@constructive-io/graphql-server 5.29.1 → 5.30.0

package/README.md

@@ -146,6 +146,7 @@ Configuration is merged from defaults, config files, and env vars via `@construc
 | `API_ROLE_NAME`                | Authenticated role name               | `administrator`                                               |
 | `API_FLUSH_TOKEN`              | Bearer token required by `POST /flush`; route is not mounted when unset | empty                        |
 | `API_INTROSPECTION_ROLE`       | Role PostGraphile introspects as; unset means the pool's connecting role. Naming a role with fewer grants removes fields from the schema | empty |
+| `API_CONTROL_ROLE`             | Role control-plane queries (routing, API lookups, module loaders, flush, refusal log) run as via `SET LOCAL ROLE`. The login role holds no privileges, so the server refuses to start without it | required |
 | `GRAPHQL_OBSERVABILITY_ENABLED` | Master switch for debug routes and sampler | `false`                                                  |
 | `GRAPHQL_DEBUG_SAMPLER_ENABLED` | Enables periodic NDJSON sampling when observability is on | `true`                                   |
 | `GRAPHQL_DEBUG_SAMPLER_INTERVAL_MS` | Sampler interval in milliseconds | `10000`                                                       |

package/control-role.d.ts

@@ -0,0 +1,8 @@
+import type { ApiOptions } from '@constructive-io/graphql-types';
+/**
+ * The role control-plane queries run as (`api.controlRole` / `API_CONTROL_ROLE`).
+ * The login role is NOINHERIT and holds no privileges, so there is no default.
+ */
+export declare const getControlRole: (opts: {
+    api?: ApiOptions;
+}) => string;

package/control-role.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getControlRole = void 0;
+/**
+ * The role control-plane queries run as (`api.controlRole` / `API_CONTROL_ROLE`).
+ * The login role is NOINHERIT and holds no privileges, so there is no default.
+ */
+const getControlRole = (opts) => {
+    const role = opts.api?.controlRole;
+    if (!role) {
+        throw new Error('GraphQL server: api.controlRole (API_CONTROL_ROLE) is required — control-plane queries run as that role');
+    }
+    return role;
+};
+exports.getControlRole = getControlRole;

package/diagnostics/debug-db-snapshot.js

@@ -4,6 +4,7 @@ exports.getDebugDatabaseSnapshot = exports.closeDebugDatabasePools = void 0;
 const pg_1 = require("pg");
 const pg_cache_1 = require("pg-cache");
 const pg_env_1 = require("pg-env");
+const control_role_1 = require("../control-role");
 const ACTIVE_ACTIVITY_SQL = `
   select
     pid,
@@ -141,6 +142,7 @@ const withDiagnosticsClient = async (opts, fn) => {
     const client = await diagnosticsPool.connect();
     try {
         await client.query('BEGIN');
+        await client.query('SELECT set_config($1, $2, true)', ['role', (0, control_role_1.getControlRole)(opts)]);
         await client.query(`SET LOCAL statement_timeout = '${DIAGNOSTICS_STATEMENT_TIMEOUT_MS}ms'`);
         await client.query(`SET LOCAL lock_timeout = '${DIAGNOSTICS_LOCK_TIMEOUT_MS}ms'`);
         const result = await fn(client);

package/esm/control-role.js

@@ -0,0 +1,11 @@
+/**
+ * The role control-plane queries run as (`api.controlRole` / `API_CONTROL_ROLE`).
+ * The login role is NOINHERIT and holds no privileges, so there is no default.
+ */
+export const getControlRole = (opts) => {
+    const role = opts.api?.controlRole;
+    if (!role) {
+        throw new Error('GraphQL server: api.controlRole (API_CONTROL_ROLE) is required — control-plane queries run as that role');
+    }
+    return role;
+};

