@constructive-io/graphql-server 4.33.0 → 4.34.1

package/middleware/api.js

@@ -8,14 +8,18 @@ const env_1 = require("@pgpmjs/env");
 const logger_1 = require("@pgpmjs/logger");
 const server_utils_1 = require("@pgpmjs/server-utils");
 const url_domains_1 = require("@constructive-io/url-domains");
+const express_context_1 = require("@constructive-io/express-context");
 const pg_cache_1 = require("pg-cache");
 const _50x_1 = __importDefault(require("../errors/50x"));
 const _404_message_1 = __importDefault(require("../errors/404-message"));
 require("./types");
 const log = new logger_1.Logger('api');
-const isDev = () => (0, env_1.getNodeEnv)() === 'development';
 // =============================================================================
-// SQL Queries
+// Module Loader Registry (replaces inline SQL queries for per-db config)
+// =============================================================================
+const defaultRegistry = (0, express_context_1.createDefaultRegistry)();
+// =============================================================================
+// SQL Queries (API resolution only — module queries now live in loaders)
 // =============================================================================
 const DOMAIN_LOOKUP_SQL = `
   SELECT 
@@ -75,153 +79,39 @@ const API_LIST_SQL = `
   GROUP BY a.id, a.database_id, a.name, a.dbname, a.role_name, a.anon_role, a.is_public
   LIMIT 100
 `;
-const RLS_MODULE_SQL = `
-  SELECT data
-  FROM services_public.api_modules
-  WHERE api_id = $1 AND name = 'rls_module'
-  LIMIT 1
-`;
-const RLS_SETTINGS_SQL = `
-  SELECT
-    auth_schema.schema_name AS authenticate_schema,
-    role_schema.schema_name AS role_schema,
-    auth_fn.name AS authenticate,
-    auth_strict_fn.name AS authenticate_strict,
-    role_fn.name AS current_role,
-    role_id_fn.name AS current_role_id,
-    ua_fn.name AS current_user_agent,
-    ip_fn.name AS current_ip_address
-  FROM services_public.rls_settings rs
-  LEFT JOIN metaschema_public.schema auth_schema ON rs.authenticate_schema_id = auth_schema.id
-  LEFT JOIN metaschema_public.schema role_schema ON rs.role_schema_id = role_schema.id
-  LEFT JOIN metaschema_public.function auth_fn ON rs.authenticate_function_id = auth_fn.id
-  LEFT JOIN metaschema_public.function auth_strict_fn ON rs.authenticate_strict_function_id = auth_strict_fn.id
-  LEFT JOIN metaschema_public.function role_fn ON rs.current_role_function_id = role_fn.id
-  LEFT JOIN metaschema_public.function role_id_fn ON rs.current_role_id_function_id = role_id_fn.id
-  LEFT JOIN metaschema_public.function ua_fn ON rs.current_user_agent_function_id = ua_fn.id
-  LEFT JOIN metaschema_public.function ip_fn ON rs.current_ip_address_function_id = ip_fn.id
-  WHERE rs.database_id = $1
-  LIMIT 1
-`;
 /**
- * Discover auth settings table location via public metaschema tables.
- * Joins sessions_module with metaschema_public.schema to resolve
- * the schema name + table name without touching private schemas.
+ * Build a LoaderContext from the API row and options.
+ * This is used to resolve per-database module settings via the loader registry.
  */
-const AUTH_SETTINGS_DISCOVERY_SQL = `
-  SELECT s.schema_name, sm.auth_settings_table AS table_name
-  FROM metaschema_modules_public.sessions_module sm
-  JOIN metaschema_public.schema s ON s.id = sm.schema_id
-  LIMIT 1
-`;
+const buildLoaderContext = (servicesPool, opts, row) => ({
+    servicesPool,
+    tenantPool: (0, pg_cache_1.getPgPool)({ ...opts.pg, database: row.dbname }),
+    databaseId: row.database_id,
+    apiId: row.api_id,
+    dbname: row.dbname,
+});
 /**
- * Query auth settings from the discovered table.
- * Schema and table name are resolved dynamically from metaschema modules.
+ * Resolve all per-database module settings in parallel via the loader registry.
+ * Each loader independently caches by databaseId — repeated calls are cheap.
