@constructive-io/graphql-server 5.28.7 → 5.28.9

package/README.md

@@ -99,6 +99,18 @@ For the operational workflow, sampler output, and heap snapshot usage, see [docs
 - `GET /debug/memory` -> memory/process/Graphile debug snapshot when observability is enabled
 - `GET /debug/db` -> PostgreSQL activity/locks/pool debug snapshot when observability is enabled
 
+## Auth cookies and CSRF
+
+Browsers authenticate with the `constructive_session` cookie; every other client sends `Authorization: Bearer <accessToken>`.
+
+- A successful sign-in mutation (`signIn`, `signUp`, `signInSso`, `signInMagicLink`, `signInEmailOtp`, `completeMfaChallenge`, …) returns the access token in the response body and also sets `constructive_session` (plus `constructive_device_token` when the mutation returns a device id). `Max-Age` comes from the API's auth settings (default 86400 s; `rememberMe: true` uses the remember-me duration).
+- `signOut` always answers with expired `constructive_session` and `constructive_device_token` cookies (`Max-Age=0`), however the request authenticated and whether or not the mutation succeeded. `revokeSession` / `revokeAllSessions` clear them on success.
+- Every request gets a `csrf_token` cookie (readable by JS, one day). A `POST /graphql` that carries `constructive_session` and no Bearer header must echo that value in `X-CSRF-Token`, or it is refused with 403 `CSRF_TOKEN_MISSING` / `CSRF_TOKEN_INVALID`. Bearer requests and requests without a session cookie skip the check.
+
+### Non-browser clients (native apps, CLIs, servers)
+
+Send `X-Constructive-Session-Cookie: omit` on every request. Sign-in mutations then set no auth cookie: read `accessToken` from the response body and send it as `Authorization: Bearer <accessToken>`. Any other value of the header is refused with 400 `INVALID_SESSION_COOKIE_HEADER` before the operation runs. The header does not bypass CSRF: a request that still carries `constructive_session` without a Bearer header is checked like a browser's, so sign out with the Bearer token (its response expires any session cookie the client was given before it opted out).
+
 ## Scoped routing
 
 This is a production-only server: every request is resolved through the scoped-routing plane. There is no static single-tenant mode and no flag to disable routing. For single-database local development without route resolution or a database id, use [`@constructive-io/graphql-dev-server`](../dev-server/README.md).

package/errors/api-errors.d.ts

@@ -22,6 +22,7 @@ export declare const ErrorCodes: {
     readonly DATABASE_CONNECTION_ERROR: "DATABASE_CONNECTION_ERROR";
     readonly AMBIGUOUS_TENANT: "AMBIGUOUS_TENANT";
     readonly ADMIN_AUTH_REQUIRED: "ADMIN_AUTH_REQUIRED";
+    readonly INVALID_SESSION_COOKIE_HEADER: "INVALID_SESSION_COOKIE_HEADER";
 };
 /**
  * Type alias for valid error codes.
@@ -161,6 +162,13 @@ export declare class AmbiguousTenantError extends ApiError {
 export declare class AdminAuthRequiredError extends ApiError {
     constructor(reason: string);
 }
+/**
+ * Thrown when the session-cookie opt-out header carries a value other than
+ * the one the server accepts, so a typo never silently falls back to cookies.
+ */
+export declare class InvalidSessionCookieHeaderError extends ApiError {
+    constructor(header: string, value: string, accepted: string);
+}
 /**
  * Check if an error is an instance of ApiError or any of its subclasses.
  *

