@constructive-io/graphql-server 5.20.5 → 5.20.7

package/esm/middleware/graphile.js

@@ -1,6 +1,6 @@
 import './types'; // for Request type
-import crypto from 'node:crypto';
-import { classify, errors, parse } from '@constructive-io/errors';
+import { errors } from '@constructive-io/errors';
+import { DEFAULT_REQUEST_PROTECTION, protectionPgSettings } from '@constructive-io/express-context';
 import { getNodeEnv } from '@pgpmjs/env';
 import { Logger } from '@pgpmjs/logger';
 import { createGraphileInstance, graphileCache } from 'graphile-cache';
@@ -12,86 +12,10 @@ import { isGraphqlObservabilityEnabled } from '../diagnostics/observability';
 import { HandlerCreationError } from '../errors/api-errors';
 import { respondWithGraphQLError } from '../errors/graphql-response';
 import { AuthCookiePlugin } from '../plugins/auth-cookie-plugin';
+import { RequestProtectionPlugin } from '../plugins/request-protection-plugin';
+import { maskError } from './mask-error';
 import { observeGraphileBuild } from './observability/graphile-build-stats';
-const maskErrorLog = new Logger('graphile:maskError');
 const isDev = () => getNodeEnv() === 'development';
-/**
- * GraphQL framework protocol codes. These originate in the GraphQL/grafast
- * transport layer (not in constructive-db), so they are not Constructive domain
- * codes in the `@constructive-io/errors` registry. They are always safe to
- * surface — they carry no sensitive detail. Everything else (auth, account,
- * resource, constraint, and every constructive-db code) is classified by the
- * registry, which is the single source of truth for public vs. internal.
- */
-const GRAPHQL_PROTOCOL_CODES = new Set([
-    'GRAPHQL_VALIDATION_FAILED',
-    'GRAPHQL_PARSE_FAILED',
-    'PERSISTED_QUERY_NOT_FOUND',
-    'PERSISTED_QUERY_NOT_SUPPORTED'
-]);
-/** A code is safe to surface when the registry classifies it public, or it is a
- * GraphQL framework protocol code. */
-const isPublicCode = (code) => Boolean(code) && (classify(code) === 'public' || GRAPHQL_PROTOCOL_CODES.has(code));
-/**
- * Normalize any GraphQL/database error into a canonical Constructive shape.
- *
- * Database errors surface through Grafast without a populated `extensions.code`
- * (the semantic code lives in the message, and any SQLSTATE/DETAIL lives on the
- * underlying pg error at `originalError`). We parse `originalError` first so we
- * can recover the structured code, then fall back to the GraphQL error itself.
- */
-const normalizeError = (error) => {
-    const original = error.originalError;
-    const fromOriginal = original ? parse(original) : null;
-    const parsed = fromOriginal?.code ? fromOriginal : parse(error);
-    return { code: parsed.code, context: parsed.context, class: parsed.class };
-};
-/**
- * Production-aware error handling backed by `@constructive-io/errors`.
- *
- * 1. Enrich `extensions.code`/`class`/`context` from the parsed error so clients
- *    always receive a machine-readable code (fixing the gap where database
- *    errors reached clients as a bare message with empty `extensions`).
- * 2. Surface public (registered/allowlisted) errors as-is.
- * 3. In development, pass everything through (enriched) for debugging.
- * 4. In production, mask internal/unknown errors behind a reference ID and log
- *    the original.
- */
-const maskError = (error) => {
-    const { code, context, class: errorClass } = normalizeError(error);
-    // Lift the structured code onto extensions for every recognized error so
-    // clients always receive a machine-readable code (`extensions` is read-only
-    // on GraphQLError, so we build a formatted error rather than mutating it).
-    const extensions = { ...error.extensions };
-    if (code) {
-        extensions.code = code;
-        extensions.class = errorClass;
