@constructive-io/graphql-server 5.28.8 → 5.29.0

package/README.md

@@ -99,6 +99,18 @@ For the operational workflow, sampler output, and heap snapshot usage, see [docs
 - `GET /debug/memory` -> memory/process/Graphile debug snapshot when observability is enabled
 - `GET /debug/db` -> PostgreSQL activity/locks/pool debug snapshot when observability is enabled
 
+## Auth cookies and CSRF
+
+Browsers authenticate with the `constructive_session` cookie; every other client sends `Authorization: Bearer <accessToken>`.
+
+- A successful sign-in mutation (`signIn`, `signUp`, `signInSso`, `signInMagicLink`, `signInEmailOtp`, `completeMfaChallenge`, …) returns the access token in the response body and also sets `constructive_session` (plus `constructive_device_token` when the mutation returns a device id). `Max-Age` comes from the API's auth settings (default 86400 s; `rememberMe: true` uses the remember-me duration).
+- `signOut` always answers with expired `constructive_session` and `constructive_device_token` cookies (`Max-Age=0`), however the request authenticated and whether or not the mutation succeeded. `revokeSession` / `revokeAllSessions` clear them on success.
+- Every request gets a `csrf_token` cookie (readable by JS, one day). A `POST /graphql` that carries `constructive_session` and no Bearer header must echo that value in `X-CSRF-Token`, or it is refused with 403 `CSRF_TOKEN_MISSING` / `CSRF_TOKEN_INVALID`. Bearer requests and requests without a session cookie skip the check.
+
+### Non-browser clients (native apps, CLIs, servers)
+
+Send `X-Constructive-Session-Cookie: omit` on every request. Sign-in mutations then set no auth cookie: read `accessToken` from the response body and send it as `Authorization: Bearer <accessToken>`. Any other value of the header is refused with 400 `INVALID_SESSION_COOKIE_HEADER` before the operation runs. The header does not bypass CSRF: a request that still carries `constructive_session` without a Bearer header is checked like a browser's, so sign out with the Bearer token (its response expires any session cookie the client was given before it opted out).
+
 ## Scoped routing
 
 This is a production-only server: every request is resolved through the scoped-routing plane. There is no static single-tenant mode and no flag to disable routing. For single-database local development without route resolution or a database id, use [`@constructive-io/graphql-dev-server`](../dev-server/README.md).

package/errors/api-errors.d.ts

@@ -22,6 +22,7 @@ export declare const ErrorCodes: {
     readonly DATABASE_CONNECTION_ERROR: "DATABASE_CONNECTION_ERROR";
     readonly AMBIGUOUS_TENANT: "AMBIGUOUS_TENANT";
     readonly ADMIN_AUTH_REQUIRED: "ADMIN_AUTH_REQUIRED";
+    readonly INVALID_SESSION_COOKIE_HEADER: "INVALID_SESSION_COOKIE_HEADER";
 };
 /**
  * Type alias for valid error codes.
@@ -161,6 +162,13 @@ export declare class AmbiguousTenantError extends ApiError {
 export declare class AdminAuthRequiredError extends ApiError {
     constructor(reason: string);
 }
+/**
+ * Thrown when the session-cookie opt-out header carries a value other than
+ * the one the server accepts, so a typo never silently falls back to cookies.
+ */
+export declare class InvalidSessionCookieHeaderError extends ApiError {
+    constructor(header: string, value: string, accepted: string);
+}
 /**
  * Check if an error is an instance of ApiError or any of its subclasses.
  *