  */
-const AUTH_SETTINGS_SQL = (schemaName, tableName) => `
-  SELECT
-    cookie_secure,
-    cookie_samesite,
-    cookie_domain,
-    cookie_httponly,
-    cookie_max_age,
-    cookie_path,
-    remember_me_duration,
-    enable_captcha,
-    captcha_site_key
-  FROM "${schemaName}"."${tableName}"
-  LIMIT 1
-`;
-const CORS_SETTINGS_SQL = `
-  SELECT allowed_origins
-  FROM services_public.cors_settings
-  WHERE database_id = $1 AND api_id = $2
-  LIMIT 1
-`;
-const CORS_SETTINGS_DB_DEFAULT_SQL = `
-  SELECT allowed_origins
-  FROM services_public.cors_settings
-  WHERE database_id = $1 AND api_id IS NULL
-  LIMIT 1
-`;
-const CORS_MODULE_SQL = `
-  SELECT data
-  FROM services_public.api_modules
-  WHERE api_id = $1 AND name = 'cors'
-  LIMIT 1
-`;
-const PUBKEY_SETTINGS_SQL = `
-  SELECT
-    s.schema_name AS schema,
-    ps.crypto_network,
-    sign_up_fn.name AS sign_up_with_key,
-    sign_in_req_fn.name AS sign_in_request_challenge,
-    sign_in_fail_fn.name AS sign_in_record_failure,
-    sign_in_fn.name AS sign_in_with_challenge
-  FROM services_public.pubkey_settings ps
-  LEFT JOIN metaschema_public.schema s ON ps.schema_id = s.id
-  LEFT JOIN metaschema_public.function sign_up_fn ON ps.sign_up_with_key_function_id = sign_up_fn.id
-  LEFT JOIN metaschema_public.function sign_in_req_fn ON ps.sign_in_request_challenge_function_id = sign_in_req_fn.id
-  LEFT JOIN metaschema_public.function sign_in_fail_fn ON ps.sign_in_record_failure_function_id = sign_in_fail_fn.id
-  LEFT JOIN metaschema_public.function sign_in_fn ON ps.sign_in_with_challenge_function_id = sign_in_fn.id
-  WHERE ps.database_id = $1
-  LIMIT 1
-`;
-const PUBKEY_MODULE_SQL = `
-  SELECT data
-  FROM services_public.api_modules
-  WHERE api_id = $1 AND name = 'pubkey_challenge'
-  LIMIT 1
-`;
-const WEBAUTHN_SETTINGS_SQL = `
-  SELECT
-    s.schema_name AS schema,
-    cred_s.schema_name AS credentials_schema,
-    sess_s.schema_name AS sessions_schema,
-    sec_s.schema_name AS session_secrets_schema,
-    ws.rp_id,
-    ws.rp_name,
-    ws.origin_allowlist,
-    ws.attestation_type,
-    ws.require_user_verification,
-    ws.resident_key,
-    ws.challenge_expiry_seconds
-  FROM services_public.webauthn_settings ws
-  LEFT JOIN metaschema_public.schema s ON ws.schema_id = s.id
-  LEFT JOIN metaschema_public.schema cred_s ON ws.credentials_schema_id = cred_s.id
-  LEFT JOIN metaschema_public.schema sess_s ON ws.sessions_schema_id = sess_s.id
-  LEFT JOIN metaschema_public.schema sec_s ON ws.session_secrets_schema_id = sec_s.id
-  WHERE ws.database_id = $1
-  LIMIT 1
-`;
-const DATABASE_SETTINGS_SQL = `
-  SELECT
-    ds.enable_aggregates,
-    ds.enable_postgis,
-    ds.enable_search,
-    ds.enable_direct_uploads,
-    ds.enable_presigned_uploads,
-    ds.enable_many_to_many,
-    ds.enable_connection_filter,
-    ds.enable_ltree,
-    ds.enable_llm,
-    ds.enable_bulk,
-    COALESCE(aps.enable_aggregates, ds.enable_aggregates) AS resolved_enable_aggregates,
-    COALESCE(aps.enable_postgis, ds.enable_postgis) AS resolved_enable_postgis,
-    COALESCE(aps.enable_search, ds.enable_search) AS resolved_enable_search,
-    COALESCE(aps.enable_direct_uploads, ds.enable_direct_uploads) AS resolved_enable_direct_uploads,
-    COALESCE(aps.enable_presigned_uploads, ds.enable_presigned_uploads) AS resolved_enable_presigned_uploads,
-    COALESCE(aps.enable_many_to_many, ds.enable_many_to_many) AS resolved_enable_many_to_many,
-    COALESCE(aps.enable_connection_filter, ds.enable_connection_filter) AS resolved_enable_connection_filter,
