@depup/apollo__server 5.5.0-depup.0

package/src/utils/makeGatewayGraphQLRequestContext.ts

@@ -0,0 +1,197 @@
+import type {
+  GatewayGraphQLRequest,
+  GatewayGraphQLRequestContext,
+  GatewayGraphQLResponse,
+  GatewaySchemaHash,
+} from '@apollo/server-gateway-interface';
+import type { FetcherHeaders } from '@apollo/utils.fetcher';
+import type { ApolloServer, ApolloServerInternals } from '../ApolloServer';
+import type {
+  BaseContext,
+  GraphQLRequestContextExecutionDidStart,
+} from '../externalTypes';
+import type { HeaderMap } from './HeaderMap';
+
+// Apollo Gateway's API included `GraphQLRequestContext` from AS2/AS3.
+// Specifically, a request context is passed to the main executor method, which
+// it then exposes to user-configurable `GraphQLDataSource`s.
+// `GraphQLRequestContext` has changed in incompatible ways since AS4; for example,
+// we represent HTTP messages using our own data structures rather than Fetches,
+// and some fields have been removed because they relate to features that don't
+// exist any more.
+//
+// In general, the future of Apollo's development is in Apollo Router, not
+// Gateway. So rather than have a big transition where a new version of Gateway
+// supports AS5's GraphQLRequestContext instead of AS3's, we simply teach AS5
+// how to produce AS3-style GraphQLRequestContext objects specifically for use
+// by Gateway. We have changed Gateway to get its TS type definitions from a new
+// package rather than from AS3 itself, so that Gateway no longer needs to
+// depend on Apollo Server.
+//
+// This function turns an AS5 GraphQLRequestContext into a
+// GatewayGraphQLRequestContext (which is basically an AS3
+// GraphQLRequestContext).
+//
+// You might think that *after* invoking the executor, we would then need to
+// propagate any changes made by the gateway back onto the "real"
+// GraphQLRequestContext. It turns out that for each bit of data on the request
+// context, this is either unnecessary or impossible. (We don't need to support
+// use cases where people break type safe, eg by changing the values of readonly
+// fields.) Here's why:
+//
+// Many fields on GatewayGraphQLRequestContext are declared readonly and their
+// values are taken directly from the real GraphQLRequestContext. This means
+// that gateways should not change the field's value, and any mutations of the
+// object stored in the field (say, calling
+// `requestContext.overallCachePolicy.restrict`, as RemoteGraphQLDataSource
+// does) already take effect.
+//
+//  The only two fields not declared as readonly are `logger` and `debug`.
+//
+// Technically, a gateway implementation could set `requestContext.logger` to a
+// different Logger without breaking the TypeScript declarations. In AS5 we
+// don't actually have a requestContext.logger; we have `readonly
+// requestContext.server` and `readonly server.logger`. So there's not an easy
+// way for us to carry out this change: AS5 just doesn't let gateway or plugins
+// override the server's logger (and generally doesn't allow the logger to
+// change after the server is created), which seems like a simpler model. If it
+// turns out there is a real use case for the gateway to be able to change the
+// overall logger for the request as seen by plugins, we can fix that later.
+//
+// Similarly, it's not clear what the intended use case of mutating `debug` in
+// gateway would be. `debug` has now mostly changed into
+// `includeStacktraceInErrorResponses`. So perhaps this could be used to let you
+// decide whether or not to include the stacktrace on a per-operation basis...
+// but you can also use `formatError` or `didEncounterErrors` for this perhaps?
+// In any case, AS5 doesn't track `includeStacktraceInErrorResponses` on a
+// per-operation basis; if we find a use case for this we can add it later.
+//
+// So we'll just ignore changes to `logger` and `debug`.
+//
+// Next, there's `request`. We don't know of a use case for mutating the
+// *request* at execution time. If there was a real use case, we could add a
+// function that copies pieces back from the gateway `request` to the AS5
+// request, but we're not bothering to yet.
+//
+// Finally, there's `response`. Sure, the executor *could* mutate `response`.
+// But the main thing the executor is doing is *returning* a response, which
+// then semi-overwrites `requestContext.response` anyway. So it doesn't seem
+// like we need to support `executor` *also* overwriting response. Yet again, we