package/errors/api-errors.js

@@ -10,7 +10,7 @@
  * @module errors/api-errors
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AdminAuthRequiredError = exports.AmbiguousTenantError = exports.SchemaAccessDeniedError = exports.DatabaseConnectionError = exports.HandlerCreationError = exports.SchemaValidationError = exports.NoValidSchemasError = exports.ApiNotFoundError = exports.DomainNotFoundError = exports.ApiError = exports.ErrorCodes = void 0;
+exports.InvalidSessionCookieHeaderError = exports.AdminAuthRequiredError = exports.AmbiguousTenantError = exports.SchemaAccessDeniedError = exports.DatabaseConnectionError = exports.HandlerCreationError = exports.SchemaValidationError = exports.NoValidSchemasError = exports.ApiNotFoundError = exports.DomainNotFoundError = exports.ApiError = exports.ErrorCodes = void 0;
 exports.isApiError = isApiError;
 exports.hasErrorCode = hasErrorCode;
 // =============================================================================
@@ -30,6 +30,7 @@ exports.ErrorCodes = {
     DATABASE_CONNECTION_ERROR: 'DATABASE_CONNECTION_ERROR',
     AMBIGUOUS_TENANT: 'AMBIGUOUS_TENANT',
     ADMIN_AUTH_REQUIRED: 'ADMIN_AUTH_REQUIRED',
+    INVALID_SESSION_COOKIE_HEADER: 'INVALID_SESSION_COOKIE_HEADER',
 };
 // =============================================================================
 // Base Error Class
@@ -230,6 +231,17 @@ class AdminAuthRequiredError extends ApiError {
     }
 }
 exports.AdminAuthRequiredError = AdminAuthRequiredError;
+/**
+ * Thrown when the session-cookie opt-out header carries a value other than
+ * the one the server accepts, so a typo never silently falls back to cookies.
+ */
+class InvalidSessionCookieHeaderError extends ApiError {
+    constructor(header, value, accepted) {
+        super(exports.ErrorCodes.INVALID_SESSION_COOKIE_HEADER, 400, `${header} accepts only "${accepted}"`, { header, value, accepted });
+        this.name = 'InvalidSessionCookieHeaderError';
+    }
+}
+exports.InvalidSessionCookieHeaderError = InvalidSessionCookieHeaderError;
 // =============================================================================
 // Type Guards
 // =============================================================================

package/esm/errors/api-errors.js

@@ -25,6 +25,7 @@ export const ErrorCodes = {
     DATABASE_CONNECTION_ERROR: 'DATABASE_CONNECTION_ERROR',
     AMBIGUOUS_TENANT: 'AMBIGUOUS_TENANT',
     ADMIN_AUTH_REQUIRED: 'ADMIN_AUTH_REQUIRED',
+    INVALID_SESSION_COOKIE_HEADER: 'INVALID_SESSION_COOKIE_HEADER',
 };
 // =============================================================================
 // Base Error Class
@@ -215,6 +216,16 @@ export class AdminAuthRequiredError extends ApiError {
         this.name = 'AdminAuthRequiredError';
     }
 }
+/**
+ * Thrown when the session-cookie opt-out header carries a value other than
+ * the one the server accepts, so a typo never silently falls back to cookies.
+ */
+export class InvalidSessionCookieHeaderError extends ApiError {
+    constructor(header, value, accepted) {
+        super(ErrorCodes.INVALID_SESSION_COOKIE_HEADER, 400, `${header} accepts only "${accepted}"`, { header, value, accepted });
+        this.name = 'InvalidSessionCookieHeaderError';
+    }
+}
 // =============================================================================
 // Type Guards
 // =============================================================================

