Make app mutation optional

As discussed in #59, a reference to the Koa app is currently accepted so the middleware initializer can modify it for performance reasons. This makes sense, but it sort of couples the middleware to the app, making it tricky to use with other middleware consumers such as koa-router.

For example, if I want to use koa-router to define different behavior for different url paths-- some paths using sessions, others not. Even if I only attach the middleware for some paths, the ctx.session and ctx.sessionOpts getters will still exist on all context objects all paths, even though they shouldn’t.

In fact, omitting the middleware doesn’t even seem to remove much of the functionality at all. Without it, I could still get and commit session data from cookies as normal. Looking at the implementation, it seems like the middleware itself only really handles external storage initialization and the autoCommit option:

https://github.com/koajs/session/blob/10bb12246699101a0c87a2f3e2e09b1a79e10e33/index.js#L37-L50

I suppose the answer here is to just not access those properties where they’re not supposed to exist, but it feels messy and likely to confuse other developers who might work on my code who aren’t familiar with the internals of koa-session.

I’d like to use koa-session since it is clearly the most popular and well-maintained module in this space, but at the moment this is a huge blocker for me. I’d be willing to take the performance hit in order to avoid these problems, though I’m aware not everyone feels that way.

Would you guys be open to the possibility of making the app argument optional in the initializer, falling back to the slower way of doing things if it is not provided? I imagine it will be a decent amount of work to make this change, but I’m happy to do it if you’d be receptive to it.

If not I’ll just save my time and use koa-session2. :\

[zavr-1]

@sripberger you can use this forke https://github.com/idiocc/session you’re welcome

[zavr-1]

@sripberger is 100% right the middleware should not be coupled to the app, it’s really easy to change the emit logic to use ctx.app. Otherwise, it’s confusing, how the session can be accessed via ctx.session on routes where session was not even installed. what are performance benefits anyway, the current logic defines session symbol on the context constructor but how much gain is there from that it would be a breaking change though https://github.com/koajs/session/blob/f81d7130ff4fd44ad97bd0b807034bd46964db8a/test/cookie.test.js#L668-L695