From 65a93711e69474f5d9e1ad8cd1bf4f03a152445d Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Sun, 31 Mar 2024 10:17:22 -0700
Subject: [PATCH 01/14] session basics

---
 .env.example                      |   2 +
 __tests__/actions/session.test.ts |   7 ++-
 actions/session.ts                |   8 ++--
 bun.lockb                         | Bin 65757 -> 69112 bytes
 config/index.ts                   |   2 +
 config/session.ts                 |   5 +++
 initializers/db.ts                |   9 ++++
 initializers/redis.ts             |  37 ++++++++++++++++
 initializers/session.ts           |  68 ++++++++++++++++++++++++++++++
 package.json                      |   1 +
 schema/messages.ts                |   6 ++-
 schema/users.ts                   |   6 ++-
 12 files changed, 144 insertions(+), 7 deletions(-)
 create mode 100644 config/session.ts
 create mode 100644 initializers/redis.ts
 create mode 100644 initializers/session.ts

diff --git a/.env.example b/.env.example
index 3f2af2a..8f21e74 100644
--- a/.env.example
+++ b/.env.example
@@ -16,6 +16,8 @@ servers.web.apiRoute="/api"
 servers.web.assetRoute="/assets"
 servers.web.pageRoute="/pages"
 
+session.ttl=86400000
+
 db.connectionString="postgres://postgres:postgres@localhost:5432/bun"
 db.connectionString.test="postgres://postgres:postgres@localhost:5432/bun-test"
 db.autoMigrate=true
diff --git a/__tests__/actions/session.test.ts b/__tests__/actions/session.test.ts
index de8e138..2c93a58 100644
--- a/__tests__/actions/session.test.ts
+++ b/__tests__/actions/session.test.ts
@@ -33,8 +33,11 @@ test("returns user when matched", async () => {
   const response = (await res.json()) as ActionResponse<SessionCreate>;
   expect(res.status).toBe(200);
 
-  expect(response.id).toEqual(1);
-  expect(response.name).toEqual("Mario Mario");
+  expect(response.user.id).toEqual(1);
+  expect(response.user.name).toEqual("Mario Mario");
+  expect(response.session.createdAt).toBeGreaterThan(0);
+  expect(response.session.id).toEqual(response.user.id);
+  expect(response.session.csrfToken).not.toBe(null);
 });
 
 test("fails when users is not found", async () => {
diff --git a/actions/session.ts b/actions/session.ts
index 64e693e..5a42356 100644
--- a/actions/session.ts
+++ b/actions/session.ts
@@ -1,5 +1,5 @@
 import { eq } from "drizzle-orm";
-import { api, type Action, type ActionParams } from "../api";
+import { api, type Action, type ActionParams, Connection } from "../api";
 import { users } from "../schema/users";
 import { ensureString } from "../util/formatters";
 import { emailValidator, passwordValidator } from "../util/validators";
@@ -23,7 +23,7 @@ export class SessionCreate implements Action {
     },
   };
 
-  run = async (params: ActionParams<SessionCreate>) => {
+  run = async (params: ActionParams<SessionCreate>, connection: Connection) => {
     const [user] = await api.db.db
       .select()
       .from(users)
@@ -41,6 +41,8 @@ export class SessionCreate implements Action {
       );
     }
 
-    return serializeUser(user);
+    const session = await api.session.create(connection, user);
+
+    return { user: serializeUser(user), session };
   };
 }
diff --git a/bun.lockb b/bun.lockb
index 5305a7975691f6a822710912859e06c21324ee0a..6f3647f94d229e09553d29e906c1fd4d3879fde3 100755
GIT binary patch
delta 10602
zcmeHN33yG{+TMH1At#*3Bsm#Lj6ouj$Vm*xJmrX)Bj!w!kU60VDv4^53gT-iMGb9<
znb1~EQ56-UXlv$PS8HfddR=4beZM`3zs>(Y_xYcD@BjSIa~JRW=C#)T*4pdroxLs>
z+B|;WW?`Uz>+Qjb!Cma82URYtS~sOu(a&GD|G9nckMnMfzcj7=l_jT=45GkgSBbTu
z6jQc6ccGY{oSu~spPVh6wHE{zK`1x|S`YMqN;iW#L0$=3A2dE8Epu{$AjBucPEJHy
zso8Rq!hF~rV1FId5ws7~bwP^}tOtFj(tDt+&vcgi@hs33O%TA28HoWoc^L`WX)Y8g
z1xoQQG*t?0`K_B`&5KD%NzTp@Myc{_qcW^Zpy;_^up6D0nmOgVEAA^i1i=pKYaV1*
z%O`)iryv+0#w%kM#zJOuLT-+%DS<m*d}=~!dh*nS1hco&OeiS(wE$&%QcT*!WJH*K
z6nz^|PEKM<dMr1To)(7`3BqexF&P<of;QUxg5<QMgskM8?BuiwDanaRIZqMD+31GL
z;p`=3$4*X8i5FJ*DOoQ9MWPC(fb#6btNMYe+)1^!QuS`CUIcZ8{~cc??hL4#kS`RJ
zgJHvFP;Pjs>M$FWr#V}d$AGe5Bq;l}18o56tJ>?T_D7AB4t@aT_y~1gf>aup6q7Ou
znP|>(J{%mt;D5o?mP#rsK>5n!Kv|#IN@?g6D5tyvv@YmBBQyD&!kSa_uglD@NF(>_
z8Y0w@7kG3?+2^_~;)sq*zW?E5pGK}<rTN;Q`sR~ep1v2KMEQ((x30b4{E=OU*n6G%
z^`gnTtM{~ezjg8%@R`lZ{xiIuMJHXE|Ar8H)uXcF!<}D#x9jYJK6?hgeKI?=hwi+4
zNLxGog5G6Gbqb`i$NF~+x-j&sqf-GU-A}kV29m*}gT4b6Y8U8hQAq=newr$YR8lwG
z7D7MS<mh42*TJ;(f@A}eNf!kvlpBx=9jK_4SziW4YnUY}@i6KB1gQ@dqy6T%`@2HV
zEt;exM=EkNOS_z?62!)t?2Kk9+?gUlUU#M<kp0e73Gx^=ceAcFaurU71|6j7E>z@h
z)|W#ODGv(cmFyajorhW94{Nc<OXb1_R0L)DOQj>O%m#VyD31e@t_vg#zg`DvmMax`
znx(z2R0$IAMs{9i{VFWIP&n72L9QnKWk~HI)s|D_hOLDYi9BEcQAV=!HtQEd$;pw(
z5dl9!;^Bydz9h3dReGDHLU*$BG3$0?D+;IL1|9VG!Er+ZmDro4<{nh(W7b=-<#1mT
z4T5r=2SqkC>u;+{wC7=xnt4(slu6jEc#LwFQmH3JHZn`+J*lXXS?}p32)Kci0qA=|
z;!DRAyPKp!FN*Xv>$gJ5^DfaTgGu_?iz=b)jSY=^7vzo#y(!YqtltOaOHciCNWqGW
zi%Hi98&*d$xOC9X0@sTS4juHB;DX>`OC=4%Z5l%0MC;pu<MAp<Np47yP0aeWP=-UP
zT<*n&RN2I=b8dvKlv5-PYDAGu&C=#ZRMgb0+lpPRClxpCpnCwWx6E~DEC_vNZWcJj
zdi15vsfp$n4NkGH1gAvY02d|4hBjqgRP&BDU<Syl<KUtws#RxE>1cd2Evyur($w9T
zI#YA4safEZh-2U^RP5i;riB(d4xG~CCRrENQZ~x1>D&7&$ye^g997cOpr$5ii$4{$
zHtYYaD(mnvlRR3IU4U77t0hGSn003`;kf0HHJ?^g34LBGvI{ipFJi~!*~c<-HR;@N
zk0Q6YZ-=#}%0RQO7>b@$71%*{8eDIga}VGFvo02#VqN!AcMqK6XA0D;)4?ebhrvb3
zu}*C?-6(JaWZedEiuDmVr4=(4ixN8<oYLFzm%0XRwTM`7N<=9*i`?D=a7t_^EJ~&2
zB5<-!`X-o)Le2VyA=*9VXm8R_fYc57s6~!0CTV>LMYc0be+r=@5Wi5W1c?tNyRi28
z20?y25Nd%s03zV1QYTO@Oj(Z~MgGYburLJ)z|xY-tCan)sstT?$&w3G)?<=niaC%A
zXuePzEG|YKKs!Y*yh^zvlWNCpD;K8RU<Uv{l)Nj+a&J&BuTqZh3ox|+9M=!v(oY_e
z%*YQt!Z2Aa$dnz2t1?p^ePn7*drc02Z9ZGasMeaO9<~Xpohkb#s`CFt*)K`;tBGPi
z6$<$=fv@KcKqT*QH+eX3LE>qg3)BG?0$ggM+)asW{l_SNN`((pf2JJ2N~NoL8o7Xx
z4Qo`omX#<>d0-y{9JmhP!j$FpETAyub+Z}Z%i9WYVQK@Esq|A&E=<{Px6oK&_Na<|
zpxp3&fIB`2*iux4TRt~)0^qQd0GC%OcmEy0(PscIOj$n50t!=(KhFXRQ<g6RZon@9
zml~*&ry30ZUBEwCuk>Hj$o}Du_(~rDoRPoDQ3_@KBY^1>RsSk=g|5E5PMP88{{x!;
zzv-CA>VS%=qe`7vKw-+Pvr1i5J=<#7TJ!&%dut6_E9U>-x3_W*l)aWWLwRe(Gvj~u
zR?f<+d+&et*8l9S%CE)$>%BGRU%t1NJ?Zkmq06_y^Fku}cvXevIt&XR+U~JkQ;!bq
zpE-Jkym6>a*~EyzO((V-c^JCPshdl~trxz}n{sXNUq`L6L^kpadvLPYQaX?V1{?D?
z%o=2A(tkxo+1XCb_7%->p4;uU3sZVu_Pd!f{L1z8>o=VC92<Jur}vode=A7$ANIbn
z-S8#z2T1Q`e*MYmU%r$c-@`2|3NPxvz;=&E?U%)--qH&3#=58r{Tya&5#EV>adU@5
z;q&NGF3V=#J8>h!_-;`A)9EMg9dsXY|7;(zxO1&^-we-bWljUVv%8F1<(fS8CSAtp
z&XoRg>1td3bC-QR^KaOV@PGbZ`6K(%>ED;HS@hoOzc_!~uiJ^3ysMqFk1T0*t!nX*
zpO=LTsZVaFEv=o9vNyvck$;A@(P`T~578#e_*v+bgb5#aKU=Z0X#9~C^poMwqxydr
zbvxns7gtyG$e+08QkUYlP43BqE3@}jg{P05{B2&#Bh$Cs@1gs8@DAJhA5-xV<gVj@
z)~~&`b>WTer<P@{oi}8|sOKAxR-Jo&=dg#BNiE`|_S8-~yXn$_V>53~Y;r|BF#n45
ztN669$Au5ZJzROg`d-W{qcica)MDd3)aH`l`C@s``wxUQElc;;kG=fUkDnW^u4(PD
z@b=PL(u8Ll&rfyz-aTeY&XSp#mcN*~J9oPKVq~&&%z|T2RvE_<bsB1<)KrTYLAz6}
z^mwQtzenW*SI=={ZtW<V+N{l-NzoPhiiD?=ua2qf(f5SIollMSXRlwf%WLxN?4+Zo
zzq21-&$Fz@t+n|x#_I0gaQW?WBOaQTNq*VTijBoPdC0+fKNW@5{=E3Z?z?PH-|?>(
z{MHY5H#R?Vx3I`=z^+NJU%s$E#XUJa#H9ap!Kxw7o^e~A7ak4|Inh1nlM`D#XvHui
z-5F#NJ5j`7D~%X#pcR8HVrRMq$<}J1s38`yD=i&jrOzNeht!?=4z*I!2m@^%Y7u+V
z6G+Br1C1GG!TWpZFe`lp$uQg^_ND0IR>~b|pnZ@mq_<kB#V7-%S}kG}?S^y?lJ^LU
zIDnEzSZU5^164s9MDEd63Lj&j*P|`s5IPF!CZvFo7I7HmjkMBxV-0i}l9l{NS*g!B
z0~L?5h|zQ&(ql-SMq9*DG<UR>){i&P9Y|v+VhpY?2G=*nB95b5kZfadePb<R3@sgt
z>x1+hQXKUihwF>O^^LQL3G@V#F&@`9-XbPa>3CcpBtwivOs41<t2mLiqn<?iSgV*q
zF{o2%H|jKUjI)aAl#Duq4x-K^_js$AMVY9x=_u+P@=dUclPM4N6gq|aHS(We6?3T&
zbsn8ZJ(b!fTE%HJ7xi?yiu!emNV1AEs04LB-9lYJU6ZY1AuUBclkTH_gZfUiinC}n
z>Nn{L>bGdnB&#@^N>R@tF~us*rD)Vev>o-^q{muqk%{?8vxvo%oQBzfR0U}Pxu;vj
zg_Mc9gpQ(KM7|kTkth%KJ9G;5yX2o~6&F(>>Lqj@^?TGd%PKCVxu}=XRn+fOM7C92
zP9>;U&@I#}scVi^{D79CUPbp&ucp3}t>PM5je0FTLH!{Onqn0{qEgf!llYodTu0HU
z*VA^?rKHcbiW?{f^+wu_dJ{S3S;ftijCu<lM7@>Vr&`5rl!<yf9Ywu^e5YB(GRi}}
zv+UHgI2}36yhH_cZR|3#5^{2q6S8t#sas)tiQH&LVVYqu-l*{SSP<xrhj1z^Oe}Ml
z`9S0V>Nwk0x26&P0-&k~O8-SXF0P$E*B9=)MZ5L<>WI>3C%v`7%x^(2ep3o--v#)&
zogY)VXfppC^MgH?#Q?MXI=K|!vIJlqzf=xV`S(<rUnCm<T$TguR~z7WKl$$>D^w-F
zss9aN<4S<vlX7>WLh17<P24y<zaCf~2fyIY2Ic_#;=vD*ivR-N0eIXzP97JJgU7iH
zcpu;~aF^T#|Gi=?Fb)_G!~n5C91ssA0Q@JCD4;)oV;TTvFfasgApcEm3_jraxpgKm
zi>_{L=;#NoF~Cm&e35^pgPYoTUk7&sxCz_>egu93ZUcAd>SpJBe)~QJoCdxH`0e~_
zU@h<=@DZ>Y_y9-*h5?QM|1qgIfIs^Qoq)~&{}hJ;Er5jpzqLICeE^&T_zw)Fzy@F=
zu!;Y2u@20~z#3o`Fbe1k@T=Y<(8s{%z&2nzumd;*d<h%|Dgge&(q3Q?PzZbjSb-5h
zG%ynA2Jl2b0iFWSfL{gj+2RvsgRXQyZJ-Wd3+Mqmpe|4k;P06BK<=lAL-}eC)<!e$
zonXrVZk<QQbH;PWBkEXIxWy{^^AA^hARI6OVL&^8GsPJTR{02W+~!R8w%Rgu+#vo0
zyUiKDP>$PL<#&Z_1~|`MR50Hf=nn9FL;{>To|j%gPoM|T2iOAeoGbw51I55RAP2|>
zQh;QD=XWr`Ypy>q5I|b<<;6D?0_T$RIvn5}bADq0Ue(&_<vC<|w5p2*<rUAe<~ttz
zIDq{$9m~we0UFQtSpEx_=9C1*cz{>q1b`dWI@El4Al&IBU?PwOWC9sLI*<ya0YhHl
zd44z>Zv#cZTwo3`8+eP}+*V&V6I>y!-X7A4z?A@tfF-~?0N?uW0-J$Nz(#;qdMUsw
zUt8!Ok@pUh&sJ!(C0z%6C*biOR9w!{;vLPXe8<TK+P8A;%bg^_Oyd3qWvj|^ZG*K>
z-`a;bNgUfY5dSd8_PGDBaciIIR7(&oJmQtFeNorG@4*<1upsPD2&<1U?F%3*p@G3{
z(Z0%S-w0s|QDU_3_S#oOxhpwF`?9ZnXOv@t0>jXp_VHi)6bX|$gc_R*!Vt)_(lczG
zqaYYDKwV<wq(9Ydb=5^QcjCK95DviN4olI2-3}KoU3;_Ia?X+Z?=^;9S3~>O7Zwd{
zwmp*_f;d;g3pLcg$DuBchu1%03*VObgQ62H-)r>pcT&DZ7mORdpw8NpP1%71aZftY
z$-VugAx`A8&lolyew_6wLtE>bo_KS<i`Y{3!peh%6T9#Du3olFdyT5L<U3KyKBJd*
zYGK;##Hu+?KlxQVEOw$*`)-D<Mhh-zp=ZxN^QODlB&oy41!(6PO4^JpZnmpage1-g
z#)Y*F40+~6`}Z5Y{^+0$E7O_k9WY8Nx#vX94ou(!5c3ZdNH`ARP#)~1eNEnT#r0zD
z&JS}iQ<#mwkO;xSjmDN6rRHvwTOKS0xzQ#_5pGlgshb-;E$`>0JwKf4ZT_&dTf?1_
z7!(-6%LxY*DE44K>03A2b}-mWJ5&*U;I3}@l{+ou<seVaB_q8!Xq0l@$@s-isl<Z@
z9x~GPFFd3b9(3VwkWXmXH4o((MY#NaNNPshX-QP32Dhl}Esgc0iHCwEoX99YY@|;P
zg-Xjk%Wfa?64^4k!bpCHL%p<v7F93K`R`ls$!>K7SX;|I>GmO`6zWa$4ja9+0~)c{
z@An(sGwYO`4*A|u+E>OkK^>{ugO_$(<LkegzMS4}N)JSZDmSXxhZa^CrKdi$p`xFJ
ztULypZKPgDa?MK{DOdIbC}zLl%9R5vHU{sDut65vMg+DE79PREi{h&~1DEu=nfgVw
zrLHgidc^4E>#H~zpFV9nxH2rE+M%5<1$|`<(~esNbz3&>)7tf=Y6tB=hQY1Jt(9A*
z9I3Ws`_c@AY9~07cXwPLT08Z6wS#uX<Ki0=dbM4A;b668vo9V0%IKvX3fb5zc}!O4
z=F6)c&iF1mY7Em(k+gJb5hA{QZFRL>^iz(Bq>Nwl+nJKxU8^l_e$*eK+QF0?i*tTi
z-TC33Y6tD;${d?bN#h*b=T=(=`qA>EMlbEG%fTN?);qiPepKx+#g9%NHBQtH$JjcW
zTYV<JbG+I?J3bTE@AxOH7ww!{ZPAXI^xwau^OXD-{+RlZz>vUTLC_AQG_dbGGA`+C
zdwEfq`0l7^Nhy`VQerDwRcQ><4y4TbZP&_Y#s+Ed!-8W!?a0daw?FqNZ}ePQjA3kf
z)QIjPR68^?*nF~;m$&0Od063r!9hZe3q!VGVRSrZ^r~@T$PQzCDdU(iOgp&qg>bib
zvs+S^>b7fK7;@-RU)qmQ?JUrm(is!)+BQ919a`hUkVDV-QoZ9wuNqf|>>&D4m*d7T
z?Lbnj>#zFy4P72qw_W4PkV8B9(R_qzXPl_R?Zy*}m(8gTt#M_@p;#H0FsvF^hU~Dy
zj~uFuUO0>+ze$bWJumwkV;v_<VlaMLu~kKfP>-s9O@99afNhMoSv)EZJcs=fW#Kv6
zS=ECcRt0;E2vyE9%?fXKT+Fq9QLeg-H<WcdF~?pzW7j62jrs%;(2mz!U{2!HE~=(Y
zTzYD1Oj>+)T*~C^oP?}^NeOuY*(vEcDe3Vs*-3%%2@_%_r{q8*i^<tBS&5TV6Vh_B
z<>Pw+30Ya`St_3qla-y2m7Rm;VzS}`Vr;Vm;&5y(Hip_>_YSDmYwEa37+Fo~fM6=W
z+1Oj@L1`79uZjU7boFb^Lm9(M4@C@UOPS{z`~Pv=@cW|@?V(5C-(7UItCj{zKi||*
zd2oVJVU*F*@&{uZ|2~QE`MrwnJ!<OnhwQVXIuXji$>%S&Wv4Gyx|KbBaINm&0V-Y#
AFaQ7m

