@constructive-io/graphql-server 2.19.1 → 2.19.3

package/middleware/api.js

@@ -3,54 +3,26 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getApiConfig = exports.createApiMiddleware = exports.getSubdomain = void 0;
+exports.getApiConfig = exports.getSvcKey = exports.queryServiceByApiName = exports.createApiMiddleware = exports.getSubdomain = exports.normalizeApiRecord = void 0;
 const graphql_env_1 = require("@constructive-io/graphql-env");
 const logger_1 = require("@pgpmjs/logger");
 const server_utils_1 = require("@pgpmjs/server-utils");
+const url_domains_1 = require("@constructive-io/url-domains");
 const graphile_query_1 = require("graphile-query");
 const graphile_settings_1 = require("graphile-settings");
 const pg_cache_1 = require("pg-cache");
 const _50x_1 = __importDefault(require("../errors/50x"));
 const _404_message_1 = __importDefault(require("../errors/404-message"));
+/**
+ * Normalizes API records into ApiStructure
+ */
 const gql_1 = require("./gql");
 require("./types"); // for Request type
+var gql_2 = require("./gql");
+Object.defineProperty(exports, "normalizeApiRecord", { enumerable: true, get: function () { return gql_2.normalizeApiRecord; } });
 const log = new logger_1.Logger('api');
 const isDev = () => (0, graphql_env_1.getNodeEnv)() === 'development';
-const transformServiceToApi = (svc) => {
-    const api = svc.data.api;
-    const schemaNames = api.apiExtensions?.nodes?.map((n) => n.schemaName) || [];
-    const additionalSchemas = api.schemasByApiSchemaApiIdAndSchemaId?.nodes?.map((n) => n.schemaName) || [];
-    let domains = [];
-    if (api.database?.sites?.nodes) {
-        domains = api.database.sites.nodes.reduce((acc, site) => {
-            if (site.domains?.nodes && site.domains.nodes.length) {
-                const siteUrls = site.domains.nodes.map((domain) => {
-                    const hostname = domain.subdomain
-                        ? `${domain.subdomain}.${domain.domain}`
-                        : domain.domain;
-                    const protocol = domain.domain === 'localhost' ? 'http://' : 'https://';
-                    return protocol + hostname;
-                });
-                return [...acc, ...siteUrls];
-            }
-            return acc;
-        }, []);
-    }
-    return {
-        dbname: api.dbname,
-        anonRole: api.anonRole,
-        roleName: api.roleName,
-        schema: [...schemaNames, ...additionalSchemas],
-        apiModules: api.apiModules?.nodes?.map((node) => ({
-            name: node.name,
-            data: node.data,
-        })) || [],
-        rlsModule: api.rlsModule,
-        domains,
-        databaseId: api.databaseId,
-        isPublic: api.isPublic,
-    };
-};
+const isApiError = (svc) => !!svc && typeof svc.errorHtml === 'string';
 const getPortFromRequest = (req) => {
     const host = req.headers.host;
     if (!host)
@@ -58,6 +30,18 @@ const getPortFromRequest = (req) => {
     const parts = host.split(':');
     return parts.length === 2 ? `:${parts[1]}` : null;
 };
+const parseCommaSeparatedHeader = (value) => value
+    .split(',')
+    .map((item) => item.trim())
+    .filter((item) => item.length > 0);
+const getUrlDomains = (req) => {
+    const fullUrl = `${req.protocol}://${req.get('host')}${req.originalUrl}`;
+    const parsed = (0, url_domains_1.parseUrl)(fullUrl);
+    return {
+        domain: parsed.domain ?? '',
+        subdomains: parsed.subdomains ?? [],
+    };
+};
 const getSubdomain = (reqDomains) => {
     const names = reqDomains.filter((name) => !['www'].includes(name));
     return !names.length ? null : names.join('.');
@@ -66,9 +50,9 @@ exports.getSubdomain = getSubdomain;
 const createApiMiddleware = (opts) => {
     return async (req, res, next) => {
         if (opts.api?.enableServicesApi === false) {
-            const schemas = opts.api.exposedSchemas;
-            const anonRole = opts.api.anonRole;
-            const roleName = opts.api.roleName;
+            const schemas = opts.api.exposedSchemas ?? [];
+            const anonRole = opts.api.anonRole ?? '';
+            const roleName = opts.api.roleName ?? '';
             const databaseId = opts.api.defaultDatabaseId;
             const api = {
                 dbname: opts.pg?.database ?? '',
@@ -86,134 +70,103 @@ const createApiMiddleware = (opts) => {
             return next();