-    COALESCE(aps.enable_ltree, ds.enable_ltree) AS resolved_enable_ltree,
-    COALESCE(aps.enable_llm, ds.enable_llm) AS resolved_enable_llm,
-    COALESCE(aps.enable_realtime, ds.enable_realtime) AS resolved_enable_realtime,
-    COALESCE(aps.enable_bulk, ds.enable_bulk) AS resolved_enable_bulk
-  FROM services_public.database_settings ds
-  LEFT JOIN services_public.api_settings aps ON ds.database_id = aps.database_id AND aps.api_id = $2
-  WHERE ds.database_id = $1
-  LIMIT 1
-`;
+const resolveModuleSettings = async (registry, ctx) => {
+    const [rlsModule, authSettings, corsOrigins, databaseSettings, pubkeyChallengeSettings, webauthnSettings,] = await Promise.all([
+        registry.resolve('rlsModule', ctx),
+        registry.resolve('authSettings', ctx),
+        registry.resolve('corsOrigins', ctx),
+        registry.resolve('databaseSettings', ctx),
+        registry.resolve('pubkeyChallengeSettings', ctx),
+        registry.resolve('webauthnSettings', ctx),
+    ]);
+    return {
+        rlsModule,
+        authSettings,
+        corsOrigins,
+        databaseSettings,
+        pubkeyChallengeSettings,
+        webauthnSettings,
+    };
+};
 // =============================================================================
 // Helpers
 // =============================================================================
@@ -257,63 +147,6 @@ const getSvcKey = (opts, req) => {
     return baseKey;
 };
 exports.getSvcKey = getSvcKey;
-const toRlsModule = (row) => {
-    if (!row?.data)
-        return undefined;
-    const d = row.data;
-    return {
-        authenticate: d.authenticate,
-        authenticateStrict: d.authenticate_strict,
-        privateSchema: {
-            schemaName: d.authenticate_schema,
-        },
-        publicSchema: {
-            schemaName: d.role_schema,
-        },
-        currentRole: d.current_role,
-        currentRoleId: d.current_role_id,
-        currentIpAddress: d.current_ip_address,
-        currentUserAgent: d.current_user_agent,
-    };
-};
-const toRlsModuleFromSettings = (row) => {
-    if (!row)
-        return undefined;
-    // If metaschema_public.function rows are missing (e.g. trigger was skipped
-    // during migration), the LEFT JOINs resolve NULL.  Return undefined so the
-    // caller falls back to the legacy api_modules lookup.
-    if (!row.authenticate || !row.authenticate_schema)
-        return undefined;
-    return {
-        authenticate: row.authenticate,
-        authenticateStrict: row.authenticate_strict,
-        privateSchema: {
-            schemaName: row.authenticate_schema,
-        },
-        publicSchema: {
-            schemaName: row.role_schema,
-        },
-        currentRole: row.current_role,
-        currentRoleId: row.current_role_id,
-        currentIpAddress: row.current_ip_address,
-        currentUserAgent: row.current_user_agent,
-    };
-};
-const toAuthSettings = (row) => {
-    if (!row)
-        return undefined;
-    return {
-        cookieSecure: row.cookie_secure,
-        cookieSamesite: row.cookie_samesite,
-        cookieDomain: row.cookie_domain,
-        cookieHttponly: row.cookie_httponly,
-        cookieMaxAge: row.cookie_max_age,
-        cookiePath: row.cookie_path,
-        rememberMeDuration: row.remember_me_duration,
-        enableCaptcha: row.enable_captcha,
-        captchaSiteKey: row.captcha_site_key,
-    };
-};
 const toApiStructure = (row, opts, settings = {}) => ({
     apiId: row.api_id,
     dbname: row.dbname || opts.pg?.database || '',
