@constructive-io/graphql-server 4.29.1 → 4.30.0

package/esm/middleware/api.js

@@ -120,6 +120,7 @@ const AUTH_SETTINGS_SQL = (schemaName, tableName) => `
     cookie_httponly,
     cookie_max_age,
     cookie_path,
+    remember_me_duration,
     enable_captcha,
     captcha_site_key
   FROM "${schemaName}"."${tableName}"
@@ -198,6 +199,7 @@ const DATABASE_SETTINGS_SQL = `
     ds.enable_connection_filter,
     ds.enable_ltree,
     ds.enable_llm,
+    ds.enable_bulk,
     COALESCE(aps.enable_aggregates, ds.enable_aggregates) AS resolved_enable_aggregates,
     COALESCE(aps.enable_postgis, ds.enable_postgis) AS resolved_enable_postgis,
     COALESCE(aps.enable_search, ds.enable_search) AS resolved_enable_search,
@@ -207,7 +209,8 @@ const DATABASE_SETTINGS_SQL = `
     COALESCE(aps.enable_connection_filter, ds.enable_connection_filter) AS resolved_enable_connection_filter,
     COALESCE(aps.enable_ltree, ds.enable_ltree) AS resolved_enable_ltree,
     COALESCE(aps.enable_llm, ds.enable_llm) AS resolved_enable_llm,
-    COALESCE(aps.enable_realtime, ds.enable_realtime) AS resolved_enable_realtime
+    COALESCE(aps.enable_realtime, ds.enable_realtime) AS resolved_enable_realtime,
+    COALESCE(aps.enable_bulk, ds.enable_bulk) AS resolved_enable_bulk
   FROM services_public.database_settings ds
   LEFT JOIN services_public.api_settings aps ON ds.database_id = aps.database_id AND aps.api_id = $2
   WHERE ds.database_id = $1
@@ -298,6 +301,7 @@ const toAuthSettings = (row) => {
         cookieHttponly: row.cookie_httponly,
         cookieMaxAge: row.cookie_max_age,
         cookiePath: row.cookie_path,
+        rememberMeDuration: row.remember_me_duration,
         enableCaptcha: row.enable_captcha,
         captchaSiteKey: row.captcha_site_key,
     };
@@ -487,6 +491,7 @@ const toDatabaseSettings = (row) => {
         enableLtree: row.resolved_enable_ltree,
         enableLlm: row.resolved_enable_llm,
         enableRealtime: row.resolved_enable_realtime,
+        enableBulk: row.resolved_enable_bulk,
     };
 };
 const queryDatabaseSettings = async (pool, databaseId, apiId) => {

package/esm/middleware/auth.js

@@ -7,6 +7,8 @@ const log = new Logger('auth');
 const isDev = () => getNodeEnv() === 'development';
 /** Default cookie name for session tokens. */
 const SESSION_COOKIE_NAME = 'constructive_session';
+/** Cookie name for trusted device tracking. */
+const DEVICE_TOKEN_COOKIE_NAME = 'constructive_device_token';
 /**
  * Extract a named cookie value from the raw Cookie header.
  * Avoids pulling in cookie-parser as a dependency.
@@ -110,6 +112,12 @@ export const createAuthenticateMiddleware = (opts) => {
             log.info(`[auth] Skipping auth: authFn=${authFn ?? 'none'}, ` +
                 `privateSchema=${rlsModule.privateSchema?.schemaName ?? 'none'}`);
         }
+        // Read device token cookie for trusted device tracking
+        const deviceToken = parseCookieToken(req, DEVICE_TOKEN_COOKIE_NAME);
+        if (deviceToken) {
+            req.deviceToken = deviceToken;
+            log.info('[auth] Device token cookie present');
+        }
         next();
     };
 };

package/esm/middleware/cookie.js

@@ -0,0 +1,114 @@
+export const SESSION_COOKIE_NAME = 'constructive_session';
+export const DEVICE_TOKEN_COOKIE_NAME = 'constructive_device_token';
+const DEVICE_TOKEN_MAX_AGE = 90 * 24 * 60 * 60; // 90 days in seconds
+/**
+ * Build cookie config from AuthSettings with optional remember_me override.
+ */
+export const getSessionCookieConfig = (authSettings, rememberMe = false) => {
+    const DEFAULT_MAX_AGE = 86400; // 24 hours
+    let maxAge = DEFAULT_MAX_AGE;
+    if (rememberMe && authSettings?.rememberMeDuration) {
+        const parsed = parseInt(authSettings.rememberMeDuration, 10);
+        if (!isNaN(parsed))
+            maxAge = parsed;
+    }
+    else if (authSettings?.cookieMaxAge) {
+        const parsed = parseInt(authSettings.cookieMaxAge, 10);
+        if (!isNaN(parsed))
+            maxAge = parsed;
+    }
+    return {
+        secure: authSettings?.cookieSecure ?? process.env.NODE_ENV === 'production',
+        sameSite: authSettings?.cookieSamesite ?? 'lax',
+        domain: authSettings?.cookieDomain ?? undefined,
+        httpOnly: authSettings?.cookieHttponly ?? true,
+        maxAge,
+        path: authSettings?.cookiePath ?? '/',
+    };
+};
+/**
+ * Build cookie config for device token (long-lived, 90 days).
+ */
+export const getDeviceTokenCookieConfig = (authSettings) => {
+    return {
+        secure: authSettings?.cookieSecure ?? process.env.NODE_ENV === 'production',
+        sameSite: authSettings?.cookieSamesite ?? 'lax',
+        domain: authSettings?.cookieDomain ?? undefined,
+        httpOnly: true,
+        maxAge: DEVICE_TOKEN_MAX_AGE,
+        path: authSettings?.cookiePath ?? '/',
+    };
+};
+/**
+ * Set the session cookie with the access token.
+ */
+export const setSessionCookie = (res, accessToken, config) => {
+    res.cookie(SESSION_COOKIE_NAME, accessToken, {
+        secure: config.secure,
+        sameSite: config.sameSite,
+        domain: config.domain,
+        httpOnly: config.httpOnly,
+        maxAge: config.maxAge * 1000, // Express expects milliseconds
+        path: config.path,
+    });
+};
+/**
+ * Clear the session cookie.
+ */
+export const clearSessionCookie = (res, config) => {
+    res.clearCookie(SESSION_COOKIE_NAME, {
+        secure: config.secure,
+        sameSite: config.sameSite,
+        domain: config.domain,
+        httpOnly: config.httpOnly,
+        path: config.path,
+    });
+};
+/**
+ * Set the device token cookie (long-lived for trusted device tracking).
+ */
+export const setDeviceTokenCookie = (res, deviceToken, config) => {
+    res.cookie(DEVICE_TOKEN_COOKIE_NAME, deviceToken, {
+        secure: config.secure,
+        sameSite: config.sameSite,
+        domain: config.domain,
+        httpOnly: config.httpOnly,
+        maxAge: config.maxAge * 1000,
+        path: config.path,
+    });
+};
+/**
+ * Clear the device token cookie.
+ */
+export const clearDeviceTokenCookie = (res, config) => {
+    res.clearCookie(DEVICE_TOKEN_COOKIE_NAME, {
+        secure: config.secure,
+        sameSite: config.sameSite,
+        domain: config.domain,
+        httpOnly: config.httpOnly,
+        path: config.path,
+    });
+};
+/**
+ * Parse a cookie value from the raw Cookie header.
+ * Avoids pulling in cookie-parser as a dependency.
+ */
+export const parseCookieValue = (req, cookieName) => {
+    const header = req.headers.cookie;
+    if (!header)
+        return undefined;
+    const match = header.split(';').find((c) => c.trim().startsWith(`${cookieName}=`));
+    return match ? decodeURIComponent(match.split('=')[1].trim()) : undefined;
+};
+/**
+ * Get the device token from the request cookie.
+ */
+export const getDeviceTokenFromRequest = (req) => {
+    return parseCookieValue(req, DEVICE_TOKEN_COOKIE_NAME);
+};
+/**
+ * Get the session token from the request cookie.
+ */
+export const getSessionTokenFromRequest = (req) => {
+    return parseCookieValue(req, SESSION_COOKIE_NAME);
+};