delta 8772
zcmeHNd013emVfWDNU1DJDbKP1NnAi96o@Q}<%)`><L(m#6_KSBTtPuGlxAs+yGKz`
zqC}IpBz7BIg0@LC#ueP-Ley!;#Awzw-D8%Sw)=P9BF+r+eWsKCFZc6z&w97>PTlt|
z*B>^z-(2XvGCXYbf33T<)BVr!m&&CpoAYDeSbF5MqU)`PY>xPSJL|O*UC#^=M1jj&
ztCV1=c;}wNm13WPkedjCE7w;LOrUi-JqODAVSa+p6x5L0!k_(SWOvRlnvpqsNHcm(
z3YYpeql;2_$11aCElSVLb<WNgy6JLO3qe4Ku0x<cppj<k=+?eOX{osv2M9uAsE>kj
z=b5v+cFru!7cys0b7o};0*}NKpDzo7H|&#HK<NRQ+p#Z~8EDUw&CAT2?wpsI8EDb^
z^9N<WMxboZNuM^w$?FSjtr>h;Q=MB-i7{R0w4BUY&ivWVX<50>?411TaN}TvU^$2f
z<~OOpnLAl14i<#wke#6Zprb+I;_9pGBXrrS+Z*fphe4X(pFj};SB)l@xb}g;8eE%o
z!%|T0xKML&Wr6a5BXl_dlsgCmWj`}0LhKTB`xk+l{R${g>=-DwpPV_VAR7V8o2|x8
zkYO|lC4$RWWdv77PI~TC*gSRlTlCHoJJ3Okpj)UGi7k*>zYQ{X>=UL1)D4s)_Ol{Y
zf(B0+s((qOf;f~$s6N4pIb<VkS`L-jswB_dVwIPdOY&R(f)IV%a{BnTy~jS@cXh?U
zs?x@5yy=D|L0aQWmezLZjxVKv1o%-oNU9&zfmHaB#cG$X`caD2?$M-~AjDBci|*36
zW>jajn>Ir+2qU^tddpak`;hujn%v#g34!fr=uOihVM;EMLM*YS&5v!BEn-b~ASI|a
zNFKphK{Qn~?Ji~bQ(cf<+UQS~V7t`UOew*3QwdfV4d+I5yJf8DkC3`S^5nry4<W@s
za%V|;t_7vEv6~8zS^c4us1h!xAn~k3!dOyZOR|L6rHL&mCB$x8k3hz$Hty^^B<@V0
z5Z_qIGk`45*iA9W8Xixg+di?<%K=ml<r!Tm((U$fqD+=&?WO_vjq^0sQKeFu%Ad7M
z@5)pM+fT4{RL9}fw{4}Z-i>ZsW2K3$sJyM+v>eJ_YV&lAbG8*(+SyI*u@CUz0;S9F
zv`{&eo1lE`X}SR^N_D9;$9i<Y29Q7%=I*8pa2y0g#vJDbfuDsJ_v7&?OB`>L*{aQ1
zi_JhQm3Oe47D35D(N=uWN|sQ&={qRxP>O1xZGluCYL}J<QeCLsV>xz<M7kN;-QyCt
z0V-!{BM3<<mjO<*Zhx$M08aCZ3t?+orv!H}T7%=@hNw;bpD}c);D)NYUEnn958$*;
zdOmCTm4ed-t5tOsofF*K8VxeQX$^LQb5L5iYSc!xw=>+9fYWrB!J)TKJ?TcP1j*5!
zEEc<IZhP&SsM&AYqe~{L42_k(Y)>f>c2giW8-8q!H~}T41Jy;?r4Kuh#b!78V*|pw
zObeuG9Hb;jZWMwCyg!uc;38vB;$H{yFd)`63X&Fi{Enp6VN@Pz_c#q@B2`3o_wYqt
z4N$o;;F45sGdRuq>0@2zPKIATIL%rOPHQ1O$E)Z5hJw>{>%k3Gb)P@BMt3%PnGa6$
zI|fec&lGOxMu5}$+YC;d-(7GHwZF&+!*3oq&F_Svll*Ly5^Fc5B4Ig*_&xc=nzlmf
zqXr6TE`4SrOPpP@Mp6pMgh(m}sf?t$xNap)1$E~a+(7XvS3f2Ebc(G?Ell|n1KW`5
zgNzd-06C+UCn@_OT?7vRQCAC7)+4$qMI6-vS|WIYjRbfC*bvn6B;|py&8YTx%`7nG
z4zXZ<9SMoLj9;)?o}}C!8Kh2l5Gc2E09+hGhQX+B17VaVs+1i^>oQYbQ3}BNaR8U6
zqST{XhvC?-gaUx4GZ)}q3Uyip%7rQG=K&m!1wbR<MS#oyp!9aH0K8cR;U%t68lpbX
zlWNr{_r3;Tx>naSWw}hJ>vTO+o<+H?->B=Evi~N2dR)M$!Kno0<!uGHFm(ss)afoz
zE=<|)ZJqvJr+YxT<97facpu;e90pkb9>9eu_j^=mt#x#awJ1+g59*N+P{Pg5s5XuA
zu(i6(l;v{(UQohafXlB)wfOvs9sa))<b{5&TA!ra_zf7emET7LZuo`XkSRyxE1iC$
z>z|}}=?m`M=xL}L|EF<$+75rFU&)g*<+dKEn0o585eq0xnf21CN!PRO7wnKFzs45%
z3wB66|6jgEatyRB(**jnc1XOgf7>ECdcSRv9EFCq*59^BH8M}Xr|LV?lRF#t@XyNe
zPd4PfpL&a|O78bpKWdTep!K7@DKFU}cA@HIg$9oCroa@3*p-|q3jF}77E&y=8mG{9
z#hVt4bBOVD3ewoI-qbnOA$F&tRE4~fz3C>T9u$_Q(7TY9r8&f&bRAMoiZ}Hb?+|;_
z;_(W}<Gkr>NPQ`Of<h-DRZMV*iF6-QVX8L`ndlG)(1wW$g{FDa-ykJXQo2IdAibUL
z5FPX*q|));ls3sB4xt^B6pEYRP2L#}aVRBcD0C0fVMxQtG+Ckb6S2O@4sj$^LmHTl
z^<_H5(d5j;`XJRpQm9oH);9_3%W{axbPCeg46HBPA&#S>Y^-lG)(0t#!g8=aNXv2@
z;sm-5DJK)_b2`LyTI|I7vami#85BPS>w{D=#UW<WeMp7bSl?8Km`xj|VtqMSA0#Iw
z<tpM7szg1Neng#1!}Am|k9MG*M&dL@oKDH8XV4zhGs!ev5ob|4>e*C{I-i=&P{aaq
zqMk!XP|u}SGZnFrW}+^lQ>f=r$Sg&iPerJU=>qBn6gFECpQnYWOXxak7e(eP;zHV?
zDB>a#$136rv>2Kf={D+@D84`uU#3;4e@FLGms0OJiny3IpnioOpk6{rbMbWY@vP=L
z#AWm&q__e+t3rpkf_4-t;z|;W6mb<Lqh3vWP!pNvDdHMRN4=J+QI}D(`HHxXoT%5+
z5!4%~Rk0$L(@fMG=@jZs6tX}OE2s$dt8@YNW(s>=5x3An)RlA{^=lMaqKI2*G3sq}
z8};iH?^47!Xcg)==|1Z1)O(>K?w}2*chUpYyQ-2FWq6QZQ+HZg>Lrczr?S#+UbD>F
z-#O{QqRDLYi-ZC%RhKuus&MFXRXtcVR#IENwZzM7A^xh@MAM#cP-~O6ZeJPF_=BC=
z7BX=cO|7z*Jo>v<Sh*D7A2okQb1`K8%HwYxF3SLB`IDP@F3SPd@n`lhonN8Ld=A3A
z)xu{B_VWbv&(98z4;XxO;ZI67@*#si9arjyfP~#NV(*v`o&%qD<^#n5e~0lo=4Ie_
zKq<}K7aX<{+$vx--~a{#Lx6t+h65u2KD#!juKOaK-r(i{e7fQj)bjwpWn92QU=i>F
z5CS{{@CL|pzX$MH;5={vxCmSVE(0F}SAeU)HQ+i>N0s{`N@~IJx#J_?IB*g;3VaCg
z32HsC0pI{|v_=7V)aqHdKWKL#0l?oZ_zzP;7oY?1BEVbmm!SNeeix_#_)DS!coo>p
z3)=#Qk7RsID+AU5DZoI0KXbnV{TkQ}Yy(~g-T)2&?*i4pL0}N@2VfXb0Gt5E017Y`
zNCtWX{6zUc@GbCXAy^O|fcXyi3-DLqKY@q9_rMSI_5KJshsQ=)`i@2$ClqvvvbTw*
zl~v|eoDiJAvA_<X55VK}s#<#hKkQM}eq^imVtBAiBN|@qFGiv6)H?<;$157>s)PCG
zfH<HN&=cU;a*R3F-GF$Y2k<&QI2cgk1eXJ(1LFY>!~mcl&=*Jq_(^d<lYpTBXP=RY
zoP`{y5da5?gU>-^nX{919K?~jZ1|3bJc^$nI~qzTRGuSl@NDM}44*Xc+&C2&2k;=q
zfQFAT=tS5i0NFqmkO@o%CIK11K>pzv!a^vV<b9}1Qa-rZz${=UFawwlOat<OTwp3N
z1y}^U0+a%af#tvwU>UHK795K0vkqJtuohSY5U?6p1*`;C0GyI<0^5N`Kos!7JE%~0
z*3!j8?cKo9_lGW2{l_0my<%SW5d;}OYLDzeQ~$k5r`u-H-h*=izYJJf!Sc%c)qbDc
zxbsrI<$w>pcU+G7NN<|tE36*Ye$PyHu!TpW=}o<9SicW@HT!7$k8I(IAfbJz=?U5D
zg=n=v->wO%D;jM*-;N!)p&$hMQm+$(r6^xoenO7v2|qvh%^CHaN4v8xEjNoDRWD=@
zEcoX-T(hsg*M|P%>Mi4a=>~={ZtUiNm0erf{L5$R9SVHO@8rE07n+;VLt^5<rNw6V
z9DVv&fN`0(Dk5cB`+Ys)CGq(vEG#m-OPw!;pOUTr*TI<9Fh43jB}+Ov=SyX$viSDz
z(J7aNyFl0JD64UEa_CmePYU;L%a_FQws2c`mw4e@e>!_wmORaL?{t*pYbNU%S(42Z
zb0$g(G1HVYgRRD!?!o~3wjF(f_e!EIJU-lppma0S#WRDYDl@gIiLx3uiplSP<FV=1
z*P$3B3WFfVhg#6I8d*|WQfbXzX+{8jP%G1zT8mU1K!eWPf}&%LYewPb#x8j?GA>G@
z_GtJ5k-eoJxL&A@l8y$D?YvCw&qho0<*L-PR*@|=P^~@}Z8a_vYad+;JG^3lwLSyn
z)_j>#&&ra&h5q}TY&9++C*6H8I5lzB1vMOzyd<rEZC+XWO!X10KCQLKf9@}_$BMho
z>4#R);gP()z}BlT$kO%JWVtX{LQrx*vRcso3x)Q=K<zWZxaPZc>-~ydQHSyAj>yD^
zM@9+8?bgXg!`Ah`mv^+@@<kx!UX-oI&7u6$Pmv=|$7I$!n1g7`MLEW}YP9t!pK!p_
zSE_d~E+f4I`rUtZ_nZ^;mJvbp4VoIam(J>h?a`ijck3OD`^`^Y$m$<iR(GV{vNVVi
zF3DEoLUdPuXWFcu9X8cF><gk9m*g1z3f0xId1x1L$(_o22jh}8cj9Y*zp|>jcfI9d
z5WR<{#;xq<W%=J#_I!A#-odzxEOmb?XF{`Xh4q$*U}}0<w)VwqtvP;TM?PD%-9KQ!
z_w^2=gQ?eLxr=c#?A6TP>0NP6O}&G0cN{agW`E`Cz4IPhDDQY{X-fxMj{c47))qcV
zDH%CeyQx_a%emtgN=Gk8S&e(wGCx=EE@`_H)#U0L9u+CLg^}OKa*S~y`{`E)Eg!V`
zo0fes+(Uz@5EmY06Oany(X_!-P#uhG=2u(W4qm#Sk)qCBwS)!HTOZ5T22(+GKq~wR
zeK(j2szZaRpjwa$;aB9C22(+GFmBH;RQd%T3%x(Iep)p_RD4CYHkb-(Q>4Nl(07BW
zpgJ^|3aSOE@CZ#COa;}!_+J4hAG(5zw~eOyX*q*w@KxE`U@E9hN7~4BRhG(ZRDN}E
z+yA}eW8dO^wJScKYPGjU+*xXTtsf1$X0xotR?!rx`C?qx8nMvlQO;S-B~hp<zgFr~
U)%S~w0hD@w{DBsdc&Euf0Fma8CIA2c

diff --git a/config/index.ts b/config/index.ts
index 49cb2ab..4e09645 100644
--- a/config/index.ts
+++ b/config/index.ts
@@ -3,11 +3,13 @@ import { configProcess } from "./process";
 import { configServerWeb } from "./server/web";
 import { configDatabase } from "./database";
 import { configRedis } from "./redis";
+import { configSession } from "./session";
 
 export const config = {
   process: configProcess,
   logger: configLogger,
   database: configDatabase,
   redis: configRedis,
+  session: configSession,
   server: { web: configServerWeb },
 };
diff --git a/config/session.ts b/config/session.ts
new file mode 100644
index 0000000..0cc6cc3
--- /dev/null
+++ b/config/session.ts
@@ -0,0 +1,5 @@
+import { loadFromEnvIfSet } from "../util/config";
+
+export const configSession = {
+  ttl: await loadFromEnvIfSet("session.ttl", 1000 * 60 * 60 * 24), // one day, in seconds
+};
diff --git a/initializers/db.ts b/initializers/db.ts
index 93f0538..ebc4f6c 100644
--- a/initializers/db.ts
+++ b/initializers/db.ts
@@ -23,6 +23,7 @@ export class DB extends Initializer {
   constructor() {
     super(namespace);
     this.startPriority = 100;
+    this.stopPriority = 910;
   }
 
   async initialize() {
@@ -51,6 +52,14 @@ export class DB extends Initializer {
     logger.info("database connection established");
   }
 