-        if (Object.keys(context).length > 0) {
-            extensions.context = context;
-        }
-    }
-    const effectiveCode = code ?? error.extensions?.code;
-    if (isPublicCode(effectiveCode) || getNodeEnv() === 'development') {
-        // Note: grafserv strips originalError and internal extensions before
-        // serializing to the client, so returning the enriched error is safe.
-        return {
-            message: error.message,
-            ...(error.locations ? { locations: error.locations } : {}),
-            ...(error.path ? { path: error.path } : {}),
-            extensions,
-        };
-    }
-    // Mask internal/unknown errors with a reference ID.
-    const errorId = crypto.randomBytes(8).toString('hex');
-    maskErrorLog.error(`[masked-error:${errorId}]`, error);
-    return {
-        message: `An unexpected error occurred. Reference: ${errorId}`,
-        extensions: {
-            code: 'INTERNAL_SERVER_ERROR',
-            errorId
-        }
-    };
-};
 // =============================================================================
 // Single-Flight Pattern: In-Flight Tracking
 // =============================================================================
@@ -136,6 +60,7 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings, apiId,
         extends: [createConstructivePreset(databaseSettings)],
         plugins: [
             AuthCookiePlugin,
+            RequestProtectionPlugin,
             // Only registered when the compute module is provisioned for this
             // database — all schema/table names come from the constructive
             // metaschema (express-context compute module loader); the plugin has
@@ -175,6 +100,11 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings, apiId,
                 // In grafserv/express/v4, the request is available at requestContext.expressv4.req
                 const req = requestContext?.expressv4?.req;
                 const context = {};
+                // Timeouts travel with the transaction as GUCs, so they bound the work
+                // this request can do inside PostgreSQL whatever the plan turns out to
+                // be. Resolved per request (not baked into the cached preset) so a
+                // tenant lowering a timeout takes effect on the next request.
+                const timeouts = protectionPgSettings(req?.requestProtection ?? DEFAULT_REQUEST_PROTECTION);
                 if (req) {
                     if (req.databaseId) {
                         context['jwt.claims.database_id'] = req.databaseId;
@@ -200,6 +130,7 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings, apiId,
                     }
                     if (req.token?.user_id) {
                         const pgSettings = {
+                            ...timeouts,
                             role: roleName,
                             'jwt.claims.token_id': req.token.id,
                             'jwt.claims.user_id': req.token.user_id,
@@ -237,6 +168,7 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings, apiId,
                     const headerActorId = req.get('X-Actor-Id');
                     if (req.api?.isPublic === false && headerActorId) {
                         const pgSettings = {
+                            ...timeouts,
                             role: roleName,
                             'jwt.claims.user_id': headerActorId,
                             'jwt.claims.principal_id': headerActorId,
@@ -257,6 +189,7 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings, apiId,
                     }
                 }
                 const anonSettings = {
+                    ...timeouts,
                     role: anonRole,
                     ...context
                 };

