SessionOptions

import type { SessionOptions } from "@shadow-js/dusk/server";

interface SessionOptions {
  /** Signing secrets (32+ characters); the first signs, all verify, so they can be rotated. */
  readonly secrets: readonly string[];
  /** Server-side store. Default: a bounded in-memory store. */
  readonly store?: SessionStore;
  /**
   * Cookie name. Default: `"__Host-shadow_session"` when the cookie is written with `Secure` (https,
   * production) and the cookie meets the `__Host-` rules (`Path=/`, no `Domain`); otherwise
   * `"shadow_session"` (development over plain http on localhost, a custom `domain` or `path`,
   * `secure: false`). A name you set here is always used as given.
   */
  readonly cookieName?: string;
  /** Cookie attributes. Defaults are `HttpOnly; Secure; SameSite=Lax; Path=/`. */
  readonly cookie?: Pick<CookieOptions, "domain" | "path" | "sameSite" | "secure">;
  /** A session unused for this long ends. Default 1800 (30 minutes). */
  readonly idleTimeoutSeconds?: number;
  /** A session ends this long after it was created, however active. Default 604 800 (7 days). */
  readonly absoluteTimeoutSeconds?: number;
  /** The session id changes after this many seconds. Default 900 (15 minutes). */
  readonly rotateAfterSeconds?: number;
  /**
   * After a timed rotation (`rotateAfterSeconds`) the previous id still works this long, for
   * requests already in flight. Not applied to `regenerate()`, which retires the old id at once.
   * Default 10.
   */
  readonly rotationGraceSeconds?: number;
  /** Time source in milliseconds. Default `Date.now`. */
  readonly now?: () => number;
  /**
   * Receives the development warning about an identity key written without `regenerate()` (see
   * {@link signIn}). Default: `console.warn` with the `[dusk]` prefix, like the handler's own
   * warnings. Never called in production.
   */
  readonly onWarning?: (message: string) => void;
}