@constructive-io/graphql-server 4.44.2 → 4.45.0

package/esm/middleware/api.js

@@ -6,6 +6,7 @@ import { createDefaultRegistry, } from '@constructive-io/express-context';
 import { getPgPool } from 'pg-cache';
 import errorPage50x from '../errors/50x';
 import errorPage404Message from '../errors/404-message';
+import { resolveRoute, routeToApiStructure } from './routing';
 import './types';
 const log = new Logger('api');
 // =============================================================================
@@ -255,6 +256,48 @@ const resolveApiNameHeader = async (ctx) => {
 const resolveMetaSchemaHeader = (ctx, validatedSchemas) => {
     return createAdminStructure(ctx.opts, validatedSchemas, ctx.headers.databaseId);
 };
+/**
+ * Scoped routing plane resolution (additive, host-only): one indexed
+ * resolve_route() call against the compiled hostname/route bindings.
+ * Path/method routing belongs to Traefik/Ingress — the server only maps
+ * host → tenant/api/db/role. Returns null (fall back to the legacy
+ * services_public lookup) when disabled, unmatched, resolver not installed,
+ * or the target is not an api surface.
+ */
+const resolveScopedRoute = async (ctx) => {
+    const { opts, pool, host } = ctx;
+    if (!opts.api?.enableScopedRouting)
+        return null;
+    const schema = opts.api?.scopedRoutingSchema || 'constructive_routing_public';
+    const route = await resolveRoute(pool, schema, host);
+    if (!route)
+        return null;
+    const structure = routeToApiStructure(route, opts);
+    if (!structure)
+        return null;
+    log.debug(`[scoped-routing] resolved host=${host} → api=${structure.apiId} db=${structure.dbname}`);
+    if (!structure.databaseId || !structure.apiId)
+        return structure;
+    const loaderCtx = buildLoaderContext(pool, opts, {
+        api_id: structure.apiId,
+        database_id: structure.databaseId,
+        dbname: structure.dbname,
+        role_name: structure.roleName,
+        anon_role: structure.anonRole,
+        is_public: structure.isPublic ?? false,
+        schemas: structure.schema,
+    });
+    const settings = await resolveModuleSettings(defaultRegistry, loaderCtx);
+    return {
+        ...structure,
+        rlsModule: settings.rlsModule,
+        authSettings: settings.authSettings,
+        corsOrigins: settings.corsOrigins,
+        databaseSettings: settings.databaseSettings,
+        pubkeyChallengeSettings: settings.pubkeyChallengeSettings,
+        webauthnSettings: settings.webauthnSettings,
+    };
+};
 const resolveDomainLookup = async (ctx) => {
     const { opts, pool, domain, subdomain } = ctx;
     const isPublic = opts.api?.isPublic ?? false;
@@ -333,6 +376,7 @@ export const getApiConfig = async (opts, req) => {
         subdomain,
         cacheKey,
         headers: getRoutingHeaders(req),
+        host: req.get('host') || '',
     };
     // Validate schemas upfront for modes that need them
     const apiOpts = opts.api || {};
@@ -365,7 +409,10 @@ export const getApiConfig = async (opts, req) => {
             result = resolveMetaSchemaHeader(ctx, validatedSchemas);
             break;
         case 'domain-lookup':
-            result = await resolveDomainLookup(ctx);
+            result = await resolveScopedRoute(ctx);
+            if (!result) {
+                result = await resolveDomainLookup(ctx);
+            }
             if (!result && apiOpts.isPublic) {
                 const fallback = await buildDevFallbackError(ctx, req);
                 if (fallback)
@@ -394,6 +441,7 @@ export const createApiMiddleware = (opts) => {
                 subdomain: null,
                 cacheKey: 'meta-api-off',
                 headers: {},
+                host: '',
             });
             req.databaseId = req.api.databaseId;
             req.svc_key = 'meta-api-off';