+  async stop() {
+    if (api.db.db) {
+      // TODO: no exit method on drizzle?
+      // await api.db.db.close();
+      // logger.info("database connection closed");
+    }
+  }
+
   /**
    * Generate migrations for the database schema.
    * Learn more @ https://orm.drizzle.team/kit-docs/overview
diff --git a/initializers/redis.ts b/initializers/redis.ts
new file mode 100644
index 0000000..0358686
--- /dev/null
+++ b/initializers/redis.ts
@@ -0,0 +1,37 @@
+import { logger, api } from "../api";
+import { Initializer } from "../classes/Initializer";
+import { config } from "../config";
+import { Redis as RedisClient } from "ioredis";
+
+const namespace = "redis";
+
+declare module "../classes/API" {
+  export interface API {
+    [namespace]: Awaited<ReturnType<Redis["initialize"]>>;
+  }
+}
+
+export class Redis extends Initializer {
+  constructor() {
+    super(namespace);
+    this.startPriority = 110;
+    this.stopPriority = 900;
+  }
+
+  async initialize() {
+    const redisContainer = {} as { redis: RedisClient };
+    return redisContainer;
+  }
+
+  async start() {
+    api.redis.redis = new RedisClient(config.redis.connectionString);
+    logger.info("redis connection established");
+  }
+
+  async stop() {
+    if (api.redis.redis) {
+      await api.redis.redis.quit(); // will wait for all pending commands to complete
+      logger.info("redis connection closed");
+    }
+  }
+}
diff --git a/initializers/session.ts b/initializers/session.ts
new file mode 100644
index 0000000..11e7b69
--- /dev/null
+++ b/initializers/session.ts
@@ -0,0 +1,68 @@
+import { api, Connection } from "../api";
+import { Initializer } from "../classes/Initializer";
+import { config } from "../config";
+import type { User } from "../schema/users";
+
+const namespace = "session";
+
+export interface SessionData {
+  id: number;
+  csrfToken: string;
+  createdAt: number;
+}
+
+declare module "../classes/API" {
+  export interface API {
+    [namespace]: Awaited<ReturnType<Session["initialize"]>>;
+  }
+}
+
+export class Session extends Initializer {
+  constructor() {
+    super(namespace);
+    this.startPriority = 600;
+  }
+
+  prefix = `${namespace}:` as const;
+
+  getKey = (connection: Connection) => {
+    return `${this.prefix}:${connection.id}`;
+  };
+
+  load = async (connection: Connection) => {
+    const key = this.getKey(connection);
+    const data = await api.redis.redis.get(key);
+    if (!data) return null;
+    await api.redis.redis.expire(key, config.session.ttl);
+    return JSON.parse(data) as SessionData;
+  };
+
+  create = async (connection: Connection, user: User) => {
+    const key = this.getKey(connection);
+    const csrfToken = crypto.randomUUID() + ":" + crypto.randomUUID();
+
+    const sessionData: SessionData = {
+      id: user.id,
+      csrfToken: csrfToken,
+      createdAt: new Date().getTime(),
+    };
+
+    await api.redis.redis.set(key, JSON.stringify(sessionData));
+    await api.redis.redis.expire(key, config.session.ttl);
+    return sessionData;
+  };
+
+  destroy = async (connection: Connection) => {
+    const key = this.getKey(connection);
+    const response = await api.redis.redis.del(key);
+    return response > 0;
+  };
+
+  async initialize() {
+    return {
+      load: this.load,
+      create: this.create,
+      destroy: this.destroy,
+    };
+  }
+}
diff --git a/package.json b/package.json
index fa109da..ba67df3 100644
--- a/package.json
+++ b/package.json
@@ -17,6 +17,7 @@
   "dependencies": {
     "colors": "^1.4.0",
     "drizzle-orm": "^0.30.4",
+    "ioredis": "^5.3.2",
     "pg": "^8.11.3",
     "react": "^18.2.0",
     "react-bootstrap": "^2.10.1",
diff --git a/schema/messages.ts b/schema/messages.ts
index 44c090c..fe1d034 100644
--- a/schema/messages.ts
+++ b/schema/messages.ts
@@ -1,5 +1,6 @@
 import { pgTable, serial, text, integer, timestamp } from "drizzle-orm/pg-core";
 import { users } from "./users";
+import { sql } from "drizzle-orm";
 
 export const messages = pgTable("messages", {
   id: serial("id").primaryKey(),
@@ -8,7 +9,10 @@ export const messages = pgTable("messages", {
     .references(() => users.id)
     .notNull(),
   createdAt: timestamp("created_at").notNull().defaultNow(),
-  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+  updatedAt: timestamp("updated_at")
+    .notNull()
+    .defaultNow()
+    .$onUpdateFn(() => sql`updated_at = NOW()`),
 });
 
 export type Message = typeof messages.$inferSelect;
diff --git a/schema/users.ts b/schema/users.ts
index 380239c..08cc645 100644
--- a/schema/users.ts
+++ b/schema/users.ts
@@ -1,3 +1,4 @@
+import { sql } from "drizzle-orm";
 import {
   pgTable,
   serial,
@@ -15,7 +16,10 @@ export const users = pgTable(
     email: text("email").notNull().unique(),
     password_hash: text("password_hash").notNull(),
     createdAt: timestamp("created_at").notNull().defaultNow(),
-    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at")
+      .notNull()
+      .defaultNow()
+      .$onUpdateFn(() => sql`updated_at = NOW()`),
   },
   (users) => {
     return {

From 3ab8875975e8adb084b0aa820aa442066e7a08d7 Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Sun, 31 Mar 2024 19:22:55 -0700
Subject: [PATCH 02/14] session setup

---
 .env.example                      |  1 +
 __tests__/actions/session.test.ts |  2 +-
 actions/session.ts                | 16 +++++++++--
 classes/Connection.ts             | 46 ++++++++++++++++++++++++++-----
 classes/TypedError.ts             |  3 ++
 config/session.ts                 |  1 +
 initializers/session.ts           | 19 ++++++++++---
 servers/web.ts                    | 36 +++++++++++++++++-------
 8 files changed, 99 insertions(+), 25 deletions(-)

diff --git a/.env.example b/.env.example
index 8f21e74..93751f2 100644
--- a/.env.example
+++ b/.env.example
@@ -17,6 +17,7 @@ servers.web.assetRoute="/assets"
 servers.web.pageRoute="/pages"
 
 session.ttl=86400000
+session.cookieName="__session"
 
 db.connectionString="postgres://postgres:postgres@localhost:5432/bun"
 db.connectionString.test="postgres://postgres:postgres@localhost:5432/bun-test"
diff --git a/__tests__/actions/session.test.ts b/__tests__/actions/session.test.ts
index 2c93a58..594af4e 100644
--- a/__tests__/actions/session.test.ts
+++ b/__tests__/actions/session.test.ts
@@ -36,8 +36,8 @@ test("returns user when matched", async () => {
   expect(response.user.id).toEqual(1);
   expect(response.user.name).toEqual("Mario Mario");
   expect(response.session.createdAt).toBeGreaterThan(0);
-  expect(response.session.id).toEqual(response.user.id);
   expect(response.session.csrfToken).not.toBe(null);
+  expect(response.session.data.userId).toEqual(response.user.id);
 });
 
 test("fails when users is not found", async () => {
diff --git a/actions/session.ts b/actions/session.ts
index 5a42356..aead241 100644
--- a/actions/session.ts
+++ b/actions/session.ts
@@ -6,6 +6,7 @@ import { emailValidator, passwordValidator } from "../util/validators";
 import { serializeUser, checkPassword } from "../ops/UserOps";
 import { ErrorType, TypedError } from "../classes/TypedError";
 import { HTTP_METHOD } from "../classes/Action";
+import type { SessionData } from "../initializers/session";
 
 export class SessionCreate implements Action {
   name = "sessionCreate";
@@ -23,7 +24,13 @@ export class SessionCreate implements Action {
     },
   };
 
-  run = async (params: ActionParams<SessionCreate>, connection: Connection) => {
+  run = async (
+    params: ActionParams<SessionCreate>,
+    connection: Connection,
+  ): Promise<{
+    user: ReturnType<typeof serializeUser>;
+    session: SessionData;
+  }> => {
     const [user] = await api.db.db
       .select()
       .from(users)
@@ -41,8 +48,11 @@ export class SessionCreate implements Action {
       );
     }
 
-    const session = await api.session.create(connection, user);
+    await connection.updateSession({ userId: user.id });
 
-    return { user: serializeUser(user), session };
+    return {
+      user: serializeUser(user),
+      session: connection.session as SessionData,
+    };
   };
 }
diff --git a/classes/Connection.ts b/classes/Connection.ts
index b0713b7..d0984f9 100644
--- a/classes/Connection.ts
+++ b/classes/Connection.ts
@@ -3,16 +3,22 @@ import { config } from "../config";
 import colors from "colors";
 import type { Action, ActionParams } from "./Action";
 import { ErrorType, TypedError } from "./TypedError";
+import type { SessionData } from "../initializers/session";
 
 export class Connection {
   type: string;
-  ipAddress: string;
+  identifier: string;
   id: string;
+  session?: SessionData;
 
-  constructor(type: string, ipAddress: string) {
-    this.id = crypto.randomUUID();
+  constructor(
+    type: string,
+    identifier: string,
+    id = crypto.randomUUID() as string,
+  ) {
     this.type = type;
-    this.ipAddress = ipAddress;
+    this.identifier = identifier;
+    this.id = id;
   }
 
   /**
@@ -39,6 +45,8 @@ export class Connection {
         );
       }
 
+      await this.loadSession();
+
       const formattedParams = await this.formatParams(params, action);
       response = await action.run(formattedParams, this);
     } catch (e) {
@@ -63,17 +71,41 @@ export class Connection {
     const duration = new Date().getTime() - reqStartTime;
 
     logger.info(
-      `${messagePrefix} ${actionName} (${duration}ms) ${method.length > 0 ? `[${method}]` : ""} ${this.ipAddress}${url.length > 0 ? `(${url})` : ""} ${error ? error : ""} ${loggingParams}`,
+      `${messagePrefix} ${actionName} (${duration}ms) ${method.length > 0 ? `[${method}]` : ""} ${this.identifier}${url.length > 0 ? `(${url})` : ""} ${error ? error : ""} ${loggingParams}`,
     );
 
     return { response, error };
   }
 
-  findAction(actionName: string | undefined) {
+  async updateSession(data: Record<string, any>) {
+    await this.loadSession();
+
+    if (!this.session) {
+      throw new TypedError(
+        "Session not found",
+        ErrorType.CONNECTION_SESSION_NOT_FOUND,
+      );
+    }
+
+    return api.session.update(this.session, data);
+  }
+
+  private async loadSession() {
+    if (this.session) return;
+
+    const session = await api.session.load(this);
+    if (session) {
+      this.session = session;
+    } else {
+      this.session = await api.session.create(this);
+    }
+  }
+
+  private findAction(actionName: string | undefined) {
     return api.actions.actions.find((a) => a.name === actionName);
   }
 
-  async formatParams(params: FormData, action: Action) {
+  private async formatParams(params: FormData, action: Action) {
     if (!action.inputs) return {} as ActionParams<Action>;
 
     const formattedParams = {} as ActionParams<Action>;
diff --git a/classes/TypedError.ts b/classes/TypedError.ts
index bb2f0ac..d499bdf 100644
--- a/classes/TypedError.ts
+++ b/classes/TypedError.ts
@@ -11,6 +11,9 @@ export enum ErrorType {
   "TASK_VALIDATION" = "TASK_VALIDATION",
   "SERVER_VALIDATION" = "SERVER_VALIDATION",
 
+  // session
+  "CONNECTION_SESSION_NOT_FOUND" = "CONNECTION_SESSION_NOT_FOUND",
+
   // actions
   "CONNECTION_SERVER_ERROR" = "CONNECTION_SERVER_ERROR",
   "CONNECTION_ACTION_NOT_FOUND" = "CONNECTION_ACTION_NOT_FOUND",
diff --git a/config/session.ts b/config/session.ts
index 0cc6cc3..251bc53 100644
--- a/config/session.ts
+++ b/config/session.ts
@@ -2,4 +2,5 @@ import { loadFromEnvIfSet } from "../util/config";
 
 export const configSession = {
   ttl: await loadFromEnvIfSet("session.ttl", 1000 * 60 * 60 * 24), // one day, in seconds
+  cookieName: await loadFromEnvIfSet("session.cookieName", "__session"),
 };
diff --git a/initializers/session.ts b/initializers/session.ts
index 11e7b69..2e95bb8 100644
--- a/initializers/session.ts
+++ b/initializers/session.ts
@@ -1,14 +1,15 @@
 import { api, Connection } from "../api";
 import { Initializer } from "../classes/Initializer";
 import { config } from "../config";
-import type { User } from "../schema/users";
 
 const namespace = "session";
 
 export interface SessionData {
-  id: number;
+  key: string;
+  cookieName: typeof config.session.cookieName;
   csrfToken: string;
   createdAt: number;
+  data: Record<string, any>;
 }
 
 declare module "../classes/API" {
@@ -37,14 +38,16 @@ export class Session extends Initializer {
     return JSON.parse(data) as SessionData;
   };
 
-  create = async (connection: Connection, user: User) => {
+  create = async (connection: Connection, data: Record<string, any> = {}) => {
     const key = this.getKey(connection);
     const csrfToken = crypto.randomUUID() + ":" + crypto.randomUUID();
 
     const sessionData: SessionData = {
-      id: user.id,
+      key,
+      cookieName: config.session.cookieName,
       csrfToken: csrfToken,
       createdAt: new Date().getTime(),
+      data,
     };
 
     await api.redis.redis.set(key, JSON.stringify(sessionData));
@@ -52,6 +55,13 @@ export class Session extends Initializer {
     return sessionData;
   };
 
+  update = async (session: SessionData, data: Record<string, any>) => {
+    session.data = { ...session.data, ...data };
+    await api.redis.redis.set(session.key, JSON.stringify(session));
+    await api.redis.redis.expire(session.key, config.session.ttl);
+    return session.data;
+  };
+
   destroy = async (connection: Connection) => {
     const key = this.getKey(connection);
     const response = await api.redis.redis.del(key);
@@ -62,6 +72,7 @@ export class Session extends Initializer {
     return {
       load: this.load,
       create: this.create,
+      update: this.update,
       destroy: this.destroy,
     };
   }
diff --git a/servers/web.ts b/servers/web.ts
index 9b7d4ee..fa2cb2a 100644
--- a/servers/web.ts
+++ b/servers/web.ts
@@ -10,9 +10,18 @@ import { ErrorType, TypedError } from "../classes/TypedError";
 
 type URLParsed = import("url").URL;
 
-const commonHeaders = {
-  "Content-Type": "application/json",
-  "x-server-name": config.process.name,
+const buildHeaders = (connection?: Connection) => {
+  const headers: Record<string, string> = {};
+
+  headers["Content-Type"] = "application/json";
+  headers["x-server-name"] = config.process.name;
+
+  if (connection) {
+    headers["Set-Cookie"] =
+      `${config.session.cookieName}=${connection.id}; Max-Age=${config.session.ttl}`; //HttpOnly; SameSite=Strict; Path=/
+  }
+
+  return headers;
 };
 
 export class WebServer extends Server<ReturnType<typeof Bun.serve>> {
@@ -71,18 +80,25 @@ export class WebServer extends Server<ReturnType<typeof Bun.serve>> {
   }
 
   async handleAction(request: Request, url: URLParsed) {
-    if (!this.server)
-      throw new TypedError("Serb server not started", ErrorType.SERVER_START);
+    if (!this.server) {
+      throw new TypedError("Server server not started", ErrorType.SERVER_START);
+    }
+
     let errorStatusCode = 500;
 
     const ipAddress = this.server.requestIP(request)?.address || "unknown";
-    const connection = new Connection(this.name, ipAddress);
+    const cookies = request.headers.getSetCookie();
+    const idFromCookie = cookies
+      .filter((c) => c.split("=")[0] === config.session.cookieName)[0]
+      ?.split("=")[1];
+    const connection = new Connection(this.name, ipAddress, idFromCookie);
     const actionName = await this.determineActionName(
       url,
       request.method as HTTP_METHOD,
     );
     if (!actionName) errorStatusCode = 404;
 
+    // param load order: url params -> body params -> query params
     let params: FormData;
     try {
       params = await request.formData();
@@ -113,7 +129,7 @@ export class WebServer extends Server<ReturnType<typeof Bun.serve>> {
 
     return error
       ? this.buildError(error, errorStatusCode)
-      : this.buildResponse(response);
+      : this.buildResponse(connection, response);
   }
 
   async handleAsset(request: Request, url: URLParsed) {
@@ -212,10 +228,10 @@ export class WebServer extends Server<ReturnType<typeof Bun.serve>> {
     }
   }
 