+// can fix this if it turns out it's necessary. (That said, the executor could
+// in theory write HTTP response headers or status, so we make sure to hook them
+// up directly to the appropriate data in the real GraphQLRequestContext.)
+//
+// So all in all, it looks like it's OK for this to be a "one-way" conversion.
+export function makeGatewayGraphQLRequestContext<TContext extends BaseContext>(
+  newRequestContext: GraphQLRequestContextExecutionDidStart<TContext>,
+  server: ApolloServer<TContext>,
+  internals: ApolloServerInternals<TContext>,
+): GatewayGraphQLRequestContext {
+  const request: GatewayGraphQLRequest = {};
+  if ('query' in newRequestContext.request) {
+    request.query = newRequestContext.request.query;
+  }
+  if ('operationName' in newRequestContext.request) {
+    request.operationName = newRequestContext.request.operationName;
+  }
+  if ('variables' in newRequestContext.request) {
+    request.variables = newRequestContext.request.variables;
+  }
+  if ('extensions' in newRequestContext.request) {
+    request.extensions = newRequestContext.request.extensions;
+  }
+  if (newRequestContext.request.http) {
+    const newHttp = newRequestContext.request.http;
+    const needQuestion =
+      newHttp.search !== '' && !newHttp.search.startsWith('?');
+    request.http = {
+      method: newHttp.method,
+      // As of AS4, we no longer attempt to track complete URLs (just the search
+      // parameters used in GET requests). So we have to fake them for Gateway.
+      url: `https://unknown-url.invalid/${needQuestion ? '?' : ''}${
+        newHttp.search
+      }`,
+      headers: new FetcherHeadersForHeaderMap(newHttp.headers),
+    };
+  }
+
+  const response: GatewayGraphQLResponse = {
+    http: {
+      headers: new FetcherHeadersForHeaderMap(
+        newRequestContext.response.http.headers,
+      ),
+      get status() {
+        return newRequestContext.response.http.status;
+      },
+      set status(newStatus) {
+        newRequestContext.response.http.status = newStatus;
+      },
+    },
+    // We leave off `body` because it hasn't been set yet.
+  };
+
+  return {
+    request,
+    response,
+    logger: server.logger,
+    schema: newRequestContext.schema,
+    // For the sake of typechecking, we still provide this field, but we don't
+    // calculate it. If somebody really needs it in their gateway
+    // implementation, they're welcome to copy
+    // https://github.com/apollographql/apollo-server/blob/3f218e78/packages/apollo-server-core/src/utils/schemaHash.ts
+    // into their code.
+    schemaHash:
+      'schemaHash no longer exists since Apollo Server 4' as GatewaySchemaHash,
+    context: newRequestContext.contextValue,
+    cache: server.cache,
+    queryHash: newRequestContext.queryHash,
+    document: newRequestContext.document,
+    source: newRequestContext.source,
+    operationName: newRequestContext.operationName,
+    operation: newRequestContext.operation,
+    errors: newRequestContext.errors,
+    metrics: newRequestContext.metrics,
+    debug: internals.includeStacktraceInErrorResponses,
+    overallCachePolicy: newRequestContext.overallCachePolicy,
+    requestIsBatched: newRequestContext.requestIsBatched,
+  };
+}
+
+// An implementation of the W3C-style headers class used by Gateway (and AS3),
+// backed by AS5's HeaderMap. Changes are written directly to the HeaderMap, so
+// any concurrent writes to the underlying HeaderMap (eg from a plugin) can be
+// seen immediately by the gateway and vice versa.
+class FetcherHeadersForHeaderMap implements FetcherHeaders {
+  constructor(private map: HeaderMap) {}
+  append(name: string, value: string) {
+    if (this.map.has(name)) {
+      this.map.set(name, this.map.get(name) + ', ' + value);
+    } else {
+      this.map.set(name, value);
+    }
+  }
+  delete(name: string) {
+    this.map.delete(name);
+  }
+  get(name: string): string | null {
+    return this.map.get(name) ?? null;
+  }
+  has(name: string): boolean {
+    return this.map.has(name);
+  }
+  set(name: string, value: string) {
+    this.map.set(name, value);
+  }
+  entries(): Iterator<[string, string]> {
+    return this.map.entries();
+  }
+  keys(): Iterator<string> {
+    return this.map.keys();
+  }
+  values(): Iterator<string> {
+    return this.map.values();
+  }
+  [Symbol.iterator](): Iterator<[string, string]> {
+    return this.map.entries();
+  }
+}