package/errors/api-errors.js

@@ -10,7 +10,7 @@
  * @module errors/api-errors
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AdminAuthRequiredError = exports.AmbiguousTenantError = exports.SchemaAccessDeniedError = exports.DatabaseConnectionError = exports.HandlerCreationError = exports.SchemaValidationError = exports.NoValidSchemasError = exports.ApiNotFoundError = exports.DomainNotFoundError = exports.ApiError = exports.ErrorCodes = void 0;
+exports.InvalidSessionCookieHeaderError = exports.AdminAuthRequiredError = exports.AmbiguousTenantError = exports.SchemaAccessDeniedError = exports.DatabaseConnectionError = exports.HandlerCreationError = exports.SchemaValidationError = exports.NoValidSchemasError = exports.ApiNotFoundError = exports.DomainNotFoundError = exports.ApiError = exports.ErrorCodes = void 0;
 exports.isApiError = isApiError;
 exports.hasErrorCode = hasErrorCode;
 // =============================================================================
@@ -30,6 +30,7 @@ exports.ErrorCodes = {
     DATABASE_CONNECTION_ERROR: 'DATABASE_CONNECTION_ERROR',
     AMBIGUOUS_TENANT: 'AMBIGUOUS_TENANT',
     ADMIN_AUTH_REQUIRED: 'ADMIN_AUTH_REQUIRED',
+    INVALID_SESSION_COOKIE_HEADER: 'INVALID_SESSION_COOKIE_HEADER',
 };
 // =============================================================================
 // Base Error Class
@@ -230,6 +231,17 @@ class AdminAuthRequiredError extends ApiError {
     }
 }
 exports.AdminAuthRequiredError = AdminAuthRequiredError;
+/**
+ * Thrown when the session-cookie opt-out header carries a value other than
+ * the one the server accepts, so a typo never silently falls back to cookies.
+ */
+class InvalidSessionCookieHeaderError extends ApiError {
+    constructor(header, value, accepted) {
+        super(exports.ErrorCodes.INVALID_SESSION_COOKIE_HEADER, 400, `${header} accepts only "${accepted}"`, { header, value, accepted });
+        this.name = 'InvalidSessionCookieHeaderError';
+    }
+}
+exports.InvalidSessionCookieHeaderError = InvalidSessionCookieHeaderError;
 // =============================================================================
 // Type Guards
 // =============================================================================

package/esm/errors/api-errors.js

@@ -25,6 +25,7 @@ export const ErrorCodes = {
     DATABASE_CONNECTION_ERROR: 'DATABASE_CONNECTION_ERROR',
     AMBIGUOUS_TENANT: 'AMBIGUOUS_TENANT',
     ADMIN_AUTH_REQUIRED: 'ADMIN_AUTH_REQUIRED',
+    INVALID_SESSION_COOKIE_HEADER: 'INVALID_SESSION_COOKIE_HEADER',
 };
 // =============================================================================
 // Base Error Class
@@ -215,6 +216,16 @@ export class AdminAuthRequiredError extends ApiError {
         this.name = 'AdminAuthRequiredError';
     }
 }
+/**
+ * Thrown when the session-cookie opt-out header carries a value other than
+ * the one the server accepts, so a typo never silently falls back to cookies.
+ */
+export class InvalidSessionCookieHeaderError extends ApiError {
+    constructor(header, value, accepted) {
+        super(ErrorCodes.INVALID_SESSION_COOKIE_HEADER, 400, `${header} accepts only "${accepted}"`, { header, value, accepted });
+        this.name = 'InvalidSessionCookieHeaderError';
+    }
+}
 // =============================================================================
 // Type Guards
 // =============================================================================

package/esm/middleware/cookie.js

@@ -1,5 +1,13 @@
+import { InvalidSessionCookieHeaderError } from '../errors/api-errors';
 export const SESSION_COOKIE_NAME = 'constructive_session';
 export const DEVICE_TOKEN_COOKIE_NAME = 'constructive_device_token';
+/**
+ * Request header a non-browser client (native app, CLI, server) sends to opt
+ * out of auth cookies: sign-in mutations then return the access token in the
+ * response body only and set neither the session nor the device-token cookie.
+ */
+export const SESSION_COOKIE_HEADER = 'X-Constructive-Session-Cookie';
+export const SESSION_COOKIE_OMIT = 'omit';
 const DEVICE_TOKEN_MAX_AGE = 90 * 24 * 60 * 60; // 90 days in seconds
 /**
  * Build cookie config from AuthSettings with optional remember_me override.
@@ -89,6 +97,22 @@ export const clearDeviceTokenCookie = (res, config) => {
         path: config.path,
     });
 };
+/**
+ * True when the request opted out of auth cookies via `SESSION_COOKIE_HEADER`.
+ */
+export const isSessionCookieOmitted = (req) => req.get(SESSION_COOKIE_HEADER) === SESSION_COOKIE_OMIT;
+/**
+ * Reject a `SESSION_COOKIE_HEADER` with any value but `omit`, before the
+ * request executes, so a misspelt opt-out fails loudly instead of setting the
+ * cookie the client asked not to receive.
+ */
+export const rejectInvalidSessionCookieHeader = (req, _res, next) => {
+    const value = req.get(SESSION_COOKIE_HEADER);
+    if (value !== undefined && value !== SESSION_COOKIE_OMIT) {
+        return next(new InvalidSessionCookieHeaderError(SESSION_COOKIE_HEADER, value, SESSION_COOKIE_OMIT));
+    }
+    next();
+};
 /**
  * Parse a cookie value from the raw Cookie header.
  * Avoids pulling in cookie-parser as a dependency.

