@constructive-io/graphql-server 5.1.0 → 5.3.2

package/README.md

@@ -56,7 +56,7 @@ This starts the server with env defaults from `@constructive-io/graphql-env`.
 
 ## What it does
 
-Runs an Express server that wires CORS, uploads, domain parsing, auth, and PostGraphile into a single GraphQL endpoint. It serves `/graphql` and `/graphiql`, injects per-request `pgSettings`, and flushes cached schemas on demand or via database notifications. When meta API is enabled, it resolves API config (schemas, roles, modules) from the meta schema using the request host and enforces `api.isPublic`, with optional header overrides in private mode; when meta API is disabled, it serves the fixed schemas and roles from `api.exposedSchemas`, `api.anonRole`, `api.roleName`, and `api.defaultDatabaseId`.
+Runs an Express server that wires CORS, uploads, domain parsing, auth, and PostGraphile into a single GraphQL endpoint. It serves `/graphql` and `/graphiql`, injects per-request `pgSettings`, and flushes cached schemas on demand or via database notifications. When meta API is enabled, it resolves API config (schemas, roles, modules) from the meta schema using the request host and enforces `api.isPublic`, with optional header overrides in private mode; when meta API is disabled, it serves the fixed schemas and roles from `api.exposedSchemas`, `api.anonRole`, and `api.roleName`.
 
 ## Key Features
 
@@ -99,21 +99,17 @@ For the operational workflow, sampler output, and heap snapshot usage, see [docs
 - `GET /debug/memory` -> memory/process/Graphile debug snapshot when observability is enabled
 - `GET /debug/db` -> PostgreSQL activity/locks/pool debug snapshot when observability is enabled
 
-## Meta API routing
+## Scoped routing
 
-When `API_ENABLE_META=true` (default):
+This is a production-only server: every request is resolved through the scoped-routing plane. There is no static single-tenant mode and no flag to disable routing. For single-database local development without route resolution or a database id, use [`@constructive-io/graphql-dev-server`](../dev-server/README.md).
 
-- The server resolves APIs from `services_public.domains` using the request host.
+- The server resolves the request host with a single `resolve_route()` call against the compiled route bindings in the scoped routing schema (`API_SCOPED_ROUTING_SCHEMA`, default `constructive_routing_public`), mapping host → tenant/api/database/role.
 - Only APIs where `api.is_public` matches `API_IS_PUBLIC` are served.
 - In private mode (`API_IS_PUBLIC=false`), you can override with headers:
   - `X-Api-Name` + `X-Database-Id`
   - `X-Schemata` + `X-Database-Id`
   - `X-Meta-Schema` + `X-Database-Id`
-
-When `API_ENABLE_META=false`:
-
-- The server skips meta lookups and serves the fixed schemas in `API_EXPOSED_SCHEMAS`.
-- Roles and database IDs come from `API_ANON_ROLE`, `API_ROLE_NAME`, and `API_DEFAULT_DATABASE_ID`.
+- A resolved database id is always required. There is no default database, so a request that resolves without a database id is rejected (`NO_DATABASE_ID` → HTTP 500).
 
 ## Configuration
 
@@ -130,13 +126,12 @@ Configuration is merged from defaults, config files, and env vars via `@construc
 | `FEATURES_SIMPLE_INFLECTION`   | Enable simple inflection              | `true`                                                        |
 | `FEATURES_OPPOSITE_BASE_NAMES` | Enable opposite base names            | `true`                                                        |
 | `FEATURES_POSTGIS`             | Enable PostGIS support                | `true`                                                        |
-| `API_ENABLE_META`              | Enable meta API routing               | `true`                                                        |
+| `API_SCOPED_ROUTING_SCHEMA`    | Schema containing `resolve_route()`   | `constructive_routing_public`                                 |
 | `API_IS_PUBLIC`                | Serve public APIs only                | `true`                                                        |
-| `API_EXPOSED_SCHEMAS`          | Schemas when meta routing is disabled | empty                                                         |
-| `API_META_SCHEMAS`             | Meta schemas to query                 | `services_public,metaschema_public,metaschema_modules_public` |
+| `API_EXPOSED_SCHEMAS`          | Additional schemas to expose          | empty                                                         |
+| `API_META_SCHEMAS`             | Meta schemas to query                 | `constructive_routing_public,metaschema_public,metaschema_modules_public` |
 | `API_ANON_ROLE`                | Anonymous role name                   | `administrator`                                               |
 | `API_ROLE_NAME`                | Authenticated role name               | `administrator`                                               |
-| `API_DEFAULT_DATABASE_ID`      | Default database ID                   | `hard-coded`                                                  |
 | `GRAPHQL_OBSERVABILITY_ENABLED` | Master switch for debug routes and sampler | `false`                                                  |
 | `GRAPHQL_DEBUG_SAMPLER_ENABLED` | Enables periodic NDJSON sampling when observability is on | `true`                                   |
 | `GRAPHQL_DEBUG_SAMPLER_INTERVAL_MS` | Sampler interval in milliseconds | `10000`                                                       |