package/esm/middleware/cookie.js

@@ -1,5 +1,13 @@
+import { InvalidSessionCookieHeaderError } from '../errors/api-errors';
 export const SESSION_COOKIE_NAME = 'constructive_session';
 export const DEVICE_TOKEN_COOKIE_NAME = 'constructive_device_token';
+/**
+ * Request header a non-browser client (native app, CLI, server) sends to opt
+ * out of auth cookies: sign-in mutations then return the access token in the
+ * response body only and set neither the session nor the device-token cookie.
+ */
+export const SESSION_COOKIE_HEADER = 'X-Constructive-Session-Cookie';
+export const SESSION_COOKIE_OMIT = 'omit';
 const DEVICE_TOKEN_MAX_AGE = 90 * 24 * 60 * 60; // 90 days in seconds
 /**
  * Build cookie config from AuthSettings with optional remember_me override.
@@ -89,6 +97,22 @@ export const clearDeviceTokenCookie = (res, config) => {
         path: config.path,
     });
 };
+/**
+ * True when the request opted out of auth cookies via `SESSION_COOKIE_HEADER`.
+ */
+export const isSessionCookieOmitted = (req) => req.get(SESSION_COOKIE_HEADER) === SESSION_COOKIE_OMIT;
+/**
+ * Reject a `SESSION_COOKIE_HEADER` with any value but `omit`, before the
+ * request executes, so a misspelt opt-out fails loudly instead of setting the
+ * cookie the client asked not to receive.
+ */
+export const rejectInvalidSessionCookieHeader = (req, _res, next) => {
+    const value = req.get(SESSION_COOKIE_HEADER);
+    if (value !== undefined && value !== SESSION_COOKIE_OMIT) {
+        return next(new InvalidSessionCookieHeaderError(SESSION_COOKIE_HEADER, value, SESSION_COOKIE_OMIT));
+    }
+    next();
+};
 /**
  * Parse a cookie value from the raw Cookie header.
  * Avoids pulling in cookie-parser as a dependency.

package/esm/middleware/mask-error.js

@@ -41,6 +41,28 @@ const isGraphQLLayerError = (value) => value == null ||
     (value.name === 'GraphQLError' &&
         isGraphQLLayerError(value.originalError));
 const isRequestError = (error) => error.path == null && isGraphQLLayerError(error.originalError);
+/**
+ * A request error's message without the values the request sent. graphql-js
+ * writes a variable coercion failure as `Variable "$x" got invalid value <the
+ * value> at "<path>"; <inner>`, and a leaf type's inner complaint ends in the
+ * value too (`String cannot represent a non string value: <value>`,
+ * `Value "<value>" does not exist in "E" enum.`), so a password or API key sent
+ * in a malformed input would come back in the answer. The variable, the path and
+ * what was wrong stay; the values go.
+ */
+const withoutInputValues = (error) => {
+    const inner = error.originalError?.message;
+    const message = error.message;
+    if (!message.startsWith('Variable "$') || !inner || !message.endsWith(`; ${inner}`))
+        return message;
+    const prefix = message.slice(0, message.length - inner.length - 2);
+    const variable = /^Variable "\$[^"]+"/.exec(prefix)?.[0];
+    const at = / at "[^"]*"$/.exec(prefix)?.[0] ?? '';
+    const complaint = inner
+        .replace(/(value): [\s\S]*$/, '$1.')
+        .replace(/^Value "[\s\S]*" does not exist in/, 'Value does not exist in');
+    return `${variable} got invalid value${at}; ${complaint}`;
+};
 /** The code a surfaced request error carries when graphql-js supplied none. */
 const BAD_USER_INPUT = 'BAD_USER_INPUT';
 /**
@@ -85,7 +107,7 @@ export const maskError = (error) => {
     if (!effectiveCode && isRequestError(error)) {
         extensions.code = BAD_USER_INPUT;
         return {
-            message: error.message,
+            message: withoutInputValues(error),
             ...(error.locations ? { locations: error.locations } : {}),
             extensions,
         };