package/esm/diagnostics/debug-db-snapshot.js

@@ -1,6 +1,7 @@
 import { Pool } from 'pg';
 import { buildConnectionString, getPgPool } from 'pg-cache';
 import { getPgEnvOptions } from 'pg-env';
+import { getControlRole } from '../control-role';
 const ACTIVE_ACTIVITY_SQL = `
   select
     pid,
@@ -138,6 +139,7 @@ const withDiagnosticsClient = async (opts, fn) => {
     const client = await diagnosticsPool.connect();
     try {
         await client.query('BEGIN');
+        await client.query('SELECT set_config($1, $2, true)', ['role', getControlRole(opts)]);
         await client.query(`SET LOCAL statement_timeout = '${DIAGNOSTICS_STATEMENT_TIMEOUT_MS}ms'`);
         await client.query(`SET LOCAL lock_timeout = '${DIAGNOSTICS_LOCK_TIMEOUT_MS}ms'`);
         const result = await fn(client);

package/esm/middleware/api.js

@@ -4,6 +4,8 @@ import { parseUrl } from '@constructive-io/url-domains';
 import { Logger } from '@pgpmjs/logger';
 import { svcCache } from '@pgpmjs/server-utils';
 import { getPgPool } from 'pg-cache';
+import { controlPlanePool } from 'pg-query-context';
+import { getControlRole } from '../control-role';
 import errorPage50x from '../errors/50x';
 import errorPage404Message from '../errors/404-message';
 import { getRoutingSchema, isValidSchemaName, requireApiRole, resolveRoute, routeToApiStructure } from './routing';
@@ -48,7 +50,7 @@ const buildLoaderContext = (routingPool, opts, row) => {
     return {
         routingPool,
         routingSchema: getRoutingSchema(opts),
-        tenantPool: getPgPool({ ...opts.pg, database: dbname }),
+        tenantPool: controlPlanePool(getPgPool({ ...opts.pg, database: dbname }), routingPool.role),
         databaseId: row.database_id,
         apiId: row.api_id,
         dbname
@@ -260,7 +262,7 @@ const resolveScopedRoute = async (ctx) => {
 // Main Resolution Function
 // =============================================================================
 export const getApiConfig = async (opts, req) => {
-    const pool = getPgPool(opts.pg);
+    const pool = controlPlanePool(getPgPool(opts.pg), getControlRole(opts));
     const { domain, subdomains } = getUrlDomains(req);
     const subdomain = getSubdomain(subdomains);
     const cacheKey = getSvcKey(opts, req);

package/esm/middleware/auth.js

@@ -62,6 +62,7 @@ export const createAuthenticateMiddleware = (opts) => {
             if (effectiveToken) {
                 log.info(`[auth] Processing ${tokenSource} authentication`);
                 const context = {
+                    role: api.anonRole,
                     'jwt.claims.ip_address': req.clientIp,
                 };
                 if (req.get('origin')) {

package/esm/middleware/flush.js

@@ -4,6 +4,8 @@ import { svcCache } from '@pgpmjs/server-utils';
 import { createHash, timingSafeEqual } from 'crypto';
 import { graphileCache } from 'graphile-cache';
 import { getPgPool } from 'pg-cache';
+import { controlPlanePool } from 'pg-query-context';
+import { getControlRole } from '../control-role';
 import { getRoutingSchema, isValidSchemaName } from './routing';
 const log = new Logger('flush');
 const bearerToken = (req) => {
@@ -47,7 +49,7 @@ export const createFlushMiddleware = (opts) => {
     };
 };
 export const flushService = async (opts, databaseId) => {
-    const pgPool = getPgPool(opts.pg);
+    const pgPool = controlPlanePool(getPgPool(opts.pg), getControlRole(opts));
     log.info('flushing db ' + databaseId);
     const api = new RegExp(`^api:${databaseId}:.*`);
     const schemata = new RegExp(`^schemata:${databaseId}:.*`);