         }
         try {
-            const svc = await (0, exports.getApiConfig)(opts, req);
-            if (svc?.errorHtml) {
+            const apiConfig = await (0, exports.getApiConfig)(opts, req);
+            if (isApiError(apiConfig)) {
                 res
                     .status(404)
-                    .send((0, _404_message_1.default)('API not found', svc.errorHtml));
+                    .send((0, _404_message_1.default)('API not found', apiConfig.errorHtml));
                 return;
             }
-            else if (!svc) {
+            else if (!apiConfig) {
                 res
                     .status(404)
                     .send((0, _404_message_1.default)('API service not found for the given domain/subdomain.'));
                 return;
             }
-            const api = transformServiceToApi(svc);
-            req.api = api;
-            req.databaseId = api.databaseId;
+            req.api = apiConfig;
+            req.databaseId = apiConfig.databaseId;
             if (isDev())
-                log.debug(`Resolved API: db=${api.dbname}, schemas=[${api.schema?.join(', ')}]`);
+                log.debug(`Resolved API: db=${apiConfig.dbname}, schemas=[${apiConfig.schema?.join(', ')}]`);
             next();
         }
-        catch (e) {
-            if (e.code === 'NO_VALID_SCHEMAS') {
-                res.status(404).send((0, _404_message_1.default)(e.message));
+        catch (error) {
+            const err = error;
+            if (err.code === 'NO_VALID_SCHEMAS') {
+                res.status(404).send((0, _404_message_1.default)(err.message));
             }
-            else if (e.message.match(/does not exist/)) {
+            else if (err.message?.match(/does not exist/)) {
                 res
                     .status(404)
                     .send((0, _404_message_1.default)("The resource you're looking for does not exist."));
             }
             else {
-                log.error('API middleware error:', e);
+                log.error('API middleware error:', err);
                 res.status(500).send(_50x_1.default);
             }
         }
     };
 };
 exports.createApiMiddleware = createApiMiddleware;
-const getHardCodedSchemata = ({ opts, schemata, databaseId, key, }) => {
-    const svc = {
-        data: {
-            api: {
-                databaseId,
-                isPublic: false,
-                dbname: opts.pg.database,
-                anonRole: 'administrator',
-                roleName: 'administrator',
-                schemaNamesFromExt: {
-                    nodes: schemata
-                        .split(',')
-                        .map((schema) => schema.trim())
-                        .map((schemaName) => ({ schemaName })),
-                },
-                schemaNames: { nodes: [] },
-                apiModules: [],
-            },
-        },
+const createAdminApiStructure = ({ opts, schemata, key, databaseId, }) => {
+    const api = {
+        dbname: opts.pg?.database ?? '',
+        anonRole: 'administrator',
+        roleName: 'administrator',
+        schema: schemata,
+        apiModules: [],
+        domains: [],
+        databaseId,
+        isPublic: false,
     };
-    server_utils_1.svcCache.set(key, svc);
-    return svc;
+    server_utils_1.svcCache.set(key, api);
+    return api;
 };
-const getMetaSchema = ({ opts, key, databaseId, }) => {
-    const apiOpts = opts.api || {};
-    const schemata = apiOpts.metaSchemas || [];
-    const svc = {
-        data: {
-            api: {
-                databaseId,
-                isPublic: false,
-                dbname: opts.pg.database,
-                anonRole: 'administrator',
-                roleName: 'administrator',
-                schemaNamesFromExt: {
-                    nodes: schemata.map((schemaName) => ({ schemaName })),
-                },
-                schemaNames: { nodes: [] },
-                apiModules: [],
-            },
-        },
+const queryServiceByDomainAndSubdomain = async ({ opts, key, domainModel, domain, subdomain, }) => {
+    const where = {
+        domain: { equalTo: domain },
+        subdomain: subdomain === null || subdomain === undefined
+            ? { isNull: true }
+            : { equalTo: subdomain },
     };
-    server_utils_1.svcCache.set(key, svc);
