@constructive-io/graphql-server 5.33.2 → 5.33.4

package/esm/middleware/admission-control.js

@@ -1,9 +1,10 @@
 import './types'; // for Request type
 import { errors } from '@constructive-io/errors';
-import { clientIpFrom, ConcurrencyLimiter, DEFAULT_REQUEST_PROTECTION, RateWindow, trustedProxyHops } from '@constructive-io/express-context';
+import { clientIpFrom, ConcurrencyLimiter, DEFAULT_REQUEST_PROTECTION, RateWindow } from '@constructive-io/express-context';
 import { Logger } from '@pgpmjs/logger';
 import { respondWithGraphQLError } from '../errors/graphql-response';
 import { recordRefusal } from '../refusals/recorder';
+import { resolveProxyHops } from './client-ip';
 const log = new Logger('admission');
 /**
  * admission-control — the gate that decides whether a GraphQL request starts.
@@ -44,25 +45,6 @@ const protectionOf = (req) => req.requestProtection ?? DEFAULT_REQUEST_PROTECTIO
 const routeOf = (req) => `${req.method} ${req.baseUrl}${req.path}`;
 /** Seconds for a `Retry-After` header — the smallest honest whole number. */
 const retryAfterSeconds = (ms) => String(Math.max(Math.ceil(ms / 1000), 1));
-/**
- * How far back through `X-Forwarded-For` to believe.
- *
- * `req.clientIp` and `req.ip` are both unusable as a limiter key here: this
- * server sets `trust proxy` to a predicate that returns true unconditionally,
- * and `request-ip` reads the *leftmost* forwarded entry regardless — so either
- * one hands a caller a fresh key per request for the cost of a header. The
- * fallback to 1 hop exists because the opposite failure is just as bad: behind
- * an ingress with no hop count configured, every caller resolves to the
- * ingress's address and one abuser throttles the whole tenant.
- */
-const resolveHops = (req, configured) => {
-    if (typeof configured === 'number')
-        return configured;
-    const fromEnv = trustedProxyHops();
-    if (fromEnv > 0)
-        return fromEnv;
-    return req.app?.get('trust proxy') ? 1 : 0;
-};
 /**
  * Rate-limit callers per route, then admit at most `maxConcurrentRequests` of
  * them per database into the handler chain.
@@ -79,7 +61,7 @@ export const createAdmissionControlMiddleware = (options = {}) => {
         const protection = protectionOf(req);
         const databaseId = req.databaseId ?? UNKNOWN_DATABASE;
         // ─── Per-caller rate ────────────────────────────────────────────────────
-        const hops = resolveHops(req, options.trustedProxyHops);
+        const hops = resolveProxyHops(req, options.trustedProxyHops);
         const ip = clientIpFrom(req, hops);
         const rateKey = `${databaseId}\u0000${ip}\u0000${routeOf(req)}`;
         if (!rate.admit(rateKey, protection.rateLimitRpm, protection.rateLimitBurst)) {
@@ -92,17 +74,31 @@ export const createAdmissionControlMiddleware = (options = {}) => {
             return;
         }
         // ─── Per-database concurrency ───────────────────────────────────────────
+        // A client that hangs up while queued must neither keep its place in the
+        // queue nor be handed the slot when its turn comes: nothing would ever
+        // release it. `close` is watched from before the wait, since a listener
+        // attached only after `acquire` resolves misses a hang-up during it.
+        const gone = new AbortController();
+        const onClose = () => gone.abort();
+        res.once('close', onClose);
         let lease;
         try {
             lease = await concurrency.acquire(databaseId, {
                 limit: protection.maxConcurrentRequests,
-                queueWaitMs: protection.maxQueueWaitMs
+                queueWaitMs: protection.maxQueueWaitMs,
+                signal: gone.signal
             });
         }
         catch (e) {
+            res.off('close', onClose);
             next(e);
             return;
         }
+        res.off('close', onClose);
+        if (gone.signal.aborted) {
+            lease.release();
+            return;
+        }
         if (!lease.granted) {
             log.warn(`[admission] concurrency refused: database=${databaseId} ` +
                 `limit=${protection.maxConcurrentRequests} reason=${lease.refusal} waited=${lease.queuedMs}ms`);