package/esm/middleware/error-handler.js

@@ -23,6 +23,10 @@ const sanitizeMessage = (error) => {
         return 'The requested resource does not exist';
     return 'An unexpected error occurred';
 };
+const isCsrfError = (err) => {
+    const code = err.code;
+    return typeof code === 'string' && code.startsWith('CSRF_');
+};
 const categorizeError = (err) => {
     if (isApiError(err)) {
         return {
@@ -32,6 +36,10 @@ const categorizeError = (err) => {
             logLevel: err.statusCode >= 500 ? 'error' : 'warn',
         };
     }
+    if (isCsrfError(err)) {
+        const code = err.code;
+        return { statusCode: 403, code, message: err.message, logLevel: 'warn' };
+    }
     if (err.message?.includes('ECONNREFUSED') || err.message?.includes('connection terminated')) {
         return { statusCode: 503, code: 'SERVICE_UNAVAILABLE', message: sanitizeMessage(err), logLevel: 'error' };
     }

package/esm/middleware/graphile.js

@@ -9,6 +9,7 @@ import './types'; // for Request type
 import { isGraphqlObservabilityEnabled } from '../diagnostics/observability';
 import { HandlerCreationError } from '../errors/api-errors';
 import { observeGraphileBuild } from './observability/graphile-build-stats';
+import { AuthCookiePlugin } from '../plugins/auth-cookie-plugin';
 const maskErrorLog = new Logger('graphile:maskError');
 const SAFE_ERROR_CODES = new Set([
     // GraphQL standard
@@ -186,6 +187,7 @@ const reqLabel = (req) => (req.requestId ? `[${req.requestId}]` : '[req]');
 const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings) => {
     return {
         extends: [createConstructivePreset(databaseSettings)],
+        plugins: [AuthCookiePlugin],
         pgServices: [
             makePgService({
                 pool,
@@ -218,6 +220,9 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings) => {
                     if (req.get('User-Agent')) {
                         context['jwt.claims.user_agent'] = req.get('User-Agent');
                     }
+                    if (req.deviceToken) {
+                        context['jwt.claims.device_token'] = req.deviceToken;
+                    }
                     if (req.token?.user_id) {
                         const pgSettings = {
                             role: roleName,