package/esm/middleware/error-handler.js

@@ -1,30 +1,15 @@
 import './types';
-import { getNodeEnv } from '@pgpmjs/env';
 import { Logger } from '@pgpmjs/logger';
 import errorPage50x from '../errors/50x';
 import errorPage404Message from '../errors/404-message';
 import { isApiError } from '../errors/api-errors';
 const log = new Logger('error-handler');
-const isDevelopment = () => getNodeEnv() === 'development';
 const wantsJson = (req) => {
     const accept = req.get('Accept') || '';
     return accept.includes('application/json')
         || accept.includes('application/graphql-response+json')
         || Boolean(req.is('json'));
 };
-const sanitizeMessage = (error) => {
-    if (isDevelopment())
-        return error.message;
-    if (isApiError(error))
-        return error.message;
-    if (error.message?.includes('ECONNREFUSED'))
-        return 'Service temporarily unavailable';
-    if (error.message?.includes('timeout') || error.message?.includes('ETIMEDOUT'))
-        return 'Request timed out';
-    if (error.message?.includes('does not exist'))
-        return 'The requested resource does not exist';
-    return 'An unexpected error occurred';
-};
 const isCsrfError = (err) => {
     const code = err.code;
     return typeof code === 'string' && code.startsWith('CSRF_');
@@ -34,7 +19,7 @@ const categorizeError = (err) => {
         return {
             statusCode: err.statusCode,
             code: err.code,
-            message: sanitizeMessage(err),
+            message: err.message,
             logLevel: err.statusCode >= 500 ? 'error' : 'warn',
         };
     }
@@ -43,12 +28,12 @@ const categorizeError = (err) => {
         return { statusCode: 403, code, message: err.message, logLevel: 'warn' };
     }
     if (err.message?.includes('ECONNREFUSED') || err.message?.includes('connection terminated')) {
-        return { statusCode: 503, code: 'SERVICE_UNAVAILABLE', message: sanitizeMessage(err), logLevel: 'error' };
+        return { statusCode: 503, code: 'SERVICE_UNAVAILABLE', message: err.message, logLevel: 'error' };
     }
     if (err.message?.includes('timeout') || err.message?.includes('ETIMEDOUT')) {
-        return { statusCode: 504, code: 'GATEWAY_TIMEOUT', message: sanitizeMessage(err), logLevel: 'error' };
+        return { statusCode: 504, code: 'GATEWAY_TIMEOUT', message: err.message, logLevel: 'error' };
     }
-    return { statusCode: 500, code: 'INTERNAL_ERROR', message: sanitizeMessage(err), logLevel: 'error' };
+    return { statusCode: 500, code: 'INTERNAL_ERROR', message: err.message, logLevel: 'error' };
 };
 const sendResponse = (req, res, { statusCode, code, message }) => {
     if (wantsJson(req)) {
@@ -72,7 +57,7 @@ const logError = (err, req, level) => {
         log[level]({ event: 'api_error', code: err.code, statusCode: err.statusCode, message: err.message, ...context });
     }
     else {
-        log[level]({ event: 'unexpected_error', name: err.name, message: err.message, stack: isDevelopment() ? err.stack : undefined, ...context });
+        log[level]({ event: 'unexpected_error', name: err.name, message: err.message, stack: err.stack, ...context });
     }
 };
 export const errorHandler = (err, req, res, _next) => {