package/esm/middleware/client-ip.js

@@ -0,0 +1,27 @@
+import './types'; // for Request type
+import { clientIpFrom, trustedProxyHops } from '@constructive-io/express-context';
+/**
+ * How far back through `X-Forwarded-For` to believe: an explicit count, then
+ * `TRUSTED_PROXY_HOPS` (an explicit 0 included), then 1 when `SERVER_TRUST_PROXY`
+ * puts a proxy in front.
+ *
+ * Express's `trust proxy` predicate and `req.ip` are not used as the answer:
+ * the predicate trusts every hop, which would hand back the leftmost entry —
+ * the one a caller writes. One ingress means one hop is believed.
+ */
+export const resolveProxyHops = (req, configured) => {
+    if (typeof configured === 'number')
+        return configured;
+    const fromEnv = trustedProxyHops();
+    if (fromEnv !== null)
+        return fromEnv;
+    return req.app?.get('trust proxy') ? 1 : 0;
+};
+/**
+ * Sets `req.clientIp` — the address `jwt.claims.ip_address`, logs and per-IP
+ * limits are keyed on — to the entry our own proxy appended, or the socket peer.
+ */
+export const clientIpMiddleware = (req, _res, next) => {
+    req.clientIp = clientIpFrom(req, resolveProxyHops(req));
+    next();
+};

package/esm/refusals/recorder.js

@@ -1,7 +1,8 @@
 import '../middleware/types'; // for Request type
-import { clientIpFrom, createRecordRefusalsSink, RefusalRecorder, trustedProxyHops } from '@constructive-io/express-context';
+import { clientIpFrom, createRecordRefusalsSink, RefusalRecorder } from '@constructive-io/express-context';
 import { Logger } from '@pgpmjs/logger';
 import { getPgPool } from 'pg-cache';
+import { resolveProxyHops } from '../middleware/client-ip';
 const log = new Logger('refusals');
 /**
  * refusals/recorder — the GraphQL lane's `RefusalRecorder`.
@@ -42,19 +43,6 @@ export const getRefusalRecorder = () => installed;
 export const getRefusalRecorderStats = () => installed?.stats() ?? null;
 /** The route half of a refusal key — the same shape admission control keys on. */
 export const routeKeyOf = (req) => `${req.method} ${req.baseUrl ?? ''}${req.path ?? req.url ?? ''}`;
-/**
- * How far back through `X-Forwarded-For` to believe; mirrors admission
- * control's resolution so the refusal source is the same address the limiter
- * keyed on.
- */
-const resolveHops = (req, configured) => {
-    if (typeof configured === 'number')
-        return configured;
-    const fromEnv = trustedProxyHops();
-    if (fromEnv > 0)
-        return fromEnv;
-    return req.app?.get('trust proxy') ? 1 : 0;
-};
 /**
  * Count one GraphQL-lane refusal. Synchronous; never throws; does nothing
  * when no recorder is installed.
@@ -70,7 +58,7 @@ export const recordRefusal = (req, reason, opts = {}) => {
         routeKey: routeKeyOf(req),
         sourceIp: opts.sourceIp !== undefined
             ? opts.sourceIp
-            : clientIpFrom(req, resolveHops(req, opts.trustedProxyHops))
+            : clientIpFrom(req, resolveProxyHops(req, opts.trustedProxyHops))
     };
     try {
         recorder.record(refusal);