-  async buildResponse(response: Object, status = 200) {
+  async buildResponse(connection: Connection, response: Object, status = 200) {
     return new Response(JSON.stringify(response, null, 2), {
       status,
-      headers: commonHeaders,
+      headers: buildHeaders(connection),
     });
   }
 
@@ -232,7 +248,7 @@ export class WebServer extends Server<ReturnType<typeof Bun.serve>> {
       }) + "\n",
       {
         status,
-        headers: commonHeaders,
+        headers: buildHeaders(),
       },
     );
   }

From ad05b14cf7cb01b0fe68f800f2a0ba7cdb49e6aa Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Mon, 1 Apr 2024 20:25:24 -0700
Subject: [PATCH 03/14] session basics

---
 __tests__/actions/user.test.ts | 104 ++++++++++++++++++++++++---------
 actions/session.ts             |   4 +-
 actions/user.ts                |  48 ++++++++++++++-
 bun.lockb                      | Bin 69112 -> 70964 bytes
 classes/Connection.ts          |   9 ++-
 initializers/session.ts        |  21 +++----
 ops/MessageOps.ts              |  11 ++++
 ops/UserOps.ts                 |   6 +-
 package.json                   |  10 ++--
 schema/messages.ts             |   3 +-
 schema/users.ts                |   3 +-
 servers/web.ts                 |   1 +
 12 files changed, 164 insertions(+), 56 deletions(-)
 create mode 100644 ops/MessageOps.ts

diff --git a/__tests__/actions/user.test.ts b/__tests__/actions/user.test.ts
index 092930a..dc9866d 100644
--- a/__tests__/actions/user.test.ts
+++ b/__tests__/actions/user.test.ts
@@ -1,7 +1,8 @@
-import { test, expect, beforeAll, afterAll } from "bun:test";
+import { describe, test, expect, beforeAll, afterAll } from "bun:test";
 import { api, type ActionResponse } from "../../api";
-import type { UserCreate } from "../../actions/user";
+import type { UserCreate, UserEdit } from "../../actions/user";
 import { config } from "../../config";
+import type { SessionCreate } from "../../actions/session";
 
 const url = `http://${config.server.web.host}:${config.server.web.port}`;
 
@@ -14,34 +15,83 @@ afterAll(async () => {
   await api.stop();
 });
 
-test("user can be created", async () => {
-  const res = await fetch(url + "/api/user", {
-    method: "PUT",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      name: "person 1",
-      email: "person1@example.com",
-      password: "password",
-    }),
+describe("userCreate", () => {
+  test("user can be created", async () => {
+    const res = await fetch(url + "/api/user", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        name: "Mario Mario",
+        email: "mario@example.com",
+        password: "mushroom1",
+      }),
+    });
+    const response = (await res.json()) as ActionResponse<UserCreate>;
+    expect(res.status).toBe(200);
+
+    expect(response.user.id).toEqual(1);
+    expect(response.user.email).toEqual("mario@example.com");
   });
-  const response = (await res.json()) as ActionResponse<UserCreate>;
-  expect(res.status).toBe(200);
 
-  expect(response.id).toEqual(1);
-  expect(response.email).toEqual("person1@example.com");
+  test("email must be unique", async () => {
+    const res = await fetch(url + "/api/user", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        name: "Mario Mario",
+        email: "mario@example.com",
+        password: "mushroom1",
+      }),
+    });
+    const response = (await res.json()) as ActionResponse<UserCreate>;
+    expect(res.status).toBe(500);
+    expect(response.error?.message).toMatch(/violates unique constraint/);
+  });
 });
 
-test("email must be unique", async () => {
-  const res = await fetch(url + "/api/user", {
-    method: "PUT",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      name: "person 1",
-      email: "person1@example.com",
-      password: "password",
-    }),
+describe("userEdit", () => {
+  test("it fails without a session", async () => {
+    const res = await fetch(url + "/api/user", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ name: "new name" }),
+    });
+    const response = (await res.json()) as ActionResponse<UserEdit>;
+    expect(res.status).toBe(500);
+    expect(response.error?.message).toMatch(/User not found/);
+  });
+
+  test("the user can be updated", async () => {
+    const sessionRes = await fetch(url + "/api/session", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        email: "mario@example.com",
+        password: "mushroom1",
+      }),
+    });
+    const sessionResponse =
+      (await sessionRes.json()) as ActionResponse<SessionCreate>;
+    expect(sessionRes.status).toBe(200);
+    const csrfToken = sessionResponse.session.csrfToken;
+    const sessionId = sessionResponse.session.id;
+
+    await Bun.sleep(1001);
+
+    const res = await fetch(url + "/api/user", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Set-Cookie": `${config.session.cookieName}=${sessionId}`,
+      },
+      body: JSON.stringify({ name: "new name" }),
+    });
+    const response = (await res.json()) as ActionResponse<UserEdit>;
+    expect(res.status).toBe(200);
+    expect(response.user.name).toEqual("new name");
+    expect(response.user.email).toEqual("mario@example.com");
+    expect(sessionResponse.user.updatedAt).toBeLessThan(
+      response.user.updatedAt,
+    );
   });
-  const response = (await res.json()) as ActionResponse<UserCreate>;
-  expect(res.status).toBe(500);
-  expect(response.error?.message).toMatch(/violates unique constraint/);
 });
diff --git a/actions/session.ts b/actions/session.ts
index aead241..8f4d729 100644
--- a/actions/session.ts
+++ b/actions/session.ts
@@ -28,7 +28,7 @@ export class SessionCreate implements Action {
     params: ActionParams<SessionCreate>,
     connection: Connection,
   ): Promise<{
-    user: ReturnType<typeof serializeUser>;
+    user: Awaited<ReturnType<typeof serializeUser>>;
     session: SessionData;
   }> => {
     const [user] = await api.db.db
@@ -51,7 +51,7 @@ export class SessionCreate implements Action {
     await connection.updateSession({ userId: user.id });
 
     return {
-      user: serializeUser(user),
+      user: await serializeUser(user),
       session: connection.session as SessionData,
     };
   };
diff --git a/actions/user.ts b/actions/user.ts
index fa7c1f4..8c8901c 100644
--- a/actions/user.ts
+++ b/actions/user.ts
@@ -1,4 +1,5 @@
-import { api, Action, type ActionParams } from "../api";
+import { eq } from "drizzle-orm";
+import { api, Action, type ActionParams, Connection } from "../api";
 import { HTTP_METHOD } from "../classes/Action";
 import { hashPassword, serializeUser } from "../ops/UserOps";
 import { users } from "../schema/users";
@@ -8,6 +9,7 @@ import {
   nameValidator,
   passwordValidator,
 } from "../util/validators";
+import { ErrorType, TypedError } from "../classes/TypedError";
 
 export class UserCreate implements Action {
   name = "userCreate";
@@ -40,6 +42,48 @@ export class UserCreate implements Action {
       })
       .returning();
 
-    return serializeUser(user);
+    return { user: await serializeUser(user) };
+  }
+}
+
+export class UserEdit implements Action {
+  name = "userEdit";
+  web = { route: "/user", method: HTTP_METHOD.POST };
+  inputs = {
+    name: {
+      required: false,
+      validator: nameValidator,
+      formatter: ensureString,
+    },
+    email: {
+      required: false,
+      validator: emailValidator,
+      formatter: ensureString,
+    },
+    password: {
+      required: false,
+      validator: passwordValidator,
+      formatter: ensureString,
+    },
+  };
+
+  async run(params: ActionParams<UserEdit>, connection: Connection) {
+    if (!connection?.session?.data.userId) {
+      throw new TypedError("User not found", ErrorType.CONNECTION_ACTION_RUN);
+    }
+
+    const { name, email, password } = params;
+    const updates = {} as Record<string, string>;
+    if (name) updates.name = name;
+    if (email) updates.email = email.toLowerCase();
+    if (password) updates.password_hash = await hashPassword(password);
+
+    const [user] = await api.db.db
+      .update(users)
+      .set(updates)
+      .where(eq(users.id, connection.session.data.userId))
+      .returning();
+
+    return { user: await serializeUser(user) };
   }
 }
diff --git a/bun.lockb b/bun.lockb
index 6f3647f94d229e09553d29e906c1fd4d3879fde3..a510f39f0660228f5f4b527432be6b7833d0aadc 100755
GIT binary patch
delta 10318
zcmeHNd0Z4%wyr8bX(O@-QZ%hBZYanOjiQYh_r@qu(n8!&8fh040fWl~&}c~Fh9_~s
zC1PSmvnd1anuNGTgGP)RgV6+|8S^vCXhySWbiPxI%$s4}yf-uN{gun_yXT(e-n!@9
zQ<ti)`_nq-n%A9Igm<euI`GPYU#{4F%v}~-Pt96&D5ur%BXQfZhwoe5ssHswZ@lU)
z3S9P;+XAG=_f!?hqG+aaF`#(#BZA;52qi@Y_S`I3Si!r2?*rNfG(w{@C--pV79<E^
ztpow067Vx;%$O#~;Jv{+X3Vl@Ir4>`=)`;v(AJ<q8g&Qt0?&iGgJ#)t^9t<(B}tye
zf5HVlAp0DY=Q0@cP_Myr7XINiQ!yaVwZBHcM`r{0Z`!J~5tPT7hzaprbiNbDWIOm!
zFlVMcCV#w->Z~4&zYW5SiG|rb5j_}bK6FM3?|wv9$C;BkZJHy$KuFQ}B0tr~lb~?7
z<WZTrJ9Q~`7*+FS{(^w0m7E3TY1s4Qdf1B!1bcq2BOBM@Iq}t&npF3AS-1=b&;8hz
z%L4Rgx2D^t&v4AO+ao%t<8=mQJ3mm?=Vaziad0Fe0#rp{05v#uDAuRz$j!0Oaunn{
za<iv7Cg&8~fEkA^2JY~(*z+eAI;Ld_%Q~t{I1dz&Etw3;OP!|4lQlkE)0;H8t0un{
zEC}sje;E}0ic5~6;R`{Prq~F|13#}CloWw-&SYu)W1u`hA}HH+0maIdcxn23L8|^b
zC{OG>DEIHKtxJ$bC*@>Ln<^9wf~*NdP@c%tP&Hz^LD}<Bpe!F9rVjKzC`WcTC`ahu
ziVUt_@()7ue;%1{;Z+oesAa60Gebf7R&wO`cq%8eK<I(|;s_vR6_1r$tGa!Qg(B@}
zIl=YXqgUQZd)CW~%36k0d${g#@|^e0<dbDyH-ca8ToM+#$Uae|n+uYvJzC4Ilw*oC
z3`5xZVLXv4J<Q^ATI-!;I0P9kTjESXt<8oX!6kr`6wZP04pr=-6RT;hPm*|zKJ`g5
zbVW+{S2UUJ%;Ho^Z<i!)r?u^p4A-EssC|6RhK_J29-I?Zwl%w@gBt-(f<G-NGa{5$
zcpF4FGRhWl7^TZeh7Gt=`zrPr*KkSWL}fPZv16sEI@xS+fEx%-nYYV!aIrL2PL#fM
zrv^WZ=tF+SBttTyhkXnV2N}(V=fEYaTx+v*!h;%&7RlF(jNTS$oEJ5;vq<Z~`C44g
zAYn()hPH`@V5GPjGEB%Ni#ZzGE>U`|EgAhS;%!RzPm;QMQ-!}p%JrrOknP@NG+Cst
zy(z<FacPfxBY`&fBudkLsKI10R6)Q&bs`?|E;x)RCmQ<Trs9w)aziP&$cHnpdZ?@P
zF&l1!>#gX(xkMq0VrfI`M5)l18ah~{w|vPMV3E>f$_TI+%5him`nIG-MD!H6Uf>XY
zaIV-I<H0#ICt3U`BhX@a7D5iJM3peP2u@vSTuX{Dk}=34%`#F(kj3yi@{*H9R0g{O
zjt3Jc$lWZ-{$vcc7zSf^<m*Y)*v2fa@uvz1FKI&blg*N^iHsdBhIH(!JWu7aQiX{s
zI$ER?CTf7Lb$dbRu3U)Sj|a!@J5i&_EX`_96`d@GO%QV8NR){SebJtboh^n0?7e(-
zLAlVZ4paf*+YmmqG<*jxS~02gHoNr1rrVn~cqh6PqBW2<cqAJ3qs1%X%7eJvVUDA1
z=n|+-7&j9llMzT2T`h(eAyn@l_O~vOj3E|-Gj>4rmf$e=3!;h;i?lI_8bT~Co3Jep
zpi3c%F4xc+q_o013BnMiRfv|V-S<%D)LFM1ik7Nfj+WZv0$RhAzMZ@1vRt%=E3$)V
zsoGXu^-)sMQu|h*rH=RcLs>|O-lGsLb$$oXvMS@X?56h}ftEV*hKI7R&{D=Tgktr0
zA=KQqYn*{9L(J04-6<o&VyM@IEjjI^M?$F~!XiBtO2$Zw;TZk{sJAf!XmH2AKSUWU
z2<bB=j2d842O%c~vJcyiD|Svb;<)dnfjy`q%Hr}ggac?pRHDlvv<4}yR^jXb%SNK5
zYS%oJHKL{3g+%Du>1e4vcA+&)>Fb32P-Q7-4Oe9A&{DP6(Naf=h|=wf&{D5<@S&^)
z@=)zD5-qhy1zJ{RylZHw*9ec%?dGAS$fUzDlwr0QJa7l8w_9Z!v%v<A_bzO{-ezfS
zEEy9l(&<>rNU*rIjZ^PdQ9z+e|4{O1?dmxM(nR!7q)>Fio!ymAw>OA!)eQ;##Nw6^
zj^r*VOxbW0Gbl`5fOLT6833364ds4MD!o){Ks!t0L5r1v?V8}fqdZWyX4f3Ww#LsM
z{OBi?X?9Gx-*X!O_Y^%OC|}SFmuPgU)`2Mxuncel$^nkp8h}f4l<n6l+W!G{hG83;
zp6px9-L`4nm@@ymM&HonOnDk_Yx3=yoGIJy(0Hc2a618ZZ#Te&DPM8FM&AYH0$QvX
z)`H;<hctQwlm|Wv@P&^9u0TD&@-qMzrabU@fcswnxcoKc30(rX-(`RcQ|3QcmQHD?
z12m$|g((mCC4hg6!Y=@q|2XB;;qo6JSRMACj$6zZW>4<{9FkuFE=*beK%*inQU03Z
z@j>v_<o_Zq{&xrXm-_RZWmKYoe+Yg`LlBIbCrr8NuTc{yN1{V@m8I=(JC_=a-*&Fw
zb}rl#D8KDo|Kis7|G9Ie_b+&)@0RSlonE<V95%{l|CH}yW7o|Ju&lZpwnK7FS^C4>
zgKniE>#iob1pndgGxe*NKl|)3v+z~WYb%OBy4vc8cN>r0x%zRn+lVr!;w85_zthU;
zM$uHS>y-z}EH!I#jB#OMKmYRDg3*7z+;8K^OF!D;hmUXj;IrDA1L;E!_FuFldEnw9
zyJOcIwrrWOKWi6KMilP5-^Z?sr{{;oxx<Bv3*WQX&Ryx^o_2HexA`}ID8B!4nze#{
zeK2-b$(<$XuN`Rj*+M73<fvzpt}I;p_}#ZZd3w;Oj=3`zS*{*im$zpz^%y0md|#Ef
z*z38z#Z_H9ywzq~&@)GCHmv*p(y&1jcAQ?=BG3N&bM7yj?|!+r$DE%xFB{}&QE+g+
zoVOxw<zk`J$>Rqsi}^`KpIrncr`hQGC^y=YW)-98Cb%_eZj|<fRg9s^Cu}tM2{&@F
zS;aU?wb|$=a67@7NgQpXtu{BZkG6_EsS4ca(Qf3EZWR-$cDRjP)7|K$kyfz}HIB5=
z9&iIjS;ZtOA7!JQ3^%$BE}1gZZ6rVGMn}-^QS!{N(FfoPGpynOss&dx#*I2ZX%z=i
z-jg;88S6&pzzw0GF*dpYZqXR4Xr+2^W#il^ZmbnQjg*eHQNnmPx(04IMU8`h;9eSM
z6;r7Z+?olP%Xq6elFG-!zf8;pTpA@$fPdh&Ot6YJx(ROUL_{LfDyCCqCj6U(NKCYf
zPg3ec_?Lx9fE!EVB=`r;KFKPMrz&tcc0?k}DrQn<7W~VGf8ZvOryc%*E3{ihJJo_K
znhgK4t>R?L%Z7hB@DH4Wf+oX1aEm5e@q<x4xH1R)%dv{nsWb=vO@V*lW>Ay^{(*bR
zVHNYJ5!{-o@NbG$%%}1x@NXLY16N4NQ*GjGT8sKAx{11ohD@`GbEp#aT>2UHJW8Ez
z6X(-5)W0J!*Cswq>8OjT3Uvt?X4u41%0#_@_M%=$o-=LYGvq+Mh-y(UCciwJ_$=k2
zE~De9pQE5zHt~6ygZc%kN4<o)<=e!iREl~TeTsTHMHRq{LU>VN70am++?v_&qR=W5
zl^4Q`r{D#+mneBQRteme*;a8i-JER`*U*rsY~os~L|s8Yqh3d;MK*CgZ9~0*#5p!`
zBc-E$nW|84BEwvpSV@_vH`89!uaM_FoA@d@P;a4H)UT1>e4F@t%0s=Cj-%d2LBF$!
zuhSgVZ%{qzH>umxHt{VgMg2B?ih4Um72Cue^c?CcYAl8qrSPJ}ik}0^OW?%<cmZxF
zC70U7U9`5;R;<52@FwBB_0G>eb(?ZuTzU3%?b2y043o?5^jlrq#cNP%*Zl|9{o>?X
zGNwhe->hCg`8=o^_}0bumW^7S-mX`mdE4ewS8q;xkKal3J9`fgs1@hZ&Hm@YDqHqT
zpI;jIeeu=7qo-_6>)v_hzFVuKH|_H|`u^*8zL~eZ<MFHR{XPzyTYNS?VdnV_zstK&
z`uwLs_Pd*g`mVx2`oMduhb%~Hv2x)EyaYSbk}_Ax?n|r6dbvI$t3Sx%XVfg#c{~b%
z0WZh_M)jB3>YEEjOG>XdUvPD$AoUk%NVhgC?JretU9mTK<-*&o)@a@&?4_yIeT(lu
zPz$?9%GA_%Q=R80Sq4Ada(M~hCckD?0$fy=)K{zF;90*K;8!hvo$>*=tOHor0?-}<
zx(e$xA-}KkO9U%70Q|C$vlkUg>;ZbbCc}&8z^}N=ffayJq{}tN&M%|63E=5$23`SP
z1-1aM0sLM+hHlpcxZzh^VHhw1NTsNqi7nb=$Rz^3Q`5mS7{ZPK|9j@y-KE-{NvXHc
z`T_Vea2vP-{0RI6{0v+GJ_Q<p&w%s5Cjh?#zX`kr@O$#_0Xr~~qIPvHUV|3DP}~RQ
zH>ocGejBa={s2@1H2}Xc^IJ5(VQ&S}fgu3DgYcUchx2_9UQ>?MKHx*34mb&%0<6Gc
z;4y$#2k$5T!bLRFfF}SOFdFCw{3=kJ-MtdrF|G&T33vf*0se^S1GEDs9Dps#h4&O9
zwCY_L6Kx5Mr4`lQK|GP&z(8OZkP2|b`Qp8Ri0ZYw-SH)1Pw#F$!6pFlKpYSY!~oGi
z6cDMk&6K*gEk*8iWw`LbEm?y9dZ>#N!E+W%8r4$zL0|AmfCcCS^aeTuyvn@VY{z{E
z0POsuKz|L~X8S=vD8SL<)Zu6j1$Y$(14yZ2WyxLy!#B`Mpd45M6ah~GGlA&<FCRyI
zB=9&e3gA`HS7034V}J~Rvvw@NNs|fW01jZh#!mocSvLPBF%b<G=*C%SPXf53E@PhC
zlL5WW`fN?k?P&n_oeE3=CII>c^>NgT3c?KNa)H?)s0x7sARovBW&!M#-sS}^qFOBC
z)qN@5R)c#9SOu&D)&Ld2TA&Kp0Vt_Y>HDo+s=?I&JAszK9$)~#OXgaO3dQ>}o!M`b
zqM|AEKr9}&CLG8%#tZsq>E5faUOPQFu$?51iwlnlkESmU7{yq+dmu)Pu8ugksD-yT
z_SQ)iZ(i>^BkK!TMTf_S$I!h)e*VZr{iFBtxbNHD%D=S)`Y7n5DDrT;zqysVQ@_6J
z-tg^~&|jTdi9ci#l^z}@M$kux{o?fR=|fJN3}fb<e_9fsjtY+qM|$fYo3B0g-L^9u
z8wE`hi(8V~9~mZn?ncv&$kLzOXz`I0fBpOUyw(r;bQr$J8B>W3kLGdQ>DwcI{`&X!
zN7@80%SayCMwzOj??FLF{qS^|h&qVUj>g0pJh2DCZI{VIr+)rOXrs4i=@X*_GYA?#
zXr6y}ugAsDzFgF#=|u;R`uPvmdJb_HR*vXWmB;!>c3GG}H;?*Bb3Cc_G1>G2%zQ9R
z$@nqLTfTC-Gn=syc56@Sdn`rT=}F6u$?@;Q&I5L{M}@g`KDB6>x7b~=!tZs^xI=TW
zZs$PPwF94Q(lmO~XSjs^&0qii*ktgNCwY8uJ>JPn{TMu8z~CkGy`6KksbaGFv4O_h
z$AyLEQ}0M3;>3{@QoX3|kSxk{?NE#uMt+Bf{gYMpqY+1pCjERtc|^w2E<5}5#7agZ
zDpBDv-?XLh<8m_wx}OuhY5s9pQi=cH52V|L(e~rRB%D9Ee_Zz0k0Tr|J9{eQ&!_!x
zy%>0a2=}3=6MlG>x1R7b>4zF-_4}|y$R9Tk8NpWYbG#3goQO8@$6(I>{g>NaEUJ06
z00vNp$Mh5sfm0`BNtWsQiD)TECew$q)Lo|d52K|RnWlW0V$vT=>IYd~-PSLlMiL{#
zdn!Rpk?G8bDbf*{0_&np`k9FIcfWI4fBD-GT!f>Ixt{c++&Wou7^$qTMq1!c@12zC
ziIYZYnLiCZ9oZo^UOy-yTv``1edeSyl8A0fQLUxn_*i!`S~}}bk*8(qaw=9@YN{S{
z$|SO;4x*JG#hUcv5GU_n=yq`VuD#j}knl@QH0G2nb?!j-K9WuPF^Y*_-AoxXU{<{n
z4&1APppLK3D_fhXb_G*lfSRZu{a`*kKW=t^^omt?frx;W^|Ev$fQ<Di5`vNgQshUw
z>Wlh3AEZ9hod-plmR!F4?uIv_5B79M5TkmAM@0+zQHBp%j#xeL`t<jkH1}xg89$SL
z^g;gRm#D{2#M_(nU4m)T8981*D-qeRV*KtF?oyM1ewxC~xBu50-=2M}Ns|>!-=V91
z{KB!f_tw}J)4ysm&<|)_T$nvDYE?sRlV)Qu_5N5k=_fkg80Z)~E2-=HCWB+aH1lIQ
zUONL)(%ma0MttGR$|eK-l*qIRn;)Dn-<#Z|aqUR&psRkY<d3TgZdE4T+23TKA3P~@
zelushXRo3rO>#$SeO5N<Csk^%m2Yk9JLtzIgUKDK?^!usKicBzX$jpUzF5~}pdWsT
zPpR8gxw2+%lV(&XEyLLQ*%6;MLoz1ie9}uv05hk}?ofLFY_v%~M6$}GBspg6+XIxm
ziVKg95_X4?$2mDpKV5S5n|;Rj0)JH#FP=weHVYEMqa%fTH1?cde6v}g==CEq8~r2q
zef;&L3}xDiCNY@aJSUr)%>u;$S@6ZVe~<-=L9<z)XpjZr=jHfjvp_M>PyW<bdbB?r
z^7ZhhX<ZJc`R8R*vss{YMHcM9*v)2vV$f_BC>mtJeROR$3lszWMAHX%N&@D;nnq32
zn%9w1K9Nn$W`WYRWh|9^B1=PKsp6BA_`m(HgdK}_R6GOy{nq|p|3|c%a9Q2jHeIGx
z7y8kN3z5cW;?!eF&m_dviA8PhpVmy)dskOn=-J98HoRc+-0E9bS~#sf<17Y}{8c-;
z@^v6R_EjVvgp#iXR0sbt*O`u938VTiJ5*n~HbAUiabsZ+J^EQ7t+?SY#;^8v6R-XS
D5yjX7