package/esm/middleware/{mask-error.js → format-error.js}

@@ -1,39 +1,20 @@
 import crypto from 'node:crypto';
-import { classify, parse } from '@constructive-io/errors';
-import { getNodeEnv } from '@pgpmjs/env';
+import { parse } from '@constructive-io/errors';
 import { Logger } from '@pgpmjs/logger';
-const maskErrorLog = new Logger('graphile:maskError');
-/**
- * GraphQL framework protocol codes. These originate in the GraphQL/grafast
- * transport layer (not in constructive-db), so they are not Constructive domain
- * codes in the `@constructive-io/errors` registry. They are always safe to
- * surface — they carry no sensitive detail. Everything else (auth, account,
- * resource, constraint, and every constructive-db code) is classified by the
- * registry, which is the single source of truth for public vs. internal.
- */
-const GRAPHQL_PROTOCOL_CODES = new Set([
-    'GRAPHQL_VALIDATION_FAILED',
-    'GRAPHQL_PARSE_FAILED',
-    'PERSISTED_QUERY_NOT_FOUND',
-    'PERSISTED_QUERY_NOT_SUPPORTED'
-]);
-/** A code is safe to surface when the registry classifies it public, or it is a
- * GraphQL framework protocol code. */
-const isPublicCode = (code) => Boolean(code) && (classify(code) === 'public' || GRAPHQL_PROTOCOL_CODES.has(code));
+const formatErrorLog = new Logger('graphile:formatError');
 /**
  * An error the GraphQL layer raised about the *request*, before any resolver
  * ran: an unknown input field, a value of the wrong type, a missing required
  * variable. graphql-js reports variable coercion without an `extensions.code`
  * (unlike parse/validation, which carry `GRAPHQL_PARSE_FAILED` /
- * `GRAPHQL_VALIDATION_FAILED`), so code-based classification alone reads it as
- * unknown and masks it — telling a client its own malformed query was a server
- * failure, with a reference id pointing at nothing.
+ * `GRAPHQL_VALIDATION_FAILED`), so code-based classification alone would read
+ * it as a server failure instead of the client's own malformed query.
  *
  * A request error is answered before a field is resolved, so it carries no
  * response `path` — every execution error has one. Coercion wraps the inner
  * complaint about the value, so `originalError` may be set, but only ever to
  * another GraphQL-layer error: anything a resolver or the database threw arrives
- * as a foreign error (a pg error, an `Error`) and is masked as before. The wrap
+ * as a foreign error (a pg error, an `Error`). The wrap
  * is recognized by name rather than by `instanceof`, because the error is raised
  * by whichever copy of graphql-js grafast resolved, not by this package's.
  */
@@ -63,8 +44,10 @@ const withoutInputValues = (error) => {
         .replace(/^Value "[\s\S]*" does not exist in/, 'Value does not exist in');
     return `${variable} got invalid value${at}; ${complaint}`;
 };
-/** The code a surfaced request error carries when graphql-js supplied none. */
+/** The code a request error carries when graphql-js supplied none. */
 const BAD_USER_INPUT = 'BAD_USER_INPUT';
+/** The code any other error carries when nothing supplied one. */
+const INTERNAL_SERVER_ERROR = 'INTERNAL_SERVER_ERROR';
 /**
  * Normalize any GraphQL/database error into a canonical Constructive shape.
  *
@@ -80,21 +63,21 @@ export const normalizeError = (error) => {
     return { code: parsed.code, context: parsed.context, class: parsed.class };
 };
 /**
- * Production-aware error handling backed by `@constructive-io/errors`.
+ * Format every GraphQL error the same way, in every environment. Nothing is
+ * masked: the client always receives the real message.
  *
- * 1. Enrich `extensions.code`/`class`/`context` from the parsed error so clients
