@constructive-io/graphql-server 5.34.6 → 5.35.0

package/README.md

@@ -70,7 +70,6 @@ Runs an Express server that wires CORS, uploads, domain parsing, auth, and PostG
 - Automatic GraphQL API generation from PostgreSQL schemas
 - RLS-aware authentication and per-request `pgSettings`
 - Meta-schema routing by domain + subdomain
-- File uploads via `graphql-upload`
 - GraphiQL and health check endpoints
 - Schema cache flush via `/flush` or database notifications
 - Opt-in observability for memory, DB activity, and Graphile build debugging
@@ -101,7 +100,6 @@ For the operational workflow, sampler output, and heap snapshot usage, see [docs
 - `GET /healthz` -> health check
 - `GET /graphiql` -> GraphiQL UI
 - `GET /graphql` / `POST /graphql` -> GraphQL endpoint
-- `POST /graphql` (multipart) -> file uploads
 - `POST /flush` -> clears cached Graphile schema for the current API; mounted only when `API_FLUSH_TOKEN` is set, and requires `Authorization: Bearer $API_FLUSH_TOKEN`. Without the variable the route is not served (404) — operators deploying a schema-cache flush must set it on the server and on every caller. The `LISTEN/NOTIFY` invalidation path is unaffected.
 - `GET /debug/memory` -> memory/process/Graphile debug snapshot when observability is enabled
 - `GET /debug/db` -> PostgreSQL activity/locks/pool debug snapshot when observability is enabled

package/esm/middleware/request-protection.js

@@ -16,12 +16,6 @@ const resolveProtection = async (req) => {
     const resolved = await req.constructive?.useModule('requestProtection');
     return resolved ?? DEFAULT_REQUEST_PROTECTION;
 };
-/**
- * Multipart requests carry file bodies, which are streamed by the upload
- * plugin and bounded by the upload limits rather than by the GraphQL request
- * size: applying a JSON-sized cap to them would reject every upload.
- */
-const isMultipart = (req) => (req.get('content-type') ?? '').toLowerCase().startsWith('multipart/form-data');
 /**
  * Express middleware that resolves request protection and enforces the one
  * bound that has to be checked before the body is read.
@@ -50,8 +44,7 @@ export const createRequestProtectionMiddleware = () => {
         req.requestProtection = protection;
         const declaredLength = Number(req.get('content-length') ?? '');
         if (Number.isFinite(declaredLength) &&
-            declaredLength > protection.maxRequestBytes &&
-            !isMultipart(req)) {
+            declaredLength > protection.maxRequestBytes) {
             recordRefusal(req, 'request_too_large');
             respondWithGraphQLError(res, errors.REQUEST_TOO_LARGE({ bytes: declaredLength, limit: protection.maxRequestBytes }));
             return;

package/esm/server.js

@@ -7,7 +7,6 @@ import { healthz, poweredBy, svcCache, trustProxy } from '@pgpmjs/server-utils';
 import cookieParser from 'cookie-parser';
 import express from 'express';
 import { closeAllCaches, graphileCache } from 'graphile-cache';
-import graphqlUpload from 'graphql-upload';
 import { getPgPool } from 'pg-cache';
 import { createAgenticRouter } from './agentic';
 import { closeDebugDatabasePools } from './diagnostics/debug-db-snapshot';
@@ -26,7 +25,6 @@ import { favicon } from './middleware/favicon';
 import { createFlushMiddleware, flushService } from './middleware/flush';
 import { createFnRouter } from './middleware/fn';
 import { graphile } from './middleware/graphile';
-import { multipartBridge } from './middleware/multipart-bridge';
 import { createDebugDatabaseMiddleware } from './middleware/observability/debug-db';
 import { debugMemory } from './middleware/observability/debug-memory';
 import { localObservabilityOnly } from './middleware/observability/guard';
@@ -128,12 +126,6 @@ class Server {
         app.use(poweredBy('constructive'));
         app.use(cookieParser());
         app.use(cors(fallbackOrigin));
-        app.use('/graphql', graphqlUpload.graphqlUploadExpress({
-            maxFileSize: 10 * 1024 * 1024, // 10 MB
-            maxFiles: 10
-        }));
-        // Rewrite Content-Type after graphql-upload so grafserv accepts the request
-        app.use('/graphql', multipartBridge);
         app.use(parseDomains());
         app.use(clientIpMiddleware);
         app.use(requestIdMiddleware());