delta 9498
zcmeHNdw7i3y8qTEA%l=aWM+~<lGY_bWG0spVN!NOm?+w<<1UfwL=qyQacd?OrAmpn
zrCPL6EmD`-p)IQD)*g3)s=Bpyt3}yu^oFgqfA4pZ{p=Gx`#k&E&-vqY@mue8UEa0c
z@0&HVvZdPV=F47-q9VF%w&mC!YC0qOz@o!zrZk%O?cN^W_9(qN|Le4K(|cT4TAS-D
zBraPkUG3!bn$4vqA%;+;Xje9=nI!p3lBcvJt1uHDS&)4pyFgoj_SfjdoUZP|lI~L9
zrji7e2lB)T6Y?b+<Uq*nLAjktqwWclvNGMp(kJMI?FT`dgYMGk2G9UWl07RaOm0{9
z97I2uXM*x{QZN-BW&wN*pnucocc82<YNd9k%MZez{V=VPsS~q`3o$0T^626Hb669`
zP0mIWNei!$Co_<4$Wf6ejcPwr)ARG)#U;{6O`c<tq?YLK94PnusF4OV>QGi{R^3+w
zOA-S2d;!YS$SRKOnpIjNVIuBq48(Kd;g*M}tHdkKWej9)$G%)D(VkbSAgf@4ds<eO
zqm9~MEGYYR0%dz{dSRZMSHjU&HFRrBw;Q!B)2Hh$%*~qQE-7{wX6L(ea!YQ*jhC$t
z!r^7kDjql4ou4VK2v>H&GY=Fi>X`z{yOpWw2WxUK&E8ql8#TQE4TAsmFr{6Y=M)%>
z;n@w!h7F+H@iNuHGY1q~=qc9Z(V*-%0F?dWKwE=`Y4&EC{pV11VwXU<eS)?x(HhOj
zP0t@Ml}S=ZP2mTM|DI`)>WX~?%8_S)vOcG?+EFbiuk1&lyh8uh%3yrYeU|1wzA|^P
zj1jzdK{0C13<u>W(p}v3iQM!OsVnk}R{$v{HLXc*JWEiDk00%8l2$X!=iNp%rsior
zbTc^Gkc0K;14lu1es-~rt^_6-&O;Xqofj1~w;TMiQr#iRiZlz-0L33RahR^OP7-%1
zA}Gnw8@c+hVzK(#4YM^#CP-pGT?tB(?>48%5Qm``CK?aNMr1YGy^A3Yrt7T|4Sxow
zPK7)0#*@dA(t+Hs1zj~d#5WXSN-`wk;e1H#0FKi&Nnn26eITT&CX?OJ1WV8tk`jpb
zKuEFF)s!fg`%$&oA!_J~Imz%D)OZ8&3YhJNj(8#URwTqH=lWB1utVM&KzSC2@S=5=
zB)NMlx@vLAGh0z)8;AUUE6Qu*@V<$Bj-`UYMDH%xmhN=Db)q~YkRsbU47;J=6+^hb
zcJHQ0_&z)dLn=64FGX)y1S$I7EOy_s)wQ-8ys+CnRa<Mj_d}3k>3Z`-xgv-nLml#a
zL6irQX{72<hv8KuJa1kTvWD0V=OOig)L0qZh!<Ksb@fe@2b!ol%wbpp1uu|HbwPH+
zRY>X%VpQ2-ro3>6TyCc7aED<VUVfYff;%$QLE<fxsHmk~?ifsY4>$}iBpZ)~9fNXB
zFkOZ6nx;fMlU?o*LU|8547qp{@*I_6<#i!+^+AXHX$VEOcNjt}k`$>7#Gxlc;?S{3
zZS8Wog|5P76O_FFGHq^Qm%p`8UI&MvAKsQcx}*$L-iEG1xf9BJo`zo_*%X($K)ZJe
zUXwlPI<~9=Twl8GmuNTuj(5R_JMs2z2Z>kO5C@JYj2ywrxZBayP7cFsQ1X(f@t$o*
zc@Yjnt58XDD4tj+c}OT-jc~{tLMbxR;k_wbl9H)wWTN*E;QA?C;sf|xQn(6ms&)T8
zUBH97-*9lMbtO2p#n<2lDs5xi>$;iX1}VBj;8d%*gWgLTIJNCMaB6>ly{EHx)LT@5
zQ|EUOoKxv9sFU7yEI762_4jl?f>Zi4^oUS5Le1+EO)^kjgk9bkLDkU?!{?f^38$SL
z97&N@hx~LT<yjquQ`r0zeE|(^@uuz%sS(u~?ef&l6lrr9&O*safvq;$4aP3|isSi}
zhjyW>Hi!2DD3j^BEz$cpxPA&}#!Iok!i@u`TG!mueFskUvq$OH8Q|0wAA%dGv<>K{
z>qdebr0A-_sn(ytsl7OmM{3(S;MCC$-P5(U>Mh2BQ(LS9=T!Rp0i4>l7xGo@c^)`L
zC!erUb$5rM9bWnB<5t(gZpenzM_s5uySz4r@)8{KXE9Wr;P4Me>hjYnB(*f7u;v}<
z^X5KsW^7Gfk3OQz0K-tt%9K4H*JP&Nz(|1gqW~`d8_MlQE3F!&Wqgj3vNZ>$+#pAj
ze~YqTuIASe#d}IB2V`It!2T5)oej!mHXkL}@HEf}cm`+!ECRSRMA^SmvHoimpJvi4
znm<!+|Efl-kfKVd(iE#S`kJbinDWHlU_Ev1WyFLfX)VATvjO1vHUV6idI2>WeFu~a
zQ})}Y(H$Dy3Ch!XAK+2;06xHefb|CeE=;-KBN7&jJ30n%`A5nV`WWDbrvNTYS^k6t
z6sFw%Qx;H|vV0aW0yh9I_oqtyzvb{hb?|T6wef#rhW8(UBmDv375PzhQz+|y2AJN`
z^#4eMplivEP|9@X|A>yfH<N#50z7FyR80Lf8o&YyQ)XLfG*HyM)Fa^cH<G$4zrT@w
ze<LZ6$^Bo2idnkx|NV_L;y?FBs!8Zu(u`J&aMs)$GP4o=IKnBqQty#2GCl4~ua9(!
zZd3<pAEcq9oWe>)kGrVU<x3ww?i4W;=5kS|VZJom<rHyL3+XhZxM5CVr}AMgnmgQ=
zE<s8l>u?u!AK^<c40nn|x(Mkqq-2cOi>gMs=*5w~<UQIcl4!_i7p08yrLB;9lNjTo
zn~<``IK>}mGo-bneW~?Wr%0ysu`U`m#+N>X)Q|krT;wy>mnNq<MSt1@>0L<e)1AUe
zMd>ceO~b4q4WzJfh%X(p9_JK;s20*bNO2iX{FGRpf%wK@){q_}YbN5$z^pT!VkljN
zbQ)4}mQ%Q>G7Ir#`qGb(hEwls#FvFN%XW&9R0ruYq@g)ZF`BA!5MMUp%XNyeG$a@C
z<sd#t=_K5U4^o!fDKcm?q_w$-FV88mC_NAHxe*_v9P%HJ`0^0nc&BjF9!T#(YM<{E
z<Ebbg@r_4(kP0ZQ0P*D`z5=J1K(&zeL5eGMiXtj6M0^E^4^lB%Cm_B;#5chyCey_U
zE-{4?Cc4BEREfHjuArVuy^CC88ZARTo$64}p#GCwVkT9gev)pXE~6pEF5#hdsLM%|
zxWrR59Q7>PjJkphlU-sqrK5hDwxOOw{!?6HF1b-ZLwiuqBl8n3@hlago=^KxFQBke
zmw1k*qFzX~rHJAQL^0JVDye)bq9{cakch0)5XDqPG0iDnpo@@BLrR|R6icacx=XxB
zS5Pmb-ZNa{C0d61WvWBHochmni4|0ZdL`XL{R$0v(j{J{b*QUIl)1zz8jkuk+KhTN
z89XlWI;Eq2gSMewL;mG1v6kGZ*U=u-)ntCkCElbW)az+K>J1b&%Oy6_RMeZO7WG>c
zQQ;Dssk{PF%t90u&VhWO)r(i<BeutOT)XqijnLpuMMpD^?=5Q<m^920=4|uL(o3E*
zlfEc=_UV30=Cq%j;%#j8b>g9AiKR_TUReCVf@d-=Pk4EJ5Vff=)m)z))0igCZ!VVv
z(UbFgcoUAFzErg^2j7mod>@5`FD9NSGtMtHRSQSTtfs+>edJZ4H7gfxmsJ`s*Q|bi
zTX@s8+5}U!(5QDGDwBS_s}`Q~3jm*U_=^q~UFOpspMAJ20hr}O_%eXYQh;@Q@E)S^
zFKRNMwOa#RmILh97*IbfI!V$BP03$o_^8Rol>i?lOShmxNqL7H?}bz5w(bEu4?c0s
z0p<b$f<|m_E59hw#%;m$-8M^`OlY%!RA3<R2rvkE6nKox+Y^UA1+D_%?@;rAXMy>^
z0^m7dArKBc0Pxw7=lVUsXa94+dEf%@8Spu95%>!|vpvbm-!f`}<G@J(Uqhs$z-z#2
z;B}x1cm>D-hLU+l$1?uz#%Ir;K>5^t8sINZ>ws$DO<+B+26zKl1-uIIx842#pI7-*
zeiPUZyaj9q{sjCP*b96Jd;~aw_W<6fa^Qp{*(Dd4VZd-;1keZIz2Kw$ZQyUf9pD$>
zSKuyyFL`Hn^k`c84)c<<ZwGHtduDmlILo*fo&s+IZw3$D6R_5lzt>WDM}zG~3w9>?
zCW6DS1pGslWT)DlM(<c~_^iPXmwxa2Fub`l{9O2cD}2tNE(?RqnJa5lOXIt}Av=I1
z;2{mncLDwYbOr_hyl(w~zCbeYFpvUl1b9C<2RIivCpb4sfMOsYaPybTp<o^bIJF)D
z1_QjPj{$!KcpZ679|w4Sd2Q2y(Lg4U1@H#4JPKglIADw>>%M7_#{%r9>&Ei00W4%_
zM%}<2=zK2tG=TFg8{k3o0d*gJ(DAV40h53tU?MO9C;$op4oc^FmrCf?u0au{;GO`c
z0Fwa%DuKnoQs8-D3Gf0H?RG}J4DKa>-x@Chn}D}~%|H{N7jSb2DlVt#FS}iGcZm}B
z#0nct+>;#~E9qBwJ(qrY=~zl=kj$HpLf`EP#v!KJ2Qk80lk~yt#&qLwP>6m3IIK(L
z^&JJ@7t6vL6&)1~e;e)D7eon1+K9g7Ix;Y1NK^G<qWbMSgEl!j|KcUaSflU{n?bvd
zm}$!XSe!)O+;0xKcL{mSVi-03)RVG!QtLE}KHF~=ljzp|ffoJF@KbY)wW(oYKlxsN
z&$Xa&2U77NwdsI4M7weHSWewJYj<sBw-^kI8SWzM!NA5gW)IRYaMdp@_Z5b<s6Fxa
zR=C>gU1LJl_)C%rp90=F1IB;Wtn<Y{;pi2ktj#VeJ7|tO4SNgN!v`CG_~m_hOrVHV
ztdjJV*0O&~Y4P9=n~S(*G>0zzN{0`c<Bb98wbaPBe1>JYEAj(5mRNR(fTcD1^o$*~
zu*qx3+H*^8hvzSVEQeC#AA^H0945Orp6Hj{_eTAoX|VXgGUbn5yxSj{{an3eVgRi?
zWQs3?1JAea$1c@RdsW@yzU@li`u*$lYdMGK27D7<-*ia;T|0C+z6wnP(KI<ZW&Vsn
zuUsu4%visgt?V{pL5Hoq60mtTgldh7`C9<BIBK%|cL#lyidxaAqb6A;A@}#|OAC(<
zlyP-?;ixG@zp36k_vDcgKO8e-yclF4*2qQv$ILhwc0Ojd=oiA1`W*B~#bc%`S)k-;
zVIZX)vsw5ajRV?oA?R%BmenP2fH^8ALGm-w#$zVAqmlL<v&qp$x&tY}NI|tWxexAx
zYf~-y@u0S!WA(Z|?Y77wIx0bV2u2#|PqnG?N#o+<Hj93nJbc$*y_a9O-bu+XWvb^)
z^vH3OTxzD=<6Gp)V0!h0iQ-QL%PWE@@>F!&*m(VlSvvo6Ou@vA<9N=Lo#M-5_Lj$l
z(DoBH`HNukJ7uEACu8O1AvHZuS_E6xLpAB+Sc`s<eE8SX5jz*Yy-k||l6ZLt^*m{k
zW82WVk4+Z+0(#t6b*ZD0C)Fyep*%Ed|LVN5wV7%oSh}@UZ_AH<Z{Is3Zpy=Gg&gLs
zaI~e*PnqP~xUN2xDq~SnK1r45m}to-rM;Ggs%NW9pvWrEg$uh@ylLB+;DtrBCPZ0n
z($BE)-t22Kcxm6u1s~K~nvwIg*%B6}+D*4_TOU0TpH**<3nR~IQ@no79Np)ovF|i)
zDc3vb7ty}Php(*MIOV_UEyZDU1WomuYxlOEYhxQ1d{ytD-)*0rmEG66<jkIW%Z4zr
zd}^}jm*H>rb&sBu)Ny&e!>KSD{HZBkyFT|s26T!M&wf!=?;yg}`|<p=Rd-KSZtGod
zF^1DhG}Uk9zg|*uqbljA9rX_So&8*|^|@pHdz98&28Yu%OiRDy-*c&QZ7XBHpX(i_
zgj47lQ@s9H0Y3hY&hLun57j&9e>V`Hdg$${#apJ;TQVZ4@Qlf#U%R(%(SJln?k7Ez
z46yT)@KGeKI%Biw_wP&mJiTK^Z%kGaD=x}rl|JfB-<>hV=@;`~UfUkLJM<Sd^WwRO
z2D6}hlr36nM!n9O;~UHZ#jgK#!OD>6?I*5ej8LYnSO$dA{Ie!YgIS<BAPaV%y-yY>
z4h?33VnG(PIA@A)Fbfn1{f{PUtNhyR?Q~^O{j{!!(WrAKOM_XUG({FHLf;K$f#T3$
z7AO{E!38vJFbfn1{f|NR{p4vkWA#v~pVqu^>T=#>X)p_vra>{3cHSfpkD+PjQy={2
z4-xff5EF+}+-ddQwdgdpz0e2e3mS957CbCg{hN)7?s11iX^UTXYhG!-HPsgqno`TU
mb~TqTH*QpuQx_>}p1)S;wKO(Rgw(9RksBtgO9uyvFaHi{h|H4!