package/esm/middleware/api.js

@@ -72,6 +72,18 @@ const resolveModuleSettings = async (registry, ctx) => {
 // Helpers
 // =============================================================================
 const isApiError = (result) => !!result && typeof result.errorHtml === 'string';
+/**
+ * Every resolved API surface must carry a database id — there is no default
+ * database. A resolved structure without one is a misconfiguration; fail loud
+ * rather than silently proceeding with an undefined tenant.
+ */
+const assertDatabaseId = (result) => {
+    if (!result.databaseId) {
+        const error = new Error('No database id resolved for this request. A database id is required; there is no default database.');
+        error.code = 'NO_DATABASE_ID';
+        throw error;
+    }
+};
 const parseCommaSeparatedHeader = (value) => value.split(',').map((s) => s.trim()).filter(Boolean);
 const getPrivateHeaderMode = (headers) => {
     if (headers.apiName)
@@ -161,28 +173,11 @@ const queryByApiName = async (pool, databaseId, name, isPublic) => {
 // =============================================================================
 const determineMode = (ctx) => {
     const { opts, headers } = ctx;
-    // Static single-tenant mode: scoped routing off — expose configured schemas
-    // directly with no route resolution.
-    if (!opts.api?.enableScopedRouting)
-        return 'static';
     if (opts.api?.isPublic === false) {
         return getPrivateHeaderMode(headers) ?? 'scoped-route';
     }
     return 'scoped-route';
 };
-const resolveStatic = (ctx) => {
-    const { opts } = ctx;
-    return {
-        dbname: opts.pg?.database ?? '',
-        anonRole: opts.api?.anonRole ?? '',
-        roleName: opts.api?.roleName ?? '',
-        schema: opts.api?.exposedSchemas ?? [],
-        apiModules: [],
-        domains: [],
-        databaseId: opts.api?.defaultDatabaseId,
-        isPublic: false
-    };
-};
 const resolveSchemataHeader = async (ctx, validatedSchemas) => {
     const { opts, headers } = ctx;
     const headerSchemas = parseCommaSeparatedHeader(headers.schemata);
@@ -221,8 +216,6 @@ const resolveMetaSchemaHeader = (ctx, validatedSchemas) => {
  */
 const resolveScopedRoute = async (ctx) => {
     const { opts, pool, host } = ctx;
-    if (!opts.api?.enableScopedRouting)
-        return null;
     const schema = opts.api?.scopedRoutingSchema || 'constructive_routing_public';
     const route = await resolveRoute(pool, schema, host);
     if (!route)
@@ -295,9 +288,6 @@ export const getApiConfig = async (opts, req) => {
     const mode = determineMode(ctx);
     let result;
     switch (mode) {
-        case 'static':
-            result = resolveStatic(ctx);
-            break;
         case 'schemata-header':
             result = await resolveSchemataHeader(ctx, validatedSchemas);
             break;
@@ -313,6 +303,7 @@ export const getApiConfig = async (opts, req) => {
     }
     // Cache successful results
     if (result && !isApiError(result)) {
+        assertDatabaseId(result);
         svcCache.set(cacheKey, result);
     }
     return result;
@@ -323,22 +314,6 @@ export const getApiConfig = async (opts, req) => {
 export const createApiMiddleware = (opts) => {
     return async (req, res, next) => {
         log.debug(`[api-middleware] ${req.method} ${req.path}`);
-        // Fast path: static single-tenant mode (scoped routing disabled) — no
-        // route resolution, expose the configured schemas directly.
-        if (!opts.api?.enableScopedRouting) {
-            req.api = resolveStatic({
-                opts,
-                pool: null,
-                domain: '',
-                subdomain: null,
-                cacheKey: 'static',
-                headers: {},
-                host: ''
-            });
-            req.databaseId = req.api.databaseId;
-            req.svc_key = 'static';
-            return next();
-        }
         try {
             const apiConfig = await getApiConfig(opts, req);
             if (isApiError(apiConfig)) {
@@ -360,6 +335,11 @@ export const createApiMiddleware = (opts) => {
                 res.status(404).send(errorPage404Message(err.message));
                 return;
             }
+            if (err.code === 'NO_DATABASE_ID') {
+                log.error('[api-middleware] no database id resolved:', err.message);
+                res.status(500).send(errorPage50x);
+                return;
+            }
             if (err.message?.includes('does not exist')) {
                 res.status(404).send(errorPage404Message("The resource you're looking for does not exist."));
                 return;