- *    always receive a machine-readable code (fixing the gap where database
- *    errors reached clients as a bare message with empty `extensions`).
- * 2. Surface public (registered/allowlisted) errors as-is.
- * 3. In development, pass everything through (enriched) for debugging.
- * 4. In production, mask internal/unknown errors behind a reference ID and log
- *    the original.
+ * 1. Lift the structured code onto `extensions.code`/`class`/`context` from the
+ *    parsed error, so database errors reach clients with a machine-readable
+ *    code instead of a bare message with empty `extensions`.
+ * 2. A request error graphql-js raised without a code is `BAD_USER_INPUT`.
+ * 3. Any other error without a code is `INTERNAL_SERVER_ERROR`.
+ * 4. Every internal error (unknown, or registered as internal) carries an
+ *    `errorId` and is logged under it, so a report can be matched to the log.
  */
-export const maskError = (error) => {
+export const formatError = (error) => {
     const { code, context, class: errorClass } = normalizeError(error);
-    // Lift the structured code onto extensions for every recognized error so
-    // clients always receive a machine-readable code (`extensions` is read-only
-    // on GraphQLError, so we build a formatted error rather than mutating it).
+    // `extensions` is read-only on GraphQLError, so build a formatted error
+    // rather than mutating it.
     const extensions = { ...error.extensions };
     if (code) {
         extensions.code = code;
@@ -103,33 +86,25 @@ export const maskError = (error) => {
             extensions.context = context;
         }
     }
-    const effectiveCode = code ?? error.extensions?.code;
-    if (!effectiveCode && isRequestError(error)) {
-        extensions.code = BAD_USER_INPUT;
-        return {
-            message: withoutInputValues(error),
-            ...(error.locations ? { locations: error.locations } : {}),
-            extensions,
-        };
+    let internal = Boolean(code) && errorClass === 'internal';
+    let message = error.message;
+    if (!code && !error.extensions?.code) {
+        const requestError = isRequestError(error);
+        if (requestError)
+            message = withoutInputValues(error);
+        extensions.code = requestError ? BAD_USER_INPUT : INTERNAL_SERVER_ERROR;
+        internal = !requestError;
     }
-    if (isPublicCode(effectiveCode) || getNodeEnv() === 'development') {
-        // Note: grafserv strips originalError and internal extensions before
-        // serializing to the client, so returning the enriched error is safe.
-        return {
-            message: error.message,
-            ...(error.locations ? { locations: error.locations } : {}),
-            ...(error.path ? { path: error.path } : {}),
-            extensions,
-        };
+    if (internal) {
+        const errorId = crypto.randomBytes(8).toString('hex');
+        extensions.errorId = errorId;
+        formatErrorLog.error(`[graphql-error:${errorId}]`, error);
     }
-    // Mask internal/unknown errors with a reference ID.
-    const errorId = crypto.randomBytes(8).toString('hex');
-    maskErrorLog.error(`[masked-error:${errorId}]`, error);
+    // grafserv strips originalError before serializing to the client.
     return {
-        message: `An unexpected error occurred. Reference: ${errorId}`,
-        extensions: {
-            code: 'INTERNAL_SERVER_ERROR',
-            errorId
-        }
+        message,
+        ...(error.locations ? { locations: error.locations } : {}),
+        ...(error.path ? { path: error.path } : {}),
+        extensions
     };
 };