diff --git a/classes/Connection.ts b/classes/Connection.ts
index d0984f9..4252b1e 100644
--- a/classes/Connection.ts
+++ b/classes/Connection.ts
@@ -127,7 +127,10 @@ export class Connection {
         );
       }
 
-      if ((paramDefinition.required && value === undefined) || value === null) {
+      if (
+        paramDefinition.required === true &&
+        (value === undefined || value === null)
+      ) {
         throw new TypedError(
           `Missing required param: ${key}`,
           ErrorType.CONNECTION_ACTION_PARAM_REQUIRED,
@@ -135,7 +138,7 @@ export class Connection {
         );
       }
 
-      if (paramDefinition.formatter) {
+      if (paramDefinition.formatter && value !== undefined && value !== null) {
         try {
           value = paramDefinition.formatter(value);
         } catch (e) {
@@ -148,7 +151,7 @@ export class Connection {
         }
       }
 
-      if (paramDefinition.validator) {
+      if (paramDefinition.validator && value !== undefined && value !== null) {
         const validationResponse = paramDefinition.validator(value);
         if (validationResponse !== true) {
           throw new TypedError(
diff --git a/initializers/session.ts b/initializers/session.ts
index 2e95bb8..34ec24f 100644
--- a/initializers/session.ts
+++ b/initializers/session.ts
@@ -5,7 +5,7 @@ import { config } from "../config";
 const namespace = "session";
 
 export interface SessionData {
-  key: string;
+  id: string;
   cookieName: typeof config.session.cookieName;
   csrfToken: string;
   createdAt: number;
@@ -24,14 +24,14 @@ export class Session extends Initializer {
     this.startPriority = 600;
   }
 
-  prefix = `${namespace}:` as const;
+  prefix = `${namespace}` as const;
 
-  getKey = (connection: Connection) => {
-    return `${this.prefix}:${connection.id}`;
+  getKey = (connectionId: Connection["id"]) => {
+    return `${this.prefix}:${connectionId}`;
   };
 
   load = async (connection: Connection) => {
-    const key = this.getKey(connection);
+    const key = this.getKey(connection.id);
     const data = await api.redis.redis.get(key);
     if (!data) return null;
     await api.redis.redis.expire(key, config.session.ttl);
@@ -39,11 +39,11 @@ export class Session extends Initializer {
   };
 
   create = async (connection: Connection, data: Record<string, any> = {}) => {
-    const key = this.getKey(connection);
+    const key = this.getKey(connection.id);
     const csrfToken = crypto.randomUUID() + ":" + crypto.randomUUID();
 
     const sessionData: SessionData = {
-      key,
+      id: connection.id,
       cookieName: config.session.cookieName,
       csrfToken: csrfToken,
       createdAt: new Date().getTime(),
@@ -56,14 +56,15 @@ export class Session extends Initializer {
   };
 
   update = async (session: SessionData, data: Record<string, any>) => {
+    const key = this.getKey(session.id);
     session.data = { ...session.data, ...data };
-    await api.redis.redis.set(session.key, JSON.stringify(session));
-    await api.redis.redis.expire(session.key, config.session.ttl);
+    await api.redis.redis.set(key, JSON.stringify(session));
+    await api.redis.redis.expire(key, config.session.ttl);
     return session.data;
   };
 
   destroy = async (connection: Connection) => {
-    const key = this.getKey(connection);
+    const key = this.getKey(connection.id);
     const response = await api.redis.redis.del(key);
     return response > 0;
   };
diff --git a/ops/MessageOps.ts b/ops/MessageOps.ts
new file mode 100644
index 0000000..7d20746
--- /dev/null
+++ b/ops/MessageOps.ts
@@ -0,0 +1,11 @@
+import type { Message } from "../schema/messages";
+
+export async function serializeMessage(message: Message) {
+  return {
+    id: message.id,
+    body: message.body,
+    user_id: message.user_id,
+    createdAt: message.createdAt.getTime(),
+    updatedAt: message.updatedAt.getTime(),
+  };
+}
diff --git a/ops/UserOps.ts b/ops/UserOps.ts
index 77c333d..2860087 100644
--- a/ops/UserOps.ts
+++ b/ops/UserOps.ts
@@ -10,12 +10,12 @@ export async function checkPassword(user: User, password: string) {
   return isMatch;
 }
 
-export function serializeUser(user: User) {
+export async function serializeUser(user: User) {
   return {
     id: user.id,
     name: user.name,
     email: user.email,
-    createdAt: user.createdAt,
-    updatedAt: user.updatedAt,
+    createdAt: user.createdAt.getTime(),
+    updatedAt: user.updatedAt.getTime(),
   };
 }
diff --git a/package.json b/package.json
index ba67df3..5632d06 100644
--- a/package.json
+++ b/package.json
@@ -5,9 +5,9 @@
   "type": "module",
   "license": "MIT",
   "devDependencies": {
-    "@types/bun": "^1.0.8",
+    "@types/bun": "^1.0.12",
     "@types/pg": "^8.11.4",
-    "@types/react-dom": "^18.2.22",
+    "@types/react-dom": "^18.2.23",
     "drizzle-kit": "^0.20.14",
     "prettier": "^3.2.5"
   },
@@ -16,11 +16,11 @@
   },
   "dependencies": {
     "colors": "^1.4.0",
-    "drizzle-orm": "^0.30.4",
+    "drizzle-orm": "^0.30.6",
     "ioredis": "^5.3.2",
-    "pg": "^8.11.3",
+    "pg": "^8.11.4",
     "react": "^18.2.0",
-    "react-bootstrap": "^2.10.1",
+    "react-bootstrap": "^2.10.2",
     "react-dom": "^18.2.0"
   },
   "scripts": {
diff --git a/schema/messages.ts b/schema/messages.ts
index fe1d034..ac2cf97 100644
--- a/schema/messages.ts
+++ b/schema/messages.ts
@@ -1,6 +1,5 @@
 import { pgTable, serial, text, integer, timestamp } from "drizzle-orm/pg-core";
 import { users } from "./users";
-import { sql } from "drizzle-orm";
 
 export const messages = pgTable("messages", {
   id: serial("id").primaryKey(),
@@ -12,7 +11,7 @@ export const messages = pgTable("messages", {
   updatedAt: timestamp("updated_at")
     .notNull()
     .defaultNow()
-    .$onUpdateFn(() => sql`updated_at = NOW()`),
+    .$onUpdateFn(() => new Date()),
 });
 
 export type Message = typeof messages.$inferSelect;
diff --git a/schema/users.ts b/schema/users.ts
index 08cc645..2a527c8 100644
--- a/schema/users.ts
+++ b/schema/users.ts
@@ -1,4 +1,3 @@
-import { sql } from "drizzle-orm";
 import {
   pgTable,
   serial,
@@ -19,7 +18,7 @@ export const users = pgTable(
     updatedAt: timestamp("updated_at")
       .notNull()
       .defaultNow()
-      .$onUpdateFn(() => sql`updated_at = NOW()`),
+      .$onUpdateFn(() => new Date()),
   },
   (users) => {
     return {
diff --git a/servers/web.ts b/servers/web.ts
index fa2cb2a..97b5834 100644
--- a/servers/web.ts
+++ b/servers/web.ts
@@ -91,6 +91,7 @@ export class WebServer extends Server<ReturnType<typeof Bun.serve>> {
     const idFromCookie = cookies
       .filter((c) => c.split("=")[0] === config.session.cookieName)[0]
       ?.split("=")[1];
+
     const connection = new Connection(this.name, ipAddress, idFromCookie);
     const actionName = await this.determineActionName(
       url,

From 8f8f7631e728860515bcb70599edfe8be2b1503b Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Mon, 1 Apr 2024 20:26:56 -0700
Subject: [PATCH 04/14] remove csrf

---
 __tests__/actions/session.test.ts | 1 -
 __tests__/actions/user.test.ts    | 1 -
 initializers/session.ts           | 3 ---
 3 files changed, 5 deletions(-)

diff --git a/__tests__/actions/session.test.ts b/__tests__/actions/session.test.ts
index 594af4e..cd85a46 100644
--- a/__tests__/actions/session.test.ts
+++ b/__tests__/actions/session.test.ts
@@ -36,7 +36,6 @@ test("returns user when matched", async () => {
   expect(response.user.id).toEqual(1);
   expect(response.user.name).toEqual("Mario Mario");
   expect(response.session.createdAt).toBeGreaterThan(0);
-  expect(response.session.csrfToken).not.toBe(null);
   expect(response.session.data.userId).toEqual(response.user.id);
 });
 
diff --git a/__tests__/actions/user.test.ts b/__tests__/actions/user.test.ts
index dc9866d..57ca234 100644
--- a/__tests__/actions/user.test.ts
+++ b/__tests__/actions/user.test.ts
@@ -73,7 +73,6 @@ describe("userEdit", () => {
     const sessionResponse =
       (await sessionRes.json()) as ActionResponse<SessionCreate>;
     expect(sessionRes.status).toBe(200);
-    const csrfToken = sessionResponse.session.csrfToken;
     const sessionId = sessionResponse.session.id;
 
     await Bun.sleep(1001);
diff --git a/initializers/session.ts b/initializers/session.ts
index 34ec24f..eb72bf4 100644
--- a/initializers/session.ts
+++ b/initializers/session.ts
@@ -7,7 +7,6 @@ const namespace = "session";
 export interface SessionData {
   id: string;
   cookieName: typeof config.session.cookieName;
-  csrfToken: string;
   createdAt: number;
   data: Record<string, any>;
 }
@@ -40,12 +39,10 @@ export class Session extends Initializer {
 
   create = async (connection: Connection, data: Record<string, any> = {}) => {
     const key = this.getKey(connection.id);
-    const csrfToken = crypto.randomUUID() + ":" + crypto.randomUUID();
 
     const sessionData: SessionData = {
       id: connection.id,
       cookieName: config.session.cookieName,
-      csrfToken: csrfToken,
       createdAt: new Date().getTime(),
       data,
     };

From 0204a84d2984e3e2562f863d2fdd6f7c713693db Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Mon, 1 Apr 2024 20:32:59 -0700
Subject: [PATCH 05/14] type packages are needed in prod?