@@ -325,7 +158,7 @@ const toApiStructure = (row, opts, settings = {}) => ({
     domains: [],
     databaseId: row.database_id,
     isPublic: row.is_public,
-    authSettings: toAuthSettings(settings.authSettingsRow ?? null),
+    authSettings: settings.authSettings,
     corsOrigins: settings.corsOrigins,
     databaseSettings: settings.databaseSettings,
     pubkeyChallengeSettings: settings.pubkeyChallengeSettings,
@@ -342,7 +175,7 @@ const createAdminStructure = (opts, schemas, databaseId) => ({
     isPublic: false,
 });
 // =============================================================================
-// Database Queries
+// Database Queries (API resolution only)
 // =============================================================================
 const validateSchemata = async (pool, schemas) => {
     const result = await pool.query(`SELECT schema_name FROM information_schema.schemata WHERE schema_name = ANY($1::text[])`, [schemas]);
@@ -360,184 +193,6 @@ const queryApiList = async (pool, isPublic) => {
     const result = await pool.query(API_LIST_SQL, [isPublic]);
     return result.rows;
 };
-const queryRlsSettings = async (pool, databaseId) => {
-    try {
-        const result = await pool.query(RLS_SETTINGS_SQL, [databaseId]);
-        return toRlsModuleFromSettings(result.rows[0] ?? null);
-    }
-    catch (e) {
-        log.warn(`[rls-settings] Failed to load RLS settings: ${e.message}`);
-        return undefined;
-    }
-};
-const queryRlsModuleLegacy = async (pool, apiId) => {
-    const result = await pool.query(RLS_MODULE_SQL, [apiId]);
-    return toRlsModule(result.rows[0] ?? null);
-};
-const queryRlsModule = async (pool, databaseId, apiId) => {
-    const fromSettings = await queryRlsSettings(pool, databaseId);
-    if (fromSettings)
-        return fromSettings;
-    return queryRlsModuleLegacy(pool, apiId);
-};
-// -- CORS --
-const queryCorsSettings = async (pool, databaseId, apiId) => {
-    try {
-        if (apiId) {
-            const perApi = await pool.query(CORS_SETTINGS_SQL, [databaseId, apiId]);
-            if (perApi.rows[0])
-                return perApi.rows[0].allowed_origins;
-        }
-        const dbDefault = await pool.query(CORS_SETTINGS_DB_DEFAULT_SQL, [databaseId]);
-        return dbDefault.rows[0]?.allowed_origins;
-    }
-    catch (e) {
-        log.warn(`[cors-settings] Failed to load CORS settings: ${e.message}`);
-        return undefined;
-    }
-};
-const queryCorsModuleLegacy = async (pool, apiId) => {
-    const result = await pool.query(CORS_MODULE_SQL, [apiId]);
-    return result.rows[0]?.data?.urls;
-};
-const queryCorsOrigins = async (pool, databaseId, apiId) => {
-    const fromSettings = await queryCorsSettings(pool, databaseId, apiId);
-    if (fromSettings)
-        return fromSettings;
-    if (apiId)
-        return queryCorsModuleLegacy(pool, apiId);
-    return undefined;
-};
-// -- Pubkey --
-const toPubkeyChallengeSettings = (row) => {
-    if (!row?.schema || !row?.sign_up_with_key)
-        return undefined;
-    return {
-        schema: row.schema,
-        cryptoNetwork: row.crypto_network,
-        signUpWithKey: row.sign_up_with_key,
-        signInRequestChallenge: row.sign_in_request_challenge,
-        signInRecordFailure: row.sign_in_record_failure,
-        signInWithChallenge: row.sign_in_with_challenge,
-    };
-};
-const toPubkeyChallengeFromModule = (row) => {
-    if (!row?.data?.schema)
-        return undefined;
-    const d = row.data;
-    return {
-        schema: d.schema,