package/esm/server.js

@@ -85,12 +85,8 @@ class Server {
             serverHost: effectiveOpts.server?.host,
             serverPort: effectiveOpts.server?.port,
             apiIsPublic: apiOpts.isPublic,
-            enableScopedRouting: apiOpts.enableScopedRouting,
             scopedRoutingSchema: apiOpts.scopedRoutingSchema,
             metaSchemas: apiOpts.metaSchemas?.join(',') || 'default',
-            exposedSchemas: apiOpts.exposedSchemas?.join(',') || 'none',
-            anonRole: apiOpts.anonRole,
-            roleName: apiOpts.roleName,
             observabilityEnabled
         });
         if (observabilityRequested && !observabilityEnabled) {

package/middleware/api.js

@@ -78,6 +78,18 @@ const resolveModuleSettings = async (registry, ctx) => {
 // Helpers
 // =============================================================================
 const isApiError = (result) => !!result && typeof result.errorHtml === 'string';
+/**
+ * Every resolved API surface must carry a database id — there is no default
+ * database. A resolved structure without one is a misconfiguration; fail loud
+ * rather than silently proceeding with an undefined tenant.
+ */
+const assertDatabaseId = (result) => {
+    if (!result.databaseId) {
+        const error = new Error('No database id resolved for this request. A database id is required; there is no default database.');
+        error.code = 'NO_DATABASE_ID';
+        throw error;
+    }
+};
 const parseCommaSeparatedHeader = (value) => value.split(',').map((s) => s.trim()).filter(Boolean);
 const getPrivateHeaderMode = (headers) => {
     if (headers.apiName)
@@ -169,28 +181,11 @@ const queryByApiName = async (pool, databaseId, name, isPublic) => {
 // =============================================================================
 const determineMode = (ctx) => {
     const { opts, headers } = ctx;
-    // Static single-tenant mode: scoped routing off — expose configured schemas
-    // directly with no route resolution.
-    if (!opts.api?.enableScopedRouting)
-        return 'static';
     if (opts.api?.isPublic === false) {
         return getPrivateHeaderMode(headers) ?? 'scoped-route';
     }
     return 'scoped-route';
 };
-const resolveStatic = (ctx) => {
-    const { opts } = ctx;
-    return {
-        dbname: opts.pg?.database ?? '',
-        anonRole: opts.api?.anonRole ?? '',
-        roleName: opts.api?.roleName ?? '',
-        schema: opts.api?.exposedSchemas ?? [],
-        apiModules: [],
-        domains: [],
-        databaseId: opts.api?.defaultDatabaseId,
-        isPublic: false
-    };
-};
 const resolveSchemataHeader = async (ctx, validatedSchemas) => {
     const { opts, headers } = ctx;
     const headerSchemas = parseCommaSeparatedHeader(headers.schemata);
@@ -229,8 +224,6 @@ const resolveMetaSchemaHeader = (ctx, validatedSchemas) => {
  */
 const resolveScopedRoute = async (ctx) => {
     const { opts, pool, host } = ctx;
-    if (!opts.api?.enableScopedRouting)
-        return null;
     const schema = opts.api?.scopedRoutingSchema || 'constructive_routing_public';
     const route = await (0, routing_1.resolveRoute)(pool, schema, host);
     if (!route)
@@ -303,9 +296,6 @@ const getApiConfig = async (opts, req) => {
     const mode = determineMode(ctx);
     let result;
     switch (mode) {
-        case 'static':
-            result = resolveStatic(ctx);
-            break;
         case 'schemata-header':
             result = await resolveSchemataHeader(ctx, validatedSchemas);
             break;
@@ -321,6 +311,7 @@ const getApiConfig = async (opts, req) => {
     }
     // Cache successful results
     if (result && !isApiError(result)) {
+        assertDatabaseId(result);
         server_utils_1.svcCache.set(cacheKey, result);
     }
     return result;
@@ -332,22 +323,6 @@ exports.getApiConfig = getApiConfig;
 const createApiMiddleware = (opts) => {
     return async (req, res, next) => {
         log.debug(`[api-middleware] ${req.method} ${req.path}`);
-        // Fast path: static single-tenant mode (scoped routing disabled) — no
-        // route resolution, expose the configured schemas directly.
-        if (!opts.api?.enableScopedRouting) {
-            req.api = resolveStatic({
-                opts,
