@constructive-io/graphql-server 5.0.4 → 5.1.0

package/middleware/routing.d.ts

@@ -23,14 +23,13 @@ export interface ResolvedRoute {
  * Resolve a hostname through the compiled scoped-routing plane (host-only:
  * path/method routing belongs to Traefik/Ingress, not the server).
  * Returns null when there is no match (route_binding_id IS NULL) or when the
- * resolver is not installed in the target database — callers fall back to the
- * legacy services_public lookup in both cases.
+ * resolver is not installed in the target database — in both cases the caller
+ * treats it as a hard no-match (→ 404); there is no legacy fallback.
  */
 export declare const resolveRoute: (pool: Pool, schema: string, host: string) => Promise<ResolvedRoute | null>;
 /**
- * Map a resolved api-target route onto the legacy ApiStructure shape consumed
- * by the rest of the middleware chain. Returns null when the route target is
- * not an api surface or its resolved_config lacks the api essentials — the
- * caller falls back to the legacy lookup.
+ * Map a resolved api-target route onto the ApiStructure shape consumed by the
+ * rest of the middleware chain. Returns null when the route target is not an
+ * api surface or its resolved_config lacks the api essentials (→ 404).
  */
 export declare const routeToApiStructure: (route: ResolvedRoute, opts: ApiOptions) => ApiStructure | null;

package/middleware/routing.js

@@ -9,8 +9,8 @@ const isValidSchemaName = (name) => /^[a-z_][a-z0-9_]*$/.test(name);
  * Resolve a hostname through the compiled scoped-routing plane (host-only:
  * path/method routing belongs to Traefik/Ingress, not the server).
  * Returns null when there is no match (route_binding_id IS NULL) or when the
- * resolver is not installed in the target database — callers fall back to the
- * legacy services_public lookup in both cases.
+ * resolver is not installed in the target database — in both cases the caller
+ * treats it as a hard no-match (→ 404); there is no legacy fallback.
  */
 const resolveRoute = async (pool, schema, host) => {
     if (!isValidSchemaName(schema)) {
@@ -29,9 +29,9 @@ const resolveRoute = async (pool, schema, host) => {
     catch (error) {
         const err = error;
         // 42883 undefined_function / 3F000 invalid_schema_name: resolver not
-        // installed in this database — treat as no-match so the caller falls back.
+        // installed in this database — treat as a hard no-match.
         if (err.code === '42883' || err.code === '3F000') {
-            log.debug(`[resolve-route] resolver not installed (${err.code}); falling back`);
+            log.debug(`[resolve-route] resolver not installed (${err.code}); no match`);
             return null;
         }
         throw error;
@@ -39,10 +39,9 @@ const resolveRoute = async (pool, schema, host) => {
 };
 exports.resolveRoute = resolveRoute;
 /**
- * Map a resolved api-target route onto the legacy ApiStructure shape consumed
- * by the rest of the middleware chain. Returns null when the route target is
- * not an api surface or its resolved_config lacks the api essentials — the
- * caller falls back to the legacy lookup.
+ * Map a resolved api-target route onto the ApiStructure shape consumed by the
+ * rest of the middleware chain. Returns null when the route target is not an
+ * api surface or its resolved_config lacks the api essentials (→ 404).
  */
 const routeToApiStructure = (route, opts) => {
     if (route.target_module !== 'apis' && route.target_module !== 'api') {
@@ -50,7 +49,7 @@ const routeToApiStructure = (route, opts) => {
     }
     const config = (route.resolved_config ?? {});
     if (!config.dbname || !config.schemas?.length) {
-        log.debug('[resolve-route] api target missing dbname/schemas in resolved_config; falling back');
+        log.debug('[resolve-route] api target missing dbname/schemas in resolved_config; no match');
         return null;
     }
     return {
@@ -62,7 +61,7 @@ const routeToApiStructure = (route, opts) => {
         apiModules: [],
         domains: [],
         databaseId: config.database_id,
-        isPublic: config.is_public ?? (opts.api?.isPublic ?? false),
+        isPublic: config.is_public ?? (opts.api?.isPublic ?? false)
     };
 };
 exports.routeToApiStructure = routeToApiStructure;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.0.4",
+  "version": "5.1.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -42,18 +42,18 @@
   ],
   "dependencies": {
     "@constructive-io/csrf": "^0.17.0",
-    "@constructive-io/express-context": "^0.12.2",
-    "@constructive-io/graphql-env": "^3.16.3",
-    "@constructive-io/graphql-types": "^3.15.0",
+    "@constructive-io/express-context": "^0.13.0",
+    "@constructive-io/graphql-env": "^3.17.0",
+    "@constructive-io/graphql-types": "^3.16.0",
     "@constructive-io/query-builder": "^3.0.1",
     "@constructive-io/s3-utils": "^2.20.0",
     "@constructive-io/url-domains": "^2.19.0",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
-    "@pgpmjs/env": "^2.28.2",
+    "@pgpmjs/env": "^2.29.0",
     "@pgpmjs/logger": "^2.14.0",
-    "@pgpmjs/server-utils": "^3.15.3",
-    "@pgpmjs/types": "^2.35.1",
-    "agentic-server": "0.11.2",
+    "@pgpmjs/server-utils": "^3.15.4",
+    "@pgpmjs/types": "^2.36.0",
+    "agentic-server": "0.11.3",
     "cors": "^2.8.6",
     "deepmerge": "^4.3.1",
     "express": "^5.2.1",
@@ -62,16 +62,16 @@
     "grafserv": "1.0.0",
     "graphile-build": "5.0.2",
     "graphile-build-pg": "5.0.2",
-    "graphile-cache": "^4.0.0",
+    "graphile-cache": "^4.0.1",
     "graphile-config": "1.0.1",
-    "graphile-function-bindings": "^1.0.4",
-    "graphile-settings": "^6.0.4",
+    "graphile-function-bindings": "^1.0.5",
+    "graphile-settings": "^6.0.5",
     "graphile-utils": "5.0.1",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
     "lru-cache": "^11.2.7",
     "pg": "^8.21.0",
-    "pg-cache": "^3.15.2",
+    "pg-cache": "^3.15.3",
     "pg-env": "^1.18.1",
     "pg-query-context": "^2.19.0",
     "pg-sql2": "5.0.1",
@@ -87,10 +87,10 @@
     "@types/pg": "^8.20.0",
     "@types/request-ip": "^0.0.41",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "5.0.4",
+    "graphile-test": "5.0.5",
     "makage": "^0.3.0",
     "nodemon": "^3.1.14",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "d48f39ebd4b7dcbab22df7c57438c06efd9e223d"
+  "gitHead": "39db6d576bce7bc1de8123849f237b1695779d88"
 }