package/esm/server.js

@@ -9,7 +9,6 @@ import express from 'express';
 import { closeAllCaches, graphileCache } from 'graphile-cache';
 import graphqlUpload from 'graphql-upload';
 import { getPgPool } from 'pg-cache';
-import requestIp from 'request-ip';
 import { createAgenticRouter } from './agentic';
 import { closeDebugDatabasePools } from './diagnostics/debug-db-snapshot';
 import { startDebugSampler } from './diagnostics/debug-sampler';
@@ -19,6 +18,7 @@ import { createApiMiddleware } from './middleware/api';
 import { createAuthenticateMiddleware, getBearerToken } from './middleware/auth';
 // Auth cookie handling is done via AuthCookiePlugin in grafserv
 import { createCaptchaMiddleware } from './middleware/captcha';
+import { clientIpMiddleware } from './middleware/client-ip';
 import { parseCookieValue, rejectInvalidSessionCookieHeader, SESSION_COOKIE_NAME } from './middleware/cookie';
 import { cors } from './middleware/cors';
 import { errorHandler, notFoundHandler } from './middleware/error-handler';
@@ -135,7 +135,7 @@ class Server {
         // Rewrite Content-Type after graphql-upload so grafserv accepts the request
         app.use('/graphql', multipartBridge);
         app.use(parseDomains());
-        app.use(requestIp.mw());
+        app.use(clientIpMiddleware);
         app.use(requestIdMiddleware());
         app.use(requestLogger);
         app.use(api);

package/middleware/admission-control.js

@@ -7,6 +7,7 @@ const express_context_1 = require("@constructive-io/express-context");
 const logger_1 = require("@pgpmjs/logger");
 const graphql_response_1 = require("../errors/graphql-response");
 const recorder_1 = require("../refusals/recorder");
+const client_ip_1 = require("./client-ip");
 const log = new logger_1.Logger('admission');
 /**
  * admission-control — the gate that decides whether a GraphQL request starts.
@@ -47,25 +48,6 @@ const protectionOf = (req) => req.requestProtection ?? express_context_1.DEFAULT
 const routeOf = (req) => `${req.method} ${req.baseUrl}${req.path}`;
 /** Seconds for a `Retry-After` header — the smallest honest whole number. */
 const retryAfterSeconds = (ms) => String(Math.max(Math.ceil(ms / 1000), 1));
-/**
- * How far back through `X-Forwarded-For` to believe.
- *
- * `req.clientIp` and `req.ip` are both unusable as a limiter key here: this
- * server sets `trust proxy` to a predicate that returns true unconditionally,
- * and `request-ip` reads the *leftmost* forwarded entry regardless — so either
- * one hands a caller a fresh key per request for the cost of a header. The
- * fallback to 1 hop exists because the opposite failure is just as bad: behind
- * an ingress with no hop count configured, every caller resolves to the
- * ingress's address and one abuser throttles the whole tenant.
- */
-const resolveHops = (req, configured) => {
-    if (typeof configured === 'number')
-        return configured;
-    const fromEnv = (0, express_context_1.trustedProxyHops)();
-    if (fromEnv > 0)
-        return fromEnv;
-    return req.app?.get('trust proxy') ? 1 : 0;
-};
 /**
  * Rate-limit callers per route, then admit at most `maxConcurrentRequests` of
  * them per database into the handler chain.
@@ -82,7 +64,7 @@ const createAdmissionControlMiddleware = (options = {}) => {
         const protection = protectionOf(req);
         const databaseId = req.databaseId ?? UNKNOWN_DATABASE;
         // ─── Per-caller rate ────────────────────────────────────────────────────
-        const hops = resolveHops(req, options.trustedProxyHops);
+        const hops = (0, client_ip_1.resolveProxyHops)(req, options.trustedProxyHops);
         const ip = (0, express_context_1.clientIpFrom)(req, hops);
         const rateKey = `${databaseId}\u0000${ip}\u0000${routeOf(req)}`;
         if (!rate.admit(rateKey, protection.rateLimitRpm, protection.rateLimitBurst)) {
@@ -95,17 +77,31 @@ const createAdmissionControlMiddleware = (options = {}) => {
             return;
         }
         // ─── Per-database concurrency ───────────────────────────────────────────
+        // A client that hangs up while queued must neither keep its place in the
+        // queue nor be handed the slot when its turn comes: nothing would ever
+        // release it. `close` is watched from before the wait, since a listener
+        // attached only after `acquire` resolves misses a hang-up during it.
+        const gone = new AbortController();
+        const onClose = () => gone.abort();
+        res.once('close', onClose);
         let lease;
         try {
             lease = await concurrency.acquire(databaseId, {
                 limit: protection.maxConcurrentRequests,
-                queueWaitMs: protection.maxQueueWaitMs
+                queueWaitMs: protection.maxQueueWaitMs,
+                signal: gone.signal
             });
         }
         catch (e) {
+            res.off('close', onClose);
             next(e);
             return;
         }
+        res.off('close', onClose);
+        if (gone.signal.aborted) {
+            lease.release();
+            return;
+        }
         if (!lease.granted) {
             log.warn(`[admission] concurrency refused: database=${databaseId} ` +
                 `limit=${protection.maxConcurrentRequests} reason=${lease.refusal} waited=${lease.queuedMs}ms`);