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index 5632d06..4406b84 100644
--- a/package.json
+++ b/package.json
@@ -5,9 +5,6 @@
   "type": "module",
   "license": "MIT",
   "devDependencies": {
-    "@types/bun": "^1.0.12",
-    "@types/pg": "^8.11.4",
-    "@types/react-dom": "^18.2.23",
     "drizzle-kit": "^0.20.14",
     "prettier": "^3.2.5"
   },
@@ -15,6 +12,9 @@
     "typescript": "^5.0.0"
   },
   "dependencies": {
+    "@types/bun": "^1.0.12",
+    "@types/pg": "^8.11.4",
+    "@types/react-dom": "^18.2.23",
     "colors": "^1.4.0",
     "drizzle-orm": "^0.30.6",
     "ioredis": "^5.3.2",

From ee3a36b471dca9be12b6d12bf6c0c5613a10d260 Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Mon, 1 Apr 2024 20:34:21 -0700
Subject: [PATCH 06/14] rebuild lock

---
 bun.lockb    | Bin 70964 -> 68009 bytes
 package.json |   6 +++---
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bun.lockb b/bun.lockb
index a510f39f0660228f5f4b527432be6b7833d0aadc..aa578bc96bb7730dbd1bd51f90eedaf8c0ee7a65 100755
GIT binary patch
delta 7944
zcmeHMX;f5Kw!Zf=$Q24fEh(@RG-{*_NEJhYU>R*hp&UC&mm`7*QYGL3DmZ~t9O6W_
zan^`!5=CQcux)Wjv|}PBrWNOr)}*x~?GR$xj;52mZ{J%tWUa^h)i106<gE4W;p}~;
zefB+d;OwvT+)19RBEy?!oL=$O(v55T9++o-(m(n8cW&+&GS&H1cXDLShnahdzX_H_
zfy;a4j!?<9x4ihp*y)*53Y-Pwg*PNY@E3%#WDh|I0v`ok2Hy?t2cA_}SX448Tj=5`
z2!Z<^Ob}akLPzW|X?z4*3fHxyKTDDN6)gp!IjZg8zTn$iqXYV<)XlW8joP3jGcV6s
zSS0wl^>~ce0-npkc?uqFD9xiwX}Cdk9~7*1xEh?t%Px$K$Sy7tvI`5GIXQx$Obc@v
z7$OKd*vIh-QCdLfiLfu1K4{M?$<NN8=$w(A{iv<l-yLxFy9&<s+{^-(ljr`(s2Xk=
z>6u6SQf<1<g52yW&Z0tRK~A1?d~VUMcIrYO>jfcz$15B=)tNU=7}P-!5QDNr@K)f@
zgCiDYdUw6()*ptc_8Z{rUjxp5?|~yiWm{Cev}_Rs-kQm7LpnHjoTfUI#e;JPo!q)V
zICt<}sOonY9CIu?2hIZ=0cZOTx4s6P+t<U11AW`gvvM=@CJ3d1aK&A59GoZ8EnJP*
zbZ}mIYjCbNnADEufpcW1gL5kUN0Gt!|5s>!@yNW31^aWzPMX!wG`CPk?=DhuH1+XL
zp{?Fwh7f({z`4)8bUNWlk)Lk~l^<R9O-k!WB_CHE^Uf8i%%^`qdG`^^yZo_df;=(l
z<NBc+4p-Iq4Ds;!{io|n-gKRFRvG**h_u^3N&1&W_5L<#qz9Q=*ra_P<O2JL2i5Cr
zlGT$;u;qJ_%imVDqeZf>7(@B36TN<ijf<xT`b6pNmSk#glj~8Dh8cU1S!eZ%L7w!X
z2t%Sg4N|gJFCT&y1x=)eV5?mJldVB-l_Rm>B-N(3iY{`t>m}}`@OHht8eoZ`2Y!iC
zte#9^n2(-ZVEQ&x8D^7*BB^4~uo;=#TIChcdO-75CQ<_}jv{o4(hqR%V3YeHVNzh0
zsG*Hj-Uy9nhxzEO(xV`9b+kzq166jk$u67+@rn&AlD9#NgC@}A7FOwsfn3koWFLIu
zJeEXeR1OQKdQ@(9SBhjdSf$Is<mzOTgK;?U9F<|E5g}CH$tEogAya3Yd>S@ntU3w#
z2{aA^0@>awS=v%PTrzN0yr?wa=Wms^wk1~=oBS;*d2~S;$YP{=R2JY6`N>n>1I?ni
zG_<yQJ%yG;53qf)I73qCK|rEB6B6%;4|n2qfHjV^d>0Z=SdC0bd#dkhlV5JHhD2TO
zvi9T(x5+0^X;VBACrJvW`f!_+9!e&Y%_{?EPG5>JC3?LDsh=X<hm@*Fu^lz*3`lC-
zhmhbGk>vTDW*iJjHLim+kn&BvL{*RMBnX3*u4Y3Ts7RkcQU?m`thE~fNu9=<Kh=E+
zNo^6^MQbq&l3nTLBqVi=faf*8(U8=-w;?J0$^U@Fd!VGf+_|f&$<z>TmBw_X$|##$
z?yhXc87F<(l}u)QSmER{+vG(!!TM{llg~g)RXS@3vPvcsnJhMW8B&Au0lOSzm204>
z!Nvz9d3U3Fi_Oc{ji>X#lIS%bQa?rd1X8LZwR%Cb4uhoDRX~DYY?9|s#)t^bI1Lga
z6U|ZPPW>V|$}Ek9G*FRtKvD;K1WEOa@2(9r8<JZ0F(kD`D`c74Vgw|+(#u<rRKJIi
zRKG+Vc}ktMz)Y3#Hu)?nIK=pL{H<~j(z%Zsqt;ewxP@E^HffcGD#6ZMs2)s?CQ}ca
zG%%VfjW%g{G`V_AF^hsAAbSKa02`td=3I}k3le~kDMjH`y2Od1?174TKr>pN6k5v8
zOBI)<Ion@z+neJ4u&sC7nX~@}H{a;4XU_GT+<ddU9=ufG>1=fyD%=L<++dqqXU?m9
z2jErh1h_Ew1m1P?ec)V}vtN~)|Iy9=1kU{)1bE!T{FCeh;X{B8Cjc(Yx#JpuJNg9R
z@^j7;Is<UKvj7+7tk<%F!kpWmX9a~h>lXo>)53j>uax`$C0_bV4$Lck2yjFmxfjTs
z>l;*FDm-=@e$Md=C%Es~zc5Gq|33%fl{N=q?(61$te`MwQRn9V;1X`zLV&v>P^1k#
z`uzG?|N2=A|LIrx>u3Gn{jB|d{#jQgq%4r=qf|Tjr0S?$nq8F1ndYE_&_09aOZ)me
zC^t<<`c%89qs&xCmBGHS1!bq(>B|v1I+|`5dy+iHLF-29D1VGy>_yek`j0|)8FsNZ
zIWrveEws;|{f2@w9kgS#j&x|(mv)YJ(6DqJ&Caxo{pb{IK4WwgG1iW|P{~+K1KLe!
zb_&nJG%|FwJj*T)q^r;jnL6q@&Mpq7CF2}a1MLB{p_GvApyIJQ+MI0{U!r@^x@PHU
zV2)jUh1Tad=nAy&p*bjZyn_~x)6u)*?c#8H3N1ccN27D?;z-(=>!2^8>6~_PG!1uR
zeK}Yyv@s;Ru)gtFt;;TEQZ=-1p|zV}7qiGY0qe`fYN2IQa30p@#QO5=;&?g*&BulH
z<=aIkmE>c6&~8GTK;Z>g-vq3$z%J&~RcMAhtZ$-SoJdP1I>bqI8+0-yOmc`*s2sGA
z?tvCj@5v5vDy;{dMh&3TDRqiNET#(35_$?cgN7D5#F?}cbQXz44skXO2c1LvKubxU
z>JZB)6Lc<BgU+MCX%2BdIYAfDanOYnJl!F_N|Qks(J9cy)S=iRE};_8rBn<08ikiQ
z#AP%WbU9rGT|wp<4sj(dnSuS8j{TWo7t1MOCibTo`!mxn65X5W5LZ+0Sq||HS`WI0
z8bH@l>THL&jw(Rc(^Jq5G<1$b+(<h?H<4KC5I56s&@HqN^i7h>9O72W1g)TI&}|er
z*CGC%oS@t3IOtmxJkKG%O_M?2p;MqcsKb1RxRXjiE2$QA7lkiyh`VVn=(}_kbPt&q
zI>bNF641T$bd*EfS9N>gbuXH<%unj9r#Z`dcqQXbpreYF<LQ>4r_KYKj4ShBafu43
zs#rNv;%XZ5x{vfyXw{aLha{D!OI6!fcj?%C?_PY6C`tQh)WHnp(#w|+QYr;uH8}q?
z^PO<8TYdwauYe5v??Nfs1(&aW+7Yc?cD+%@mm9Y6g_rLzxqJ~td11fGn<q_;w%EeR
zend~X)iL3G72q3S888>%D*|7#mjTOx6~Ibh6%9WWimkd+J+ZU}eE7mX510=u02TtT
z0*ipf0N?&i0AFo*o(}-Na$W*116P2nz%}4Ha09pr)B%45ZUMJ}&w($1zX5lEy9n9F
zL;7&O27d~i2L1x@HTe|47yB*1n*hgPJp~@_rpMo%!V-WlMqh#RmGB(ZRtF8OfV36h
zKMXjI!+}(QuTFeH{2JiURRX(!-M~@cec%J&7+?nu0K9LX(ecAU;v+hBC^Y05^zVRw
z1K$Hb06zkPNY@T`Y(C7rC7TYC?MTO9-l#o5BEWx5^auI@DO7UA-nTiVK!Ecg0Pq2t
z0Y9Q}9$~sl?)ZcI0_-mXY~!5bTb>`uN4p35LBhY4l-6wZrPQO(iOneg=q@iF+n3Dm
zx1xaeecbRY?SNWs9Oha{M*Ryw63`9!4bTU85$FZjfSy2apf9i!cnw$z@NRIPaK20g
z3V`vzIA91c5J&^C7o|#o2S6DFaFAaCUIK;!zXe_fMghZsF+c|JJAicuz;&Ym-dxr-
z-;t0<0PLsLvCeWjpvtAH19zY~WkKe~V}VS7JJkl%e6&GxV9N&bfjnRW-~w_1C%}u+
z<T%J2jaPw%0DoEYsok+|J&Pet2c`j2fg+#~m;y`&CIKseWx#Uabzmh>4y>Yu$E<@k
zLfQcE39=4Y3#<X&09FHh5>*1bfZc#E@CSf*d9RzFJqQ71=>_`ySQpN#s%FQhdeGhz
zDN>>beS0EIO7@_Tj|NCxJZa7eOI6NCi+v<}OPY2jM_SR6>dur&cwxvmYr$#V`%JKr
z|0mlTr_bTKHrI>yZ!eO>^r*<F$mj&&xSsZ$HAq+VRCCrM-PY5;q1EfDO|3<Gtf#cv
z0Y>czuI*>rzOzs0eo2gqOo)uato+*0d$j|kg>7CxXEACo6T?4v=(VZtL061n!5C%)
zDu@Q1Gf3eE%00JV>Jv;`&l@Q2e26qCm`s<V+Q-Cc&lSSWjnVm&vd&2&nkhx~mRf|+
zq4O4Lbua~7GLZL$7-?WgRni5c$d=uxnsPD5s69%2_QRF%qbm<oyJrxMG!LPq3kK;<
zTe@-4VALKn#@=lhFskpAS|u80UXj|rI<Fk}Ox+_GZyD8>moty8CuYS?OGc}hNHeeR
zk&$j)GDy4H(X&efBm|}Z<pENB5UsgfY)cDOf4{W%g1Wj7Ht(_=P4Gkz%?Xiai=e$I
z)HEBiHs#CwKQ~&AgwlX32BY=_VR-h;{M%3BvKt-lhEmxTL!9<z5!GkIm_K>9kQyEQ
z!_-#`T~PA9EqkV&Y_xO=qraeOJRERJl{u@EcEot+-)(eAgN0M(`uv;}^O|eN8!hQ!
zWV~uHPImXbE5$i_O0VZPH99N`qajxfaa-Iym|Av?7GL|KqS4_!chkI#Z9iTrukPJw
zsR^SkXnF$<JgvX4Df+si*OSAI4i8~z1<PX3-MM1|dlWZX#13>H)6!myj^8QY(JH9l
zzZxB$??7SK3~|~MlTV<n+d*;l=|%_b5h`xL=>rw7@1N0VX&p`l*9=DO4M*>vIwC9g
zat|d1teiO0!)e<!i&1;bSrbs!J9_k<zDj1rMq13mbQ67r!L?VOzui9+axCn7HTB}S
zhbGe?KGG5;APsES4RKATf#RUORc&b-b?E%PtP#q*70Y*_wCuXU*kl?g4oHJz=)1`@
zP#l^}1I2<g@V{Y*YcdTKheg<`AZ%4_ML@d~UGEKUoYs~w8g;{9Y%&d$rbvTT=)1`@
zP#l^}1I2<gs6*2x(?D_1o)&AKl!eaP{t7itE3pH;aMNIHG7XfbC(V>`(;(qNYsSqS
zqxNX4y;Vu#91A{bb7VB0y8O==I{j}4lc1I>7gTPzNbT$TP<ovuWG;>=KSXOmeC%nl
z*#C$A7gd))xvH{G@~A5OyqiefKli4vyIyqg_Tj3{U*Hd_TVFS$>yKOdzNow^cQ2SY
qE}Q0lW2}<DX@!e2jBOtWcwj~p@i@QA_$0nP9r?QF+Lv34xBdrh_?XTB