package/middleware/request-protection.js

@@ -19,12 +19,6 @@ const resolveProtection = async (req) => {
     const resolved = await req.constructive?.useModule('requestProtection');
     return resolved ?? express_context_1.DEFAULT_REQUEST_PROTECTION;
 };
-/**
- * Multipart requests carry file bodies, which are streamed by the upload
- * plugin and bounded by the upload limits rather than by the GraphQL request
- * size: applying a JSON-sized cap to them would reject every upload.
- */
-const isMultipart = (req) => (req.get('content-type') ?? '').toLowerCase().startsWith('multipart/form-data');
 /**
  * Express middleware that resolves request protection and enforces the one
  * bound that has to be checked before the body is read.
@@ -53,8 +47,7 @@ const createRequestProtectionMiddleware = () => {
         req.requestProtection = protection;
         const declaredLength = Number(req.get('content-length') ?? '');
         if (Number.isFinite(declaredLength) &&
-            declaredLength > protection.maxRequestBytes &&
-            !isMultipart(req)) {
+            declaredLength > protection.maxRequestBytes) {
             (0, recorder_1.recordRefusal)(req, 'request_too_large');
             (0, graphql_response_1.respondWithGraphQLError)(res, errors_1.errors.REQUEST_TOO_LARGE({ bytes: declaredLength, limit: protection.maxRequestBytes }));
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.34.6",
+  "version": "5.35.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -43,7 +43,7 @@
     "@agentic-kit/ollama": "2.16.0",
     "@constructive-io/csrf": "^0.31.0",
     "@constructive-io/errors": "^0.25.0",
-    "@constructive-io/express-context": "^0.36.0",
+    "@constructive-io/express-context": "^0.37.0",
     "@constructive-io/graphql-env": "^3.37.2",
     "@constructive-io/graphql-types": "^3.36.1",
     "@constructive-io/llm-env": "^0.16.0",
@@ -71,12 +71,11 @@
     "graphile-function-bindings": "^1.19.2",
     "graphile-function-source": "^0.3.2",
     "graphile-plugin-utils": "^1.14.1",
-    "graphile-presigned-url-plugin": "^1.23.5",
+    "graphile-presigned-url-plugin": "^1.24.0",
     "graphile-scoped-introspection": "^0.6.2",
-    "graphile-settings": "^6.30.5",
+    "graphile-settings": "^6.31.0",
     "graphile-utils": "5.0.3",
     "graphql": "16.13.0",
-    "graphql-upload": "^13.0.0",
     "lru-cache": "^11.2.7",
     "pg": "^8.21.0",
     "pg-cache": "^3.30.0",
@@ -90,7 +89,6 @@
     "@types/cookie-parser": "^1.4.10",
     "@types/cors": "^2.8.17",
     "@types/express": "^5.0.6",
-    "@types/graphql-upload": "^8.0.12",
     "@types/pg": "^8.20.4",
     "@types/supertest": "^7.2.1",
     "graphile-test": "5.19.2",
@@ -99,5 +97,5 @@
     "supertest": "^7.2.2",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "723c0a02471517c3015a218dd179fa9f53b47980"
+  "gitHead": "b579521f138b5f9a2922ed1066e2ad5dfe2a7073"
 }

package/server.js

@@ -13,7 +13,6 @@ const server_utils_1 = require("@pgpmjs/server-utils");
 const cookie_parser_1 = __importDefault(require("cookie-parser"));
 const express_1 = __importDefault(require("express"));
 const graphile_cache_1 = require("graphile-cache");
-const graphql_upload_1 = __importDefault(require("graphql-upload"));
 const pg_cache_1 = require("pg-cache");
 const agentic_1 = require("./agentic");
 const debug_db_snapshot_1 = require("./diagnostics/debug-db-snapshot");
@@ -32,7 +31,6 @@ const favicon_1 = require("./middleware/favicon");
 const flush_1 = require("./middleware/flush");
 const fn_1 = require("./middleware/fn");
 const graphile_1 = require("./middleware/graphile");
-const multipart_bridge_1 = require("./middleware/multipart-bridge");
 const debug_db_1 = require("./middleware/observability/debug-db");
 const debug_memory_1 = require("./middleware/observability/debug-memory");
 const guard_1 = require("./middleware/observability/guard");
@@ -135,12 +133,6 @@ class Server {
         app.use((0, server_utils_1.poweredBy)('constructive'));
         app.use((0, cookie_parser_1.default)());
         app.use((0, cors_1.cors)(fallbackOrigin));
-        app.use('/graphql', graphql_upload_1.default.graphqlUploadExpress({
-            maxFileSize: 10 * 1024 * 1024, // 10 MB
-            maxFiles: 10
-        }));
-        // Rewrite Content-Type after graphql-upload so grafserv accepts the request
-        app.use('/graphql', multipart_bridge_1.multipartBridge);
         app.use((0, url_domains_1.middleware)());
         app.use(client_ip_1.clientIpMiddleware);
         app.use((0, express_context_1.requestIdMiddleware)());