package/src/utils/resolvable.ts

@@ -0,0 +1,30 @@
+// Copyright 2019 Joseph Gentle
+
+// Permission to use, copy, modify, and / or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+// FITNESS.IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+//   INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+export type Resolvable<T> = Promise<T> & {
+  resolve: (t: T) => void;
+  reject: (e: any) => void;
+};
+
+export default <T = void>(): Resolvable<T> => {
+  let resolve: (val: T) => void;
+  let reject: (err: any) => void;
+  const promise = new Promise<T>((_resolve, _reject) => {
+    resolve = _resolve;
+    reject = _reject;
+  }) as Resolvable<T>;
+  promise.resolve = resolve!;
+  promise.reject = reject!;
+  return promise;
+};

package/src/utils/schemaInstrumentation.ts

@@ -0,0 +1,132 @@
+import {
+  type GraphQLSchema,
+  type GraphQLField,
+  getNamedType,
+  GraphQLObjectType,
+  type GraphQLFieldResolver,
+  defaultFieldResolver,
+} from 'graphql';
+import type {
+  BaseContext,
+  GraphQLRequestExecutionListener,
+} from '../externalTypes/index.js';
+
+export const symbolExecutionDispatcherWillResolveField = Symbol(
+  'apolloServerExecutionDispatcherWillResolveField',
+);
+export const symbolUserFieldResolver = Symbol('apolloServerUserFieldResolver');
+const symbolPluginsEnabled = Symbol('apolloServerPluginsEnabled');
+
+export function enablePluginsForSchemaResolvers<TContext extends BaseContext>(
+  schema: GraphQLSchema & { [symbolPluginsEnabled]?: boolean },
+) {
+  if (pluginsEnabledForSchemaResolvers(schema)) {
+    return schema;
+  }
+  Object.defineProperty(schema, symbolPluginsEnabled, {
+    value: true,
+  });
+
+  const typeMap = schema.getTypeMap();
+  Object.values(typeMap).forEach((type) => {
+    if (
+      !getNamedType(type).name.startsWith('__') &&
+      type instanceof GraphQLObjectType
+    ) {
+      const fields = type.getFields();
+      Object.values(fields).forEach((field) => {
+        wrapField<TContext>(field);
+      });
+    }
+  });
+
+  return schema;
+}
+
+export function pluginsEnabledForSchemaResolvers(
+  schema: GraphQLSchema & { [symbolPluginsEnabled]?: boolean },
+): boolean {
+  return !!schema[symbolPluginsEnabled];
+}
+
+function wrapField<TContext extends BaseContext>(
+  field: GraphQLField<any, any>,
+): void {
+  const originalFieldResolve = field.resolve;
+
+  field.resolve = (source, args, contextValue, info) => {
+    const willResolveField = contextValue?.[
+      symbolExecutionDispatcherWillResolveField
+    ] as
+      | GraphQLRequestExecutionListener<TContext>['willResolveField']
+      | undefined;
+
+    const userFieldResolver = contextValue?.[symbolUserFieldResolver] as
+      | GraphQLFieldResolver<any, any>
+      | undefined;
+
+    // The technique for implementing a  "did resolve field" is accomplished by
+    // returning a function from the `willResolveField` handler.  While there
+    // may be several callbacks, depending on the number of plugins which have
+    // implemented a `willResolveField` hook, this hook will call them all
+    // as dictated by the dispatcher.  We will call this when object
+    // resolution is complete.
+    const didResolveField =
+      typeof willResolveField === 'function' &&
+      willResolveField({ source, args, contextValue, info });
+
+    const fieldResolver =
+      originalFieldResolve || userFieldResolver || defaultFieldResolver;
+
+    try {
+      const result = fieldResolver(source, args, contextValue, info);
+
+      // Call the stack's handlers either immediately (if result is not a
+      // Promise) or once the Promise is done. Then return that same
+      // maybe-Promise value.
+      if (typeof didResolveField === 'function') {
+        whenResultIsFinished(result, didResolveField);
+      }
+      return result;
+    } catch (error) {
+      // Normally it's a bad sign to see an error both handled and
+      // re-thrown. But it is useful to allow extensions to track errors while
+      // still handling them in the normal GraphQL way.
+      if (typeof didResolveField === 'function') {
+        didResolveField(error as Error);
+      }
+      throw error;
+    }
+  };
+}
+
+function isPromise(x: any): boolean {
+  return x && typeof x.then === 'function';
+}
+
+// Given result (which may be a Promise or an array some of whose elements are
+// promises) Promises, set up 'callback' to be invoked when result is fully
+// resolved. (Unfortunately, this does not perfectly handle every possible
+// return value shape, such as arrays of arrays of Promises.)
+export function whenResultIsFinished(
+  result: any,
+  callback: (err: Error | null, result?: any) => void,
+) {
+  if (isPromise(result)) {
+    result.then(
+      (r: any) => whenResultIsFinished(r, callback),
+      (err: Error) => callback(err),
+    );
+  } else if (Array.isArray(result)) {
+    if (result.some(isPromise)) {
+      Promise.all(result).then(
+        (r: any) => callback(null, r),
+        (err: Error) => callback(err),
+      );
+    } else {
+      callback(null, result);
+    }
+  } else {
+    callback(null, result);
+  }
+}

