@constructive-io/graphql-server 5.28.6 → 5.28.8

package/esm/middleware/mask-error.js

@@ -41,6 +41,28 @@ const isGraphQLLayerError = (value) => value == null ||
     (value.name === 'GraphQLError' &&
         isGraphQLLayerError(value.originalError));
 const isRequestError = (error) => error.path == null && isGraphQLLayerError(error.originalError);
+/**
+ * A request error's message without the values the request sent. graphql-js
+ * writes a variable coercion failure as `Variable "$x" got invalid value <the
+ * value> at "<path>"; <inner>`, and a leaf type's inner complaint ends in the
+ * value too (`String cannot represent a non string value: <value>`,
+ * `Value "<value>" does not exist in "E" enum.`), so a password or API key sent
+ * in a malformed input would come back in the answer. The variable, the path and
+ * what was wrong stay; the values go.
+ */
+const withoutInputValues = (error) => {
+    const inner = error.originalError?.message;
+    const message = error.message;
+    if (!message.startsWith('Variable "$') || !inner || !message.endsWith(`; ${inner}`))
+        return message;
+    const prefix = message.slice(0, message.length - inner.length - 2);
+    const variable = /^Variable "\$[^"]+"/.exec(prefix)?.[0];
+    const at = / at "[^"]*"$/.exec(prefix)?.[0] ?? '';
+    const complaint = inner
+        .replace(/(value): [\s\S]*$/, '$1.')
+        .replace(/^Value "[\s\S]*" does not exist in/, 'Value does not exist in');
+    return `${variable} got invalid value${at}; ${complaint}`;
+};
 /** The code a surfaced request error carries when graphql-js supplied none. */
 const BAD_USER_INPUT = 'BAD_USER_INPUT';
 /**
@@ -85,7 +107,7 @@ export const maskError = (error) => {
     if (!effectiveCode && isRequestError(error)) {
         extensions.code = BAD_USER_INPUT;
         return {
-            message: error.message,
+            message: withoutInputValues(error),
             ...(error.locations ? { locations: error.locations } : {}),
             extensions,
         };

package/middleware/mask-error.js

@@ -47,6 +47,28 @@ const isGraphQLLayerError = (value) => value == null ||
     (value.name === 'GraphQLError' &&
         isGraphQLLayerError(value.originalError));
 const isRequestError = (error) => error.path == null && isGraphQLLayerError(error.originalError);
+/**
+ * A request error's message without the values the request sent. graphql-js
+ * writes a variable coercion failure as `Variable "$x" got invalid value <the
+ * value> at "<path>"; <inner>`, and a leaf type's inner complaint ends in the
+ * value too (`String cannot represent a non string value: <value>`,
+ * `Value "<value>" does not exist in "E" enum.`), so a password or API key sent
+ * in a malformed input would come back in the answer. The variable, the path and
+ * what was wrong stay; the values go.
+ */
+const withoutInputValues = (error) => {
+    const inner = error.originalError?.message;
+    const message = error.message;
+    if (!message.startsWith('Variable "$') || !inner || !message.endsWith(`; ${inner}`))
+        return message;
+    const prefix = message.slice(0, message.length - inner.length - 2);
+    const variable = /^Variable "\$[^"]+"/.exec(prefix)?.[0];
+    const at = / at "[^"]*"$/.exec(prefix)?.[0] ?? '';
+    const complaint = inner
+        .replace(/(value): [\s\S]*$/, '$1.')
+        .replace(/^Value "[\s\S]*" does not exist in/, 'Value does not exist in');
+    return `${variable} got invalid value${at}; ${complaint}`;
+};
 /** The code a surfaced request error carries when graphql-js supplied none. */
 const BAD_USER_INPUT = 'BAD_USER_INPUT';
 /**
@@ -92,7 +114,7 @@ const maskError = (error) => {
     if (!effectiveCode && isRequestError(error)) {
         extensions.code = BAD_USER_INPUT;
         return {
-            message: error.message,
+            message: withoutInputValues(error),
             ...(error.locations ? { locations: error.locations } : {}),
             extensions,
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.28.6",
+  "version": "5.28.8",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -43,19 +43,19 @@
   "dependencies": {
     "@agentic-kit/ollama": "2.15.0",
     "@constructive-io/csrf": "^0.30.0",
-    "@constructive-io/errors": "^0.21.0",
-    "@constructive-io/express-context": "^0.33.4",
-    "@constructive-io/graphql-env": "^3.34.4",
-    "@constructive-io/graphql-types": "^3.33.4",
+    "@constructive-io/errors": "^0.22.0",
+    "@constructive-io/express-context": "^0.33.5",
+    "@constructive-io/graphql-env": "^3.34.5",
+    "@constructive-io/graphql-types": "^3.33.5",
     "@constructive-io/llm-env": "^0.15.0",
-    "@constructive-io/query-builder": "^3.16.5",
+    "@constructive-io/query-builder": "^3.16.6",
     "@constructive-io/s3-utils": "^2.34.0",
     "@constructive-io/url-domains": "^2.31.0",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
-    "@pgpmjs/env": "^2.46.1",
+    "@pgpmjs/env": "^2.46.2",
     "@pgpmjs/logger": "^2.26.0",
-    "@pgpmjs/server-utils": "^3.29.4",
-    "@pgpmjs/types": "^2.56.1",
+    "@pgpmjs/server-utils": "^3.29.5",
+    "@pgpmjs/types": "^2.56.2",
     "cors": "^2.8.6",
     "deepmerge": "^4.3.1",
     "express": "^5.2.1",
@@ -64,17 +64,17 @@
     "grafserv": "1.0.1",
     "graphile-build": "5.1.1",
     "graphile-build-pg": "5.1.3",
-    "graphile-cache": "^4.14.4",
+    "graphile-cache": "^4.14.5",
     "graphile-config": "1.1.0",
-    "graphile-function-bindings": "^1.17.5",
-    "graphile-scoped-introspection": "^0.4.5",
-    "graphile-settings": "^6.24.6",
+    "graphile-function-bindings": "^1.17.6",
+    "graphile-scoped-introspection": "^0.4.6",
+    "graphile-settings": "^6.24.7",
     "graphile-utils": "5.0.3",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
     "lru-cache": "^11.2.7",
     "pg": "^8.21.0",
-    "pg-cache": "^3.29.4",
+    "pg-cache": "^3.29.5",
     "pg-env": "^1.32.0",
     "pg-query-context": "^2.31.0",
     "pg-sql2": "5.0.1",
@@ -91,11 +91,11 @@
     "@types/request-ip": "^0.0.41",
     "@types/supertest": "^7.2.1",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "5.17.5",
+    "graphile-test": "5.17.6",
     "makage": "^0.8.0",
     "nodemon": "^3.1.14",
     "supertest": "^7.2.2",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "735479ba289c73a1cafb3a7a3e38dfd9c9a9dda7"
+  "gitHead": "31fb086361c3e2f3806d7945abe5074b3ce58f76"
 }