setSession

tcmts.server.setSession · #ozua6dvl · term · runs on the server

uses #tcm/host (database)

Start a new session with this data for maxAge seconds (default 30 days). The data is stored server-side (.tcm/data/sessions.sqlite); the cookie holds only a fresh, unguessable id.

import { requestNow, SESSION_COOKIE, sessionOf, setCookie } from "#codebase/tcmts/server";
import { database, randomId } from "#tcm/host";

export function setSession(data: Record<string, unknown>, maxAge = 30 * 24 * 3600): void {
  const c = requestNow("setSession()");
  const db = database("sessions");
  // a fresh id every time (e.g. at login), so an id planted before login is worthless after it
  const old = sessionOf(c);
  if (old) db.prepare("DELETE FROM sessions WHERE id = ?").run(old.id);
  const id = randomId(32);
  db.prepare("INSERT INTO sessions (id, data, expires) VALUES (?, ?, ?)").run(
    id,
    JSON.stringify(data),
    Date.now() + maxAge * 1000,
  );
  db.prepare("DELETE FROM sessions WHERE expires <= ?").run(Date.now());
  c.request.cookies[SESSION_COOKIE] = id;
  setCookie(SESSION_COOKIE, id, { maxAge });
}

uses

used by