package/esm/middleware/graphile.js

@@ -7,6 +7,8 @@ import { createFunctionBindingsPlugin } from 'graphile-function-bindings';
 import { createConstructivePreset, createGrafastCacheLimitsPreset } from 'graphile-settings';
 import { getPgPool } from 'pg-cache';
 import { getPgEnvOptions } from 'pg-env';
+import { controlPlanePool } from 'pg-query-context';
+import { getControlRole } from '../control-role';
 import { isGraphqlObservabilityEnabled } from '../diagnostics/observability';
 import { HandlerCreationError } from '../errors/api-errors';
 import { respondWithGraphQLError } from '../errors/graphql-response';
@@ -56,7 +58,7 @@ const reqLabel = (req) => (req.requestId ? `[${req.requestId}]` : '[req]');
  * plugin preset.  Without settings the default preset is used
  * (everything on except aggregates).
  */
-const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole, graphileOptions, databaseSettings, apiId, compute, webauthn) => {
+const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole, controlRole, graphileOptions, databaseSettings, apiId, compute, webauthn) => {
     const introspection = await makeIntrospectionWiring(pool, schemas, graphileOptions, undefined, introspectionRole);
     const configuredPreset = graphileOptions?.preset ?? {};
     const grafastCachePreset = createGrafastCacheLimitsPreset(graphileOptions?.grafastCache);
@@ -87,6 +89,7 @@ const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole,
                 ? [
                     createFunctionBindingsPlugin({
                         apiId,
+                        role: controlRole,
                         modules: compute.modules.map((m) => ({
                             computeSchema: m.schemaName,
                             bindingsTable: m.bindingsTableName,
@@ -311,7 +314,7 @@ export const graphile = (opts) => {
             // concurrent requests coalesce while optional plugin modules load.
             const creationPromise = (async () => {
                 const compute = api.apiId ? await req.constructive?.useModule('compute') : undefined;
-                const preset = await buildPreset(pool, schema || [], anonRole, roleName, opts.api?.introspectionRole, opts.graphile, api.databaseSettings, api.apiId, compute, Boolean(api.webauthnSettings));
+                const preset = await buildPreset(pool, schema || [], anonRole, roleName, opts.api?.introspectionRole, getControlRole(opts), opts.graphile, api.databaseSettings, api.apiId, compute, Boolean(api.webauthnSettings));
                 return observeGraphileBuild({
                     cacheKey: key,
                     serviceKey: key,
@@ -319,7 +322,8 @@ export const graphile = (opts) => {
                 }, () => createGraphileInstance({
                     preset,
                     cacheKey: key,
-                    enableRealtime: api.databaseSettings?.enableRealtime
+                    enableRealtime: api.databaseSettings?.enableRealtime,
+                    realtimePool: controlPlanePool(pool, getControlRole(opts))
                 }), { enabled: observabilityEnabled });
             })();
             creating.set(key, creationPromise);

package/esm/plugins/webauthn-plugin.js

@@ -242,20 +242,27 @@ export const WebauthnPlugin = {
                         if (name !== null && name.length > MAX_NAME_LENGTH) {
                             fail('BAD_USER_INPUT', `name must be at most ${MAX_NAME_LENGTH} characters`);
                         }
+                        let verifiedChallenge = null;
                         const verified = await withVerifierLane(withPgClient, pgSettings, (tx) => verifying(() => verifyRegistrationResponse({
                             response,
-                            expectedChallenge: (challenge) => challengeMatches(tx, settings, REGISTER_CHALLENGE, challenge, null),
+                            expectedChallenge: async (challenge) => {
+                                const matches = await challengeMatches(tx, settings, REGISTER_CHALLENGE, challenge, null);
+                                if (matches)
+                                    verifiedChallenge = challenge;
+                                return matches;
+                            },
                             expectedOrigin: settings.originAllowlist,
                             expectedRPID: settings.rpId,
                             requireUserVerification: settings.requireUserVerification
                         })));
-                        if (!verified.verified)
+                        if (!verified.verified || verifiedChallenge === null) {
                             fail('WEBAUTHN_VERIFICATION_FAILED', 'WebAuthn registration verification failed');
+                        }
                         const { credential, credentialDeviceType, credentialBackedUp } = verified.registrationInfo;
                         const credentialId = await withVerifierLane(withPgClient, pgSettings, async (tx) => {
                             const { rows } = await tx.query({
                                 text: `SELECT ${procedure(settings, 'webauthn_finish_registration')}(
-                  $1, $2, $3, $4, $5, $6, $7, $8, $9, $10
+                  $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11
                 ) AS id`,
                                 values: [
                                     credential.id,
@@ -269,6 +276,8 @@ export const WebauthnPlugin = {
                                     credentialBackedUp,
                                     webauthnUserId,
                                     userId,
+                                    // Consume exactly the challenge the attestation was verified against.
+                                    verifiedChallenge,
                                     name
                                 ]
                             });