-    return svc;
-};
-const queryServiceByDomainAndSubdomain = async ({ opts, key, client, domain, subdomain, }) => {
-    const doc = (0, gql_1.buildDomainLookup)({ domain, subdomain });
-    const result = await client.query({
-        role: 'administrator',
-        query: doc.document,
-        variables: doc.variables,
-    });
-    if (result.errors?.length) {
+    const result = await domainModel
+        .findFirst({ select: gql_1.domainSelect, where })
+        .execute();
+    if (!result.ok) {
         log.error('GraphQL query errors:', result.errors);
         return null;
     }
-    const nodes = result?.data?.domains?.nodes;
-    if (nodes?.length) {
-        const data = nodes[0];
-        const apiPublic = opts.api?.isPublic;
-        if (!data.api || data.api.isPublic !== apiPublic)
-            return null;
-        const svc = { data };
-        server_utils_1.svcCache.set(key, svc);
-        return svc;
-    }
-    return null;
+    const domainRecord = result.data.domains.nodes[0];
+    const api = domainRecord?.api;
+    const apiPublic = opts.api?.isPublic;
+    if (!api || api.isPublic !== apiPublic)
+        return null;
+    const apiStructure = (0, gql_1.normalizeApiRecord)(api);
+    server_utils_1.svcCache.set(key, apiStructure);
+    return apiStructure;
 };
-const queryServiceByApiName = async ({ opts, key, client, databaseId, name, }) => {
-    const doc = (0, gql_1.buildApiByDatabaseIdAndName)({ databaseId, name });
-    const result = await client.query({
-        role: 'administrator',
-        query: doc.document,
-        variables: doc.variables,
-    });
-    if (result.errors?.length) {
+const queryServiceByApiName = async ({ opts, key, queryOps, databaseId, name, }) => {
+    if (!databaseId)
+        return null;
+    const result = await queryOps
+        .apiByDatabaseIdAndName({ databaseId, name }, { select: gql_1.apiSelect })
+        .execute();
+    if (!result.ok) {
         log.error('GraphQL query errors:', result.errors);
         return null;
     }
-    const data = result?.data;
+    const api = result.data.apiByDatabaseIdAndName;
     const apiPublic = opts.api?.isPublic;
-    if (data?.api && data.api.isPublic === apiPublic) {
-        const svc = { data };
-        server_utils_1.svcCache.set(key, svc);
-        return svc;
+    if (api && api.isPublic === apiPublic) {
+        const apiStructure = (0, gql_1.normalizeApiRecord)(api);
+        server_utils_1.svcCache.set(key, apiStructure);
+        return apiStructure;
     }
     return null;
 };
+exports.queryServiceByApiName = queryServiceByApiName;
 const getSvcKey = (opts, req) => {
-    const domain = req.urlDomains.domain;
-    const key = req.urlDomains.subdomains
+    const { domain, subdomains } = getUrlDomains(req);
+    const key = subdomains
         .filter((name) => !['www'].includes(name))
         .concat(domain)
         .join('.');
@@ -231,101 +184,125 @@ const getSvcKey = (opts, req) => {
     }
     return key;
 };
+exports.getSvcKey = getSvcKey;
 const validateSchemata = async (pool, schemata) => {
     const result = await pool.query(`SELECT schema_name FROM information_schema.schemata WHERE schema_name = ANY($1::text[])`, [schemata]);
     return result.rows.map((row) => row.schema_name);
 };
 const getApiConfig = async (opts, req) => {
     const rootPgPool = (0, pg_cache_1.getPgPool)(opts.pg);
-    // @ts-ignore
-    const subdomain = (0, exports.getSubdomain)(req.urlDomains.subdomains);
-    const domain = req.urlDomains.domain;
-    const key = getSvcKey(opts, req);
+    const { domain, subdomains } = getUrlDomains(req);
+    const subdomain = (0, exports.getSubdomain)(subdomains);
+    const key = (0, exports.getSvcKey)(opts, req);
     req.svc_key = key;
-    let svc;
+    let apiConfig;
     if (server_utils_1.svcCache.has(key)) {
         if (isDev())
             log.debug(`Cache HIT for key=${key}`);
-        svc = server_utils_1.svcCache.get(key);
+        apiConfig = server_utils_1.svcCache.get(key);
     }
     else {
         if (isDev())
             log.debug(`Cache MISS for key=${key}, looking up API`);
         const apiOpts = opts.api || {};
-        const allSchemata = apiOpts.metaSchemas || [];
-        const validatedSchemata = await validateSchemata(rootPgPool, allSchemata);
+        const apiPublic = apiOpts.isPublic;
