Hono session boundary — cookie I/O, request-time middleware, and the session-creation helper shared by login / signup / bootstrap.
6 declarations
auth/session_middleware.ts view source
<T>(c: Context<any, any, {}>, options: SessionOptions<T>): void import {clear_session_cookie} from '@fuzdev/fuz_app/auth/session_middleware.js'; Clear the session cookie on a response.
cContext<any, any, {}>optionsSessionOptions<T>void clear_session_cookie<T>Tauth/session_middleware.ts view source
(options: CreateSessionAndSetCookieOptions): Promise<void> import {create_session_and_set_cookie} from '@fuzdev/fuz_app/auth/session_middleware.js'; Create an auth session and set the session cookie on the response.
Shared by login, signup, and bootstrap — generates a token, hashes it, persists the session row, optionally enforces a per-account session limit, and sets the signed cookie.
optionsPromise<void> auth/session_middleware.ts view source
<TIdentity>(keyring: Keyring, options: SessionOptions<TIdentity>): MiddlewareHandler import {create_session_middleware} from '@fuzdev/fuz_app/auth/session_middleware.js'; Create session middleware that parses cookies and sets identity on context.
Always sets the identity on context (null when invalid/missing) for type-safe reads.
Uses options.context_key as the Hono context variable name.
keyringkey ring for cookie verification
optionssession configuration
SessionOptions<TIdentity>MiddlewareHandler create_session_middleware<TIdentity>TIdentityHono — context - sets `options.context_key` and may clear the session cookieauth/session_middleware.ts view source
CreateSessionAndSetCookieOptions import type {CreateSessionAndSetCookieOptions} from '@fuzdev/fuz_app/auth/session_middleware.js'; Options for create_session_and_set_cookie.
keyringKeyring for cookie signing.
type Keyring
depsQuery deps (needs db for session creation).
type QueryDeps
cHono context for setting the cookie.
type Context
account_idThe account to create a session for.
type string
session_optionsSession cookie configuration.
type SessionOptions<string>
max_sessions?Per-account session cap (null to skip enforcement).
type number | null
auth/session_middleware.ts view source
<T>(c: Context<any, any, {}>, options: SessionOptions<T>): string | undefined import {get_session_cookie} from '@fuzdev/fuz_app/auth/session_middleware.js'; Read the session cookie value from a request.
cContext<any, any, {}>optionsSessionOptions<T>string | undefined get_session_cookie<T>Tauth/session_middleware.ts view source
<T>(c: Context<any, any, {}>, value: string, options: SessionOptions<T>): void import {set_session_cookie} from '@fuzdev/fuz_app/auth/session_middleware.js'; Set the session cookie on a response.
options.max_age is the single source of truth for cookie lifetime: it
drives both the embedded expires_at (via create_session_cookie_value)
and the cookie's HTTP Max-Age attribute set here. Falls back to
session_cookie_options.maxAge (= SESSION_AGE_MAX) when unset.
options.cookie_options cannot carry maxAge (omitted in the type) so
the two values can't drift.
cContext<any, any, {}>valuestringoptionsSessionOptions<T>void set_session_cookie<T>T