package/middleware/client-ip.d.ts

@@ -0,0 +1,17 @@
+import './types';
+import type { NextFunction, Request, Response } from 'express';
+/**
+ * How far back through `X-Forwarded-For` to believe: an explicit count, then
+ * `TRUSTED_PROXY_HOPS` (an explicit 0 included), then 1 when `SERVER_TRUST_PROXY`
+ * puts a proxy in front.
+ *
+ * Express's `trust proxy` predicate and `req.ip` are not used as the answer:
+ * the predicate trusts every hop, which would hand back the leftmost entry —
+ * the one a caller writes. One ingress means one hop is believed.
+ */
+export declare const resolveProxyHops: (req: Request, configured?: number) => number;
+/**
+ * Sets `req.clientIp` — the address `jwt.claims.ip_address`, logs and per-IP
+ * limits are keyed on — to the entry our own proxy appended, or the socket peer.
+ */
+export declare const clientIpMiddleware: (req: Request, _res: Response, next: NextFunction) => void;

package/middleware/client-ip.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clientIpMiddleware = exports.resolveProxyHops = void 0;
+require("./types"); // for Request type
+const express_context_1 = require("@constructive-io/express-context");
+/**
+ * How far back through `X-Forwarded-For` to believe: an explicit count, then
+ * `TRUSTED_PROXY_HOPS` (an explicit 0 included), then 1 when `SERVER_TRUST_PROXY`
+ * puts a proxy in front.
+ *
+ * Express's `trust proxy` predicate and `req.ip` are not used as the answer:
+ * the predicate trusts every hop, which would hand back the leftmost entry —
+ * the one a caller writes. One ingress means one hop is believed.
+ */
+const resolveProxyHops = (req, configured) => {
+    if (typeof configured === 'number')
+        return configured;
+    const fromEnv = (0, express_context_1.trustedProxyHops)();
+    if (fromEnv !== null)
+        return fromEnv;
+    return req.app?.get('trust proxy') ? 1 : 0;
+};
+exports.resolveProxyHops = resolveProxyHops;
+/**
+ * Sets `req.clientIp` — the address `jwt.claims.ip_address`, logs and per-IP
+ * limits are keyed on — to the entry our own proxy appended, or the socket peer.
+ */
+const clientIpMiddleware = (req, _res, next) => {
+    req.clientIp = (0, express_context_1.clientIpFrom)(req, (0, exports.resolveProxyHops)(req));
+    next();
+};
+exports.clientIpMiddleware = clientIpMiddleware;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.33.2",
+  "version": "5.33.4",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -43,7 +43,7 @@
     "@agentic-kit/ollama": "2.16.0",
     "@constructive-io/csrf": "^0.31.0",
     "@constructive-io/errors": "^0.25.0",
-    "@constructive-io/express-context": "^0.35.1",
+    "@constructive-io/express-context": "^0.35.3",
     "@constructive-io/graphql-env": "^3.37.2",
     "@constructive-io/graphql-types": "^3.36.1",
     "@constructive-io/llm-env": "^0.16.0",
@@ -72,7 +72,7 @@
     "graphile-plugin-utils": "^1.14.1",
     "graphile-presigned-url-plugin": "^1.23.4",
     "graphile-scoped-introspection": "^0.6.0",
-    "graphile-settings": "^6.28.1",
+    "graphile-settings": "^6.28.3",
     "graphile-utils": "5.0.3",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
@@ -82,8 +82,7 @@
     "pg-env": "^1.33.0",
     "pg-query-context": "^2.33.0",
     "pg-sql2": "5.0.1",
-    "postgraphile": "5.1.4",
-    "request-ip": "^3.3.0"
+    "postgraphile": "5.1.4"
   },
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.1052.0",
@@ -92,7 +91,6 @@
     "@types/express": "^5.0.6",
     "@types/graphql-upload": "^8.0.12",
     "@types/pg": "^8.20.4",
-    "@types/request-ip": "^0.0.41",
     "@types/supertest": "^7.2.1",
     "graphile-test": "5.19.0",
     "makage": "^0.8.0",
@@ -100,5 +98,5 @@
     "supertest": "^7.2.2",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "0e90e47d0abcc37fb74ae98ed9cff5ada43c68e2"
+  "gitHead": "7ce27b6ff591192fe5eb87e26bb3fb1e538d6505"
 }

