
105140
return this.expires instanceof Date
106141
? this.expires.valueOf() - Date.now()
107-
: this.expires;
108-
},
142+
: this.expires
143+
}
109144

110145
/**
111146
* Return cookie data object.
112147
*
113-
* @return {Object}
114-
* @api private
148+
* @return {CookieSerializeOptions}
149+
* @private
115150
*/
116151

117152
get data() {
153+
if (this.secure === 'auto') {
154+
throw new Error("Invalid runtime state, the Cookie.secure == 'auto', which should not be possible.")
155+
}
118156
return {
119-
originalMaxAge: this.originalMaxAge,
120157
partitioned: this.partitioned,
121158
priority: this.priority
122-
, expires: this._expires
159+
, expires: this.expires
123160
, secure: this.secure
124161
, httpOnly: this.httpOnly
125162
, domain: this.domain
126163
, path: this.path
127164
, sameSite: this.sameSite
128165
}
129-
},
130-
131-
/**
132-
* Return a serialized cookie string.
133-
*
134-
* @return {String}
135-
* @api public
136-
*/
137-
138-
serialize: function(name, val){
139-
return cookie.serialize(name, val, this.data);
140-
},
166+
}
141167

142168
/**
143169
* Return JSON representation of this cookie.
144170
*
145-
* @return {Object}
146-
* @api private
171+
* Used by `JSON.stringify`
172+
*
173+
* @returns {Object}
174+
* @protected
147175
*/
148176

149-
toJSON: function(){
150-
return this.data;
177+
toJSON() {
178+
const data = {
179+
...this.data,
180+
expires: this.expires,
181+
originalMaxAge: this.originalMaxAge,
182+
}
183+
console.log(`Cookie.toJSON: ${JSON.stringify(data)}`)
184+
return data
151185
}
152-
};
186+
}
187+
188+
module.exports = Cookie

0 commit comments

Comments
 (0)