package/esm/plugins/auth-cookie-plugin.js

@@ -1,6 +1,7 @@
 import '../middleware/types';
 import { Logger } from '@pgpmjs/logger';
-import { DEVICE_TOKEN_COOKIE_NAME, getDeviceTokenCookieConfig, getSessionCookieConfig, SESSION_COOKIE_NAME, } from '../middleware/cookie';
+import { getOperationAST, Kind, parse } from 'graphql';
+import { DEVICE_TOKEN_COOKIE_NAME, getDeviceTokenCookieConfig, getSessionCookieConfig, isSessionCookieOmitted, SESSION_COOKIE_NAME, } from '../middleware/cookie';
 const log = new Logger('auth-cookie');
 /**
  * Serialize a cookie to a Set-Cookie header value.
@@ -76,26 +77,21 @@ const SIGN_OUT_MUTATIONS = new Set([
     'revokeAllSessions',
 ]);
 /**
- * Extract mutation names from a GraphQL query string.
+ * Top-level field names of the mutation that will execute: the operation
+ * picked by `operationName`, so other operations in the document never count.
  */
-const extractMutationNames = (query) => {
-    const mutations = [];
-    if (!/^\s*mutation\b/i.test(query)) {
-        return mutations;
+const extractMutationNames = (query, operationName) => {
+    let document;
+    try {
+        document = parse(query);
     }
-    const bodyStart = query.indexOf('{');
-    if (bodyStart === -1)
-        return mutations;
-    const bodyContent = query.slice(bodyStart + 1);
-    const fieldPattern = /(\w+)\s*(?:\(|{)/g;
-    let match;
-    while ((match = fieldPattern.exec(bodyContent)) !== null) {
-        const name = match[1];
-        if (name !== 'mutation' && name !== 'query' && name !== 'fragment') {
-            mutations.push(name);
-        }
+    catch {
+        return [];
     }
-    return mutations;
+    const operation = getOperationAST(document, operationName);
+    if (operation?.operation !== 'mutation')
+        return [];
+    return operation.selectionSet.selections.flatMap((selection) => selection.kind === Kind.FIELD ? [selection.name.value] : []);
 };
 /**
  * Extract access token from mutation response.
@@ -198,7 +194,7 @@ export const AuthCookiePlugin = {
                         return result;
                     }
                     // Extract mutation names
-                    const mutationNames = extractMutationNames(body.query);
+                    const mutationNames = extractMutationNames(body.query, body.operationName);
                     if (mutationNames.length === 0) {
                         return result;
                     }
@@ -213,24 +209,25 @@ export const AuthCookiePlugin = {
                         // Parse response body
                         const payload = bufferResult.buffer.toString('utf8');
                         const graphqlResponse = JSON.parse(payload);
-                        // Skip if there are GraphQL errors
-                        if (graphqlResponse.errors?.length || !graphqlResponse.data) {
-                            return result;
-                        }
-                        const data = graphqlResponse.data;
+                        const succeeded = !graphqlResponse.errors?.length && Boolean(graphqlResponse.data);
+                        const data = graphqlResponse.data ?? {};
                         const authSettings = req.api?.authSettings;
                         const cookiesToSet = [];
-                        // Handle sign-out mutations
-                        if (signOutMutation && data[signOutMutation]) {
-                            log.info('[auth-cookie] Sign-out mutation succeeded, clearing session cookie');
+                        // signOut always clears the cookies, whatever the mutation returned
+                        // and however the request authenticated: a Bearer client that was
+                        // once handed a session cookie must not keep sending it afterwards.
+                        // revokeSession/revokeAllSessions clear them only on success.
+                        if (signOutMutation === 'signOut' || (signOutMutation && succeeded && data[signOutMutation])) {
+                            log.info(`[auth-cookie] ${signOutMutation}: clearing session cookie`);
                             const config = getSessionCookieConfig(authSettings);
                             cookiesToSet.push(serializeClearCookie(SESSION_COOKIE_NAME, config));
                             // Also clear device token on sign-out
                             const deviceConfig = getDeviceTokenCookieConfig(authSettings);
                             cookiesToSet.push(serializeClearCookie(DEVICE_TOKEN_COOKIE_NAME, deviceConfig));
                         }
-                        // Handle sign-in mutations
-                        if (signInMutation) {
+                        // Handle sign-in mutations; a client that sent the opt-out header
+                        // reads the token from the response body and gets no cookies.
+                        if (signInMutation && succeeded && !isSessionCookieOmitted(req)) {
                             const accessToken = extractAccessToken(data, signInMutation);
                             if (accessToken) {
                                 const rememberMe = hasRememberMe(body.variables);