package/esm/refusals/recorder.js

@@ -2,6 +2,8 @@ import '../middleware/types'; // for Request type
 import { clientIpFrom, createRecordRefusalsSink, RefusalRecorder, trustedProxyHops } from '@constructive-io/express-context';
 import { Logger } from '@pgpmjs/logger';
 import { getPgPool } from 'pg-cache';
+import { controlPlanePool } from 'pg-query-context';
+import { getControlRole } from '../control-role';
 const log = new Logger('refusals');
 /**
  * refusals/recorder — the GraphQL lane's `RefusalRecorder`.
@@ -119,16 +121,17 @@ export const platformFlushClaims = (identity) => ({
  */
 export const createPlatformRefusalRecorder = (opts, recorderOpts = {}) => {
     const pool = getPgPool(opts.pg);
+    const role = getControlRole(opts);
     let cached = null;
     const claims = async () => {
         if (cached)
             return cached;
-        cached = platformFlushClaims(await resolvePlatformFlushIdentity(pool, recorderOpts.principalName));
+        cached = platformFlushClaims(await resolvePlatformFlushIdentity(controlPlanePool(pool, role), recorderOpts.principalName));
         log.info(`[refusals] flushing as '${recorderOpts.principalName ?? PLATFORM_BOOTSTRAP_PRINCIPAL}'`);
         return cached;
     };
     return new RefusalRecorder({
-        sink: createRecordRefusalsSink({ pool, claims }),
+        sink: createRecordRefusalsSink({ pool, role, claims }),
         intervalMs: recorderOpts.intervalMs,
         jitterMs: recorderOpts.jitterMs,
         maxKeys: recorderOpts.maxKeys

package/esm/server.js

@@ -11,6 +11,7 @@ import graphqlUpload from 'graphql-upload';
 import { getPgPool } from 'pg-cache';
 import requestIp from 'request-ip';
 import { createAgenticRouter } from './agentic';
+import { getControlRole } from './control-role';
 import { closeDebugDatabasePools } from './diagnostics/debug-db-snapshot';
 import { startDebugSampler } from './diagnostics/debug-sampler';
 import { isDevelopmentObservabilityMode, isGraphqlObservabilityEnabled, isGraphqlObservabilityRequested, isLoopbackHost } from './diagnostics/observability';
@@ -76,6 +77,7 @@ class Server {
     constructor(opts) {
         this.opts = getEnvOptions(opts);
         const effectiveOpts = this.opts;
+        const controlRole = getControlRole(effectiveOpts);
         const observabilityRequested = isGraphqlObservabilityRequested();
         const observabilityEnabled = isGraphqlObservabilityEnabled(effectiveOpts.server?.host);
         const app = express();
@@ -145,7 +147,8 @@ class Server {
         app.use(createContextMiddleware({
             pg: effectiveOpts.pg,
             loaders: createDefaultRegistry(),
-            routingSchema: getRoutingSchema(effectiveOpts)
+            routingSchema: getRoutingSchema(effectiveOpts),
+            controlRole
         }));
         // A suspended (or unknown) database is refused before anything is spent on
         // the request; billing and platform admins set that state, the loader reads it.