package/esm/middleware/mask-error.js

@@ -0,0 +1,113 @@
+import crypto from 'node:crypto';
+import { classify, parse } from '@constructive-io/errors';
+import { getNodeEnv } from '@pgpmjs/env';
+import { Logger } from '@pgpmjs/logger';
+const maskErrorLog = new Logger('graphile:maskError');
+/**
+ * GraphQL framework protocol codes. These originate in the GraphQL/grafast
+ * transport layer (not in constructive-db), so they are not Constructive domain
+ * codes in the `@constructive-io/errors` registry. They are always safe to
+ * surface — they carry no sensitive detail. Everything else (auth, account,
+ * resource, constraint, and every constructive-db code) is classified by the
+ * registry, which is the single source of truth for public vs. internal.
+ */
+const GRAPHQL_PROTOCOL_CODES = new Set([
+    'GRAPHQL_VALIDATION_FAILED',
+    'GRAPHQL_PARSE_FAILED',
+    'PERSISTED_QUERY_NOT_FOUND',
+    'PERSISTED_QUERY_NOT_SUPPORTED'
+]);
+/** A code is safe to surface when the registry classifies it public, or it is a
+ * GraphQL framework protocol code. */
+const isPublicCode = (code) => Boolean(code) && (classify(code) === 'public' || GRAPHQL_PROTOCOL_CODES.has(code));
+/**
+ * An error the GraphQL layer raised about the *request*, before any resolver
+ * ran: an unknown input field, a value of the wrong type, a missing required
+ * variable. graphql-js reports variable coercion without an `extensions.code`
+ * (unlike parse/validation, which carry `GRAPHQL_PARSE_FAILED` /
+ * `GRAPHQL_VALIDATION_FAILED`), so code-based classification alone reads it as
+ * unknown and masks it — telling a client its own malformed query was a server
+ * failure, with a reference id pointing at nothing.
+ *
+ * A request error is answered before a field is resolved, so it carries no
+ * response `path` — every execution error has one. Coercion wraps the inner
+ * complaint about the value, so `originalError` may be set, but only ever to
+ * another GraphQL-layer error: anything a resolver or the database threw arrives
+ * as a foreign error (a pg error, an `Error`) and is masked as before. The wrap
+ * is recognized by name rather than by `instanceof`, because the error is raised
+ * by whichever copy of graphql-js grafast resolved, not by this package's.
+ */
+const isGraphQLLayerError = (value) => value == null ||
+    (value.name === 'GraphQLError' &&
+        isGraphQLLayerError(value.originalError));
+const isRequestError = (error) => error.path == null && isGraphQLLayerError(error.originalError);
+/** The code a surfaced request error carries when graphql-js supplied none. */
+const BAD_USER_INPUT = 'BAD_USER_INPUT';
+/**
+ * Normalize any GraphQL/database error into a canonical Constructive shape.
+ *
+ * Database errors surface through Grafast without a populated `extensions.code`
+ * (the semantic code lives in the message, and any SQLSTATE/DETAIL lives on the
+ * underlying pg error at `originalError`). We parse `originalError` first so we
+ * can recover the structured code, then fall back to the GraphQL error itself.
+ */
+const normalizeError = (error) => {
+    const original = error.originalError;
+    const fromOriginal = original ? parse(original) : null;
+    const parsed = fromOriginal?.code ? fromOriginal : parse(error);
+    return { code: parsed.code, context: parsed.context, class: parsed.class };
+};
+/**
+ * Production-aware error handling backed by `@constructive-io/errors`.
+ *
+ * 1. Enrich `extensions.code`/`class`/`context` from the parsed error so clients
+ *    always receive a machine-readable code (fixing the gap where database
+ *    errors reached clients as a bare message with empty `extensions`).
+ * 2. Surface public (registered/allowlisted) errors as-is.
+ * 3. In development, pass everything through (enriched) for debugging.
+ * 4. In production, mask internal/unknown errors behind a reference ID and log
+ *    the original.
+ */
+export const maskError = (error) => {
+    const { code, context, class: errorClass } = normalizeError(error);
+    // Lift the structured code onto extensions for every recognized error so
+    // clients always receive a machine-readable code (`extensions` is read-only
+    // on GraphQLError, so we build a formatted error rather than mutating it).
+    const extensions = { ...error.extensions };
+    if (code) {
+        extensions.code = code;
+        extensions.class = errorClass;
+        if (Object.keys(context).length > 0) {
+            extensions.context = context;
+        }
+    }
+    const effectiveCode = code ?? error.extensions?.code;
+    if (!effectiveCode && isRequestError(error)) {
+        extensions.code = BAD_USER_INPUT;
+        return {
+            message: error.message,
+            ...(error.locations ? { locations: error.locations } : {}),
+            extensions,
+        };
+    }
+    if (isPublicCode(effectiveCode) || getNodeEnv() === 'development') {
+        // Note: grafserv strips originalError and internal extensions before
+        // serializing to the client, so returning the enriched error is safe.
+        return {
+            message: error.message,
+            ...(error.locations ? { locations: error.locations } : {}),
+            ...(error.path ? { path: error.path } : {}),
+            extensions,
+        };
+    }
+    // Mask internal/unknown errors with a reference ID.
+    const errorId = crypto.randomBytes(8).toString('hex');
+    maskErrorLog.error(`[masked-error:${errorId}]`, error);
+    return {
+        message: `An unexpected error occurred. Reference: ${errorId}`,
+        extensions: {
+            code: 'INTERNAL_SERVER_ERROR',
+            errorId
+        }
+    };
+};