package/esm/middleware/graphile.js

@@ -1,7 +1,6 @@
 import './types'; // for Request type
 import { errors } from '@constructive-io/errors';
 import { DEFAULT_REQUEST_PROTECTION, protectionPgSettings } from '@constructive-io/express-context';
-import { getNodeEnv } from '@pgpmjs/env';
 import { Logger } from '@pgpmjs/logger';
 import { createGraphileInstance, graphileCache } from 'graphile-cache';
 import { createFunctionBindingsPlugin } from 'graphile-function-bindings';
@@ -14,10 +13,10 @@ import { respondWithGraphQLError } from '../errors/graphql-response';
 import { AuthCookiePlugin } from '../plugins/auth-cookie-plugin';
 import { createErrorEventsPlugin } from '../plugins/error-events-plugin';
 import { RequestProtectionPlugin } from '../plugins/request-protection-plugin';
+import { WebauthnPlugin } from '../plugins/webauthn-plugin';
+import { formatError } from './format-error';
 import { makeIntrospectionWiring } from './graphile-introspection';
-import { maskError } from './mask-error';
 import { observeGraphileBuild } from './observability/graphile-build-stats';
-const isDev = () => getNodeEnv() === 'development';
 // =============================================================================
 // Single-Flight Pattern: In-Flight Tracking
 // =============================================================================
@@ -57,7 +56,7 @@ const reqLabel = (req) => (req.requestId ? `[${req.requestId}]` : '[req]');
  * plugin preset.  Without settings the default preset is used
  * (everything on except aggregates).
  */
-const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole, graphileOptions, databaseSettings, apiId, compute) => {
+const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole, graphileOptions, databaseSettings, apiId, compute, webauthn) => {
     const introspection = await makeIntrospectionWiring(pool, schemas, graphileOptions, undefined, introspectionRole);
     const configuredPreset = graphileOptions?.preset ?? {};
     const grafastCachePreset = createGrafastCacheLimitsPreset(graphileOptions?.grafastCache);
@@ -77,6 +76,9 @@ const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole,
             AuthCookiePlugin,
             RequestProtectionPlugin,
             createErrorEventsPlugin(pool),
+            // Only when the tenant provisioned the WebAuthn module; the policy
+            // itself is read per request from `req.api.webauthnSettings`.
+            ...(webauthn ? [WebauthnPlugin] : []),
             // Only registered when the compute module is provisioned for this
             // database — all schema/table names come from the constructive
             // metaschema (express-context compute module loader); the plugin has
@@ -103,10 +105,10 @@ const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole,
             graphiqlPath: '/graphiql',
             graphiql: true,
             graphiqlOnGraphQLGET: false,
-            maskError
+            maskError: formatError
         },
         grafast: {
-            explain: process.env.NODE_ENV === 'development',
+            explain: graphileOptions?.explain === true,
             context: (requestContext) => {
                 // In grafserv/express/v4, the request is available at requestContext.expressv4.req
                 const req = requestContext?.expressv4?.req;
@@ -309,7 +311,7 @@ export const graphile = (opts) => {
             // concurrent requests coalesce while optional plugin modules load.
             const creationPromise = (async () => {
                 const compute = api.apiId ? await req.constructive?.useModule('compute') : undefined;
-                const preset = await buildPreset(pool, schema || [], anonRole, roleName, opts.api?.introspectionRole, opts.graphile, api.databaseSettings, api.apiId, compute);
+                const preset = await buildPreset(pool, schema || [], anonRole, roleName, opts.api?.introspectionRole, opts.graphile, api.databaseSettings, api.apiId, compute, Boolean(api.webauthnSettings));
                 return observeGraphileBuild({
                     cacheKey: key,
                     serviceKey: key,
@@ -343,7 +345,7 @@ export const graphile = (opts) => {
             log.error(`${label} PostGraphile middleware error`, e);
             if (!res.headersSent) {
                 respondWithGraphQLError(res, errors.INTERNAL_FAILURE({
-                    details: isDev() ? e?.message ?? String(e) : 'An unexpected error occurred'
+                    details: e?.message ?? String(e)
                 }));
                 return;
             }