package/esm/middleware/routing.js

@@ -0,0 +1,63 @@
+import { Logger } from '@pgpmjs/logger';
+const log = new Logger('routing');
+const RESOLVER_FUNCTION = 'resolve_route';
+const isValidSchemaName = (name) => /^[a-z_][a-z0-9_]*$/.test(name);
+/**
+ * Resolve a hostname through the compiled scoped-routing plane (host-only:
+ * path/method routing belongs to Traefik/Ingress, not the server).
+ * Returns null when there is no match (route_binding_id IS NULL) or when the
+ * resolver is not installed in the target database — callers fall back to the
+ * legacy services_public lookup in both cases.
+ */
+export const resolveRoute = async (pool, schema, host) => {
+    if (!isValidSchemaName(schema)) {
+        log.warn(`[resolve-route] invalid routing schema name: ${schema}`);
+        return null;
+    }
+    try {
+        const result = await pool.query(`SELECT * FROM "${schema}".${RESOLVER_FUNCTION}($1, '/', NULL)`, [host]);
+        const row = result.rows[0];
+        if (!row || row.route_binding_id === null) {
+            log.debug(`[resolve-route] no match for host=${host}`);
+            return null;
+        }
+        return row;
+    }
+    catch (error) {
+        const err = error;
+        // 42883 undefined_function / 3F000 invalid_schema_name: resolver not
+        // installed in this database — treat as no-match so the caller falls back.
+        if (err.code === '42883' || err.code === '3F000') {
+            log.debug(`[resolve-route] resolver not installed (${err.code}); falling back`);
+            return null;
+        }
+        throw error;
+    }
+};
+/**
+ * Map a resolved api-target route onto the legacy ApiStructure shape consumed
+ * by the rest of the middleware chain. Returns null when the route target is
+ * not an api surface or its resolved_config lacks the api essentials — the
+ * caller falls back to the legacy lookup.
+ */
+export const routeToApiStructure = (route, opts) => {
+    if (route.target_module !== 'apis' && route.target_module !== 'api') {
+        return null;
+    }
+    const config = (route.resolved_config ?? {});
+    if (!config.dbname || !config.schemas?.length) {
+        log.debug('[resolve-route] api target missing dbname/schemas in resolved_config; falling back');
+        return null;
+    }
+    return {
+        apiId: config.api_id ?? route.target_source_id ?? undefined,
+        dbname: config.dbname || opts.pg?.database || '',
+        anonRole: config.anon_role || 'anon',
+        roleName: config.role_name || 'authenticated',
+        schema: config.schemas,
+        apiModules: [],
+        domains: [],
+        databaseId: config.database_id,
+        isPublic: config.is_public ?? (opts.api?.isPublic ?? false),
+    };
+};

package/middleware/api.js

@@ -12,6 +12,7 @@ const express_context_1 = require("@constructive-io/express-context");
 const pg_cache_1 = require("pg-cache");
 const _50x_1 = __importDefault(require("../errors/50x"));
 const _404_message_1 = __importDefault(require("../errors/404-message"));
+const routing_1 = require("./routing");
 require("./types");
 const log = new logger_1.Logger('api');
 // =============================================================================
@@ -263,6 +264,48 @@ const resolveApiNameHeader = async (ctx) => {
 const resolveMetaSchemaHeader = (ctx, validatedSchemas) => {
     return createAdminStructure(ctx.opts, validatedSchemas, ctx.headers.databaseId);
 };
+/**
+ * Scoped routing plane resolution (additive, host-only): one indexed
+ * resolve_route() call against the compiled hostname/route bindings.
+ * Path/method routing belongs to Traefik/Ingress — the server only maps
+ * host → tenant/api/db/role. Returns null (fall back to the legacy
+ * services_public lookup) when disabled, unmatched, resolver not installed,
+ * or the target is not an api surface.
+ */
+const resolveScopedRoute = async (ctx) => {
+    const { opts, pool, host } = ctx;
+    if (!opts.api?.enableScopedRouting)
+        return null;
+    const schema = opts.api?.scopedRoutingSchema || 'constructive_routing_public';
+    const route = await (0, routing_1.resolveRoute)(pool, schema, host);
+    if (!route)
+        return null;
+    const structure = (0, routing_1.routeToApiStructure)(route, opts);
+    if (!structure)
+        return null;
+    log.debug(`[scoped-routing] resolved host=${host} → api=${structure.apiId} db=${structure.dbname}`);
+    if (!structure.databaseId || !structure.apiId)
+        return structure;
+    const loaderCtx = buildLoaderContext(pool, opts, {
+        api_id: structure.apiId,
+        database_id: structure.databaseId,
+        dbname: structure.dbname,
+        role_name: structure.roleName,
+        anon_role: structure.anonRole,
+        is_public: structure.isPublic ?? false,
+        schemas: structure.schema,
+    });
+    const settings = await resolveModuleSettings(defaultRegistry, loaderCtx);
+    return {
+        ...structure,
+        rlsModule: settings.rlsModule,
+        authSettings: settings.authSettings,
+        corsOrigins: settings.corsOrigins,
+        databaseSettings: settings.databaseSettings,
+        pubkeyChallengeSettings: settings.pubkeyChallengeSettings,
+        webauthnSettings: settings.webauthnSettings,
+    };
+};
 const resolveDomainLookup = async (ctx) => {
     const { opts, pool, domain, subdomain } = ctx;
     const isPublic = opts.api?.isPublic ?? false;
@@ -341,6 +384,7 @@ const getApiConfig = async (opts, req) => {
         subdomain,
         cacheKey,
         headers: getRoutingHeaders(req),
+        host: req.get('host') || '',
     };
     // Validate schemas upfront for modes that need them
     const apiOpts = opts.api || {};
@@ -373,7 +417,10 @@ const getApiConfig = async (opts, req) => {
             result = resolveMetaSchemaHeader(ctx, validatedSchemas);
             break;
         case 'domain-lookup':
-            result = await resolveDomainLookup(ctx);
+            result = await resolveScopedRoute(ctx);
+            if (!result) {
+                result = await resolveDomainLookup(ctx);
+            }
             if (!result && apiOpts.isPublic) {
                 const fallback = await buildDevFallbackError(ctx, req);
                 if (fallback)
@@ -403,6 +450,7 @@ const createApiMiddleware = (opts) => {
                 subdomain: null,
                 cacheKey: 'meta-api-off',
                 headers: {},
+                host: '',
             });
             req.databaseId = req.api.databaseId;
             req.svc_key = 'meta-api-off';