package/esm/middleware/request-protection.js

@@ -0,0 +1,59 @@
+import './types'; // for Request type
+import { errors } from '@constructive-io/errors';
+import { DEFAULT_REQUEST_PROTECTION } from '@constructive-io/express-context';
+import { respondWithGraphQLError } from '../errors/graphql-response';
+/**
+ * Resolve the bounds this request runs under and attach them to it.
+ *
+ * The values come from the tenant's own `database_settings`/`api_settings`
+ * (clamped by the platform), read through the cached loader, so the cost is one
+ * routing-plane query per database/API per TTL window. A database with no
+ * settings row — or a request that arrived before the context middleware could
+ * resolve one — still gets the platform defaults, never "unlimited".
+ */
+const resolveProtection = async (req) => {
+    const resolved = await req.constructive?.useModule('requestProtection');
+    return resolved ?? DEFAULT_REQUEST_PROTECTION;
+};
+/**
+ * Multipart requests carry file bodies, which are streamed by the upload
+ * plugin and bounded by the upload limits rather than by the GraphQL request
+ * size: applying a JSON-sized cap to them would reject every upload.
+ */
+const isMultipart = (req) => (req.get('content-type') ?? '').toLowerCase().startsWith('multipart/form-data');
+/**
+ * Express middleware that resolves request protection and enforces the one
+ * bound that has to be checked before the body is read.
+ *
+ * The document bounds (depth, cost, page size, introspection) are enforced by
+ * `RequestProtectionPlugin` inside grafast, which is where the parsed document
+ * and coerced variables exist; this middleware exists so the resolved values
+ * are on the request by the time either that plugin or the pgSettings builder
+ * asks for them.
+ *
+ * Mount after the context middleware and before the GraphQL handler.
+ */
+export const createRequestProtectionMiddleware = () => {
+    return async (req, res, next) => {
+        // A lookup failure is neither "unlimited" nor "the defaults": the request
+        // has no known bounds, so it is handed to the error handler rather than
+        // served under numbers nobody chose.
+        let protection;
+        try {
+            protection = await resolveProtection(req);
+        }
+        catch (e) {
+            next(e);
+            return;
+        }
+        req.requestProtection = protection;
+        const declaredLength = Number(req.get('content-length') ?? '');
+        if (Number.isFinite(declaredLength) &&
+            declaredLength > protection.maxRequestBytes &&
+            !isMultipart(req)) {
+            respondWithGraphQLError(res, errors.REQUEST_TOO_LARGE({ bytes: declaredLength, limit: protection.maxRequestBytes }));
+            return;
+        }
+        next();
+    };
+};

package/esm/plugins/request-protection-plugin.js

@@ -0,0 +1,40 @@
+import '../middleware/types'; // for Request type
+import { DEFAULT_REQUEST_PROTECTION } from '@constructive-io/express-context';
+import { enforceDocumentProtection } from '../protection/document-gate';
+/**
+ * Get the Express request from a grafserv request context.
+ */
+const getExpressRequest = (requestContext) => requestContext?.expressv4?.req;
+/**
+ * RequestProtectionPlugin — applies a tenant's document bounds to every
+ * operation.
+ *
+ * The check runs in `prepareArgs` rather than `parseAndValidate` for one
+ * reason: `parseAndValidate` sees no request, so it could only enforce the
+ * bounds baked into the schema's preset at build time — and a Graphile
+ * instance is cached per API for as long as the schema is valid, so a tenant
+ * lowering a limit would not take effect until the cache turned over.
+ * `prepareArgs` carries both the request (hence the freshly resolved settings)
+ * and the coerced variables, which is also what makes `first: $n` enforceable.
+ */
+export const RequestProtectionPlugin = {
+    name: 'RequestProtectionPlugin',
+    version: '0.0.0',
+    description: 'Enforces per-request query depth, cost, page size and introspection bounds resolved from database_settings/api_settings.',
+    grafast: {
+        middleware: {
+            prepareArgs(next, event) {
+                const { args } = event;
+                const req = getExpressRequest(args.requestContext);
+                // No resolved settings means the protection middleware did not run for
+                // this request (an embedded/test harness mounting grafserv directly);
+                // the platform defaults still apply rather than nothing at all.
+                const protection = req?.requestProtection ?? DEFAULT_REQUEST_PROTECTION;
+                if (args.document && args.schema) {
+                    enforceDocumentProtection(args.schema, args.document, args.variableValues, protection, args.operationName);
+                }
+                return next();
+            }
+        }
+    }
+};

