@constructive-io/graphql-server 5.32.5 → 5.32.7

package/esm/middleware/auth.js

@@ -22,6 +22,14 @@ const parseCookieToken = (req, cookieName) => {
     const match = header.split(';').find((c) => c.trim().startsWith(`${cookieName}=`));
     return match ? decodeURIComponent(match.split('=')[1].trim()) : undefined;
 };
+/**
+ * The Bearer token `authenticate` would use, or undefined when it would fall
+ * back to the session cookie (no header, another scheme, or an empty token).
+ */
+export const getBearerToken = (req) => {
+    const [authType, authToken] = (req.headers.authorization ?? '').split(' ');
+    return authType?.toLowerCase() === 'bearer' && authToken ? authToken : undefined;
+};
 export const createAuthenticateMiddleware = (opts) => {
     return async (req, res, next) => {
         const api = req.api;
@@ -49,16 +57,15 @@ export const createAuthenticateMiddleware = (opts) => {
         log.info(`[auth] strictAuth=${opts.server?.strictAuth ?? false}, authFn=${authFn ?? 'none'}`);
         if (authFn && rlsModule.privateSchema.schemaName) {
             const { authorization = '' } = req.headers;
-            const [authType, authToken] = authorization.split(' ');
+            const [authType] = authorization.split(' ');
+            const bearerToken = getBearerToken(req);
             let token = {};
             log.info(`[auth] authorization header present=${!!authorization}, ` +
-                `authType=${authType ?? 'none'}, hasToken=${!!authToken}`);
+                `authType=${authType ?? 'none'}, hasToken=${!!bearerToken}`);
             // Resolve the credential: prefer Bearer header, fall back to session cookie
             const cookieToken = parseCookieToken(req, SESSION_COOKIE_NAME);
-            const effectiveToken = (authType?.toLowerCase() === 'bearer' && authToken)
-                ? authToken
-                : cookieToken;
-            const tokenSource = (authType?.toLowerCase() === 'bearer' && authToken) ? 'bearer' : (cookieToken ? 'cookie' : 'none');
+            const effectiveToken = bearerToken ?? cookieToken;
+            const tokenSource = bearerToken ? 'bearer' : (cookieToken ? 'cookie' : 'none');
             if (effectiveToken) {
                 log.info(`[auth] Processing ${tokenSource} authentication`);
                 const context = {

package/esm/server.js

@@ -16,7 +16,7 @@ import { startDebugSampler } from './diagnostics/debug-sampler';
 import { isDevelopmentObservabilityMode, isGraphqlObservabilityEnabled, isGraphqlObservabilityRequested, isLoopbackHost } from './diagnostics/observability';
 import { createAdmissionControlMiddleware } from './middleware/admission-control';
 import { createApiMiddleware } from './middleware/api';
-import { createAuthenticateMiddleware } from './middleware/auth';
+import { createAuthenticateMiddleware, getBearerToken } from './middleware/auth';
 // Auth cookie handling is done via AuthCookiePlugin in grafserv
 import { createCaptchaMiddleware } from './middleware/captcha';
 import { parseCookieValue, rejectInvalidSessionCookieHeader, SESSION_COOKIE_NAME } from './middleware/cookie';
@@ -168,9 +168,8 @@ class Server {
             }
         });
         const csrfProtect = (req, res, next) => {
-            // Skip CSRF for Bearer token auth
-            const auth = req.headers.authorization;
-            if (auth?.toLowerCase().startsWith('bearer ')) {
+            // Skip CSRF only when authenticate will use the Bearer token, not the cookie
+            if (getBearerToken(req)) {
                 return next();
             }
             // Skip if no session cookie (anonymous requests)
@@ -185,7 +184,9 @@ class Server {
             csrf.setToken(req, res, next);
         };
         app.use(csrfSetToken); // Set CSRF token cookie on all requests
-        app.use('/graphql', csrfProtect); // Enforce CSRF on GraphQL mutations
+        // Enforce CSRF on every cookie-authenticated route: GraphQL, the agentic
+        // router (/v1) and REST function invocation (/fn)
+        app.use(['/graphql', '/v1', '/fn'], csrfProtect);
         // The session-cookie opt-out does not bypass CSRF: it only stops sign-in
         // responses from setting cookies (see AuthCookiePlugin).
         app.use('/graphql', rejectInvalidSessionCookieHeader);

package/middleware/auth.d.ts

@@ -1,4 +1,9 @@
 import './types';
 import { PgpmOptions } from '@pgpmjs/types';
-import { RequestHandler } from 'express';
+import { Request, RequestHandler } from 'express';
+/**
+ * The Bearer token `authenticate` would use, or undefined when it would fall
+ * back to the session cookie (no header, another scheme, or an empty token).
+ */
+export declare const getBearerToken: (req: Request) => string | undefined;
 export declare const createAuthenticateMiddleware: (opts: PgpmOptions) => RequestHandler;