package/refusals/recorder.js

@@ -5,6 +5,7 @@ require("../middleware/types"); // for Request type
 const express_context_1 = require("@constructive-io/express-context");
 const logger_1 = require("@pgpmjs/logger");
 const pg_cache_1 = require("pg-cache");
+const client_ip_1 = require("../middleware/client-ip");
 const log = new logger_1.Logger('refusals');
 /**
  * refusals/recorder — the GraphQL lane's `RefusalRecorder`.
@@ -49,19 +50,6 @@ exports.getRefusalRecorderStats = getRefusalRecorderStats;
 /** The route half of a refusal key — the same shape admission control keys on. */
 const routeKeyOf = (req) => `${req.method} ${req.baseUrl ?? ''}${req.path ?? req.url ?? ''}`;
 exports.routeKeyOf = routeKeyOf;
-/**
- * How far back through `X-Forwarded-For` to believe; mirrors admission
- * control's resolution so the refusal source is the same address the limiter
- * keyed on.
- */
-const resolveHops = (req, configured) => {
-    if (typeof configured === 'number')
-        return configured;
-    const fromEnv = (0, express_context_1.trustedProxyHops)();
-    if (fromEnv > 0)
-        return fromEnv;
-    return req.app?.get('trust proxy') ? 1 : 0;
-};
 /**
  * Count one GraphQL-lane refusal. Synchronous; never throws; does nothing
  * when no recorder is installed.
@@ -77,7 +65,7 @@ const recordRefusal = (req, reason, opts = {}) => {
         routeKey: (0, exports.routeKeyOf)(req),
         sourceIp: opts.sourceIp !== undefined
             ? opts.sourceIp
-            : (0, express_context_1.clientIpFrom)(req, resolveHops(req, opts.trustedProxyHops))
+            : (0, express_context_1.clientIpFrom)(req, (0, client_ip_1.resolveProxyHops)(req, opts.trustedProxyHops))
     };
     try {
         recorder.record(refusal);

package/server.js

@@ -15,7 +15,6 @@ const express_1 = __importDefault(require("express"));
 const graphile_cache_1 = require("graphile-cache");
 const graphql_upload_1 = __importDefault(require("graphql-upload"));
 const pg_cache_1 = require("pg-cache");
-const request_ip_1 = __importDefault(require("request-ip"));
 const agentic_1 = require("./agentic");
 const debug_db_snapshot_1 = require("./diagnostics/debug-db-snapshot");
 const debug_sampler_1 = require("./diagnostics/debug-sampler");
@@ -25,6 +24,7 @@ const api_1 = require("./middleware/api");
 const auth_1 = require("./middleware/auth");
 // Auth cookie handling is done via AuthCookiePlugin in grafserv
 const captcha_1 = require("./middleware/captcha");
+const client_ip_1 = require("./middleware/client-ip");
 const cookie_1 = require("./middleware/cookie");
 const cors_1 = require("./middleware/cors");
 const error_handler_1 = require("./middleware/error-handler");
@@ -142,7 +142,7 @@ class Server {
         // Rewrite Content-Type after graphql-upload so grafserv accepts the request
         app.use('/graphql', multipart_bridge_1.multipartBridge);
         app.use((0, url_domains_1.middleware)());
-        app.use(request_ip_1.default.mw());
+        app.use(client_ip_1.clientIpMiddleware);
         app.use((0, express_context_1.requestIdMiddleware)());
         app.use(requestLogger);
         app.use(api);