package/esm/protection/document-gate.js

@@ -0,0 +1,182 @@
+/**
+ * Document gate — depth, cost, page size and introspection limits.
+ *
+ * A statement timeout stops a slow query; it does not stop a cheap-looking one
+ * that asks for a million rows across nested connections, because that request
+ * spends its budget in output size and memory rather than in a single statement.
+ * These bounds are therefore checked against the *document*, before any plan is
+ * executed.
+ *
+ * Cost is measured as the number of rows the operation can pull: a connection
+ * contributes its page size multiplied by the page sizes of every connection
+ * above it, so `users(first: 100) { posts(first: 100) }` costs 100 + 10,000
+ * rather than the 4 fields it looks like. A connection with no `first`/`last`
+ * is charged `ASSUMED_PAGE_SIZE`, since it is unbounded in principle.
+ *
+ * The walk is manual rather than `visitWithTypeInfo` because fragment spreads
+ * have to be followed (a document can hide its depth entirely inside
+ * fragments) and the visitor does not follow them.
+ */
+import { errors } from '@constructive-io/errors';
+import { ASSUMED_PAGE_SIZE } from '@constructive-io/express-context';
+import { SafeError } from 'grafast';
+import { getNamedType, isObjectType, Kind, typeFromAST } from 'graphql';
+/**
+ * Reject the request with an error the client can act on.
+ *
+ * The gate runs inside grafast's `prepareArgs`, before execution, where a
+ * plain throw is reported as an unknown handler failure: HTTP 500 with the
+ * `extensions` dropped. `SafeError` is grafserv's contract for "this message
+ * and these extensions are meant for the client", so the registered code,
+ * class and HTTP status survive the trip.
+ */
+const reject = (error) => {
+    throw new SafeError(error.message, {
+        ...error.toExtensions(),
+        statusCode: error.http
+    });
+};
+/** Arguments a connection field uses to size its page. */
+const PAGE_SIZE_ARGS = ['first', 'last'];
+/** A connection is any object type that carries Relay's `pageInfo`. */
+const isConnectionType = (type) => Boolean(type && isObjectType(type) && 'pageInfo' in type.getFields());
+/**
+ * Resolve a `first`/`last` argument to a number, whether it arrived as a
+ * literal or through a variable. Returns null when the field does not page.
+ */
+const requestedPageSize = (args, variableValues) => {
+    if (!args)
+        return null;
+    let size = null;
+    for (const arg of args) {
+        if (!PAGE_SIZE_ARGS.includes(arg.name.value))
+            continue;
+        const value = arg.value;
+        const resolved = value.kind === Kind.INT
+            ? Number(value.value)
+            : value.kind === Kind.VARIABLE
+                ? Number(variableValues[value.name.value])
+                : null;
+        if (resolved !== null && Number.isFinite(resolved)) {
+            size = size === null ? resolved : Math.max(size, resolved);
+        }
+    }
+    return size;
+};
+/**
+ * Walk one selection set, accumulating depth and cost.
+ *
+ * @param parentType - the type the selections are read from, or null when the
+ *   schema cannot resolve it (an invalid document; validation reports that, so
+ *   the walk only stops charging cost rather than raising its own error)
+ * @param depth - nesting level of these selections
+ * @param multiplier - rows the enclosing connections can return
+ */
+function walkSelectionSet(walk, selectionSet, parentType, depth, multiplier) {
+    if (depth > walk.maxDepth)
+        walk.maxDepth = depth;
+    if (depth > walk.protection.maxQueryDepth) {
+        reject(errors.QUERY_TOO_DEEP({ depth, limit: walk.protection.maxQueryDepth }));
+    }
+    for (const selection of selectionSet.selections) {
+        if (selection.kind === Kind.FIELD) {
+            if (selection.name.value === '__schema' || selection.name.value === '__type') {
+                if (!walk.protection.enableIntrospection) {
+                    reject(errors.INTROSPECTION_DISABLED());
+                }
+            }
+            const field = parentType && isObjectType(parentType)
+                ? parentType.getFields()[selection.name.value]
+                : undefined;
+            const fieldType = field ? getNamedType(field.type) : null;
+            const pageSize = requestedPageSize(selection.arguments, walk.variableValues);
+            if (pageSize !== null && pageSize > walk.protection.maxPageSize) {
+                reject(errors.PAGE_SIZE_TOO_LARGE({
+                    requested: pageSize,
+                    limit: walk.protection.maxPageSize
+                }));
+            }
