Hono session boundary — cookie I/O, request-time middleware, and the session-creation helper shared by login / signup / bootstrap.
6 declarations
auth/session_middleware.ts view source
<T>(c: Context<any, any, {}>, options: SessionOptions<T>): void Clear the session cookie on a response.
cContext<any, any, {}>optionsSessionOptions<T>void auth/session_middleware.ts view source
(options: CreateSessionAndSetCookieOptions): Promise<void> Create an auth session and set the session cookie on the response.
Shared by login, signup, and bootstrap — generates a token, hashes it, persists the session row, optionally enforces a per-account session limit, and sets the signed cookie.
optionsPromise<void> auth/session_middleware.ts view source
<TIdentity>(keyring: Keyring, options: SessionOptions<TIdentity>): MiddlewareHandler Create session middleware that parses cookies and sets identity on context.
Always sets the identity on context (null when invalid/missing) for type-safe reads.
Uses options.context_key as the Hono context variable name.
keyringkey ring for cookie verification
optionssession configuration
SessionOptions<TIdentity>MiddlewareHandler auth/session_middleware.ts view source
CreateSessionAndSetCookieOptions Options for create_session_and_set_cookie.
keyringKeyring for cookie signing.
depsQuery deps (needs db for session creation).
cHono context for setting the cookie.
Contextaccount_idThe account to create a session for.
stringsession_optionsSession cookie configuration.
SessionOptions<string>max_sessionsPer-account session cap (null to skip enforcement).
number | nullauth/session_middleware.ts view source
<T>(c: Context<any, any, {}>, options: SessionOptions<T>): string | undefined Read the session cookie value from a request.
cContext<any, any, {}>optionsSessionOptions<T>string | undefined auth/session_middleware.ts view source
<T>(c: Context<any, any, {}>, value: string, options: SessionOptions<T>): void Set the session cookie on a response.
options.max_age is the single source of truth for cookie lifetime: it
drives both the embedded expires_at (via create_session_cookie_value)
and the cookie's HTTP Max-Age attribute set here. Falls back to
SESSION_COOKIE_OPTIONS.maxAge (= SESSION_AGE_MAX) when unset.
options.cookie_options cannot carry maxAge (omitted in the type) so
the two values can't drift.
cContext<any, any, {}>valuestringoptionsSessionOptions<T>void