package/esm/plugins/auth-cookie-plugin.js

@@ -0,0 +1,286 @@
+import { Logger } from '@pgpmjs/logger';
+import '../middleware/types';
+import { SESSION_COOKIE_NAME, DEVICE_TOKEN_COOKIE_NAME, getSessionCookieConfig, getDeviceTokenCookieConfig, } from '../middleware/cookie';
+const log = new Logger('auth-cookie');
+/**
+ * Serialize a cookie to a Set-Cookie header value.
+ */
+const serializeCookie = (name, value, config) => {
+    const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
+    if (config.maxAge !== undefined) {
+        parts.push(`Max-Age=${config.maxAge}`);
+    }
+    if (config.domain) {
+        parts.push(`Domain=${config.domain}`);
+    }
+    if (config.path) {
+        parts.push(`Path=${config.path}`);
+    }
+    if (config.secure) {
+        parts.push('Secure');
+    }
+    if (config.httpOnly) {
+        parts.push('HttpOnly');
+    }
+    if (config.sameSite) {
+        parts.push(`SameSite=${config.sameSite.charAt(0).toUpperCase() + config.sameSite.slice(1)}`);
+    }
+    return parts.join('; ');
+};
+/**
+ * Serialize a cookie for clearing (expired).
+ */
+const serializeClearCookie = (name, config) => {
+    const parts = [`${encodeURIComponent(name)}=`];
+    parts.push('Max-Age=0');
+    if (config.domain) {
+        parts.push(`Domain=${config.domain}`);
+    }
+    if (config.path) {
+        parts.push(`Path=${config.path}`);
+    }
+    if (config.secure) {
+        parts.push('Secure');
+    }
+    if (config.httpOnly) {
+        parts.push('HttpOnly');
+    }
+    if (config.sameSite) {
+        parts.push(`SameSite=${config.sameSite.charAt(0).toUpperCase() + config.sameSite.slice(1)}`);
+    }
+    return parts.join('; ');
+};
+/**
+ * Auth mutations that should set session cookie on success.
+ */
+const SIGN_IN_MUTATIONS = new Set([
+    'signIn',
+    'signUp',
+    'signInSso',
+    'signUpSso',
+    'signInMagicLink',
+    'signUpMagicLink',
+    'signInEmailOtp',
+    'signInSmsOtp',
+    'signUpSms',
+    'completeMfaChallenge',
+    'signInOneTimeToken',
+    'signInCrossOrigin',
+]);
+/**
+ * Auth mutations that should clear the session cookie.
+ */
+const SIGN_OUT_MUTATIONS = new Set([
+    'signOut',
+    'revokeSession',
+    'revokeAllSessions',
+]);
+/**
+ * Extract mutation names from a GraphQL query string.
+ */
+const extractMutationNames = (query) => {
+    const mutations = [];
+    if (!/^\s*mutation\b/i.test(query)) {
+        return mutations;
+    }
+    const bodyStart = query.indexOf('{');
+    if (bodyStart === -1)
+        return mutations;
+    const bodyContent = query.slice(bodyStart + 1);
+    const fieldPattern = /(\w+)\s*(?:\(|{)/g;
+    let match;
+    while ((match = fieldPattern.exec(bodyContent)) !== null) {
+        const name = match[1];
+        if (name !== 'mutation' && name !== 'query' && name !== 'fragment') {
+            mutations.push(name);
+        }
+    }
+    return mutations;
+};
+/**
+ * Extract access token from mutation response.
+ */
+const extractAccessToken = (data, mutationName) => {
+    const result = data[mutationName];
+    if (!result)
+        return undefined;
+    // Check for non-empty string tokens
+    if (typeof result.accessToken === 'string' && result.accessToken)
+        return result.accessToken;
+    if (typeof result.access_token === 'string' && result.access_token)
+        return result.access_token;
+    const nested = result.result;
+    if (nested) {
+        if (typeof nested.accessToken === 'string' && nested.accessToken)
+            return nested.accessToken;
+        if (typeof nested.access_token === 'string' && nested.access_token)
+            return nested.access_token;
+    }
+    return undefined;
+};
+/**
+ * Extract device ID from mutation response.
+ */
+const extractDeviceId = (data, mutationName) => {
+    const result = data[mutationName];
+    if (!result)
+        return undefined;
+    if (typeof result.deviceId === 'string')
+        return result.deviceId;
+    if (typeof result.device_id === 'string')
+        return result.device_id;
+    const nested = result.result;
+    if (nested) {
+        if (typeof nested.deviceId === 'string')
+            return nested.deviceId;
+        if (typeof nested.device_id === 'string')
+            return nested.device_id;
+    }
+    return undefined;
+};
+/**
+ * Check if request includes remember_me flag.
+ */
+const hasRememberMe = (variables) => {
+    if (!variables)
+        return false;
+    return variables.rememberMe === true || variables.remember_me === true;
+};
+/**
+ * Get Express request from grafserv request context.
+ */
+const getExpressRequest = (requestContext) => {
+    return requestContext?.expressv4?.req;
+};
+/**
+ * AuthCookiePlugin - grafserv middleware plugin that handles auth cookie lifecycle.
+ *
+ * This plugin intercepts GraphQL responses and:
+ * - Sets session cookies on successful sign-in mutations
+ * - Clears session cookies on sign-out mutations
+ * - Handles device token cookies for trusted device tracking
+ */
+export const AuthCookiePlugin = {
+    name: 'AuthCookiePlugin',
+    version: '1.0.0',
+    grafserv: {
+        middleware: {
+            processRequest: {
+                callback: async (next, event) => {
+                    const result = await next();
+                    // Only process buffer results (JSON responses)
+                    if (!result || result.type !== 'buffer') {
+                        return result;
+                    }
+                    const bufferResult = result;
+                    const req = getExpressRequest(event.requestDigest.requestContext);
+                    // Skip if no Express request or not a POST
+                    if (!req || event.requestDigest.method !== 'POST') {
+                        return result;
+                    }
+                    // Get request body for mutation detection
+                    // grafserv provides getBody() which returns { type: 'buffer', buffer: Buffer }
+                    let body;
+                    if (typeof event.requestDigest.getBody === 'function') {
+                        try {
+                            const rawBody = await event.requestDigest.getBody();
+                            if (rawBody?.type === 'buffer' && rawBody.buffer) {
+                                const jsonStr = rawBody.buffer.toString('utf8');
+                                body = JSON.parse(jsonStr);
+                            }
+                        }
+                        catch (e) {
+                            log.debug('[auth-cookie] Failed to parse body from requestDigest');
+                        }
+                    }
+                    body = body || req.body;
+                    if (!body?.query) {
+                        return result;
+                    }
+                    // Extract mutation names
+                    const mutationNames = extractMutationNames(body.query);
+                    if (mutationNames.length === 0) {
+                        return result;
+                    }
+                    // Check for auth mutations
+                    const signInMutation = mutationNames.find((m) => SIGN_IN_MUTATIONS.has(m));
+                    const signOutMutation = mutationNames.find((m) => SIGN_OUT_MUTATIONS.has(m));
+                    if (!signInMutation && !signOutMutation) {
+                        return result;
+                    }
+                    log.debug(`[auth-cookie] Detected auth mutation: ${signInMutation || signOutMutation}`);
+                    try {
+                        // Parse response body
+                        const payload = bufferResult.buffer.toString('utf8');
+                        const graphqlResponse = JSON.parse(payload);
+                        // Skip if there are GraphQL errors
+                        if (graphqlResponse.errors?.length || !graphqlResponse.data) {
+                            return result;
+                        }
+                        const data = graphqlResponse.data;
+                        const authSettings = req.api?.authSettings;
+                        const cookiesToSet = [];
+                        // Handle sign-out mutations
+                        if (signOutMutation && data[signOutMutation]) {
+                            log.info('[auth-cookie] Sign-out mutation succeeded, clearing session cookie');
+                            const config = getSessionCookieConfig(authSettings);
+                            cookiesToSet.push(serializeClearCookie(SESSION_COOKIE_NAME, config));
+                            // Also clear device token on sign-out
+                            const deviceConfig = getDeviceTokenCookieConfig(authSettings);
+                            cookiesToSet.push(serializeClearCookie(DEVICE_TOKEN_COOKIE_NAME, deviceConfig));
+                        }
+                        // Handle sign-in mutations
+                        if (signInMutation) {
+                            const accessToken = extractAccessToken(data, signInMutation);
+                            if (accessToken) {
+                                const rememberMe = hasRememberMe(body.variables);
+                                const config = getSessionCookieConfig(authSettings, rememberMe);
+                                log.info(`[auth-cookie] Sign-in mutation succeeded, setting session cookie (rememberMe=${rememberMe})`);
+                                cookiesToSet.push(serializeCookie(SESSION_COOKIE_NAME, accessToken, config));
+                                const deviceId = extractDeviceId(data, signInMutation);
+                                if (deviceId) {
+                                    log.info('[auth-cookie] Device ID returned, setting device token cookie');
+                                    const deviceConfig = getDeviceTokenCookieConfig(authSettings);
+                                    cookiesToSet.push(serializeCookie(DEVICE_TOKEN_COOKIE_NAME, deviceId, deviceConfig));
+                                }
+                            }
+                        }
+                        // Set cookies directly on Express response and return modified headers
+                        if (cookiesToSet.length > 0) {
+                            const res = event.requestDigest.requestContext?.expressv4?.res;
+                            if (res?.setHeader) {
+                                // Get existing Set-Cookie headers from Express response
+                                const existingCookies = res.getHeader('Set-Cookie');
+                                const allCookies = [];
+                                if (existingCookies) {
+                                    if (Array.isArray(existingCookies)) {
+                                        allCookies.push(...existingCookies);
+                                    }
+                                    else {
+                                        allCookies.push(existingCookies);
+                                    }
+                                }
+                                allCookies.push(...cookiesToSet);
+                                // Set as array to get multiple Set-Cookie headers
+                                res.setHeader('Set-Cookie', allCookies);
+                            }
+                            // Also update the BufferResult headers for grafserv to pass through
+                            const existingBufferCookie = bufferResult.headers['set-cookie'];
+                            const updatedHeaders = { ...bufferResult.headers };
+                            // Remove set-cookie from grafserv headers since we set it on Express
+                            delete updatedHeaders['set-cookie'];
+                            return {
+                                ...bufferResult,
+                                headers: updatedHeaders,
+                            };
+                        }
+                    }
+                    catch (err) {
+                        log.error('[auth-cookie] Error processing auth response:', err);
+                    }
+                    return result;
+                },
+            },
+        },
+    },
+};