package/server.js

@@ -5,37 +5,37 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Server = exports.GraphQLServer = void 0;
 const csrf_1 = require("@constructive-io/csrf");
+const express_context_1 = require("@constructive-io/express-context");
 const graphql_env_1 = require("@constructive-io/graphql-env");
+const url_domains_1 = require("@constructive-io/url-domains");
 const logger_1 = require("@pgpmjs/logger");
 const server_utils_1 = require("@pgpmjs/server-utils");
-const url_domains_1 = require("@constructive-io/url-domains");
+const agentic_server_1 = require("agentic-server");
 const cookie_parser_1 = __importDefault(require("cookie-parser"));
 const express_1 = __importDefault(require("express"));
-const graphql_upload_1 = __importDefault(require("graphql-upload"));
 const graphile_cache_1 = require("graphile-cache");
+const graphql_upload_1 = __importDefault(require("graphql-upload"));
 const pg_cache_1 = require("pg-cache");
 const request_ip_1 = __importDefault(require("request-ip"));
 const debug_db_snapshot_1 = require("./diagnostics/debug-db-snapshot");
+const debug_sampler_1 = require("./diagnostics/debug-sampler");
 const observability_1 = require("./diagnostics/observability");
 const api_1 = require("./middleware/api");
 const auth_1 = require("./middleware/auth");
+// Auth cookie handling is done via AuthCookiePlugin in grafserv
+const captcha_1 = require("./middleware/captcha");
+const cookie_1 = require("./middleware/cookie");
 const cors_1 = require("./middleware/cors");
 const error_handler_1 = require("./middleware/error-handler");
 const favicon_1 = require("./middleware/favicon");
-const fn_1 = require("./middleware/fn");
 const flush_1 = require("./middleware/flush");
+const fn_1 = require("./middleware/fn");
 const graphile_1 = require("./middleware/graphile");
 const multipart_bridge_1 = require("./middleware/multipart-bridge");
 const debug_db_1 = require("./middleware/observability/debug-db");
 const debug_memory_1 = require("./middleware/observability/debug-memory");
 const guard_1 = require("./middleware/observability/guard");
 const request_logger_1 = require("./middleware/observability/request-logger");
-// Auth cookie handling is done via AuthCookiePlugin in grafserv
-const captcha_1 = require("./middleware/captcha");
-const cookie_1 = require("./middleware/cookie");
-const agentic_server_1 = require("agentic-server");
-const express_context_1 = require("@constructive-io/express-context");
-const debug_sampler_1 = require("./diagnostics/debug-sampler");
 const log = new logger_1.Logger('server');
 /**
  * Creates and starts a GraphQL server instance
@@ -92,12 +92,13 @@ class Server {
             serverHost: effectiveOpts.server?.host,
             serverPort: effectiveOpts.server?.port,
             apiIsPublic: apiOpts.isPublic,
-            enableServicesApi: apiOpts.enableServicesApi,
+            enableScopedRouting: apiOpts.enableScopedRouting,
+            scopedRoutingSchema: apiOpts.scopedRoutingSchema,
             metaSchemas: apiOpts.metaSchemas?.join(',') || 'default',
             exposedSchemas: apiOpts.exposedSchemas?.join(',') || 'none',
             anonRole: apiOpts.anonRole,
             roleName: apiOpts.roleName,
-            observabilityEnabled,
+            observabilityEnabled
         });
         if (observabilityRequested && !observabilityEnabled) {
             const reasons = [];
@@ -136,7 +137,7 @@ class Server {
         app.use((0, cors_1.cors)(fallbackOrigin));
         app.use('/graphql', graphql_upload_1.default.graphqlUploadExpress({
             maxFileSize: 10 * 1024 * 1024, // 10 MB
-            maxFiles: 10,
+            maxFiles: 10
         }));
         // Rewrite Content-Type after graphql-upload so grafserv accepts the request
         app.use('/graphql', multipart_bridge_1.multipartBridge);
@@ -154,8 +155,8 @@ class Server {
             cookieOptions: {
                 httpOnly: false, // SPA clients need to read this via document.cookie
                 secure: process.env.NODE_ENV === 'production',
-                sameSite: 'lax',
-            },
+                sameSite: 'lax'
+            }
         });
         const csrfProtect = (req, res, next) => {
             // Skip CSRF for Bearer token auth