package/esm/server.js

@@ -19,7 +19,7 @@ import { createApiMiddleware } from './middleware/api';
 import { createAuthenticateMiddleware } from './middleware/auth';
 // Auth cookie handling is done via AuthCookiePlugin in grafserv
 import { createCaptchaMiddleware } from './middleware/captcha';
-import { parseCookieValue, SESSION_COOKIE_NAME } from './middleware/cookie';
+import { parseCookieValue, rejectInvalidSessionCookieHeader, SESSION_COOKIE_NAME } from './middleware/cookie';
 import { cors } from './middleware/cors';
 import { errorHandler, notFoundHandler } from './middleware/error-handler';
 import { favicon } from './middleware/favicon';
@@ -189,6 +189,9 @@ class Server {
         };
         app.use(csrfSetToken); // Set CSRF token cookie on all requests
         app.use('/graphql', csrfProtect); // Enforce CSRF on GraphQL mutations
+        // The session-cookie opt-out does not bypass CSRF: it only stops sign-in
+        // responses from setting cookies (see AuthCookiePlugin).
+        app.use('/graphql', rejectInvalidSessionCookieHeader);
         // LLM Agent REST API — mounted before graphile so SSE streaming
         // routes are handled without going through PostGraphile
         app.use(createAgenticRouter());

package/middleware/cookie.d.ts

@@ -1,7 +1,14 @@
-import type { Request, Response } from 'express';
+import type { NextFunction, Request, Response } from 'express';
 import type { AuthSettings } from '../types';
 export declare const SESSION_COOKIE_NAME = "constructive_session";
 export declare const DEVICE_TOKEN_COOKIE_NAME = "constructive_device_token";
+/**
+ * Request header a non-browser client (native app, CLI, server) sends to opt
+ * out of auth cookies: sign-in mutations then return the access token in the
+ * response body only and set neither the session nor the device-token cookie.
+ */
+export declare const SESSION_COOKIE_HEADER = "X-Constructive-Session-Cookie";
+export declare const SESSION_COOKIE_OMIT = "omit";
 export interface CookieConfig {
     secure: boolean;
     sameSite: 'strict' | 'lax' | 'none';
@@ -34,6 +41,16 @@ export declare const setDeviceTokenCookie: (res: Response, deviceToken: string,
  * Clear the device token cookie.
  */
 export declare const clearDeviceTokenCookie: (res: Response, config: CookieConfig) => void;
+/**
+ * True when the request opted out of auth cookies via `SESSION_COOKIE_HEADER`.
+ */
+export declare const isSessionCookieOmitted: (req: Request) => boolean;
+/**
+ * Reject a `SESSION_COOKIE_HEADER` with any value but `omit`, before the
+ * request executes, so a misspelt opt-out fails loudly instead of setting the
+ * cookie the client asked not to receive.
+ */
+export declare const rejectInvalidSessionCookieHeader: (req: Request, _res: Response, next: NextFunction) => void;
 /**
  * Parse a cookie value from the raw Cookie header.
  * Avoids pulling in cookie-parser as a dependency.