+        const schemataHeader = req.get('X-Schemata');
+        const apiNameHeader = req.get('X-Api-Name');
+        const metaSchemaHeader = req.get('X-Meta-Schema');
+        const databaseIdHeader = req.get('X-Database-Id');
+        const headerSchemata = schemataHeader
+            ? parseCommaSeparatedHeader(schemataHeader)
+            : [];
+        const candidateSchemata = apiPublic === false && headerSchemata.length
+            ? Array.from(new Set([...(apiOpts.metaSchemas || []), ...headerSchemata]))
+            : apiOpts.metaSchemas || [];
+        const validatedSchemata = await validateSchemata(rootPgPool, candidateSchemata);
         if (validatedSchemata.length === 0) {
-            const apiOpts2 = opts.api || {};
-            const message = `No valid schemas found. Configured metaSchemas: [${(apiOpts2.metaSchemas || []).join(', ')}]`;
+            const schemaSource = headerSchemata.length
+                ? headerSchemata
+                : apiOpts.metaSchemas || [];
+            const label = headerSchemata.length ? 'X-Schemata' : 'metaSchemas';
+            const message = `No valid schemas found. Configured ${label}: [${schemaSource.join(', ')}]`;
             if (isDev())
                 log.debug(message);
             const error = new Error(message);
             error.code = 'NO_VALID_SCHEMAS';
             throw error;
         }
+        const validSchemaSet = new Set(validatedSchemata);
+        const validatedHeaderSchemata = headerSchemata.filter((schemaName) => validSchemaSet.has(schemaName));
         const settings = (0, graphile_settings_1.getGraphileSettings)({
             graphile: {
                 schema: validatedSchemata,
             },
         });
-        // @ts-ignore
-        const schema = await (0, graphile_query_1.getSchema)(rootPgPool, settings);
-        // @ts-ignore
-        const client = new graphile_query_1.GraphileQuery({ schema, pool: rootPgPool, settings });
-        const apiPublic = opts.api?.isPublic;
+        const graphileSettings = {
+            ...settings,
+            schema: validatedSchemata,
+        };
+        const schema = await (0, graphile_query_1.getSchema)(rootPgPool, graphileSettings);
+        const graphileClient = new graphile_query_1.GraphileQuery({
+            schema,
+            pool: rootPgPool,
+            settings: graphileSettings,
+        });
+        const orm = (0, gql_1.createGraphileOrm)(graphileClient);
         if (apiPublic === false) {
-            if (req.get('X-Schemata')) {
-                svc = getHardCodedSchemata({
+            if (schemataHeader) {
+                if (validatedHeaderSchemata.length === 0) {
+                    return {
+                        errorHtml: 'No valid schemas found for the supplied X-Schemata header.',
+                    };
+                }
+                apiConfig = createAdminApiStructure({
                     opts,
+                    schemata: validatedHeaderSchemata,
                     key,
-                    schemata: req.get('X-Schemata'),
-                    databaseId: req.get('X-Database-Id'),
+                    databaseId: databaseIdHeader,
                 });
             }
-            else if (req.get('X-Api-Name')) {
-                svc = await queryServiceByApiName({
+            else if (apiNameHeader) {
+                apiConfig = await (0, exports.queryServiceByApiName)({
                     opts,
                     key,
-                    client,
-                    name: req.get('X-Api-Name'),
-                    databaseId: req.get('X-Database-Id'),
+                    queryOps: orm.query,
+                    name: apiNameHeader,
+                    databaseId: databaseIdHeader,
                 });
             }
-            else if (req.get('X-Meta-Schema')) {
-                svc = getMetaSchema({
+            else if (metaSchemaHeader) {
+                apiConfig = createAdminApiStructure({
                     opts,
+                    schemata: validatedSchemata,
                     key,
-                    databaseId: req.get('X-Database-Id'),
+                    databaseId: databaseIdHeader,
                 });
             }
             else {
-                svc = await queryServiceByDomainAndSubdomain({
+                apiConfig = await queryServiceByDomainAndSubdomain({