package/esm/server.js

@@ -1,7 +1,9 @@
+import { createCsrfMiddleware } from '@constructive-io/csrf';
 import { getEnvOptions } from '@constructive-io/graphql-env';
 import { Logger } from '@pgpmjs/logger';
 import { healthz, poweredBy, svcCache, trustProxy } from '@pgpmjs/server-utils';
 import { middleware as parseDomains } from '@constructive-io/url-domains';
+import cookieParser from 'cookie-parser';
 import express from 'express';
 import graphqlUpload from 'graphql-upload';
 import { graphileCache, closeAllCaches } from 'graphile-cache';
@@ -21,7 +23,9 @@ import { createDebugDatabaseMiddleware } from './middleware/observability/debug-
 import { debugMemory } from './middleware/observability/debug-memory';
 import { localObservabilityOnly } from './middleware/observability/guard';
 import { createRequestLogger } from './middleware/observability/request-logger';
+// Auth cookie handling is done via AuthCookiePlugin in grafserv
 import { createCaptchaMiddleware } from './middleware/captcha';
+import { parseCookieValue, SESSION_COOKIE_NAME } from './middleware/cookie';
 import { createUploadAuthenticateMiddleware, uploadRoute } from './middleware/upload';
 import { startDebugSampler } from './diagnostics/debug-sampler';
 const log = new Logger('server');
@@ -120,6 +124,7 @@ class Server {
             }
         }
         app.use(poweredBy('constructive'));
+        app.use(cookieParser());
         app.use(cors(fallbackOrigin));
         app.use('/graphql', graphqlUpload.graphqlUploadExpress({
             maxFileSize: 10 * 1024 * 1024, // 10 MB
@@ -134,6 +139,34 @@ class Server {
         app.post('/upload', uploadAuthenticate, ...uploadRoute);
         app.use(authenticate);
         app.use(createCaptchaMiddleware());
+        // CSRF protection for cookie-authenticated requests
+        // Skip CSRF for Bearer token auth (not vulnerable to CSRF) and anonymous requests
+        const csrf = createCsrfMiddleware({
+            cookieOptions: {
+                httpOnly: false, // SPA clients need to read this via document.cookie
+                secure: process.env.NODE_ENV === 'production',
+                sameSite: 'lax',
+            },
+        });
+        const csrfProtect = (req, res, next) => {
+            // Skip CSRF for Bearer token auth
+            const auth = req.headers.authorization;
+            if (auth?.toLowerCase().startsWith('bearer ')) {
+                return next();
+            }
+            // Skip if no session cookie (anonymous requests)
+            const sessionCookie = parseCookieValue(req, SESSION_COOKIE_NAME);
+            if (!sessionCookie) {
+                return next();
+            }
+            // Apply CSRF protection for cookie-authenticated requests
+            csrf.protect(req, res, next);
+        };
+        const csrfSetToken = (req, res, next) => {
+            csrf.setToken(req, res, next);
+        };
+        app.use(csrfSetToken); // Set CSRF token cookie on all requests
+        app.use('/graphql', csrfProtect); // Enforce CSRF on GraphQL mutations
         app.use(graphile(effectiveOpts));
         app.use(flush);
         // Error handling - MUST be LAST

package/middleware/api.js

@@ -126,6 +126,7 @@ const AUTH_SETTINGS_SQL = (schemaName, tableName) => `
     cookie_httponly,
     cookie_max_age,
     cookie_path,
+    remember_me_duration,
     enable_captcha,
     captcha_site_key
   FROM "${schemaName}"."${tableName}"
@@ -204,6 +205,7 @@ const DATABASE_SETTINGS_SQL = `
     ds.enable_connection_filter,
     ds.enable_ltree,
     ds.enable_llm,
+    ds.enable_bulk,
     COALESCE(aps.enable_aggregates, ds.enable_aggregates) AS resolved_enable_aggregates,
     COALESCE(aps.enable_postgis, ds.enable_postgis) AS resolved_enable_postgis,
     COALESCE(aps.enable_search, ds.enable_search) AS resolved_enable_search,
@@ -213,7 +215,8 @@ const DATABASE_SETTINGS_SQL = `
     COALESCE(aps.enable_connection_filter, ds.enable_connection_filter) AS resolved_enable_connection_filter,
     COALESCE(aps.enable_ltree, ds.enable_ltree) AS resolved_enable_ltree,
     COALESCE(aps.enable_llm, ds.enable_llm) AS resolved_enable_llm,
-    COALESCE(aps.enable_realtime, ds.enable_realtime) AS resolved_enable_realtime
+    COALESCE(aps.enable_realtime, ds.enable_realtime) AS resolved_enable_realtime,
+    COALESCE(aps.enable_bulk, ds.enable_bulk) AS resolved_enable_bulk
   FROM services_public.database_settings ds
   LEFT JOIN services_public.api_settings aps ON ds.database_id = aps.database_id AND aps.api_id = $2
   WHERE ds.database_id = $1
@@ -306,6 +309,7 @@ const toAuthSettings = (row) => {
         cookieHttponly: row.cookie_httponly,
         cookieMaxAge: row.cookie_max_age,
         cookiePath: row.cookie_path,
+        rememberMeDuration: row.remember_me_duration,
         enableCaptcha: row.enable_captcha,
         captchaSiteKey: row.captcha_site_key,
     };
@@ -495,6 +499,7 @@ const toDatabaseSettings = (row) => {
         enableLtree: row.resolved_enable_ltree,
         enableLlm: row.resolved_enable_llm,
         enableRealtime: row.resolved_enable_realtime,
+        enableBulk: row.resolved_enable_bulk,
     };
 };
 const queryDatabaseSettings = async (pool, databaseId, apiId) => {

package/middleware/auth.js

@@ -13,6 +13,8 @@ const log = new logger_1.Logger('auth');
 const isDev = () => (0, env_1.getNodeEnv)() === 'development';
 /** Default cookie name for session tokens. */
 const SESSION_COOKIE_NAME = 'constructive_session';
+/** Cookie name for trusted device tracking. */
+const DEVICE_TOKEN_COOKIE_NAME = 'constructive_device_token';
 /**
  * Extract a named cookie value from the raw Cookie header.
  * Avoids pulling in cookie-parser as a dependency.
@@ -116,6 +118,12 @@ const createAuthenticateMiddleware = (opts) => {
             log.info(`[auth] Skipping auth: authFn=${authFn ?? 'none'}, ` +
                 `privateSchema=${rlsModule.privateSchema?.schemaName ?? 'none'}`);
         }
+        // Read device token cookie for trusted device tracking
+        const deviceToken = parseCookieToken(req, DEVICE_TOKEN_COOKIE_NAME);
+        if (deviceToken) {
+            req.deviceToken = deviceToken;
+            log.info('[auth] Device token cookie present');
+        }
         next();
     };
 };

