@constructive-io/graphql-server 5.4.1 → 5.7.0

package/esm/middleware/api.js

@@ -16,7 +16,10 @@ const defaultRegistry = createDefaultRegistry();
 // SQL Queries (API resolution only — module queries now live in loaders)
 // =============================================================================
 // Private-header X-Api-Name lookup against the scoped routing plane.
-// `is_published` is the routing-plane analog of the legacy `is_public` column.
+// X-Api-Name is a trusted internal selector (only honored when the server
+// runs with isPublic=false): it addresses a database's API surface by name.
+// `is_published` governs cross-scope route visibility, not internal
+// addressability, so it does not filter this lookup.
 const scopedApiNameLookupSql = (routingSchema) => `
   SELECT 
     a.id as api_id,
@@ -31,7 +34,6 @@ const scopedApiNameLookupSql = (routingSchema) => `
   LEFT JOIN metaschema_public.schema s ON aps.schema_id = s.id
   WHERE a.database_id = $1 
     AND a.name = $2
-    AND a.is_published = $3
   GROUP BY a.id, a.database_id, a.dbname, a.role_name, a.anon_role, a.is_published
   LIMIT 1
 `;
@@ -163,13 +165,13 @@ const validateSchemata = async (pool, schemas) => {
     const result = await pool.query(`SELECT schema_name FROM information_schema.schemata WHERE schema_name = ANY($1::text[])`, [schemas]);
     return result.rows.map((row) => row.schema_name);
 };
-const queryByApiName = async (pool, opts, databaseId, name, isPublic) => {
+const queryByApiName = async (pool, opts, databaseId, name) => {
     const routingSchema = getRoutingSchema(opts);
     if (!isValidSchemaName(routingSchema)) {
         log.warn(`[api-name-lookup] invalid routing schema name: ${routingSchema}`);
         return null;
     }
-    const result = await pool.query(scopedApiNameLookupSql(routingSchema), [databaseId, name, isPublic]);
+    const result = await pool.query(scopedApiNameLookupSql(routingSchema), [databaseId, name]);
     return result.rows[0] ?? null;
 };
 // =============================================================================
@@ -196,8 +198,7 @@ const resolveApiNameHeader = async (ctx) => {
     const { opts, pool, headers } = ctx;
     if (!headers.databaseId)
         return null;
-    const isPublic = opts.api?.isPublic ?? false;
-    const row = await queryByApiName(pool, opts, headers.databaseId, headers.apiName, isPublic);
+    const row = await queryByApiName(pool, opts, headers.databaseId, headers.apiName);
     if (!row) {
         log.debug(`[api-name-lookup] No API found for databaseId=${headers.databaseId} name=${headers.apiName}`);
         return null;

package/esm/middleware/routing.js

@@ -48,12 +48,14 @@ export const routeToApiStructure = (route, opts) => {
         return null;
     }
     const config = (route.resolved_config ?? {});
-    if (!config.dbname || !config.schemas?.length) {
-        log.debug('[resolve-route] api target missing dbname/schemas in resolved_config; no match');
+    if (!config.schemas?.length) {
+        log.debug('[resolve-route] api target missing schemas in resolved_config; no match');
         return null;
     }
     return {
         apiId: config.api_id ?? route.target_source_id ?? undefined,
+        // Scoped APIs leave dbname NULL when their schemas live in the serving
+        // database; fall back to the server's own database in that case.
         dbname: config.dbname || opts.pg?.database || '',
         anonRole: config.anon_role || 'anon',
         roleName: config.role_name || 'authenticated',

package/middleware/api.js

@@ -22,7 +22,10 @@ const defaultRegistry = (0, express_context_1.createDefaultRegistry)();
 // SQL Queries (API resolution only — module queries now live in loaders)
 // =============================================================================
 // Private-header X-Api-Name lookup against the scoped routing plane.
-// `is_published` is the routing-plane analog of the legacy `is_public` column.
+// X-Api-Name is a trusted internal selector (only honored when the server
+// runs with isPublic=false): it addresses a database's API surface by name.
+// `is_published` governs cross-scope route visibility, not internal
+// addressability, so it does not filter this lookup.
 const scopedApiNameLookupSql = (routingSchema) => `
   SELECT 
     a.id as api_id,
@@ -37,7 +40,6 @@ const scopedApiNameLookupSql = (routingSchema) => `
   LEFT JOIN metaschema_public.schema s ON aps.schema_id = s.id
   WHERE a.database_id = $1 
     AND a.name = $2
-    AND a.is_published = $3
   GROUP BY a.id, a.database_id, a.dbname, a.role_name, a.anon_role, a.is_published
   LIMIT 1
 `;
@@ -171,13 +173,13 @@ const validateSchemata = async (pool, schemas) => {
     const result = await pool.query(`SELECT schema_name FROM information_schema.schemata WHERE schema_name = ANY($1::text[])`, [schemas]);
     return result.rows.map((row) => row.schema_name);
 };
-const queryByApiName = async (pool, opts, databaseId, name, isPublic) => {
+const queryByApiName = async (pool, opts, databaseId, name) => {
     const routingSchema = (0, routing_1.getRoutingSchema)(opts);
     if (!(0, routing_1.isValidSchemaName)(routingSchema)) {
         log.warn(`[api-name-lookup] invalid routing schema name: ${routingSchema}`);
         return null;
     }
-    const result = await pool.query(scopedApiNameLookupSql(routingSchema), [databaseId, name, isPublic]);
+    const result = await pool.query(scopedApiNameLookupSql(routingSchema), [databaseId, name]);
     return result.rows[0] ?? null;
 };
 // =============================================================================
@@ -204,8 +206,7 @@ const resolveApiNameHeader = async (ctx) => {
     const { opts, pool, headers } = ctx;
     if (!headers.databaseId)
         return null;
-    const isPublic = opts.api?.isPublic ?? false;
-    const row = await queryByApiName(pool, opts, headers.databaseId, headers.apiName, isPublic);
+    const row = await queryByApiName(pool, opts, headers.databaseId, headers.apiName);
     if (!row) {
         log.debug(`[api-name-lookup] No API found for databaseId=${headers.databaseId} name=${headers.apiName}`);
         return null;