package/middleware/cookie.js

@@ -1,8 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSessionTokenFromRequest = exports.getDeviceTokenFromRequest = exports.parseCookieValue = exports.clearDeviceTokenCookie = exports.setDeviceTokenCookie = exports.clearSessionCookie = exports.setSessionCookie = exports.getDeviceTokenCookieConfig = exports.getSessionCookieConfig = exports.DEVICE_TOKEN_COOKIE_NAME = exports.SESSION_COOKIE_NAME = void 0;
+exports.getSessionTokenFromRequest = exports.getDeviceTokenFromRequest = exports.parseCookieValue = exports.rejectInvalidSessionCookieHeader = exports.isSessionCookieOmitted = exports.clearDeviceTokenCookie = exports.setDeviceTokenCookie = exports.clearSessionCookie = exports.setSessionCookie = exports.getDeviceTokenCookieConfig = exports.getSessionCookieConfig = exports.SESSION_COOKIE_OMIT = exports.SESSION_COOKIE_HEADER = exports.DEVICE_TOKEN_COOKIE_NAME = exports.SESSION_COOKIE_NAME = void 0;
+const api_errors_1 = require("../errors/api-errors");
 exports.SESSION_COOKIE_NAME = 'constructive_session';
 exports.DEVICE_TOKEN_COOKIE_NAME = 'constructive_device_token';
+/**
+ * Request header a non-browser client (native app, CLI, server) sends to opt
+ * out of auth cookies: sign-in mutations then return the access token in the
+ * response body only and set neither the session nor the device-token cookie.
+ */
+exports.SESSION_COOKIE_HEADER = 'X-Constructive-Session-Cookie';
+exports.SESSION_COOKIE_OMIT = 'omit';
 const DEVICE_TOKEN_MAX_AGE = 90 * 24 * 60 * 60; // 90 days in seconds
 /**
  * Build cookie config from AuthSettings with optional remember_me override.
@@ -98,6 +106,24 @@ const clearDeviceTokenCookie = (res, config) => {
     });
 };
 exports.clearDeviceTokenCookie = clearDeviceTokenCookie;
+/**
+ * True when the request opted out of auth cookies via `SESSION_COOKIE_HEADER`.
+ */
+const isSessionCookieOmitted = (req) => req.get(exports.SESSION_COOKIE_HEADER) === exports.SESSION_COOKIE_OMIT;
+exports.isSessionCookieOmitted = isSessionCookieOmitted;
+/**
+ * Reject a `SESSION_COOKIE_HEADER` with any value but `omit`, before the
+ * request executes, so a misspelt opt-out fails loudly instead of setting the
+ * cookie the client asked not to receive.
+ */
+const rejectInvalidSessionCookieHeader = (req, _res, next) => {
+    const value = req.get(exports.SESSION_COOKIE_HEADER);
+    if (value !== undefined && value !== exports.SESSION_COOKIE_OMIT) {
+        return next(new api_errors_1.InvalidSessionCookieHeaderError(exports.SESSION_COOKIE_HEADER, value, exports.SESSION_COOKIE_OMIT));
+    }
+    next();
+};
+exports.rejectInvalidSessionCookieHeader = rejectInvalidSessionCookieHeader;
 /**
  * Parse a cookie value from the raw Cookie header.
  * Avoids pulling in cookie-parser as a dependency.