-        cryptoNetwork: d.crypto_network,
-        signUpWithKey: d.sign_up_with_key,
-        signInRequestChallenge: d.sign_in_request_challenge,
-        signInRecordFailure: d.sign_in_record_failure,
-        signInWithChallenge: d.sign_in_with_challenge,
-    };
-};
-const queryPubkeySettings = async (pool, databaseId) => {
-    try {
-        const result = await pool.query(PUBKEY_SETTINGS_SQL, [databaseId]);
-        return toPubkeyChallengeSettings(result.rows[0] ?? null);
-    }
-    catch (e) {
-        log.warn(`[pubkey-settings] Failed to load pubkey challenge settings: ${e.message}`);
-        return undefined;
-    }
-};
-const queryPubkeyModuleLegacy = async (pool, apiId) => {
-    const result = await pool.query(PUBKEY_MODULE_SQL, [apiId]);
-    return toPubkeyChallengeFromModule(result.rows[0] ?? null);
-};
-const queryPubkeyChallenge = async (pool, databaseId, apiId) => {
-    const fromSettings = await queryPubkeySettings(pool, databaseId);
-    if (fromSettings)
-        return fromSettings;
-    if (apiId)
-        return queryPubkeyModuleLegacy(pool, apiId);
-    return undefined;
-};
-// -- WebAuthn --
-const toWebauthnSettings = (row) => {
-    if (!row?.schema)
-        return undefined;
-    return {
-        schema: row.schema,
-        credentialsSchema: row.credentials_schema,
-        sessionsSchema: row.sessions_schema,
-        sessionSecretsSchema: row.session_secrets_schema,
-        rpId: row.rp_id,
-        rpName: row.rp_name,
-        originAllowlist: row.origin_allowlist,
-        attestationType: row.attestation_type,
-        requireUserVerification: row.require_user_verification,
-        residentKey: row.resident_key,
-        challengeExpirySeconds: row.challenge_expiry_seconds,
-    };
-};
-const queryWebauthnSettings = async (pool, databaseId) => {
-    try {
-        const result = await pool.query(WEBAUTHN_SETTINGS_SQL, [databaseId]);
-        return toWebauthnSettings(result.rows[0] ?? null);
-    }
-    catch (e) {
-        log.warn(`[webauthn-settings] Failed to load webauthn settings: ${e.message}`);
-        return undefined;
-    }
-};
-// -- Database Settings (feature flags) --
-const toDatabaseSettings = (row) => {
-    if (!row)
-        return undefined;
-    return {
-        enableAggregates: row.resolved_enable_aggregates,
-        enablePostgis: row.resolved_enable_postgis,
-        enableSearch: row.resolved_enable_search,
-        enableDirectUploads: row.resolved_enable_direct_uploads,
-        enablePresignedUploads: row.resolved_enable_presigned_uploads,
-        enableManyToMany: row.resolved_enable_many_to_many,
-        enableConnectionFilter: row.resolved_enable_connection_filter,
-        enableLtree: row.resolved_enable_ltree,
-        enableLlm: row.resolved_enable_llm,
-        enableRealtime: row.resolved_enable_realtime,
-        enableBulk: row.resolved_enable_bulk,
-    };
-};
-const queryDatabaseSettings = async (pool, databaseId, apiId) => {
-    try {
-        const result = await pool.query(DATABASE_SETTINGS_SQL, [databaseId, apiId ?? null]);
-        return toDatabaseSettings(result.rows[0] ?? null);
-    }
-    catch (e) {
-        log.warn(`[database-settings] Failed to load database settings: ${e.message}`);
-        return undefined;
-    }
-};
-/**
- * Load server-relevant auth settings from the tenant DB.
- * Discovers the auth settings table dynamically by joining
- * metaschema_modules_public.sessions_module with metaschema_public.schema
- * (both public schemas). Fails gracefully if modules or table don't exist yet.