                     opts,
                     key,
-                    client,
+                    domainModel: orm.domain,
                     domain,
                     subdomain,
                 });
             }
         }
         else {
-            svc = await queryServiceByDomainAndSubdomain({
+            apiConfig = await queryServiceByDomainAndSubdomain({
                 opts,
                 key,
-                client,
+                domainModel: orm.domain,
                 domain,
                 subdomain,
             });
-            if (!svc) {
+            if (!apiConfig) {
+                // IMPORTANT NOTE: ONLY DO THIS IN DEV MODE
                 if ((0, graphql_env_1.getNodeEnv)() === 'development') {
-                    // TODO ONLY DO THIS IN DEV MODE
-                    const fallbackResult = await client.query({
-                        role: 'administrator',
-                        // @ts-ignore
-                        query: (0, gql_1.buildListApis)().document,
-                    });
-                    if (!fallbackResult.errors?.length &&
-                        fallbackResult.data?.apis?.nodes?.length) {
+                    const fallbackResult = await orm.api
+                        .findMany({ select: gql_1.apiListSelect, first: gql_1.connectionFirst })
+                        .execute();
+                    if (fallbackResult.ok && fallbackResult.data.apis.nodes.length) {
                         const port = getPortFromRequest(req);
                         const allDomains = fallbackResult.data.apis.nodes.flatMap((api) => api.domains.nodes.map((d) => ({
                             domain: d.domain,
@@ -337,7 +314,7 @@ const getApiConfig = async (opts, req) => {
                         const linksHtml = allDomains.length
                             ? `<ul class="mt-4 pl-5 list-disc space-y-1">` +
                                 allDomains
-                                    .map((d) => `<li><a href="${d.href}" class="text-brand hover:underline">${d.href}</a></li>`)
+                                    .map((domainLink) => `<li><a href="${domainLink.href}" class="text-brand hover:underline">${domainLink.href}</a></li>`)
                                     .join('') +
                                 `</ul>`
                             : `<p class="text-gray-600">No APIs are currently registered for this database.</p>`;
@@ -347,14 +324,12 @@ const getApiConfig = async (opts, req) => {
             ${linksHtml}
           </div>
         `.trim();
-                        return {
-                            errorHtml,
-                        };
+                        return { errorHtml };
                     }
                 }
             }
         }
     }
-    return svc;
+    return apiConfig;
 };
 exports.getApiConfig = getApiConfig;

package/middleware/gql.d.ts

@@ -1,26 +1,176 @@
-type BuiltDocument = {
-    document: string;
-    variables: Record<string, unknown>;
+import { GraphileQuery } from 'graphile-query';
+import { type ApiSelect, type ApiWithRelations, type DomainFilter, type DomainWithRelations } from '../codegen/orm/input-types';
+import { type QueryResult } from '../codegen/orm/client';
+import { ApiModel, DomainModel } from '../codegen/orm/models';
+import type { InferSelectResult } from '../codegen/orm/select-types';
+import { ApiStructure } from '../types';
+export declare const connectionFirst = 1000;
+export declare const apiSelect: {
+    databaseId: true;
+    dbname: true;
+    roleName: true;
+    anonRole: true;
+    isPublic: true;
+    domains: {
+        select: {
+            subdomain: true;
+            domain: true;
+        };
+        first: number;
+    };
+    apiExtensions: {
+        select: {
+            schemaName: true;
+        };
+        first: number;
+    };
+    schemasByApiSchemaApiIdAndSchemaId: {
+        select: {
+            schemaName: true;
+        };
+        first: number;
+    };
+    rlsModule: {
+        select: {
+            privateSchema: {
+                select: {
+                    schemaName: true;
+                };
+            };
+            authenticateStrict: true;
+            authenticate: true;
+            currentRole: true;
+            currentRoleId: true;
+        };
+    };
+    apiModules: {