package/middleware/routing.js

@@ -54,12 +54,14 @@ const routeToApiStructure = (route, opts) => {
         return null;
     }
     const config = (route.resolved_config ?? {});
-    if (!config.dbname || !config.schemas?.length) {
-        log.debug('[resolve-route] api target missing dbname/schemas in resolved_config; no match');
+    if (!config.schemas?.length) {
+        log.debug('[resolve-route] api target missing schemas in resolved_config; no match');
         return null;
     }
     return {
         apiId: config.api_id ?? route.target_source_id ?? undefined,
+        // Scoped APIs leave dbname NULL when their schemas live in the serving
+        // database; fall back to the server's own database in that case.
         dbname: config.dbname || opts.pg?.database || '',
         anonRole: config.anon_role || 'anon',
         roleName: config.role_name || 'authenticated',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.4.1",
+  "version": "5.7.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -41,39 +41,39 @@
     "backend"
   ],
   "dependencies": {
-    "@constructive-io/csrf": "^0.18.2",
-    "@constructive-io/express-context": "^0.15.0",
-    "@constructive-io/graphql-env": "^3.20.0",
-    "@constructive-io/graphql-types": "^3.19.0",
-    "@constructive-io/query-builder": "^3.1.2",
-    "@constructive-io/s3-utils": "^2.21.2",
-    "@constructive-io/url-domains": "^2.20.2",
+    "@constructive-io/csrf": "^0.21.0",
+    "@constructive-io/express-context": "^0.18.0",
+    "@constructive-io/graphql-env": "^3.23.0",
+    "@constructive-io/graphql-types": "^3.22.0",
+    "@constructive-io/query-builder": "^3.4.0",
+    "@constructive-io/s3-utils": "^2.24.0",
+    "@constructive-io/url-domains": "^2.23.0",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
-    "@pgpmjs/env": "^2.30.2",
-    "@pgpmjs/logger": "^2.15.2",
-    "@pgpmjs/server-utils": "^3.16.2",
-    "@pgpmjs/types": "^2.37.2",
-    "agentic-server": "0.13.0",
+    "@pgpmjs/env": "^2.33.0",
+    "@pgpmjs/logger": "^2.18.0",
+    "@pgpmjs/server-utils": "^3.19.0",
+    "@pgpmjs/types": "^2.40.0",
+    "agentic-server": "0.16.0",
     "cors": "^2.8.6",
     "deepmerge": "^4.3.1",
     "express": "^5.2.1",
-    "gql-ast": "^3.14.2",
+    "gql-ast": "^3.17.0",
     "grafast": "1.0.2",
     "grafserv": "1.0.0",
     "graphile-build": "5.0.2",
     "graphile-build-pg": "5.0.2",
-    "graphile-cache": "^4.1.2",
+    "graphile-cache": "^4.4.0",
     "graphile-config": "1.0.1",
-    "graphile-function-bindings": "^1.2.1",
-    "graphile-settings": "^6.2.1",
+    "graphile-function-bindings": "^1.5.0",
+    "graphile-settings": "^6.5.0",
     "graphile-utils": "5.0.1",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
     "lru-cache": "^11.2.7",
     "pg": "^8.21.0",
-    "pg-cache": "^3.16.2",
-    "pg-env": "^1.19.2",
-    "pg-query-context": "^2.20.2",
+    "pg-cache": "^3.19.0",
+    "pg-env": "^1.22.0",
+    "pg-query-context": "^2.23.0",
     "pg-sql2": "5.0.1",
     "postgraphile": "5.0.3",
     "request-ip": "^3.3.0"
@@ -87,10 +87,10 @@
     "@types/pg": "^8.20.0",
     "@types/request-ip": "^0.0.41",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "5.2.1",
+    "graphile-test": "5.5.0",
     "makage": "^0.3.0",
     "nodemon": "^3.1.14",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "cc1b2af2c73c23b99a221e6bd8a8ba76c7ce79e6"
+  "gitHead": "73f55ad24d9a92e7ef1e268526b31bfb7bb12b28"
 }