-                pool: null,
-                domain: '',
-                subdomain: null,
-                cacheKey: 'static',
-                headers: {},
-                host: ''
-            });
-            req.databaseId = req.api.databaseId;
-            req.svc_key = 'static';
-            return next();
-        }
         try {
             const apiConfig = await (0, exports.getApiConfig)(opts, req);
             if (isApiError(apiConfig)) {
@@ -369,6 +344,11 @@ const createApiMiddleware = (opts) => {
                 res.status(404).send((0, _404_message_1.default)(err.message));
                 return;
             }
+            if (err.code === 'NO_DATABASE_ID') {
+                log.error('[api-middleware] no database id resolved:', err.message);
+                res.status(500).send(_50x_1.default);
+                return;
+            }
             if (err.message?.includes('does not exist')) {
                 res.status(404).send((0, _404_message_1.default)("The resource you're looking for does not exist."));
                 return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.1.0",
+  "version": "5.3.2",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -41,39 +41,39 @@
     "backend"
   ],
   "dependencies": {
-    "@constructive-io/csrf": "^0.17.0",
-    "@constructive-io/express-context": "^0.13.0",
-    "@constructive-io/graphql-env": "^3.17.0",
-    "@constructive-io/graphql-types": "^3.16.0",
-    "@constructive-io/query-builder": "^3.0.1",
-    "@constructive-io/s3-utils": "^2.20.0",
-    "@constructive-io/url-domains": "^2.19.0",
+    "@constructive-io/csrf": "^0.18.2",
+    "@constructive-io/express-context": "^0.14.2",
+    "@constructive-io/graphql-env": "^3.19.2",
+    "@constructive-io/graphql-types": "^3.18.2",
+    "@constructive-io/query-builder": "^3.1.2",
+    "@constructive-io/s3-utils": "^2.21.2",
+    "@constructive-io/url-domains": "^2.20.2",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
-    "@pgpmjs/env": "^2.29.0",
-    "@pgpmjs/logger": "^2.14.0",
-    "@pgpmjs/server-utils": "^3.15.4",
-    "@pgpmjs/types": "^2.36.0",
-    "agentic-server": "0.11.3",
+    "@pgpmjs/env": "^2.30.2",
+    "@pgpmjs/logger": "^2.15.2",
+    "@pgpmjs/server-utils": "^3.16.2",
+    "@pgpmjs/types": "^2.37.2",
+    "agentic-server": "0.12.2",
     "cors": "^2.8.6",
     "deepmerge": "^4.3.1",
     "express": "^5.2.1",
-    "gql-ast": "^3.13.0",
+    "gql-ast": "^3.14.2",
     "grafast": "1.0.2",
     "grafserv": "1.0.0",
     "graphile-build": "5.0.2",
     "graphile-build-pg": "5.0.2",
-    "graphile-cache": "^4.0.1",
+    "graphile-cache": "^4.1.2",
     "graphile-config": "1.0.1",
-    "graphile-function-bindings": "^1.0.5",
-    "graphile-settings": "^6.0.5",
+    "graphile-function-bindings": "^1.1.2",
+    "graphile-settings": "^6.1.2",
     "graphile-utils": "5.0.1",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
     "lru-cache": "^11.2.7",
     "pg": "^8.21.0",
-    "pg-cache": "^3.15.3",
-    "pg-env": "^1.18.1",
-    "pg-query-context": "^2.19.0",
+    "pg-cache": "^3.16.2",
+    "pg-env": "^1.19.2",
+    "pg-query-context": "^2.20.2",
     "pg-sql2": "5.0.1",
     "postgraphile": "5.0.3",
     "request-ip": "^3.3.0"
@@ -87,10 +87,10 @@
     "@types/pg": "^8.20.0",
     "@types/request-ip": "^0.0.41",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "5.0.5",
+    "graphile-test": "5.1.2",
     "makage": "^0.3.0",
     "nodemon": "^3.1.14",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "39db6d576bce7bc1de8123849f237b1695779d88"
+  "gitHead": "08741ce3a6897192c2dbc7d1da48b9f456ffb59f"
 }

package/server.js

@@ -92,12 +92,8 @@ class Server {
             serverHost: effectiveOpts.server?.host,
             serverPort: effectiveOpts.server?.port,
             apiIsPublic: apiOpts.isPublic,
-            enableScopedRouting: apiOpts.enableScopedRouting,
             scopedRoutingSchema: apiOpts.scopedRoutingSchema,
             metaSchemas: apiOpts.metaSchemas?.join(',') || 'default',
-            exposedSchemas: apiOpts.exposedSchemas?.join(',') || 'none',
-            anonRole: apiOpts.anonRole,
-            roleName: apiOpts.roleName,
             observabilityEnabled
         });
         if (observabilityRequested && !observabilityEnabled) {