+        select: {
+            name: true;
+            data: true;
+        };
+        first: number;
+    };
 };
-/**
- * Build query for domain lookup with optional subdomain
- * This uses domains connection instead of domainBySubdomainAndDomain
- * because we need to handle null subdomain with condition filter
- */
-export declare const buildDomainLookup: (vars: {
-    domain: string;
-    subdomain?: string | null;
-}) => BuiltDocument;
-/**
- * Build query for API lookup by database ID and name
- * Uses the generated apiByDatabaseIdAndName custom query
- */
-export declare const buildApiByDatabaseIdAndName: (vars: {
-    databaseId: string;
-    name: string;
-}) => BuiltDocument;
-/**
- * Build query to list all APIs
- */
-export declare const buildListApis: () => BuiltDocument;
+export declare const domainSelect: {
+    domain: true;
+    subdomain: true;
+    api: {
+        select: {
+            databaseId: true;
+            dbname: true;
+            roleName: true;
+            anonRole: true;
+            isPublic: true;
+            domains: {
+                select: {
+                    subdomain: true;
+                    domain: true;
+                };
+                first: number;
+            };
+            apiExtensions: {
+                select: {
+                    schemaName: true;
+                };
+                first: number;
+            };
+            schemasByApiSchemaApiIdAndSchemaId: {
+                select: {
+                    schemaName: true;
+                };
+                first: number;
+            };
+            rlsModule: {
+                select: {
+                    privateSchema: {
+                        select: {
+                            schemaName: true;
+                        };
+                    };
+                    authenticateStrict: true;
+                    authenticate: true;
+                    currentRole: true;
+                    currentRoleId: true;
+                };
+            };
+            apiModules: {
+                select: {
+                    name: true;
+                    data: true;
+                };
+                first: number;
+            };
+        };
+    };
+};
+export declare const apiListSelect: {
+    id: true;
+    databaseId: true;
+    name: true;
+    dbname: true;
+    roleName: true;
+    anonRole: true;
+    isPublic: true;
+    domains: {
+        select: {
+            domain: true;
+            subdomain: true;
+        };
+        first: number;
+    };
+};
+export type ApiRecord = InferSelectResult<ApiWithRelations, typeof apiSelect>;
+export type DomainRecord = InferSelectResult<DomainWithRelations, typeof domainSelect>;
+export type ApiListRecord = InferSelectResult<ApiWithRelations, typeof apiListSelect>;
+type ApiByNameResult = QueryResult<{
+    apiByDatabaseIdAndName: ApiRecord;
+}>;
+export type ApiQueryOps = {
+    apiByDatabaseIdAndName: (args: {
+        databaseId: string;
+        name: string;
+    }, options: {
+        select: typeof apiSelect;
+    }) => {
+        execute: () => Promise<ApiByNameResult>;
+    };
+};
+type DomainLookupResult = QueryResult<{
+    domains: {
+        nodes: DomainRecord[];
+    };
+}>;
+export type DomainLookupModel = {
+    findFirst: (args: {
+        select: typeof domainSelect;
+        where: DomainFilter;
+    }) => {
+        execute: () => Promise<DomainLookupResult>;
+    };
+};
+type ApiListResult = QueryResult<{
+    apis: {
+        nodes: ApiListRecord[];
+    };
+}>;
+export type ApiListModel = {
+    findMany: (args: {
+        select: typeof apiListSelect;
+        first: number;
+    }) => {
+        execute: () => Promise<ApiListResult>;
+    };
+};
+export declare const createGraphileOrm: (graphile: GraphileQuery) => {
+    api: ApiModel;
+    domain: DomainModel;
+    query: {
+        apiByDatabaseIdAndName: <const S extends ApiSelect>(args: import("../codegen/orm/query").ApiByDatabaseIdAndNameVariables, options?: {
+            select?: import("../codegen/orm/select-types").DeepExact<S, ApiSelect>;
+        }) => import("../codegen/orm").QueryBuilder<{
+            apiByDatabaseIdAndName: InferSelectResult<import("../codegen/orm/input-types").Api, S>;
+        }>;
+    };
+};
+export declare const normalizeApiRecord: (api: ApiRecord) => ApiStructure;
 export {};