package/middleware/auth.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAuthenticateMiddleware = void 0;
+exports.createAuthenticateMiddleware = exports.getBearerToken = void 0;
 require("./types"); // for Request type
 const errors_1 = require("@constructive-io/errors");
 const env_1 = require("@pgpmjs/env");
@@ -28,6 +28,15 @@ const parseCookieToken = (req, cookieName) => {
     const match = header.split(';').find((c) => c.trim().startsWith(`${cookieName}=`));
     return match ? decodeURIComponent(match.split('=')[1].trim()) : undefined;
 };
+/**
+ * The Bearer token `authenticate` would use, or undefined when it would fall
+ * back to the session cookie (no header, another scheme, or an empty token).
+ */
+const getBearerToken = (req) => {
+    const [authType, authToken] = (req.headers.authorization ?? '').split(' ');
+    return authType?.toLowerCase() === 'bearer' && authToken ? authToken : undefined;
+};
+exports.getBearerToken = getBearerToken;
 const createAuthenticateMiddleware = (opts) => {
     return async (req, res, next) => {
         const api = req.api;
@@ -55,16 +64,15 @@ const createAuthenticateMiddleware = (opts) => {
         log.info(`[auth] strictAuth=${opts.server?.strictAuth ?? false}, authFn=${authFn ?? 'none'}`);
         if (authFn && rlsModule.privateSchema.schemaName) {
             const { authorization = '' } = req.headers;
-            const [authType, authToken] = authorization.split(' ');
+            const [authType] = authorization.split(' ');
+            const bearerToken = (0, exports.getBearerToken)(req);
             let token = {};
             log.info(`[auth] authorization header present=${!!authorization}, ` +
-                `authType=${authType ?? 'none'}, hasToken=${!!authToken}`);
+                `authType=${authType ?? 'none'}, hasToken=${!!bearerToken}`);
             // Resolve the credential: prefer Bearer header, fall back to session cookie
             const cookieToken = parseCookieToken(req, SESSION_COOKIE_NAME);
-            const effectiveToken = (authType?.toLowerCase() === 'bearer' && authToken)
-                ? authToken
-                : cookieToken;
-            const tokenSource = (authType?.toLowerCase() === 'bearer' && authToken) ? 'bearer' : (cookieToken ? 'cookie' : 'none');
+            const effectiveToken = bearerToken ?? cookieToken;
+            const tokenSource = bearerToken ? 'bearer' : (cookieToken ? 'cookie' : 'none');
             if (effectiveToken) {
                 log.info(`[auth] Processing ${tokenSource} authentication`);
                 const context = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.32.5",
+  "version": "5.32.7",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -47,7 +47,7 @@
     "@constructive-io/graphql-env": "^3.37.2",
     "@constructive-io/graphql-types": "^3.36.1",
     "@constructive-io/llm-env": "^0.16.0",
-    "@constructive-io/query-builder": "^3.17.1",
+    "@constructive-io/query-builder": "^3.17.2",
     "@constructive-io/s3-utils": "^2.35.0",
     "@constructive-io/url-domains": "^2.32.0",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
@@ -67,11 +67,11 @@
     "graphile-build-pg": "5.1.3",
     "graphile-cache": "^4.16.1",
     "graphile-config": "1.1.0",
-    "graphile-function-bindings": "^1.18.2",
+    "graphile-function-bindings": "^1.18.3",
     "graphile-plugin-utils": "^1.14.1",
     "graphile-presigned-url-plugin": "^1.23.3",
-    "graphile-scoped-introspection": "^0.5.1",
-    "graphile-settings": "^6.27.0",
+    "graphile-scoped-introspection": "^0.5.2",
+    "graphile-settings": "^6.27.1",
     "graphile-utils": "5.0.3",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
@@ -94,11 +94,11 @@
     "@types/request-ip": "^0.0.41",
     "@types/supertest": "^7.2.1",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "5.18.2",
+    "graphile-test": "5.18.3",
     "makage": "^0.8.0",
     "nodemon": "^3.1.14",
     "supertest": "^7.2.2",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "772d31b8f0afd8947d4f4df8b0ffee86414ec866"
+  "gitHead": "0b8a4fa54f658bf3b3a8776b98cc5fb373103ce8"
 }

package/server.js

@@ -175,9 +175,8 @@ class Server {
             }
         });
         const csrfProtect = (req, res, next) => {
-            // Skip CSRF for Bearer token auth
-            const auth = req.headers.authorization;
-            if (auth?.toLowerCase().startsWith('bearer ')) {
+            // Skip CSRF only when authenticate will use the Bearer token, not the cookie
+            if ((0, auth_1.getBearerToken)(req)) {
                 return next();
             }
             // Skip if no session cookie (anonymous requests)
@@ -192,7 +191,9 @@ class Server {
             csrf.setToken(req, res, next);
         };
         app.use(csrfSetToken); // Set CSRF token cookie on all requests
-        app.use('/graphql', csrfProtect); // Enforce CSRF on GraphQL mutations
+        // Enforce CSRF on every cookie-authenticated route: GraphQL, the agentic
+        // router (/v1) and REST function invocation (/fn)
+        app.use(['/graphql', '/v1', '/fn'], csrfProtect);
         // The session-cookie opt-out does not bypass CSRF: it only stops sign-in
         // responses from setting cookies (see AuthCookiePlugin).
         app.use('/graphql', cookie_1.rejectInvalidSessionCookieHeader);