package/middleware/mask-error.js

@@ -47,6 +47,28 @@ const isGraphQLLayerError = (value) => value == null ||
     (value.name === 'GraphQLError' &&
         isGraphQLLayerError(value.originalError));
 const isRequestError = (error) => error.path == null && isGraphQLLayerError(error.originalError);
+/**
+ * A request error's message without the values the request sent. graphql-js
+ * writes a variable coercion failure as `Variable "$x" got invalid value <the
+ * value> at "<path>"; <inner>`, and a leaf type's inner complaint ends in the
+ * value too (`String cannot represent a non string value: <value>`,
+ * `Value "<value>" does not exist in "E" enum.`), so a password or API key sent
+ * in a malformed input would come back in the answer. The variable, the path and
+ * what was wrong stay; the values go.
+ */
+const withoutInputValues = (error) => {
+    const inner = error.originalError?.message;
+    const message = error.message;
+    if (!message.startsWith('Variable "$') || !inner || !message.endsWith(`; ${inner}`))
+        return message;
+    const prefix = message.slice(0, message.length - inner.length - 2);
+    const variable = /^Variable "\$[^"]+"/.exec(prefix)?.[0];
+    const at = / at "[^"]*"$/.exec(prefix)?.[0] ?? '';
+    const complaint = inner
+        .replace(/(value): [\s\S]*$/, '$1.')
+        .replace(/^Value "[\s\S]*" does not exist in/, 'Value does not exist in');
+    return `${variable} got invalid value${at}; ${complaint}`;
+};
 /** The code a surfaced request error carries when graphql-js supplied none. */
 const BAD_USER_INPUT = 'BAD_USER_INPUT';
 /**
@@ -92,7 +114,7 @@ const maskError = (error) => {
     if (!effectiveCode && isRequestError(error)) {
         extensions.code = BAD_USER_INPUT;
         return {
-            message: error.message,
+            message: withoutInputValues(error),
             ...(error.locations ? { locations: error.locations } : {}),
             extensions,
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.28.7",
+  "version": "5.28.9",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -42,20 +42,20 @@
   ],
   "dependencies": {
     "@agentic-kit/ollama": "2.15.0",
-    "@constructive-io/csrf": "^0.30.0",
-    "@constructive-io/errors": "^0.22.0",
-    "@constructive-io/express-context": "^0.33.5",
-    "@constructive-io/graphql-env": "^3.34.5",
-    "@constructive-io/graphql-types": "^3.33.5",
+    "@constructive-io/csrf": "^0.30.1",
+    "@constructive-io/errors": "^0.23.0",
+    "@constructive-io/express-context": "^0.33.6",
+    "@constructive-io/graphql-env": "^3.34.6",
+    "@constructive-io/graphql-types": "^3.33.6",
     "@constructive-io/llm-env": "^0.15.0",
-    "@constructive-io/query-builder": "^3.16.6",
+    "@constructive-io/query-builder": "^3.16.7",
     "@constructive-io/s3-utils": "^2.34.0",
     "@constructive-io/url-domains": "^2.31.0",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
-    "@pgpmjs/env": "^2.46.2",
+    "@pgpmjs/env": "^2.46.3",
     "@pgpmjs/logger": "^2.26.0",
-    "@pgpmjs/server-utils": "^3.29.5",
-    "@pgpmjs/types": "^2.56.2",
+    "@pgpmjs/server-utils": "^3.29.6",
+    "@pgpmjs/types": "^2.56.3",
     "cors": "^2.8.6",
     "deepmerge": "^4.3.1",
     "express": "^5.2.1",
@@ -64,17 +64,17 @@
     "grafserv": "1.0.1",
     "graphile-build": "5.1.1",
     "graphile-build-pg": "5.1.3",
-    "graphile-cache": "^4.14.5",
+    "graphile-cache": "^4.14.6",
     "graphile-config": "1.1.0",
-    "graphile-function-bindings": "^1.17.6",
-    "graphile-scoped-introspection": "^0.4.6",
-    "graphile-settings": "^6.24.7",
+    "graphile-function-bindings": "^1.17.7",
+    "graphile-scoped-introspection": "^0.4.7",
+    "graphile-settings": "^6.24.8",
     "graphile-utils": "5.0.3",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
     "lru-cache": "^11.2.7",
     "pg": "^8.21.0",
-    "pg-cache": "^3.29.5",
+    "pg-cache": "^3.29.6",
     "pg-env": "^1.32.0",
     "pg-query-context": "^2.31.0",
     "pg-sql2": "5.0.1",
@@ -91,11 +91,11 @@
     "@types/request-ip": "^0.0.41",
     "@types/supertest": "^7.2.1",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "5.17.6",
+    "graphile-test": "5.17.7",
     "makage": "^0.8.0",
     "nodemon": "^3.1.14",
     "supertest": "^7.2.2",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "1bab719e353dad566819d58ba7912dd335ef51c4"
+  "gitHead": "a95137c03998f4ef18aaba770bdeb598077e5b51"
 }