package/middleware/api.js

@@ -10,6 +10,8 @@ const url_domains_1 = require("@constructive-io/url-domains");
 const logger_1 = require("@pgpmjs/logger");
 const server_utils_1 = require("@pgpmjs/server-utils");
 const pg_cache_1 = require("pg-cache");
+const pg_query_context_1 = require("pg-query-context");
+const control_role_1 = require("../control-role");
 const _50x_1 = __importDefault(require("../errors/50x"));
 const _404_message_1 = __importDefault(require("../errors/404-message"));
 const routing_1 = require("./routing");
@@ -54,7 +56,7 @@ const buildLoaderContext = (routingPool, opts, row) => {
     return {
         routingPool,
         routingSchema: (0, routing_1.getRoutingSchema)(opts),
-        tenantPool: (0, pg_cache_1.getPgPool)({ ...opts.pg, database: dbname }),
+        tenantPool: (0, pg_query_context_1.controlPlanePool)((0, pg_cache_1.getPgPool)({ ...opts.pg, database: dbname }), routingPool.role),
         databaseId: row.database_id,
         apiId: row.api_id,
         dbname
@@ -268,7 +270,7 @@ const resolveScopedRoute = async (ctx) => {
 // Main Resolution Function
 // =============================================================================
 const getApiConfig = async (opts, req) => {
-    const pool = (0, pg_cache_1.getPgPool)(opts.pg);
+    const pool = (0, pg_query_context_1.controlPlanePool)((0, pg_cache_1.getPgPool)(opts.pg), (0, control_role_1.getControlRole)(opts));
     const { domain, subdomains } = getUrlDomains(req);
     const subdomain = (0, exports.getSubdomain)(subdomains);
     const cacheKey = (0, exports.getSvcKey)(opts, req);

package/middleware/auth.js

@@ -68,6 +68,7 @@ const createAuthenticateMiddleware = (opts) => {
             if (effectiveToken) {
                 log.info(`[auth] Processing ${tokenSource} authentication`);
                 const context = {
+                    role: api.anonRole,
                     'jwt.claims.ip_address': req.clientIp,
                 };
                 if (req.get('origin')) {

package/middleware/flush.js

@@ -7,6 +7,8 @@ const server_utils_1 = require("@pgpmjs/server-utils");
 const crypto_1 = require("crypto");
 const graphile_cache_1 = require("graphile-cache");
 const pg_cache_1 = require("pg-cache");
+const pg_query_context_1 = require("pg-query-context");
+const control_role_1 = require("../control-role");
 const routing_1 = require("./routing");
 const log = new logger_1.Logger('flush');
 const bearerToken = (req) => {
@@ -51,7 +53,7 @@ const createFlushMiddleware = (opts) => {
 };
 exports.createFlushMiddleware = createFlushMiddleware;
 const flushService = async (opts, databaseId) => {
-    const pgPool = (0, pg_cache_1.getPgPool)(opts.pg);
+    const pgPool = (0, pg_query_context_1.controlPlanePool)((0, pg_cache_1.getPgPool)(opts.pg), (0, control_role_1.getControlRole)(opts));
     log.info('flushing db ' + databaseId);
     const api = new RegExp(`^api:${databaseId}:.*`);
     const schemata = new RegExp(`^schemata:${databaseId}:.*`);