package/middleware/cookie.d.ts

@@ -0,0 +1,49 @@
+import type { Request, Response } from 'express';
+import type { AuthSettings } from '../types';
+export declare const SESSION_COOKIE_NAME = "constructive_session";
+export declare const DEVICE_TOKEN_COOKIE_NAME = "constructive_device_token";
+export interface CookieConfig {
+    secure: boolean;
+    sameSite: 'strict' | 'lax' | 'none';
+    domain?: string;
+    httpOnly: boolean;
+    maxAge: number;
+    path: string;
+}
+/**
+ * Build cookie config from AuthSettings with optional remember_me override.
+ */
+export declare const getSessionCookieConfig: (authSettings?: AuthSettings, rememberMe?: boolean) => CookieConfig;
+/**
+ * Build cookie config for device token (long-lived, 90 days).
+ */
+export declare const getDeviceTokenCookieConfig: (authSettings?: AuthSettings) => CookieConfig;
+/**
+ * Set the session cookie with the access token.
+ */
+export declare const setSessionCookie: (res: Response, accessToken: string, config: CookieConfig) => void;
+/**
+ * Clear the session cookie.
+ */
+export declare const clearSessionCookie: (res: Response, config: CookieConfig) => void;
+/**
+ * Set the device token cookie (long-lived for trusted device tracking).
+ */
+export declare const setDeviceTokenCookie: (res: Response, deviceToken: string, config: CookieConfig) => void;
+/**
+ * Clear the device token cookie.
+ */
+export declare const clearDeviceTokenCookie: (res: Response, config: CookieConfig) => void;
+/**
+ * Parse a cookie value from the raw Cookie header.
+ * Avoids pulling in cookie-parser as a dependency.
+ */
+export declare const parseCookieValue: (req: Request, cookieName: string) => string | undefined;
+/**
+ * Get the device token from the request cookie.
+ */
+export declare const getDeviceTokenFromRequest: (req: Request) => string | undefined;
+/**
+ * Get the session token from the request cookie.
+ */
+export declare const getSessionTokenFromRequest: (req: Request) => string | undefined;

package/middleware/cookie.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSessionTokenFromRequest = exports.getDeviceTokenFromRequest = exports.parseCookieValue = exports.clearDeviceTokenCookie = exports.setDeviceTokenCookie = exports.clearSessionCookie = exports.setSessionCookie = exports.getDeviceTokenCookieConfig = exports.getSessionCookieConfig = exports.DEVICE_TOKEN_COOKIE_NAME = exports.SESSION_COOKIE_NAME = void 0;
+exports.SESSION_COOKIE_NAME = 'constructive_session';
+exports.DEVICE_TOKEN_COOKIE_NAME = 'constructive_device_token';
+const DEVICE_TOKEN_MAX_AGE = 90 * 24 * 60 * 60; // 90 days in seconds
+/**
+ * Build cookie config from AuthSettings with optional remember_me override.
+ */
+const getSessionCookieConfig = (authSettings, rememberMe = false) => {
+    const DEFAULT_MAX_AGE = 86400; // 24 hours
+    let maxAge = DEFAULT_MAX_AGE;
+    if (rememberMe && authSettings?.rememberMeDuration) {
+        const parsed = parseInt(authSettings.rememberMeDuration, 10);
+        if (!isNaN(parsed))
+            maxAge = parsed;
+    }
+    else if (authSettings?.cookieMaxAge) {
+        const parsed = parseInt(authSettings.cookieMaxAge, 10);
+        if (!isNaN(parsed))
+            maxAge = parsed;
+    }
+    return {
+        secure: authSettings?.cookieSecure ?? process.env.NODE_ENV === 'production',
+        sameSite: authSettings?.cookieSamesite ?? 'lax',
+        domain: authSettings?.cookieDomain ?? undefined,
+        httpOnly: authSettings?.cookieHttponly ?? true,
+        maxAge,
+        path: authSettings?.cookiePath ?? '/',
+    };
+};
+exports.getSessionCookieConfig = getSessionCookieConfig;
+/**
+ * Build cookie config for device token (long-lived, 90 days).
+ */
+const getDeviceTokenCookieConfig = (authSettings) => {
+    return {
+        secure: authSettings?.cookieSecure ?? process.env.NODE_ENV === 'production',
+        sameSite: authSettings?.cookieSamesite ?? 'lax',
+        domain: authSettings?.cookieDomain ?? undefined,
+        httpOnly: true,
+        maxAge: DEVICE_TOKEN_MAX_AGE,
+        path: authSettings?.cookiePath ?? '/',
+    };
+};
+exports.getDeviceTokenCookieConfig = getDeviceTokenCookieConfig;
+/**
+ * Set the session cookie with the access token.
+ */
+const setSessionCookie = (res, accessToken, config) => {
+    res.cookie(exports.SESSION_COOKIE_NAME, accessToken, {
+        secure: config.secure,
+        sameSite: config.sameSite,
+        domain: config.domain,
+        httpOnly: config.httpOnly,
+        maxAge: config.maxAge * 1000, // Express expects milliseconds
+        path: config.path,
+    });
+};
+exports.setSessionCookie = setSessionCookie;
+/**
+ * Clear the session cookie.
+ */
+const clearSessionCookie = (res, config) => {
+    res.clearCookie(exports.SESSION_COOKIE_NAME, {
+        secure: config.secure,
+        sameSite: config.sameSite,
+        domain: config.domain,
+        httpOnly: config.httpOnly,
+        path: config.path,
+    });
+};
+exports.clearSessionCookie = clearSessionCookie;
+/**
+ * Set the device token cookie (long-lived for trusted device tracking).
+ */
+const setDeviceTokenCookie = (res, deviceToken, config) => {
+    res.cookie(exports.DEVICE_TOKEN_COOKIE_NAME, deviceToken, {
+        secure: config.secure,
+        sameSite: config.sameSite,
+        domain: config.domain,
+        httpOnly: config.httpOnly,
+        maxAge: config.maxAge * 1000,
+        path: config.path,
+    });
+};
+exports.setDeviceTokenCookie = setDeviceTokenCookie;
+/**
+ * Clear the device token cookie.
+ */
+const clearDeviceTokenCookie = (res, config) => {
+    res.clearCookie(exports.DEVICE_TOKEN_COOKIE_NAME, {
+        secure: config.secure,
+        sameSite: config.sameSite,
+        domain: config.domain,
+        httpOnly: config.httpOnly,
+        path: config.path,
+    });
+};
+exports.clearDeviceTokenCookie = clearDeviceTokenCookie;
+/**
+ * Parse a cookie value from the raw Cookie header.
+ * Avoids pulling in cookie-parser as a dependency.
+ */
+const parseCookieValue = (req, cookieName) => {
+    const header = req.headers.cookie;
+    if (!header)
+        return undefined;
+    const match = header.split(';').find((c) => c.trim().startsWith(`${cookieName}=`));
+    return match ? decodeURIComponent(match.split('=')[1].trim()) : undefined;
+};
+exports.parseCookieValue = parseCookieValue;
+/**
+ * Get the device token from the request cookie.
+ */
+const getDeviceTokenFromRequest = (req) => {
+    return (0, exports.parseCookieValue)(req, exports.DEVICE_TOKEN_COOKIE_NAME);
+};
+exports.getDeviceTokenFromRequest = getDeviceTokenFromRequest;
+/**
+ * Get the session token from the request cookie.
+ */
+const getSessionTokenFromRequest = (req) => {
+    return (0, exports.parseCookieValue)(req, exports.SESSION_COOKIE_NAME);
+};
+exports.getSessionTokenFromRequest = getSessionTokenFromRequest;