+            // A connection charges rows; every other field is free, so a wide but
+            // flat selection is not penalized for being wide.
+            let childMultiplier = multiplier;
+            if (isConnectionType(fieldType)) {
+                childMultiplier = multiplier * (pageSize ?? ASSUMED_PAGE_SIZE);
+                walk.cost += childMultiplier;
+                if (walk.cost > walk.protection.maxQueryCost) {
+                    reject(errors.QUERY_TOO_COSTLY({
+                        cost: walk.cost,
+                        limit: walk.protection.maxQueryCost
+                    }));
+                }
+            }
+            if (selection.selectionSet) {
+                walkSelectionSet(walk, selection.selectionSet, fieldType, depth + 1, childMultiplier);
+            }
+            continue;
+        }
+        if (selection.kind === Kind.INLINE_FRAGMENT) {
+            const onType = selection.typeCondition
+                ? typeFromAST(walk.schema, selection.typeCondition)
+                : parentType;
+            // An inline fragment is not a level of nesting of its own.
+            walkSelectionSet(walk, selection.selectionSet, onType ?? null, depth, multiplier);
+            continue;
+        }
+        if (selection.kind === Kind.FRAGMENT_SPREAD) {
+            const name = selection.name.value;
+            // A document may spread the same fragment in sibling positions; only a
+            // cycle (a fragment reachable from itself) is refused, and the GraphQL
+            // validation rules already reject those with a proper error.
+            if (walk.activeFragments.has(name))
+                continue;
+            const fragment = walk.fragments[name];
+            if (!fragment)
+                continue;
+            const onType = typeFromAST(walk.schema, fragment.typeCondition);
+            walk.activeFragments.add(name);
+            try {
+                walkSelectionSet(walk, fragment.selectionSet, onType ?? null, depth, multiplier);
+            }
+            finally {
+                walk.activeFragments.delete(name);
+            }
+        }
+    }
+}
+/**
+ * Enforce the document-level bounds for one operation.
+ *
+ * Throws the matching public error on the first bound exceeded; returns what it
+ * measured otherwise, so a caller can log or expose it.
+ */
+export function enforceDocumentProtection(schema, document, variableValues, protection, operationName) {
+    const fragments = {};
+    const operations = [];
+    for (const definition of document.definitions) {
+        if (definition.kind === Kind.FRAGMENT_DEFINITION)
+            fragments[definition.name.value] = definition;
+        else if (definition.kind === Kind.OPERATION_DEFINITION)
+            operations.push(definition);
+    }
+    const operation = operationName
+        ? operations.find((op) => op.name?.value === operationName)
+        : operations[0];
+    if (!operation)
+        return { depth: 0, cost: 0 };
+    const rootType = operation.operation === 'query'
+        ? schema.getQueryType()
+        : operation.operation === 'mutation'
+            ? schema.getMutationType()
+            : schema.getSubscriptionType();
+    const walk = {
+        schema,
+        fragments,
+        variableValues: variableValues ?? {},
+        protection,
+        activeFragments: new Set(),
+        maxDepth: 0,
+        cost: 0
+    };
+    walkSelectionSet(walk, operation.selectionSet, rootType ?? null, 1, 1);
+    return { depth: walk.maxDepth, cost: walk.cost };
+}

package/esm/server.js

@@ -30,6 +30,7 @@ import { createDebugDatabaseMiddleware } from './middleware/observability/debug-
 import { debugMemory } from './middleware/observability/debug-memory';
 import { localObservabilityOnly } from './middleware/observability/guard';
 import { createRequestLogger } from './middleware/observability/request-logger';
+import { createRequestProtectionMiddleware } from './middleware/request-protection';
 import { getRoutingSchema } from './middleware/routing';
 const log = new Logger('server');
 /**
@@ -142,6 +143,9 @@ class Server {
             loaders: createDefaultRegistry(),
             routingSchema: getRoutingSchema(effectiveOpts)
         }));
+        // Resolve the tenant's protection bounds before anything can spend budget
+        // on the request (and before the GraphQL handler reads them for pgSettings).
+        app.use(createRequestProtectionMiddleware());
         app.use(createCaptchaMiddleware());
         // CSRF protection for cookie-authenticated requests
         // Skip CSRF for Bearer token auth (not vulnerable to CSRF) and anonymous requests