package/middleware/graphile.js

@@ -13,6 +13,8 @@ const graphile_function_bindings_1 = require("graphile-function-bindings");
 const graphile_settings_1 = require("graphile-settings");
 const pg_cache_1 = require("pg-cache");
 const pg_env_1 = require("pg-env");
+const pg_query_context_1 = require("pg-query-context");
+const control_role_1 = require("../control-role");
 const observability_1 = require("../diagnostics/observability");
 const api_errors_1 = require("../errors/api-errors");
 const graphql_response_1 = require("../errors/graphql-response");
@@ -62,7 +64,7 @@ const reqLabel = (req) => (req.requestId ? `[${req.requestId}]` : '[req]');
  * plugin preset.  Without settings the default preset is used
  * (everything on except aggregates).
  */
-const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole, graphileOptions, databaseSettings, apiId, compute, webauthn) => {
+const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole, controlRole, graphileOptions, databaseSettings, apiId, compute, webauthn) => {
     const introspection = await (0, graphile_introspection_1.makeIntrospectionWiring)(pool, schemas, graphileOptions, undefined, introspectionRole);
     const configuredPreset = graphileOptions?.preset ?? {};
     const grafastCachePreset = (0, graphile_settings_1.createGrafastCacheLimitsPreset)(graphileOptions?.grafastCache);
@@ -93,6 +95,7 @@ const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole,
                 ? [
                     (0, graphile_function_bindings_1.createFunctionBindingsPlugin)({
                         apiId,
+                        role: controlRole,
                         modules: compute.modules.map((m) => ({
                             computeSchema: m.schemaName,
                             bindingsTable: m.bindingsTableName,
@@ -317,7 +320,7 @@ const graphile = (opts) => {
             // concurrent requests coalesce while optional plugin modules load.
             const creationPromise = (async () => {
                 const compute = api.apiId ? await req.constructive?.useModule('compute') : undefined;
-                const preset = await buildPreset(pool, schema || [], anonRole, roleName, opts.api?.introspectionRole, opts.graphile, api.databaseSettings, api.apiId, compute, Boolean(api.webauthnSettings));
+                const preset = await buildPreset(pool, schema || [], anonRole, roleName, opts.api?.introspectionRole, (0, control_role_1.getControlRole)(opts), opts.graphile, api.databaseSettings, api.apiId, compute, Boolean(api.webauthnSettings));
                 return (0, graphile_build_stats_1.observeGraphileBuild)({
                     cacheKey: key,
                     serviceKey: key,
@@ -325,7 +328,8 @@ const graphile = (opts) => {
                 }, () => (0, graphile_cache_1.createGraphileInstance)({
                     preset,
                     cacheKey: key,
-                    enableRealtime: api.databaseSettings?.enableRealtime
+                    enableRealtime: api.databaseSettings?.enableRealtime,
+                    realtimePool: (0, pg_query_context_1.controlPlanePool)(pool, (0, control_role_1.getControlRole)(opts))
                 }), { enabled: observabilityEnabled });
             })();
             creating.set(key, creationPromise);

package/middleware/routing.d.ts

@@ -1,4 +1,4 @@
-import { Pool } from 'pg';
+import type { ControlPlaneQueryable } from 'pg-query-context';
 import { ApiOptions, ApiStructure } from '../types';
 /**
  * The role an API row names is the role the server will SET ROLE to; a row
@@ -41,7 +41,7 @@ export declare const isValidSchemaName: (name: string) => boolean;
  * resolver is not installed in the target database — in both cases the caller
  * treats it as a hard no-match (→ 404); there is no legacy fallback.
  */
-export declare const resolveRoute: (pool: Pool, schema: string, host: string) => Promise<ResolvedRoute | null>;
+export declare const resolveRoute: (pool: ControlPlaneQueryable, schema: string, host: string) => Promise<ResolvedRoute | null>;
 /**
  * Map a resolved api-target route onto the ApiStructure shape consumed by the
  * rest of the middleware chain. Returns null when the route target is not an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.29.1",
+  "version": "5.30.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -43,9 +43,9 @@
     "@agentic-kit/ollama": "2.15.0",
     "@constructive-io/csrf": "^0.30.1",
     "@constructive-io/errors": "^0.24.0",
-    "@constructive-io/express-context": "^0.33.7",
-    "@constructive-io/graphql-env": "^3.35.0",
-    "@constructive-io/graphql-types": "^3.34.0",
+    "@constructive-io/express-context": "^0.34.0",
+    "@constructive-io/graphql-env": "^3.36.0",
+    "@constructive-io/graphql-types": "^3.35.0",
     "@constructive-io/llm-env": "^0.15.0",
     "@constructive-io/query-builder": "^3.16.9",
     "@constructive-io/s3-utils": "^2.34.0",
@@ -65,12 +65,12 @@
     "grafserv": "1.0.1",
     "graphile-build": "5.1.1",
     "graphile-build-pg": "5.1.3",
-    "graphile-cache": "^4.14.7",
+    "graphile-cache": "^4.15.0",
     "graphile-config": "1.1.0",
-    "graphile-function-bindings": "^1.17.9",
+    "graphile-function-bindings": "^1.17.10",
     "graphile-plugin-utils": "^1.13.0",
-    "graphile-scoped-introspection": "^0.4.9",
-    "graphile-settings": "^6.25.1",
+    "graphile-scoped-introspection": "^0.4.10",
+    "graphile-settings": "^6.25.2",
     "graphile-utils": "5.0.3",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
@@ -78,7 +78,7 @@
     "pg": "^8.21.0",
     "pg-cache": "^3.29.7",
     "pg-env": "^1.32.0",
-    "pg-query-context": "^2.31.0",
+    "pg-query-context": "^2.32.0",
     "pg-sql2": "5.0.1",
     "postgraphile": "5.1.4",
     "request-ip": "^3.3.0"
@@ -93,11 +93,11 @@
     "@types/request-ip": "^0.0.41",
     "@types/supertest": "^7.2.1",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "5.17.9",
+    "graphile-test": "5.17.10",
     "makage": "^0.8.0",
     "nodemon": "^3.1.14",
     "supertest": "^7.2.2",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "850fc5e75a3a31e2db2fc28aa58377e886fe3c6a"
+  "gitHead": "2f506a4a4062b4bd92979c02249e0fee14af4043"
 }