package/esm/plugins/auth-cookie-plugin.js

@@ -1,6 +1,7 @@
 import '../middleware/types';
 import { Logger } from '@pgpmjs/logger';
-import { DEVICE_TOKEN_COOKIE_NAME, getDeviceTokenCookieConfig, getSessionCookieConfig, SESSION_COOKIE_NAME, } from '../middleware/cookie';
+import { getOperationAST, Kind, parse } from 'graphql';
+import { DEVICE_TOKEN_COOKIE_NAME, getDeviceTokenCookieConfig, getSessionCookieConfig, isSessionCookieOmitted, SESSION_COOKIE_NAME, } from '../middleware/cookie';
 const log = new Logger('auth-cookie');
 /**
  * Serialize a cookie to a Set-Cookie header value.
@@ -66,6 +67,7 @@ const SIGN_IN_MUTATIONS = new Set([
     'completeMfaChallenge',
     'signInOneTimeToken',
     'signInCrossOrigin',
+    'webauthnSignInFinish',
 ]);
 /**
  * Auth mutations that should clear the session cookie.
@@ -76,26 +78,21 @@ const SIGN_OUT_MUTATIONS = new Set([
     'revokeAllSessions',
 ]);
 /**
- * Extract mutation names from a GraphQL query string.
+ * Top-level field names of the mutation that will execute: the operation
+ * picked by `operationName`, so other operations in the document never count.
  */
-const extractMutationNames = (query) => {
-    const mutations = [];
-    if (!/^\s*mutation\b/i.test(query)) {
-        return mutations;
+const extractMutationNames = (query, operationName) => {
+    let document;
+    try {
+        document = parse(query);
     }
-    const bodyStart = query.indexOf('{');
-    if (bodyStart === -1)
-        return mutations;
-    const bodyContent = query.slice(bodyStart + 1);
-    const fieldPattern = /(\w+)\s*(?:\(|{)/g;
-    let match;
-    while ((match = fieldPattern.exec(bodyContent)) !== null) {
-        const name = match[1];
-        if (name !== 'mutation' && name !== 'query' && name !== 'fragment') {
-            mutations.push(name);
-        }
+    catch {
+        return [];
     }
-    return mutations;
+    const operation = getOperationAST(document, operationName);
+    if (operation?.operation !== 'mutation')
+        return [];
+    return operation.selectionSet.selections.flatMap((selection) => selection.kind === Kind.FIELD ? [selection.name.value] : []);
 };
 /**
  * Extract access token from mutation response.
@@ -198,7 +195,7 @@ export const AuthCookiePlugin = {
                         return result;
                     }
                     // Extract mutation names
-                    const mutationNames = extractMutationNames(body.query);
+                    const mutationNames = extractMutationNames(body.query, body.operationName);
                     if (mutationNames.length === 0) {
                         return result;
                     }
@@ -213,24 +210,25 @@ export const AuthCookiePlugin = {
                         // Parse response body
                         const payload = bufferResult.buffer.toString('utf8');
                         const graphqlResponse = JSON.parse(payload);
-                        // Skip if there are GraphQL errors
-                        if (graphqlResponse.errors?.length || !graphqlResponse.data) {
-                            return result;
-                        }
-                        const data = graphqlResponse.data;
+                        const succeeded = !graphqlResponse.errors?.length && Boolean(graphqlResponse.data);
+                        const data = graphqlResponse.data ?? {};
                         const authSettings = req.api?.authSettings;
                         const cookiesToSet = [];
-                        // Handle sign-out mutations
-                        if (signOutMutation && data[signOutMutation]) {
-                            log.info('[auth-cookie] Sign-out mutation succeeded, clearing session cookie');
+                        // signOut always clears the cookies, whatever the mutation returned
+                        // and however the request authenticated: a Bearer client that was
+                        // once handed a session cookie must not keep sending it afterwards.
+                        // revokeSession/revokeAllSessions clear them only on success.
+                        if (signOutMutation === 'signOut' || (signOutMutation && succeeded && data[signOutMutation])) {
+                            log.info(`[auth-cookie] ${signOutMutation}: clearing session cookie`);
                             const config = getSessionCookieConfig(authSettings);
                             cookiesToSet.push(serializeClearCookie(SESSION_COOKIE_NAME, config));
                             // Also clear device token on sign-out
                             const deviceConfig = getDeviceTokenCookieConfig(authSettings);
                             cookiesToSet.push(serializeClearCookie(DEVICE_TOKEN_COOKIE_NAME, deviceConfig));
                         }
-                        // Handle sign-in mutations
-                        if (signInMutation) {
+                        // Handle sign-in mutations; a client that sent the opt-out header
+                        // reads the token from the response body and gets no cookies.
+                        if (signInMutation && succeeded && !isSessionCookieOmitted(req)) {
                             const accessToken = extractAccessToken(data, signInMutation);
                             if (accessToken) {
                                 const rememberMe = hasRememberMe(body.variables);

package/esm/plugins/error-events-plugin.js

@@ -3,13 +3,13 @@ import { Logger } from '@pgpmjs/logger';
 import { getOperationAST } from 'graphql';
 import { escapeIdentifier } from 'pg';
 import { withPgClient } from 'pg-query-context';
-import { normalizeError } from '../middleware/mask-error';
+import { normalizeError } from '../middleware/format-error';
 const log = new Logger('error-events');
 const getExpressRequest = (requestContext) => requestContext?.expressv4?.req;
 /**
  * The first structured, public-classified registry code among the errors.
- * Internal/unknown errors are bugs, not refusals: they are masked and logged
- * by `maskError` and never recorded as tenant events.
+ * Internal/unknown errors are bugs, not refusals: they are logged by
+ * `formatError` and never recorded as tenant events.
  */
 const refusalCode = (errors) => {
     for (const error of errors ?? []) {