@bhooai/nexus-graphql 2.0.10 → 2.0.12

package/src/federation/executor.ts

@@ -1,4 +1,11 @@
 import { execute, parse, isObjectType, isInterfaceType, type DocumentNode, type SelectionSetNode, type FieldNode, type InlineFragmentNode, type FragmentSpreadNode, type ExecutionResult } from 'graphql';
+
+/** Introspection root fields (`__schema`/`__type`) live on the merged schema, not any one subgraph. */
+function isIntrospectionSelection(sel: SelectionSetNode): boolean {
+  return sel.selections.some(
+    (s) => s.kind === 'Field' && (s.name.value === '__schema' || s.name.value === '__type'),
+  );
+}
 import type { Supergraph } from './composeSupergraph.js';
 import type { Subgraph, GraphQLContext } from '../types.js';
 import { createFieldResolver } from '../gateway/fieldResolver.js';
@@ -72,6 +79,19 @@ export async function executeFederated(
   if (!op) return { errors: [{ message: 'No operation in document' }] as unknown as NonNullable<ExecutionResult['errors']> };
   const rootType = op.operation === 'mutation' ? 'Mutation' : op.operation === 'subscription' ? 'Subscription' : 'Query';
 
+  // Introspection (`__schema`/`__type`) belongs to the merged schema, not a
+  // subgraph — execute it directly against the composed schema so the explorer
+  // Docs panel and standard clients can fetch the full schema.
+  if (isIntrospectionSelection(op.selectionSet)) {
+    return execute({
+      schema: supergraph.schema,
+      document,
+      rootValue: undefined,
+      contextValue,
+      variableValues,
+    }) as Promise<ExecutionResult>;
+  }
+
   const subgraphByName = new Map<string, Subgraph>(supergraph.subgraphs.map((s) => [s.name, s]));
 
   // 1. Root pass: group top-level fields by owner and execute trimmed subqueries.

package/src/federation/parseMetadata.ts

@@ -64,17 +64,19 @@ function balancedBody(s: string, start: number): string {
 /** Parse field definitions in a type body into name → FieldMeta. */
 function parseFields(body: string): Map<string, FieldMeta> {
   const out = new Map<string, FieldMeta>();
-  // Each field line roughly: `name(args): Type <directives>` separated by newlines.
-  // We scan line-ish fragments split on top-level commas/newlines.
-  const lines = body.split('\n').map((l) => l.trim()).filter(Boolean);
-  for (const line of lines) {
-    // Strip leading modifiers; capture field name as the first identifier.
-    const nameMatch = /^(\w+)/.exec(line);
-    if (!nameMatch) continue;
-    const name = nameMatch[1]!;
-    const external = /@external\b/.test(line);
-    const provides = matchFields(line, '@provides');
-    const requires = matchFields(line, '@requires');
+  // A field is `name(args)?: Type <directives>` — a type like `[String!]!` never
+  // contains `@`, so a field run ends when the next field name (before its `:`)
+  // begins. Scanning with a regex (rather than splitting on newlines) handles
+  // bodies that pack many fields onto one line, e.g.
+  //   type Message @key(fields: "id") { id: ID! roomId: String! text: String! }
+  const fieldRe = /(\w+)\s*(?:\([^)]*\))?\s*:\s*[\w\[\]!()]+\s*(?:@\w+(?:\s*\([^)]*\))?)*/g;
+  let m: RegExpExecArray | null;
+  while ((m = fieldRe.exec(body)) !== null) {
+    const name = m[1]!;
+    const text = m[0];
+    const external = /@external\b/.test(text);
+    const provides = matchFields(text, '@provides');
+    const requires = matchFields(text, '@requires');
     out.set(name, { external, provides, requires });
   }
   return out;

package/src/gateway/graphqlHttpHandler.ts

@@ -1,6 +1,7 @@
-import { parse, type DocumentNode } from 'graphql';
+import { parse, type DocumentNode, type OperationDefinitionNode } from 'graphql';
 import type { RequestContext, Handler } from '@bhooai/nexus-core';
 import type { Gateway, GraphQLContext } from '../types.js';
+import { verifyMutationCsrf } from '@bhooai/nexus-auth';
 
 export interface GraphqlHandlerOptions {
   /** The gateway to execute against. */
@@ -9,12 +10,23 @@ export interface GraphqlHandlerOptions {
   context?: (ctx: RequestContext) => GraphQLContext | Promise<GraphQLContext>;
   /** Allow introspection queries (default follows config.graphql.introspection = true). */
   introspection?: boolean;
+  /** Require a matching CSRF token to execute mutations (default true). The token may be sent via the `X-CSRF-Token` header or a `csrf` argument, and must match the double-submit cookie. Obtain it from GET /csrf-token or the GraphQL `csrfToken` query. */
+  requireMutationCsrf?: boolean;
 }
 
 interface GraphQLRequestBody {
   query?: string;
   variables?: Record<string, any>;
   operationName?: string;
+  csrf?: string;
+}
+
+/** True when any operation in the document is a mutation. */
+function hasMutationOperation(doc: DocumentNode): boolean {
+  for (const def of doc.definitions) {
+    if (def.kind === 'OperationDefinition' && (def as OperationDefinitionNode).operation === 'mutation') return true;
+  }
+  return false;
 }
 