package/plugins/webauthn-plugin.js

@@ -245,20 +245,27 @@ exports.WebauthnPlugin = {
                         if (name !== null && name.length > MAX_NAME_LENGTH) {
                             fail('BAD_USER_INPUT', `name must be at most ${MAX_NAME_LENGTH} characters`);
                         }
+                        let verifiedChallenge = null;
                         const verified = await withVerifierLane(withPgClient, pgSettings, (tx) => verifying(() => (0, server_1.verifyRegistrationResponse)({
                             response,
-                            expectedChallenge: (challenge) => challengeMatches(tx, settings, REGISTER_CHALLENGE, challenge, null),
+                            expectedChallenge: async (challenge) => {
+                                const matches = await challengeMatches(tx, settings, REGISTER_CHALLENGE, challenge, null);
+                                if (matches)
+                                    verifiedChallenge = challenge;
+                                return matches;
+                            },
                             expectedOrigin: settings.originAllowlist,
                             expectedRPID: settings.rpId,
                             requireUserVerification: settings.requireUserVerification
                         })));
-                        if (!verified.verified)
+                        if (!verified.verified || verifiedChallenge === null) {
                             fail('WEBAUTHN_VERIFICATION_FAILED', 'WebAuthn registration verification failed');
+                        }
                         const { credential, credentialDeviceType, credentialBackedUp } = verified.registrationInfo;
                         const credentialId = await withVerifierLane(withPgClient, pgSettings, async (tx) => {
                             const { rows } = await tx.query({
                                 text: `SELECT ${procedure(settings, 'webauthn_finish_registration')}(
-                  $1, $2, $3, $4, $5, $6, $7, $8, $9, $10
+                  $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11
                 ) AS id`,
                                 values: [
                                     credential.id,
@@ -272,6 +279,8 @@ exports.WebauthnPlugin = {
                                     credentialBackedUp,
                                     webauthnUserId,
                                     userId,
+                                    // Consume exactly the challenge the attestation was verified against.
+                                    verifiedChallenge,
                                     name
                                 ]
                             });

package/refusals/recorder.d.ts

@@ -3,7 +3,7 @@ import type { RefusalReason, RefusalRecorderStats } from '@constructive-io/expre
 import { RefusalRecorder } from '@constructive-io/express-context';
 import type { ConstructiveOptions } from '@constructive-io/graphql-types';
 import type { Request } from 'express';
-import type { Pool } from 'pg';
+import { type ControlPlaneQueryable } from 'pg-query-context';
 /**
  * refusals/recorder — the GraphQL lane's `RefusalRecorder`.
  *
@@ -61,7 +61,7 @@ interface PlatformFlushIdentity {
  * `platform-bootstrap` service principal's user row. Throws — with the row
  * that was missing named — rather than returning a partial identity.
  */
-export declare const resolvePlatformFlushIdentity: (pool: Pool, principalName?: string) => Promise<PlatformFlushIdentity>;
+export declare const resolvePlatformFlushIdentity: (pool: ControlPlaneQueryable, principalName?: string) => Promise<PlatformFlushIdentity>;
 export declare const platformFlushClaims: (identity: PlatformFlushIdentity) => Record<string, string>;
 export interface PlatformRefusalRecorderOptions {
     intervalMs?: number;