package/middleware/routing.d.ts

@@ -0,0 +1,36 @@
+import { Pool } from 'pg';
+import { ApiOptions, ApiStructure } from '../types';
+/** Row shape returned by <schema>.resolve_route() — frozen DB↔server contract. */
+export interface ResolvedRoute {
+    route_binding_id: string | null;
+    hostname: string | null;
+    matched_wildcard: boolean | null;
+    matched_path: string | null;
+    method: string | null;
+    priority: number | null;
+    domain_id: string | null;
+    target_catalog_id: string | null;
+    target_module: string | null;
+    target_source_id: string | null;
+    target_owner_scope: string | null;
+    target_owner_key: string | null;
+    resolved_config: Record<string, unknown> | null;
+    verification_status: string | null;
+    tls_status: string | null;
+    tls_secret_name: string | null;
+}
+/**
+ * Resolve a hostname through the compiled scoped-routing plane (host-only:
+ * path/method routing belongs to Traefik/Ingress, not the server).
+ * Returns null when there is no match (route_binding_id IS NULL) or when the
+ * resolver is not installed in the target database — callers fall back to the
+ * legacy services_public lookup in both cases.
+ */
+export declare const resolveRoute: (pool: Pool, schema: string, host: string) => Promise<ResolvedRoute | null>;
+/**
+ * Map a resolved api-target route onto the legacy ApiStructure shape consumed
+ * by the rest of the middleware chain. Returns null when the route target is
+ * not an api surface or its resolved_config lacks the api essentials — the
+ * caller falls back to the legacy lookup.
+ */
+export declare const routeToApiStructure: (route: ResolvedRoute, opts: ApiOptions) => ApiStructure | null;