- */
-const queryAuthSettings = async (opts, dbname) => {
-    try {
-        const tenantPool = (0, pg_cache_1.getPgPool)({ ...opts.pg, database: dbname });
-        // Discover the auth settings schema + table name from public metaschema tables
-        const discovery = await tenantPool.query(AUTH_SETTINGS_DISCOVERY_SQL);
-        const resolved = discovery.rows[0];
-        if (!resolved) {
-            log.debug('[auth-settings] No sessions_module row found in tenant DB');
-            return null;
-        }
-        // Query the discovered auth settings table
-        const result = await tenantPool.query(AUTH_SETTINGS_SQL(resolved.schema_name, resolved.table_name));
-        return result.rows[0] ?? null;
-    }
-    catch (e) {
-        // Table/module may not exist yet if the 2FA migration hasn't been applied
-        log.debug(`[auth-settings] Failed to load auth settings: ${e.message}`);
-        return null;
-    }
-};
 // =============================================================================
 // Resolution Logic
 // =============================================================================
@@ -588,16 +243,10 @@ const resolveApiNameHeader = async (ctx) => {
         log.debug(`[api-name-lookup] No API found for databaseId=${headers.databaseId} name=${headers.apiName}`);
         return null;
     }
-    const [rlsModule, authSettingsRow, corsOrigins, databaseSettings, pubkeyChallengeSettings, webauthnSettings] = await Promise.all([
-        queryRlsModule(pool, row.database_id, row.api_id),
-        queryAuthSettings(opts, row.dbname),
-        queryCorsOrigins(pool, row.database_id, row.api_id),
-        queryDatabaseSettings(pool, row.database_id, row.api_id),
-        queryPubkeyChallenge(pool, row.database_id, row.api_id),
-        queryWebauthnSettings(pool, row.database_id),
-    ]);
-    log.debug(`[api-name-lookup] resolved schemas: [${row.schemas?.join(', ')}], rlsModule: ${rlsModule ? 'found' : 'none'}, authSettings: ${authSettingsRow ? 'found' : 'none'}`);
-    return toApiStructure(row, opts, { rlsModule, authSettingsRow, corsOrigins, databaseSettings, pubkeyChallengeSettings, webauthnSettings });
+    const loaderCtx = buildLoaderContext(pool, opts, row);
+    const settings = await resolveModuleSettings(defaultRegistry, loaderCtx);
+    log.debug(`[api-name-lookup] resolved schemas: [${row.schemas?.join(', ')}], rlsModule: ${settings.rlsModule ? 'found' : 'none'}, authSettings: ${settings.authSettings ? 'found' : 'none'}`);
+    return toApiStructure(row, opts, settings);
 };
 const resolveMetaSchemaHeader = (ctx, validatedSchemas) => {
     return createAdminStructure(ctx.opts, validatedSchemas, ctx.headers.databaseId);
@@ -611,16 +260,10 @@ const resolveDomainLookup = async (ctx) => {
         log.debug(`[domain-lookup] No API found for domain=${domain} subdomain=${subdomain}`);
         return null;
     }
-    const [rlsModule, authSettingsRow, corsOrigins, databaseSettings, pubkeyChallengeSettings, webauthnSettings] = await Promise.all([
-        queryRlsModule(pool, row.database_id, row.api_id),
-        queryAuthSettings(opts, row.dbname),
-        queryCorsOrigins(pool, row.database_id, row.api_id),
-        queryDatabaseSettings(pool, row.database_id, row.api_id),
-        queryPubkeyChallenge(pool, row.database_id, row.api_id),
-        queryWebauthnSettings(pool, row.database_id),
-    ]);
-    log.debug(`[domain-lookup] resolved schemas: [${row.schemas?.join(', ')}], rlsModule: ${rlsModule ? 'found' : 'none'}, authSettings: ${authSettingsRow ? 'found' : 'none'}`);
-    return toApiStructure(row, opts, { rlsModule, authSettingsRow, corsOrigins, databaseSettings, pubkeyChallengeSettings, webauthnSettings });
+    const loaderCtx = buildLoaderContext(pool, opts, row);
+    const settings = await resolveModuleSettings(defaultRegistry, loaderCtx);
+    log.debug(`[domain-lookup] resolved schemas: [${row.schemas?.join(', ')}], rlsModule: ${settings.rlsModule ? 'found' : 'none'}, authSettings: ${settings.authSettings ? 'found' : 'none'}`);
+    return toApiStructure(row, opts, settings);
 };
 const buildDevFallbackError = async (ctx, req) => {
     if ((0, env_1.getNodeEnv)() !== 'development')

package/middleware/llm-api.d.ts

@@ -19,6 +19,9 @@
  *
  * Auth: JWT from the auth middleware (req.token) → pg SET LOCAL context for RLS
  * Metering: check_billing_quota → LLM call → record_usage with real token counts
+ *
+ * Context: Uses `req.constructive` from @constructive-io/express-context
+ * for tenant-scoped database access, pgSettings, and withPgClient.
  */
 import { Router } from 'express';
 export declare function createLlmApiRouter(): Router;