package/refusals/recorder.js

@@ -5,6 +5,8 @@ require("../middleware/types"); // for Request type
 const express_context_1 = require("@constructive-io/express-context");
 const logger_1 = require("@pgpmjs/logger");
 const pg_cache_1 = require("pg-cache");
+const pg_query_context_1 = require("pg-query-context");
+const control_role_1 = require("../control-role");
 const log = new logger_1.Logger('refusals');
 /**
  * refusals/recorder — the GraphQL lane's `RefusalRecorder`.
@@ -129,16 +131,17 @@ exports.platformFlushClaims = platformFlushClaims;
  */
 const createPlatformRefusalRecorder = (opts, recorderOpts = {}) => {
     const pool = (0, pg_cache_1.getPgPool)(opts.pg);
+    const role = (0, control_role_1.getControlRole)(opts);
     let cached = null;
     const claims = async () => {
         if (cached)
             return cached;
-        cached = (0, exports.platformFlushClaims)(await (0, exports.resolvePlatformFlushIdentity)(pool, recorderOpts.principalName));
+        cached = (0, exports.platformFlushClaims)(await (0, exports.resolvePlatformFlushIdentity)((0, pg_query_context_1.controlPlanePool)(pool, role), recorderOpts.principalName));
         log.info(`[refusals] flushing as '${recorderOpts.principalName ?? exports.PLATFORM_BOOTSTRAP_PRINCIPAL}'`);
         return cached;
     };
     return new express_context_1.RefusalRecorder({
-        sink: (0, express_context_1.createRecordRefusalsSink)({ pool, claims }),
+        sink: (0, express_context_1.createRecordRefusalsSink)({ pool, role, claims }),
         intervalMs: recorderOpts.intervalMs,
         jitterMs: recorderOpts.jitterMs,
         maxKeys: recorderOpts.maxKeys

package/server.js

@@ -17,6 +17,7 @@ const graphql_upload_1 = __importDefault(require("graphql-upload"));
 const pg_cache_1 = require("pg-cache");
 const request_ip_1 = __importDefault(require("request-ip"));
 const agentic_1 = require("./agentic");
+const control_role_1 = require("./control-role");
 const debug_db_snapshot_1 = require("./diagnostics/debug-db-snapshot");
 const debug_sampler_1 = require("./diagnostics/debug-sampler");
 const observability_1 = require("./diagnostics/observability");
@@ -83,6 +84,7 @@ class Server {
     constructor(opts) {
         this.opts = (0, graphql_env_1.getEnvOptions)(opts);
         const effectiveOpts = this.opts;
+        const controlRole = (0, control_role_1.getControlRole)(effectiveOpts);
         const observabilityRequested = (0, observability_1.isGraphqlObservabilityRequested)();
         const observabilityEnabled = (0, observability_1.isGraphqlObservabilityEnabled)(effectiveOpts.server?.host);
         const app = (0, express_1.default)();
@@ -152,7 +154,8 @@ class Server {
         app.use((0, express_context_1.createContextMiddleware)({
             pg: effectiveOpts.pg,
             loaders: (0, express_context_1.createDefaultRegistry)(),
-            routingSchema: (0, routing_1.getRoutingSchema)(effectiveOpts)
+            routingSchema: (0, routing_1.getRoutingSchema)(effectiveOpts),
+            controlRole
         }));
         // A suspended (or unknown) database is refused before anything is spent on
         // the request; billing and platform admins set that state, the loader reads it.