package/middleware/error-handler.js

@@ -29,6 +29,10 @@ const sanitizeMessage = (error) => {
         return 'The requested resource does not exist';
     return 'An unexpected error occurred';
 };
+const isCsrfError = (err) => {
+    const code = err.code;
+    return typeof code === 'string' && code.startsWith('CSRF_');
+};
 const categorizeError = (err) => {
     if ((0, api_errors_1.isApiError)(err)) {
         return {
@@ -38,6 +42,10 @@ const categorizeError = (err) => {
             logLevel: err.statusCode >= 500 ? 'error' : 'warn',
         };
     }
+    if (isCsrfError(err)) {
+        const code = err.code;
+        return { statusCode: 403, code, message: err.message, logLevel: 'warn' };
+    }
     if (err.message?.includes('ECONNREFUSED') || err.message?.includes('connection terminated')) {
         return { statusCode: 503, code: 'SERVICE_UNAVAILABLE', message: sanitizeMessage(err), logLevel: 'error' };
     }

package/middleware/graphile.js

@@ -18,6 +18,7 @@ require("./types"); // for Request type
 const observability_1 = require("../diagnostics/observability");
 const api_errors_1 = require("../errors/api-errors");
 const graphile_build_stats_1 = require("./observability/graphile-build-stats");
+const auth_cookie_plugin_1 = require("../plugins/auth-cookie-plugin");
 const maskErrorLog = new logger_1.Logger('graphile:maskError');
 const SAFE_ERROR_CODES = new Set([
     // GraphQL standard
@@ -195,6 +196,7 @@ const reqLabel = (req) => (req.requestId ? `[${req.requestId}]` : '[req]');
 const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings) => {
     return {
         extends: [(0, graphile_settings_1.createConstructivePreset)(databaseSettings)],
+        plugins: [auth_cookie_plugin_1.AuthCookiePlugin],
         pgServices: [
             (0, graphile_settings_1.makePgService)({
                 pool,
@@ -227,6 +229,9 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings) => {
                     if (req.get('User-Agent')) {
                         context['jwt.claims.user_agent'] = req.get('User-Agent');
                     }
+                    if (req.deviceToken) {
+                        context['jwt.claims.device_token'] = req.deviceToken;
+                    }
                     if (req.token?.user_id) {
                         const pgSettings = {
                             role: roleName,

package/middleware/types.d.ts

@@ -16,6 +16,8 @@ declare global {
             databaseId?: string;
             requestId?: string;
             token?: ConstructiveAPIToken;
+            /** Device token from constructive_device_token cookie for trusted device tracking */
+            deviceToken?: string;
         }
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "4.29.1",
+  "version": "4.30.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -41,6 +41,7 @@
     "backend"
   ],
   "dependencies": {
+    "@constructive-io/csrf": "^0.13.1",
     "@constructive-io/graphql-env": "^3.10.1",
     "@constructive-io/graphql-types": "^3.9.1",
     "@constructive-io/s3-utils": "^2.16.1",
@@ -63,7 +64,7 @@
     "graphile-build-pg": "5.0.0",
     "graphile-cache": "^3.10.1",
     "graphile-config": "1.0.0",
-    "graphile-settings": "^4.33.1",
+    "graphile-settings": "^5.0.0",
     "graphile-utils": "5.0.0",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
@@ -79,16 +80,18 @@
   },
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.1009.0",
+    "@types/cookie-parser": "^1.4.10",
     "@types/cors": "^2.8.17",
     "@types/express": "^5.0.6",
     "@types/graphql-upload": "^8.0.12",
     "@types/multer": "^2.1.0",
     "@types/pg": "^8.18.0",
     "@types/request-ip": "^0.0.41",
-    "graphile-test": "4.14.1",
+    "cookie-parser": "^1.4.7",
+    "graphile-test": "4.14.2",
     "makage": "^0.3.0",
     "nodemon": "^3.1.14",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "d43f1d7e38cc39a71b4f8d2cafb39f46df12e31a"
+  "gitHead": "28b0b236e65b2a2228acad4fd840543c04b24825"
 }

package/plugins/auth-cookie-plugin.d.ts

@@ -0,0 +1,11 @@
+import type { GraphileConfig } from 'graphile-config';
+import '../middleware/types';
+/**
+ * AuthCookiePlugin - grafserv middleware plugin that handles auth cookie lifecycle.
+ *
+ * This plugin intercepts GraphQL responses and:
+ * - Sets session cookies on successful sign-in mutations
+ * - Clears session cookies on sign-out mutations
+ * - Handles device token cookies for trusted device tracking
+ */
+export declare const AuthCookiePlugin: GraphileConfig.Plugin;