delta 9433
zcmeHNd017|+TVLK9`GQ8$N>+tp@1CWFbf`$1c!qurEM_>rXz!ZfH+_&SY}#^;+qqt
zX}2^`Njf-SYEn5+SWcN%j@?Q~>gv7Or1t&R-e-&5$9lf+KKK6fJ$F6N@154W=6A2X
z*IB2YteYFGSL%Y>kECAR|I1aAdu-6t*V1#>yqE7V=5TcVv@!b@_Z@ca*=?`&;yIS~
z)r!8tqkC)TCPi--IIaiBRp-o{Sy5SP;%-BCfj%dzyriHck6R7h3A&>-$9aHHg05=n
zn$Fvm=1FzYCEjyXx+}-2kvq)7zeg1+=-1t3eg)hSdUh|lHAU}>DwtnsUKneA=2Uko
z6m&M@-8s&Ib_k&%hc&W8WmZv9!ORLS&7#ls<hY(FcpRK{?_muIRza=>Ub1^lA5;MI
znLaeg%BO0%R_<P|)MJht1D$1?=2l3Sr{T^fq1aSBqhOxNG|)$`<{@zA=Lyd8^Rr3{
z3s7R9uWa`NXT8WPnvu;ano*KtVth_{R%vM^r}Va}x}YTAR9;Xqv!G;JQ9)jQ#kVNP
z<|7iraRxWd%$`+Hl*`owavY|x`blt1S#=&brmT9r#Xi)c>n!<Ni{0L0zZt-Bz2Scm
zoRvEY?!i@Y)lHU+jo_@}=PeF%!C8a37X1-$RzU(d^9usUVpO|Y@^Aag`PaZ%182cm
z`4G#x_*-~Repb<R%!G#NRdC=Tu=trCDo^Dea5nOB;LJW@fLzhL;B3nGfIEW!J7%Ve
z_4L70^PiiUE{uw`YZt}YNijYuiaxUmB755;jhFjFE(-%6YmdKG(ZjKlY7Z>?M{2L{
zE053!TR(HPZ9Z@R)x%d0j(^V8l}hb2aT5lFbiG~t_nB9IXycx#oqp@d>v_kQxPBY(
zmk-xfzEXIqpmyNI<w3g!$E#)}9_dW4dt1@zn%xL<lKogK^E$^fJQX=53Ti8Aa54xF
zTTv(25-TcH8-#-}f(2MpC)iwT3UM-+`}Z8?s0zaX?6HiFbR#U3GJDvoreL)Vu<{h)
z6RUa|S`0KRYU&+pa|+s6Dt1dy1t4~kWiQxsnMPr~6I`}HN?>;OlpqDtX2*W4Uf~Bf
zYKS$cgE3|CZ~)_aAQO%DRZ)j_2>&M4Ylql$AR~&p+!AcO5teaO?4BSLyHlr^LDdAq
zD5)<IX!BQS$+W{GK{XihJWR2x7D5YWJ)knrSXI-#yfXJ#)eq1T<vjOTn+Pmm6czVK
z5N3H$p|?TU;Xw^x<2BR?R;!^9AA{;6#PuMQu_d&svd4B51I?Ogg29tI;qn}esW1vu
z2A9vFvF@M)?y<r^FKX~L2<2YX>1$9mVEc-b@>pe8p|Q$1ig1b*G<~SS&!8HCt%|iL
z&<%C0u&xh<_#0FgEJmK1JYoe8Ej7THflV$-@<g*jot8oZ48jLmDhx2FdU$hOh|~}p
zcMLQ(ZY#Rs6)Ti`Q%ImewF$-~xi}iS>`e_Y#$h95t#eXC<vtYB*Pv>I@t&vZJ7{{z
zrL0%1O*}TbL@Mr;U^5F+Diu2?sNROemcX7>VsndWY?@U;esYK9nVINEAwdS!i!ib&
zk;mKaM-4DqW7n|+A%>RhPa*vb!bX28>}Rmqgsm`zb_5UMhf{IC1e*bUIc}sR&4QF7
zN&D{EtRCVx*>4miId=slxx_h0qoooL1u3=?NMj`10Z5~%tAC<(Kc$j%NOI9SNOE<T
z?%DeHSE`!@Np5yOB%@TFU9eJiEF`(v4fkwcLz3!Kg<|2@8dymYXR>H2is%<Byb?m4
zVFuMni_wlnoPdX@P-hV4gi?dfpgM{TcLa*#0Y;4V#5Oxps;mr=Q#gPM2O3oEFtT{S
zDzlizCLm8Xo){rDj6%W<HVa@xcl2zQ!@?769CWPnOnMAbiX^SOXS)JP_Uk`T$t{K?
zm)H$yv{b?hVIkYnAdQi1FF_hjJ0cRTA;^^sj8NR>LXsOhaL;Co=##5^43b=;4w6x-
z?kh-g6S_#n?@36KO?W?&I-?CLXFNCZL)N5@Rf*8pW@bf*XkmR6HN+T%6H(L&<`zvM
zu?AseG!=rajHb@m@(6+BI7FC~?&oaRLqu^l09Hs!jPvH@aWi-q6~ra7RpLCU2YHZo
zkbM=a@CD`wEVJ<C;4CrD>@|QDPz%@r>j0J>#F_tkDffTHtJo(Nx7AXBaaO?_7G7_$
zGtTS{7QW45XPkAc(PDqoVrQKB@3iQQvzgfiumSG@SlWZ{7tR{O+W_P504y=i99u2?
zJqte!&MH0vu!h?Jd*CF%?56;h7-#jJ1z0`j0G96OtV0*jzEtoc%SB?GRdk6dNQ|=z
zt}q3Oai)I>;3dNS0<iS2@~VHe;J>L{)t~m9jr2CaX5<dQ664JNn}zc%6X|}Amo4XE
zvHv;8{QtSbe>gwopL)tVtpQ=&)55)&g2Xrz`&hUZoXvy}PhN4!|J@p-$@%Zr@ZYWB
z|Hsxa43GBxdlP%~|Ib^4IsV~A0(lQNl6|V0W(_y;Dry}r(q3o>QjEMKsZvGCAFih2
zR3opZmQ>NK8S!k-q+ic9?w{d2f6I%F`?7u+mGb#>9xLZhi2KS%Xda!ptnlnl>%7-&
zvhzB<vF3})Bhl`Sam{PjA84@sDXydTcw6hW(O=UAQBxK9<$Evf_%*)f@yPiJr#CDp
zIdpaU>WeG3&iD7RJ@k^#*-g<smSl%y3^>?wG52fdZOdySzYT8LHz|5y|8t^4^3K2h
zj1lwP-JW+b^udsoWL-1hdSF~`KxmnL-p9lBd7rGE^y<4|7hk?J%KMYk;@4+y<&~5!
zdphfN&u<)$c%B}8F8NOCw12p?<~xjN@_pvJU*5Yjh?Y;#RF(VGv~H~%{9OM7jeUbR
zR5raed(oEP#@$WK9lXhH@2-AVf6{-D-0a33ZEJtV@cF8v2?0yq^?SC_)#Yk&pp9?a
z{!QqP(z_u_*TAi{LgSqqdwgmSCnRw<vJ$uD8>(F==AE|f`q6=|suG)zaE29Tr#R0q
zD;NADqPFO&|D{`N-!xzOaM+j6KOV5ZE`Bl%&d^j%-(AoWGwze9;#Yb+9bJ6vt52g^
zbCNHNn{WJn(R;x$+S!x0cfFfbx9asv2fi}K|Cln5JJ?pAWOr_v=WkU{8FEsdxvzIa
z@9$kux@mRN>WDS(9n1Utoll2m%$dE*Bg2@u;!Mgj!SA0Q@1C7`*5hyd0M7-azWeJw
zpD}{1>$Ycix31hWDMml#o%fx+sVhT6pHvw~KYV|+%g4Sw-}Hl1zsj`px9hUDyB(i4
zC-iRDn_IQ#$1VA!+}yh7$IMrve=6k1P5$}Ab*H~v_}KL0*NQrpy8osZ=Fgbd^*U{s
zs3G+eMm~k=CyF%T2{mmHjW_~yh$7ifQq$-OMt&r%pMcnfb_be~MrI&(C#z{khLIml
zKSR?@QPbp!Mt%%sJR#CCXa`VdI;kd!G<PbZe3FrWj9Q@e&s3B5WFtSG3MPwm4%%^O
zB6&^`X-Srv=1(#58Po<XE?Z4uQ;qx+R5?|oYtSx0n@qu(BCX3&)ACFsKb6iy8<DG~
z!C6K=i<V}I^b@o$XgL(0Ez%n%j40d4o2UcYglQO2j*-u!^*I<{9!3PMfJWwGe9(5}
z8u{t;Gqn7CjL2l<i>cm(@fD~^J<Z6^pp0oEUrJ4&Wu(dz`Etqvok=aA737jH^0TM_
zbT+ku&LPhNk)KOtpq11HI*<GdMgB>u1bvE5g3hPl=_0>?7J^pMdC+Q#C=&UFv=sDd
zx&rzP#TSeGBB}*_mO4Ne)6f!;e~#9JE}<KsOKIc`k$;{xgT6pNgD#`=QjuRy^`JGx
zmx=re$|%G7RA7C|jC?Jr%CSDPus-ERo~Wf<<X<G0nIgZM3P9ITE9hGCtPuHiR0g`9
z+Cb~bf0oF<M3tZ~(@D?`6g*qxH_}4TSLi(GCW@FN@|$TX=&N)E^e+@YSL9!#TF}?2
z19S@wtrYpKv>x;gx&c~GBj<^H18oM~Mn8jYr}QU9eh1ZqHWL4oh@XuzKzC9TXcMXC
zi~L)Z1!|@i&}MR3Ao9DY0CYFCg6<*DDv{qyWuPr)|LV_e=tOlhexkBowb))Td62{6
zK{kst_&u3g7w0j%!^6;UcB}UFG9O%ADA<rcelRn)E`CBl(Xq^h{Fd6^GY=Qc!)k&8
z%qOas@DA(t%Fkz93svmQln#3AYmt3Dva}jtq7|?iU}+7&Z0zVV#v-q^=<K+HAHJmY
z5-9Vt1(bup%N83uAhK_CmbU?5-{Sc#(zy}8!R)8hrXb31ii&3aU<b<;z)FC9-LivY
z9l+{m^|A6BfmeV{z-CG}d(gF}A{%dbFQdavzAgc<2LkL>$@=muwZ7HQ^E#w1;5*=Z
z;BUYU;3l0k`v$XP*m>YH;0u5q(>?{*$K!Tj2f)spTgk;7TGb!YI)J@=?}D=v$z_0@
zDw}|}05i}Gu#+b{jk1#}JH=)IBLVg;&pu1ow7m<))}{s62Yd*$1IK}n03+}|@Cbla
z@a5Qt{^wA}1CIkDFabyg?r`ML9FVMniv!>Y^Z?X=6VMZI23!DFzztwGHSR!fAag(J
zKst8_3lreUy0iyK1$G1Jz*t}ml{Fhv)R0^N76#6MBj5nAC1;_9`dG9|Ct?;>P5{ee
z<$3_j$BOt}16|me*%e@=nbnSl?h51`$h2#lmbJ}F{q|33C~T{C_oAfTy<CzYvv;lm
zU|$A_RJ+TqDghEZP_cPoFDLc|#lYl5U^oy8u!$WFu!$Z8umu_cqycO(UjztP1=Ip7
zfw{mOpcE(u*ut{4cno+H7{}qa1hzoR;!J@&377~x0Zax=Ko*b>6aZ5#dL}rtO#`xl
zOhEC?g`5Mha*B=VOwI!oIg9<4!75OkiXgMX(}6-D6Hppde3V9KAg=_N4a@>6fSEuU
zP!6y`DRK;CHXAE|8eloF40wTs#Ph&XU<vRX)$d6dycW`GU=6^Y>vcdKupVdvb^^*%
zvjg&WU>nc?)RX_-*dQ|`_H69}SYYf0QUJEh_N^dDy)M$0y+P&^dn>Gj+XCI*ucv^0
z?v$}VLJ+KJ*?vF4(V80fr<rvJme{8$cZtfahrsJ~;kt0tque$s_aXuxVad@r$d@iT
zb=$8c&B(nh@Kf}<7@eLr9rElG!EpnS?})8>MfCT*Z_d2A4EYhr52rJS3bmFCO-{Lc
zapnz!<D>?!xRK$Erb@ZZRPJ2_enFfrS{D({DfgMm&5OW?NFzq1^pfwpl)D*}iPq_3
zbWwkj^9Qxj@x$rDcz5zUQZ3-3^wlGJq058*c0{99F4vs4w!faf_CmHa>}XvyyMLp;
zNA+5Njr@u_>l9z&>TVnfhj?9-4l@#>q4J}8AyPwIj;3jqSJ}zohS%zoeVYY7To*4*
zL7Ik~j-?5QH8km%UYP4iE01Zk%I&L|erELKn{8L5>6F%}z>D5L)+{{ThrVmq(5f~s
zp{5Ttw&}HJ`p7-uF1!?3T$*zVYiF4$*;g2&rQRRt1>D>gp=9<4QNnU9`Lt`yJ3p}I
zS?=x+)3nNk?D4zjf)A|N-69P*oc*FJJI5$Dw^j{Dv-OMe3nd4=PLI1=AGrhBU*AZZ
zlu~{YIpI3Q568((${h`--R&`!?#C$C#hqKC79X)+aScTxQ3M@VE`UG&d+hs9Mb93F
z9Ly@q8R$!i$2G#YzV!I<Gy${s8kjt7<nU2u-{<`;D+2C{h`f05oekUc2jZ<U;}P+?
z2t9YrpK3nR#3(nej~Y&dYQ0^yb~`9{vYKChiFovb7*lsnPyl`Lkw&Xr;)W;JP2FSL
zQ|NYhB!HYh*2E~czVCA14G-!NlDZv~d*OnX#5baBi@)y9c|L%qpr~?@{A&Gz!td-K
zI@Rr<Ts3b?Etp(Bq~FWkIY$F%`^OsX#Q^ys4RP%s$-nUB=5B|Z0dyI4E4SI%y>F{}
z`u4ij?V#Luf3v3I=H?-{-tNxP1(NQBCT3`$TsI|L4=h|>x1`%axk7LKs`d>xkKsRd
z=i~*_QztZ9<<8yS#Spref3dyWp(c=aqHg7?`jLZg4VhhaH&_aTNETDdrMA1%$cZ`m
zpAM43AeP0{o>01bLa$YBx7RpV4~?AMm;#4z>>T<CZqEQpJE_qs*WQ1<zR&BB-yJzB
zu`zKh460B5K^Vm8^x@nC!$8VG7<`1H4-5mzLAmW$dkpK?*f{&BG-N3!H-NOKG};G-
zf#iTN7<=ju!a#C(U>Ha_2!o9%`oJ)d9F(j2qRdx+J6qc_w7XmOfpi_+dSDnxMG*#m
zr~e=fB!>rvfs}(VC_&K&hJoau{5c~gt$p|ARn7CdyJZ(e`%h~G-0+`0Jx!3`7JdKt
zZIO9V-tsnGq!-U5)44O@UW>3-_rNx=C@#94pX+q@gvI6MUgm&L1S>jm-j2qfKV<HE
zE|fR-{tSoKM=q(oBXt#d^Rj16n`SBxn}h$Cn957Da;BRq!pcoqxx}CKrV&?t=;oC`
zT6)!uPF)J1gI9I*_lths_xYL12Zjy&olcj#9`gNNwea|z9;T<(vw>@i?D;;<(X10m
z(%*LmmdwaCtzBl%4_>{P*V35twsfY$S<vg~n~q{>3}-qtN>-23Jl1etSez~*f=Vy=
Y)5OcY{&M^q!91=r&S!0#J%9Os07RBvA^-pY

diff --git a/package.json b/package.json
index 4406b84..5632d06 100644
--- a/package.json
+++ b/package.json
@@ -5,6 +5,9 @@
   "type": "module",
   "license": "MIT",
   "devDependencies": {
+    "@types/bun": "^1.0.12",
+    "@types/pg": "^8.11.4",
+    "@types/react-dom": "^18.2.23",
     "drizzle-kit": "^0.20.14",
     "prettier": "^3.2.5"
   },
@@ -12,9 +15,6 @@
     "typescript": "^5.0.0"
   },
   "dependencies": {
-    "@types/bun": "^1.0.12",
-    "@types/pg": "^8.11.4",
-    "@types/react-dom": "^18.2.23",
     "colors": "^1.4.0",
     "drizzle-orm": "^0.30.6",
     "ioredis": "^5.3.2",

From d76d22eebbfd7d19e4353190b19333f79b9005c8 Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Mon, 1 Apr 2024 20:48:48 -0700
Subject: [PATCH 07/14] use react-dom/server.browser.js

---
 servers/web.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/servers/web.ts b/servers/web.ts
index 97b5834..64107d6 100644
--- a/servers/web.ts
+++ b/servers/web.ts
@@ -4,10 +4,12 @@ import { logger, api } from "../api";
 import { Connection } from "../classes/Connection";
 import path from "path";
 import { type HTTP_METHOD } from "../classes/Action";
-import { renderToReadableStream } from "react-dom/server";
 import type { BunFile } from "bun";
 import { ErrorType, TypedError } from "../classes/TypedError";
 
+// @ts-ignore TODO: Hack because react-dom wants to load the node package, but wa want the browser package for some reason
+import { renderToReadableStream } from "react-dom/server.browser.js";
+
 type URLParsed = import("url").URL;
 
 const buildHeaders = (connection?: Connection) => {

From 8809e8b4bd423afae3d1186ea99c2cdf7bb61393 Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Mon, 1 Apr 2024 20:51:52 -0700
Subject: [PATCH 08/14] type hack

---
 servers/web.ts | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/servers/web.ts b/servers/web.ts
index 64107d6..99de06d 100644
--- a/servers/web.ts
+++ b/servers/web.ts
@@ -7,8 +7,14 @@ import { type HTTP_METHOD } from "../classes/Action";
 import type { BunFile } from "bun";
 import { ErrorType, TypedError } from "../classes/TypedError";
 
-// @ts-ignore TODO: Hack because react-dom wants to load the node package, but wa want the browser package for some reason
-import { renderToReadableStream } from "react-dom/server.browser.js";
+// TODO: Hack because react-dom wants to load the node package, but wa want the browser package for some reason
+import ReactDOM from "react-dom/server";
+// @ts-ignore
+import reactDomBrowser from "react-dom/server.browser.js";
+const {
+  renderToReadableStream,
+}: { renderToReadableStream: typeof ReactDOM.renderToReadableStream } =
+  reactDomBrowser;
 
 type URLParsed = import("url").URL;
 

From f1a177dba10b5f603882af473eef7fc60f3bc842 Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Mon, 1 Apr 2024 20:54:24 -0700
Subject: [PATCH 09/14] redis host change

---
 .github/workflows/test.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index c52e624..2d2396e 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -49,6 +49,8 @@ jobs:
       - run: bun install
       - run: cp .env.example .env
       - run: bun test
+        env:
+          redis.connectionString.test: "redis://redis:6379/1"
 
   complete:
     runs-on: ubuntu-latest

From b91d2c84317bf9147f73cc238bcb51f315052795 Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Mon, 1 Apr 2024 20:57:19 -0700
Subject: [PATCH 10/14] try secure

---
 .github/workflows/test.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 2d2396e..fed195e 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -50,7 +50,7 @@ jobs:
       - run: cp .env.example .env
       - run: bun test
         env:
-          redis.connectionString.test: "redis://redis:6379/1"
+          redis.connectionString.test: "rediss://redis:6379/1"
 
   complete:
     runs-on: ubuntu-latest

From 442eb578f9190d2eafed17ee8376158385e2abe0 Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Mon, 1 Apr 2024 20:57:53 -0700
Subject: [PATCH 11/14] redis pass ports

---
 .github/workflows/test.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index fed195e..c84e593 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -30,6 +30,8 @@ jobs:
     services:
       redis:
         image: redis
+        ports:
+          - 6379:6379
       postgres:
         image: postgres
         env:
@@ -50,7 +52,7 @@ jobs:
       - run: cp .env.example .env
       - run: bun test
         env:
-          redis.connectionString.test: "rediss://redis:6379/1"
+          redis.connectionString.test: "redis://redis:6379/1"
 
   complete:
     runs-on: ubuntu-latest

From 8ff74bf08e73bc9af5a54d2479d3051f0b51cfcf Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Mon, 1 Apr 2024 20:58:52 -0700
Subject: [PATCH 12/14] no override redis

---
 .github/workflows/test.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index c84e593..87ae92d 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -52,7 +52,7 @@ jobs:
       - run: cp .env.example .env
       - run: bun test
         env:
-          redis.connectionString.test: "redis://redis:6379/1"
+          # redis.connectionString.test: "redis://redis:6379/1"
 
   complete:
     runs-on: ubuntu-latest

From 7868a992aea05a83fcb5f3e810d04746726ae8ae Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Mon, 1 Apr 2024 20:59:02 -0700
Subject: [PATCH 13/14] fix

---
 .github/workflows/test.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 87ae92d..9651656 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -51,8 +51,8 @@ jobs:
       - run: bun install
       - run: cp .env.example .env
       - run: bun test
-        env:
-          # redis.connectionString.test: "redis://redis:6379/1"
+        # env:
+        #   redis.connectionString.test: "redis://redis:6379/1"
 
   complete:
     runs-on: ubuntu-latest

From 17852dfbe7f2c3075e2d7d9421d346c617e9b790 Mon Sep 17 00:00:00 2001
From: Evan Tahler <evan@evantahler.com>
Date: Mon, 1 Apr 2024 21:00:03 -0700
Subject: [PATCH 14/14] cleanup

---
 .github/workflows/test.yaml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 9651656..c8cc9dc 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -51,8 +51,6 @@ jobs:
       - run: bun install
       - run: cp .env.example .env
       - run: bun test
-        # env:
-        #   redis.connectionString.test: "redis://redis:6379/1"
 
   complete:
     runs-on: ubuntu-latest