package/esm/middleware/multipart-bridge.js

@@ -1,30 +0,0 @@
-/**
- * Bridge middleware between graphql-upload and grafserv (PostGraphile v5).
- *
- * graphql-upload's `graphqlUploadExpress()` parses multipart/form-data requests
- * and sets `req.body` to a standard GraphQL operation object, but leaves the
- * original Content-Type header unchanged. grafserv rejects any Content-Type it
- * doesn't recognize (415 Unsupported Media Type) because its allowlist only
- * includes `application/json` and `application/graphql`.
- *
- * This middleware rewrites the Content-Type header to `application/json` after
- * graphql-upload has finished parsing, so grafserv accepts the request.
- *
- * This is the standard bridge pattern for grafserv + graphql-upload.
- * See: https://github.com/graphql/graphql-http/discussions/36
- *
- * Must be registered immediately after `graphqlUploadExpress()` in the
- * middleware chain — it relies on graphql-upload having already parsed the
- * multipart body into `req.body`.
- *
- * Security note: multipart/form-data is a CORS "simple request" content type,
- * which means browsers send it without a preflight OPTIONS check. The CSRF risk
- * is mitigated by the CORS middleware that runs before this middleware in the
- * Express pipeline.
- */
-export const multipartBridge = (req, _res, next) => {
-    if (req.body != null && req.headers['content-type']?.startsWith('multipart/form-data')) {
-        req.headers['content-type'] = 'application/json';
-    }
-    next();
-};

package/middleware/multipart-bridge.d.ts

@@ -1,26 +0,0 @@
-import type { RequestHandler } from 'express';
-/**
- * Bridge middleware between graphql-upload and grafserv (PostGraphile v5).
- *
- * graphql-upload's `graphqlUploadExpress()` parses multipart/form-data requests
- * and sets `req.body` to a standard GraphQL operation object, but leaves the
- * original Content-Type header unchanged. grafserv rejects any Content-Type it
- * doesn't recognize (415 Unsupported Media Type) because its allowlist only
- * includes `application/json` and `application/graphql`.
- *
- * This middleware rewrites the Content-Type header to `application/json` after
- * graphql-upload has finished parsing, so grafserv accepts the request.
- *
- * This is the standard bridge pattern for grafserv + graphql-upload.
- * See: https://github.com/graphql/graphql-http/discussions/36
- *
- * Must be registered immediately after `graphqlUploadExpress()` in the
- * middleware chain — it relies on graphql-upload having already parsed the
- * multipart body into `req.body`.
- *
- * Security note: multipart/form-data is a CORS "simple request" content type,
- * which means browsers send it without a preflight OPTIONS check. The CSRF risk
- * is mitigated by the CORS middleware that runs before this middleware in the
- * Express pipeline.
- */
-export declare const multipartBridge: RequestHandler;

package/middleware/multipart-bridge.js

@@ -1,34 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.multipartBridge = void 0;
-/**
- * Bridge middleware between graphql-upload and grafserv (PostGraphile v5).
- *
- * graphql-upload's `graphqlUploadExpress()` parses multipart/form-data requests
- * and sets `req.body` to a standard GraphQL operation object, but leaves the
- * original Content-Type header unchanged. grafserv rejects any Content-Type it
- * doesn't recognize (415 Unsupported Media Type) because its allowlist only
- * includes `application/json` and `application/graphql`.
- *
- * This middleware rewrites the Content-Type header to `application/json` after
- * graphql-upload has finished parsing, so grafserv accepts the request.
- *
- * This is the standard bridge pattern for grafserv + graphql-upload.
- * See: https://github.com/graphql/graphql-http/discussions/36
- *
- * Must be registered immediately after `graphqlUploadExpress()` in the
- * middleware chain — it relies on graphql-upload having already parsed the
- * multipart body into `req.body`.
- *
- * Security note: multipart/form-data is a CORS "simple request" content type,
- * which means browsers send it without a preflight OPTIONS check. The CSRF risk
- * is mitigated by the CORS middleware that runs before this middleware in the
- * Express pipeline.
- */
-const multipartBridge = (req, _res, next) => {
-    if (req.body != null && req.headers['content-type']?.startsWith('multipart/form-data')) {
-        req.headers['content-type'] = 'application/json';
-    }
-    next();
-};
-exports.multipartBridge = multipartBridge;