package/plugins/auth-cookie-plugin.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthCookiePlugin = void 0;
 require("../middleware/types");
 const logger_1 = require("@pgpmjs/logger");
+const graphql_1 = require("graphql");
 const cookie_1 = require("../middleware/cookie");
 const log = new logger_1.Logger('auth-cookie');
 /**
@@ -79,26 +80,21 @@ const SIGN_OUT_MUTATIONS = new Set([
     'revokeAllSessions',
 ]);
 /**
- * Extract mutation names from a GraphQL query string.
+ * Top-level field names of the mutation that will execute: the operation
+ * picked by `operationName`, so other operations in the document never count.
  */
-const extractMutationNames = (query) => {
-    const mutations = [];
-    if (!/^\s*mutation\b/i.test(query)) {
-        return mutations;
+const extractMutationNames = (query, operationName) => {
+    let document;
+    try {
+        document = (0, graphql_1.parse)(query);
     }
-    const bodyStart = query.indexOf('{');
-    if (bodyStart === -1)
-        return mutations;
-    const bodyContent = query.slice(bodyStart + 1);
-    const fieldPattern = /(\w+)\s*(?:\(|{)/g;
-    let match;
-    while ((match = fieldPattern.exec(bodyContent)) !== null) {
-        const name = match[1];
-        if (name !== 'mutation' && name !== 'query' && name !== 'fragment') {
-            mutations.push(name);
-        }
+    catch {
+        return [];
     }
-    return mutations;
+    const operation = (0, graphql_1.getOperationAST)(document, operationName);
+    if (operation?.operation !== 'mutation')
+        return [];
+    return operation.selectionSet.selections.flatMap((selection) => selection.kind === graphql_1.Kind.FIELD ? [selection.name.value] : []);
 };
 /**
  * Extract access token from mutation response.
@@ -201,7 +197,7 @@ exports.AuthCookiePlugin = {
                         return result;
                     }
                     // Extract mutation names
-                    const mutationNames = extractMutationNames(body.query);
+                    const mutationNames = extractMutationNames(body.query, body.operationName);
                     if (mutationNames.length === 0) {
                         return result;
                     }
@@ -216,24 +212,25 @@ exports.AuthCookiePlugin = {
                         // Parse response body
                         const payload = bufferResult.buffer.toString('utf8');
                         const graphqlResponse = JSON.parse(payload);
-                        // Skip if there are GraphQL errors
-                        if (graphqlResponse.errors?.length || !graphqlResponse.data) {
-                            return result;
-                        }
-                        const data = graphqlResponse.data;
+                        const succeeded = !graphqlResponse.errors?.length && Boolean(graphqlResponse.data);
+                        const data = graphqlResponse.data ?? {};
                         const authSettings = req.api?.authSettings;
                         const cookiesToSet = [];
-                        // Handle sign-out mutations
-                        if (signOutMutation && data[signOutMutation]) {
-                            log.info('[auth-cookie] Sign-out mutation succeeded, clearing session cookie');
+                        // signOut always clears the cookies, whatever the mutation returned
+                        // and however the request authenticated: a Bearer client that was
+                        // once handed a session cookie must not keep sending it afterwards.
+                        // revokeSession/revokeAllSessions clear them only on success.
+                        if (signOutMutation === 'signOut' || (signOutMutation && succeeded && data[signOutMutation])) {
+                            log.info(`[auth-cookie] ${signOutMutation}: clearing session cookie`);
                             const config = (0, cookie_1.getSessionCookieConfig)(authSettings);
                             cookiesToSet.push(serializeClearCookie(cookie_1.SESSION_COOKIE_NAME, config));
                             // Also clear device token on sign-out
                             const deviceConfig = (0, cookie_1.getDeviceTokenCookieConfig)(authSettings);
                             cookiesToSet.push(serializeClearCookie(cookie_1.DEVICE_TOKEN_COOKIE_NAME, deviceConfig));
                         }
-                        // Handle sign-in mutations
-                        if (signInMutation) {
+                        // Handle sign-in mutations; a client that sent the opt-out header
+                        // reads the token from the response body and gets no cookies.
+                        if (signInMutation && succeeded && !(0, cookie_1.isSessionCookieOmitted)(req)) {
                             const accessToken = extractAccessToken(data, signInMutation);
                             if (accessToken) {
                                 const rememberMe = hasRememberMe(body.variables);

package/server.js

@@ -196,6 +196,9 @@ class Server {
         };
         app.use(csrfSetToken); // Set CSRF token cookie on all requests
         app.use('/graphql', csrfProtect); // Enforce CSRF on GraphQL mutations
+        // The session-cookie opt-out does not bypass CSRF: it only stops sign-in
+        // responses from setting cookies (see AuthCookiePlugin).
+        app.use('/graphql', cookie_1.rejectInvalidSessionCookieHeader);
         // LLM Agent REST API — mounted before graphile so SSE streaming
         // routes are handled without going through PostGraphile
         app.use((0, agentic_1.createAgenticRouter)());