 /** True when a parsed operation set contains an introspection field (`__schema`/`__type`). */
@@ -33,15 +45,16 @@ function isIntrospectionDocument(doc: DocumentNode): boolean {
 /**
  * HTTP handler for `/graphql`. Accepts POST with `{ query, variables, operationName }`
  * (or GET with `?query=`). Applies the gateway in-process. Introspection is
- * rejected when disabled.
+ * rejected when disabled. Mutations additionally require a CSRF token (via the
+ * `X-CSRF-Token` header or a `csrf` argument) that matches the double-submit cookie.
  */
 export function graphqlHttpHandler(options: GraphqlHandlerOptions): Handler {
-  const { gateway, introspection = true } = options;
+  const { gateway, introspection = true, requireMutationCsrf = true } = options;
   return async (ctx: RequestContext) => {
     let body: GraphQLRequestBody;
     if (ctx.method === 'GET') {
       const q = ctx.query.query;
-      body = { query: Array.isArray(q) ? q[0] : q, variables: parseJsonQuery(ctx.query.variables), operationName: single(ctx.query.operationName) };
+      body = { query: Array.isArray(q) ? q[0] : q, variables: parseJsonQuery(ctx.query.variables), operationName: single(ctx.query.operationName), csrf: single(ctx.query.csrf) };
     } else {
       body = (ctx.body as GraphQLRequestBody) ?? {};
     }
@@ -64,6 +77,20 @@ export function graphqlHttpHandler(options: GraphqlHandlerOptions): Handler {
       return;
     }
 
+    // Mutations are unsafe: require a matching CSRF token equal to the double-submit
+    // cookie. The token may arrive as an argument (body.csrf, variables.csrf, GET
+    // ?csrf=) OR in the X-CSRF-Token header — either channel matching the cookie passes.
+    if (requireMutationCsrf && hasMutationOperation(document)) {
+      const headerToken = single(ctx.headers['x-csrf-token'] as string | string[] | undefined);
+      const argToken =
+        body.csrf ??
+        (body.variables && typeof body.variables === 'object' ? (body.variables as Record<string, unknown>).csrf as string : undefined);
+      if (!verifyMutationCsrf(ctx, argToken, headerToken)) {
+        ctx.json({ errors: [{ message: 'Invalid CSRF token: required for mutations.' }] }, 403);
+        return;
+      }
+    }
+
     const contextValue = options.context
       ? await options.context(ctx)
       : { request: ctx, user: (ctx.state.user as GraphQLContext['user']) };

package/src/index.ts

@@ -1,7 +1,9 @@
 export * from './types.js';
+export * from './mutationCsrf.js';
 export * from './subgraph/federationDirectives.js';
 export * from './subgraph/parseKeys.js';
 export * from './subgraph/defineSubgraph.js';
+export * from './explorer/explorerHtml.js';
 export * from './gateway/fieldResolver.js';
 export * from './gateway/publicSchema.js';
 export * from './gateway/createGateway.js';
@@ -11,4 +13,5 @@ export * from './subscriptions/SubscriptionServer.js';
 export * from './federation/parseMetadata.js';
 export * from './federation/composeSupergraph.js';
 export * from './federation/executor.js';
-export * from './federation/createFederatedGateway.js';
+export * from './federation/createFederatedGateway.js';
+export * from './builtin/helloSubgraph.js';

package/src/mutationCsrf.ts

@@ -0,0 +1,25 @@
+import type { GraphQLContext } from './types.js';
+import { verifyMutationCsrf } from '@bhooai/nexus-auth';
+
+/**
+ * Validate a mutation's CSRF token against the request's double-submit cookie.
+ * The token may be passed as the `csrfToken` argument or in the `X-CSRF-Token`
+ * header — either channel matching the cookie passes. Throws when missing or
+ * mismatched, so per-mutation resolvers can gate writes explicitly (defense-in-depth
+ * on top of the HTTP-level enforcement).
+ */
+export function assertMutationCsrf(context: GraphQLContext, csrfToken: string | undefined): void {
+  const ctx = context?.request as
+    | { headers?: Record<string, string | string[] | undefined> }
+    | undefined;
+  if (!ctx) throw new Error('Invalid CSRF token: required for this mutation.');
+  const headerToken =
+    ctx.headers?.['x-csrf-token'] !== undefined
+      ? Array.isArray(ctx.headers['x-csrf-token'])
+        ? (ctx.headers['x-csrf-token'] as string[])[0]
+        : (ctx.headers['x-csrf-token'] as string)
+      : undefined;
+  if (!verifyMutationCsrf(ctx as Parameters<typeof verifyMutationCsrf>[0], csrfToken, headerToken)) {
+    throw new Error('Invalid CSRF token: required for this mutation.');
+  }
+}