package/plugins/auth-cookie-plugin.js

@@ -0,0 +1,289 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthCookiePlugin = void 0;
+const logger_1 = require("@pgpmjs/logger");
+require("../middleware/types");
+const cookie_1 = require("../middleware/cookie");
+const log = new logger_1.Logger('auth-cookie');
+/**
+ * Serialize a cookie to a Set-Cookie header value.
+ */
+const serializeCookie = (name, value, config) => {
+    const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
+    if (config.maxAge !== undefined) {
+        parts.push(`Max-Age=${config.maxAge}`);
+    }
+    if (config.domain) {
+        parts.push(`Domain=${config.domain}`);
+    }
+    if (config.path) {
+        parts.push(`Path=${config.path}`);
+    }
+    if (config.secure) {
+        parts.push('Secure');
+    }
+    if (config.httpOnly) {
+        parts.push('HttpOnly');
+    }
+    if (config.sameSite) {
+        parts.push(`SameSite=${config.sameSite.charAt(0).toUpperCase() + config.sameSite.slice(1)}`);
+    }
+    return parts.join('; ');
+};
+/**
+ * Serialize a cookie for clearing (expired).
+ */
+const serializeClearCookie = (name, config) => {
+    const parts = [`${encodeURIComponent(name)}=`];
+    parts.push('Max-Age=0');
+    if (config.domain) {
+        parts.push(`Domain=${config.domain}`);
+    }
+    if (config.path) {
+        parts.push(`Path=${config.path}`);
+    }
+    if (config.secure) {
+        parts.push('Secure');
+    }
+    if (config.httpOnly) {
+        parts.push('HttpOnly');
+    }
+    if (config.sameSite) {
+        parts.push(`SameSite=${config.sameSite.charAt(0).toUpperCase() + config.sameSite.slice(1)}`);
+    }
+    return parts.join('; ');
+};
+/**
+ * Auth mutations that should set session cookie on success.
+ */
+const SIGN_IN_MUTATIONS = new Set([
+    'signIn',
+    'signUp',
+    'signInSso',
+    'signUpSso',
+    'signInMagicLink',
+    'signUpMagicLink',
+    'signInEmailOtp',
+    'signInSmsOtp',
+    'signUpSms',
+    'completeMfaChallenge',
+    'signInOneTimeToken',
+    'signInCrossOrigin',
+]);
+/**
+ * Auth mutations that should clear the session cookie.
+ */
+const SIGN_OUT_MUTATIONS = new Set([
+    'signOut',
+    'revokeSession',
+    'revokeAllSessions',
+]);
+/**
+ * Extract mutation names from a GraphQL query string.
+ */
+const extractMutationNames = (query) => {
+    const mutations = [];
+    if (!/^\s*mutation\b/i.test(query)) {
+        return mutations;
+    }
+    const bodyStart = query.indexOf('{');
+    if (bodyStart === -1)
+        return mutations;
+    const bodyContent = query.slice(bodyStart + 1);
+    const fieldPattern = /(\w+)\s*(?:\(|{)/g;
+    let match;
+    while ((match = fieldPattern.exec(bodyContent)) !== null) {
+        const name = match[1];
+        if (name !== 'mutation' && name !== 'query' && name !== 'fragment') {
+            mutations.push(name);
+        }
+    }
+    return mutations;
+};
+/**
+ * Extract access token from mutation response.
+ */
+const extractAccessToken = (data, mutationName) => {
+    const result = data[mutationName];
+    if (!result)
+        return undefined;
+    // Check for non-empty string tokens
+    if (typeof result.accessToken === 'string' && result.accessToken)
+        return result.accessToken;
+    if (typeof result.access_token === 'string' && result.access_token)
+        return result.access_token;
+    const nested = result.result;
+    if (nested) {
+        if (typeof nested.accessToken === 'string' && nested.accessToken)
+            return nested.accessToken;
+        if (typeof nested.access_token === 'string' && nested.access_token)
+            return nested.access_token;
+    }
+    return undefined;
+};
+/**
+ * Extract device ID from mutation response.
+ */
+const extractDeviceId = (data, mutationName) => {
+    const result = data[mutationName];
+    if (!result)
+        return undefined;
+    if (typeof result.deviceId === 'string')
+        return result.deviceId;
+    if (typeof result.device_id === 'string')
+        return result.device_id;
+    const nested = result.result;
+    if (nested) {
+        if (typeof nested.deviceId === 'string')
+            return nested.deviceId;
+        if (typeof nested.device_id === 'string')
+            return nested.device_id;
+    }
+    return undefined;
+};
+/**
+ * Check if request includes remember_me flag.
+ */
+const hasRememberMe = (variables) => {
+    if (!variables)
+        return false;
+    return variables.rememberMe === true || variables.remember_me === true;
+};
+/**
+ * Get Express request from grafserv request context.
+ */
+const getExpressRequest = (requestContext) => {
+    return requestContext?.expressv4?.req;
+};
+/**
+ * AuthCookiePlugin - grafserv middleware plugin that handles auth cookie lifecycle.
+ *
+ * This plugin intercepts GraphQL responses and:
+ * - Sets session cookies on successful sign-in mutations
+ * - Clears session cookies on sign-out mutations
+ * - Handles device token cookies for trusted device tracking
+ */
+exports.AuthCookiePlugin = {
+    name: 'AuthCookiePlugin',
+    version: '1.0.0',
+    grafserv: {
+        middleware: {
+            processRequest: {
+                callback: async (next, event) => {
+                    const result = await next();
+                    // Only process buffer results (JSON responses)
+                    if (!result || result.type !== 'buffer') {
+                        return result;
+                    }
+                    const bufferResult = result;
+                    const req = getExpressRequest(event.requestDigest.requestContext);
+                    // Skip if no Express request or not a POST
+                    if (!req || event.requestDigest.method !== 'POST') {
+                        return result;
+                    }
+                    // Get request body for mutation detection
+                    // grafserv provides getBody() which returns { type: 'buffer', buffer: Buffer }
+                    let body;
+                    if (typeof event.requestDigest.getBody === 'function') {
+                        try {
+                            const rawBody = await event.requestDigest.getBody();
+                            if (rawBody?.type === 'buffer' && rawBody.buffer) {
+                                const jsonStr = rawBody.buffer.toString('utf8');
+                                body = JSON.parse(jsonStr);
+                            }
+                        }
+                        catch (e) {
+                            log.debug('[auth-cookie] Failed to parse body from requestDigest');
+                        }
+                    }
+                    body = body || req.body;
+                    if (!body?.query) {
+                        return result;
+                    }
+                    // Extract mutation names
+                    const mutationNames = extractMutationNames(body.query);
+                    if (mutationNames.length === 0) {
+                        return result;
+                    }
+                    // Check for auth mutations
+                    const signInMutation = mutationNames.find((m) => SIGN_IN_MUTATIONS.has(m));
+                    const signOutMutation = mutationNames.find((m) => SIGN_OUT_MUTATIONS.has(m));
+                    if (!signInMutation && !signOutMutation) {
+                        return result;
+                    }
+                    log.debug(`[auth-cookie] Detected auth mutation: ${signInMutation || signOutMutation}`);
+                    try {
+                        // Parse response body
+                        const payload = bufferResult.buffer.toString('utf8');
+                        const graphqlResponse = JSON.parse(payload);
+                        // Skip if there are GraphQL errors
+                        if (graphqlResponse.errors?.length || !graphqlResponse.data) {
+                            return result;
+                        }
+                        const data = graphqlResponse.data;
+                        const authSettings = req.api?.authSettings;
+                        const cookiesToSet = [];
+                        // Handle sign-out mutations
+                        if (signOutMutation && data[signOutMutation]) {
+                            log.info('[auth-cookie] Sign-out mutation succeeded, clearing session cookie');
+                            const config = (0, cookie_1.getSessionCookieConfig)(authSettings);
+                            cookiesToSet.push(serializeClearCookie(cookie_1.SESSION_COOKIE_NAME, config));
+                            // Also clear device token on sign-out
+                            const deviceConfig = (0, cookie_1.getDeviceTokenCookieConfig)(authSettings);
+                            cookiesToSet.push(serializeClearCookie(cookie_1.DEVICE_TOKEN_COOKIE_NAME, deviceConfig));
+                        }
+                        // Handle sign-in mutations
+                        if (signInMutation) {
+                            const accessToken = extractAccessToken(data, signInMutation);
+                            if (accessToken) {
+                                const rememberMe = hasRememberMe(body.variables);
+                                const config = (0, cookie_1.getSessionCookieConfig)(authSettings, rememberMe);
+                                log.info(`[auth-cookie] Sign-in mutation succeeded, setting session cookie (rememberMe=${rememberMe})`);
+                                cookiesToSet.push(serializeCookie(cookie_1.SESSION_COOKIE_NAME, accessToken, config));
+                                const deviceId = extractDeviceId(data, signInMutation);
+                                if (deviceId) {
+                                    log.info('[auth-cookie] Device ID returned, setting device token cookie');
+                                    const deviceConfig = (0, cookie_1.getDeviceTokenCookieConfig)(authSettings);
+                                    cookiesToSet.push(serializeCookie(cookie_1.DEVICE_TOKEN_COOKIE_NAME, deviceId, deviceConfig));
+                                }
+                            }
+                        }
+                        // Set cookies directly on Express response and return modified headers
+                        if (cookiesToSet.length > 0) {
+                            const res = event.requestDigest.requestContext?.expressv4?.res;
+                            if (res?.setHeader) {
+                                // Get existing Set-Cookie headers from Express response
+                                const existingCookies = res.getHeader('Set-Cookie');
+                                const allCookies = [];
+                                if (existingCookies) {
+                                    if (Array.isArray(existingCookies)) {
+                                        allCookies.push(...existingCookies);
+                                    }
+                                    else {
+                                        allCookies.push(existingCookies);
+                                    }
+                                }
+                                allCookies.push(...cookiesToSet);
+                                // Set as array to get multiple Set-Cookie headers
+                                res.setHeader('Set-Cookie', allCookies);
+                            }
+                            // Also update the BufferResult headers for grafserv to pass through
+                            const existingBufferCookie = bufferResult.headers['set-cookie'];
+                            const updatedHeaders = { ...bufferResult.headers };
+                            // Remove set-cookie from grafserv headers since we set it on Express
+                            delete updatedHeaders['set-cookie'];
+                            return {
+                                ...bufferResult,
+                                headers: updatedHeaders,
+                            };
+                        }
+                    }
+                    catch (err) {
+                        log.error('[auth-cookie] Error processing auth response:', err);
+                    }
+                    return result;
+                },
+            },
+        },
+    },
+};