package/middleware/routing.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.routeToApiStructure = exports.resolveRoute = void 0;
+const logger_1 = require("@pgpmjs/logger");
+const log = new logger_1.Logger('routing');
+const RESOLVER_FUNCTION = 'resolve_route';
+const isValidSchemaName = (name) => /^[a-z_][a-z0-9_]*$/.test(name);
+/**
+ * Resolve a hostname through the compiled scoped-routing plane (host-only:
+ * path/method routing belongs to Traefik/Ingress, not the server).
+ * Returns null when there is no match (route_binding_id IS NULL) or when the
+ * resolver is not installed in the target database — callers fall back to the
+ * legacy services_public lookup in both cases.
+ */
+const resolveRoute = async (pool, schema, host) => {
+    if (!isValidSchemaName(schema)) {
+        log.warn(`[resolve-route] invalid routing schema name: ${schema}`);
+        return null;
+    }
+    try {
+        const result = await pool.query(`SELECT * FROM "${schema}".${RESOLVER_FUNCTION}($1, '/', NULL)`, [host]);
+        const row = result.rows[0];
+        if (!row || row.route_binding_id === null) {
+            log.debug(`[resolve-route] no match for host=${host}`);
+            return null;
+        }
+        return row;
+    }
+    catch (error) {
+        const err = error;
+        // 42883 undefined_function / 3F000 invalid_schema_name: resolver not
+        // installed in this database — treat as no-match so the caller falls back.
+        if (err.code === '42883' || err.code === '3F000') {
+            log.debug(`[resolve-route] resolver not installed (${err.code}); falling back`);
+            return null;
+        }
+        throw error;
+    }
+};
+exports.resolveRoute = resolveRoute;
+/**
+ * Map a resolved api-target route onto the legacy ApiStructure shape consumed
+ * by the rest of the middleware chain. Returns null when the route target is
+ * not an api surface or its resolved_config lacks the api essentials — the
+ * caller falls back to the legacy lookup.
+ */
+const routeToApiStructure = (route, opts) => {
+    if (route.target_module !== 'apis' && route.target_module !== 'api') {
+        return null;
+    }
+    const config = (route.resolved_config ?? {});
+    if (!config.dbname || !config.schemas?.length) {
+        log.debug('[resolve-route] api target missing dbname/schemas in resolved_config; falling back');
+        return null;
+    }
+    return {
+        apiId: config.api_id ?? route.target_source_id ?? undefined,
+        dbname: config.dbname || opts.pg?.database || '',
+        anonRole: config.anon_role || 'anon',
+        roleName: config.role_name || 'authenticated',
+        schema: config.schemas,
+        apiModules: [],
+        domains: [],
+        databaseId: config.database_id,
+        isPublic: config.is_public ?? (opts.api?.isPublic ?? false),
+    };
+};
+exports.routeToApiStructure = routeToApiStructure;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "4.44.2",
+  "version": "4.45.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -42,18 +42,18 @@
   ],
   "dependencies": {
     "@constructive-io/csrf": "^0.17.0",
-    "@constructive-io/express-context": "^0.12.1",
-    "@constructive-io/graphql-env": "^3.16.1",
-    "@constructive-io/graphql-types": "^3.14.1",
+    "@constructive-io/express-context": "^0.12.2",
+    "@constructive-io/graphql-env": "^3.16.3",
+    "@constructive-io/graphql-types": "^3.15.0",
     "@constructive-io/query-builder": "^2.25.0",
     "@constructive-io/s3-utils": "^2.20.0",
     "@constructive-io/url-domains": "^2.19.0",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
-    "@pgpmjs/env": "^2.28.1",
+    "@pgpmjs/env": "^2.28.2",
     "@pgpmjs/logger": "^2.14.0",
-    "@pgpmjs/server-utils": "^3.15.2",
-    "@pgpmjs/types": "^2.35.0",
-    "agentic-server": "0.11.1",
+    "@pgpmjs/server-utils": "^3.15.3",
+    "@pgpmjs/types": "^2.35.1",
+    "agentic-server": "0.11.2",
     "cors": "^2.8.6",
     "deepmerge": "^4.3.1",
     "express": "^5.2.1",
@@ -62,17 +62,17 @@
     "grafserv": "1.0.0",
     "graphile-build": "5.0.2",
     "graphile-build-pg": "5.0.2",
-    "graphile-cache": "^3.15.1",
+    "graphile-cache": "^3.15.2",
     "graphile-config": "1.0.1",
-    "graphile-function-bindings": "^0.5.1",
-    "graphile-settings": "^5.15.1",
+    "graphile-function-bindings": "^0.5.3",
+    "graphile-settings": "^5.17.0",
     "graphile-utils": "5.0.1",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
     "lru-cache": "^11.2.7",
     "pg": "^8.21.0",
-    "pg-cache": "^3.15.1",
-    "pg-env": "^1.18.0",
+    "pg-cache": "^3.15.2",
+    "pg-env": "^1.18.1",
     "pg-query-context": "^2.19.0",
     "pg-sql2": "5.0.1",
     "postgraphile": "5.0.3",
@@ -87,10 +87,10 @@
     "@types/pg": "^8.20.0",
     "@types/request-ip": "^0.0.41",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "4.21.1",
+    "graphile-test": "4.21.3",
     "makage": "^0.3.0",
     "nodemon": "^3.1.14",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "0e4acd5d0db04587fb0112b047be6f2c8f2493d9"
+  "gitHead": "b0843e23070cf4e28a119b06e4ebd1828be1ebde"
 }