package/server.js

@@ -4,10 +4,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Server = exports.GraphQLServer = void 0;
+const csrf_1 = require("@constructive-io/csrf");
 const graphql_env_1 = require("@constructive-io/graphql-env");
 const logger_1 = require("@pgpmjs/logger");
 const server_utils_1 = require("@pgpmjs/server-utils");
 const url_domains_1 = require("@constructive-io/url-domains");
+const cookie_parser_1 = __importDefault(require("cookie-parser"));
 const express_1 = __importDefault(require("express"));
 const graphql_upload_1 = __importDefault(require("graphql-upload"));
 const graphile_cache_1 = require("graphile-cache");
@@ -27,7 +29,9 @@ const debug_db_1 = require("./middleware/observability/debug-db");
 const debug_memory_1 = require("./middleware/observability/debug-memory");
 const guard_1 = require("./middleware/observability/guard");
 const request_logger_1 = require("./middleware/observability/request-logger");
+// Auth cookie handling is done via AuthCookiePlugin in grafserv
 const captcha_1 = require("./middleware/captcha");
+const cookie_1 = require("./middleware/cookie");
 const upload_1 = require("./middleware/upload");
 const debug_sampler_1 = require("./diagnostics/debug-sampler");
 const log = new logger_1.Logger('server');
@@ -127,6 +131,7 @@ class Server {
             }
         }
         app.use((0, server_utils_1.poweredBy)('constructive'));
+        app.use((0, cookie_parser_1.default)());
         app.use((0, cors_1.cors)(fallbackOrigin));
         app.use('/graphql', graphql_upload_1.default.graphqlUploadExpress({
             maxFileSize: 10 * 1024 * 1024, // 10 MB
@@ -141,6 +146,34 @@ class Server {
         app.post('/upload', uploadAuthenticate, ...upload_1.uploadRoute);
         app.use(authenticate);
         app.use((0, captcha_1.createCaptchaMiddleware)());
+        // CSRF protection for cookie-authenticated requests
+        // Skip CSRF for Bearer token auth (not vulnerable to CSRF) and anonymous requests
+        const csrf = (0, csrf_1.createCsrfMiddleware)({
+            cookieOptions: {
+                httpOnly: false, // SPA clients need to read this via document.cookie
+                secure: process.env.NODE_ENV === 'production',
+                sameSite: 'lax',
+            },
+        });
+        const csrfProtect = (req, res, next) => {
+            // Skip CSRF for Bearer token auth
+            const auth = req.headers.authorization;
+            if (auth?.toLowerCase().startsWith('bearer ')) {
+                return next();
+            }
+            // Skip if no session cookie (anonymous requests)
+            const sessionCookie = (0, cookie_1.parseCookieValue)(req, cookie_1.SESSION_COOKIE_NAME);
+            if (!sessionCookie) {
+                return next();
+            }
+            // Apply CSRF protection for cookie-authenticated requests
+            csrf.protect(req, res, next);
+        };
+        const csrfSetToken = (req, res, next) => {
+            csrf.setToken(req, res, next);
+        };
+        app.use(csrfSetToken); // Set CSRF token cookie on all requests
+        app.use('/graphql', csrfProtect); // Enforce CSRF on GraphQL mutations
         app.use((0, graphile_1.graphile)(effectiveOpts));
         app.use(flush_1.flush);
         // Error handling - MUST be LAST

package/types.d.ts

@@ -29,6 +29,7 @@ export interface DatabaseSettings {
     enableLtree: boolean;
     enableLlm: boolean;
     enableRealtime: boolean;
+    enableBulk: boolean;
 }
 /**
  * Resolved pubkey challenge config from pubkey_settings typed table.
@@ -96,6 +97,8 @@ export interface AuthSettings {
     cookieHttponly?: boolean;
     cookieMaxAge?: string | null;
     cookiePath?: string;
+    /** Remember me duration (seconds) for extended session cookies */
+    rememberMeDuration?: string | null;
     /** reCAPTCHA / CAPTCHA */
     enableCaptcha?: boolean;
     captchaSiteKey?: string | null;