package/src/utils/schemaManager.ts

@@ -0,0 +1,212 @@
+import type { Logger } from '@apollo/utils.logger';
+import type { GraphQLSchema } from 'graphql';
+import type {
+  GatewayExecutor,
+  GatewayInterface,
+  GatewayUnsubscriber,
+} from '@apollo/server-gateway-interface';
+import type { SchemaDerivedData } from '../ApolloServer.js';
+import type {
+  ApolloConfig,
+  GraphQLSchemaContext,
+} from '../externalTypes/index.js';
+
+type SchemaDerivedDataProvider = (
+  apiSchema: GraphQLSchema,
+) => SchemaDerivedData;
+
+/**
+ * An async-safe class for tracking changes in schemas and schema-derived data.
+ *
+ * Specifically, as long as start() is called (and completes) before stop() is
+ * called, any set of executions of public methods is linearizable.
+ *
+ * Note that linearizability in Javascript is trivial if all public methods are
+ * non-async, but increasingly difficult to guarantee if public methods become
+ * async. Accordingly, if you believe a public method should be async, think
+ * carefully on whether it's worth the mental overhead. (E.g. if you wished that
+ * a callback was async, consider instead resolving a Promise in a non-async
+ * callback and having your async code wait on the Promise in setTimeout().)
+ */
+export class SchemaManager {
+  private readonly logger: Logger;
+  private readonly schemaDerivedDataProvider: SchemaDerivedDataProvider;
+  private readonly onSchemaLoadOrUpdateListeners = new Set<
+    (schemaContext: GraphQLSchemaContext) => void
+  >();
+  private isStopped = false;
+  private schemaDerivedData?: SchemaDerivedData;
+  private schemaContext?: GraphQLSchemaContext;
+
+  // For state that's specific to the mode of operation.
+  private readonly modeSpecificState:
+    | {
+        readonly mode: 'gateway';
+        readonly gateway: GatewayInterface;
+        readonly apolloConfig: ApolloConfig;
+        unsubscribeFromGateway?: GatewayUnsubscriber;
+      }
+    | {
+        readonly mode: 'schema';
+        readonly apiSchema: GraphQLSchema;
+        readonly schemaDerivedData: SchemaDerivedData;
+      };
+
+  constructor(
+    options: (
+      | { gateway: GatewayInterface; apolloConfig: ApolloConfig }
+      | { apiSchema: GraphQLSchema }
+    ) & {
+      logger: Logger;
+      schemaDerivedDataProvider: SchemaDerivedDataProvider;
+    },
+  ) {
+    this.logger = options.logger;
+    this.schemaDerivedDataProvider = options.schemaDerivedDataProvider;
+    if ('gateway' in options) {
+      this.modeSpecificState = {
+        mode: 'gateway',
+        gateway: options.gateway,
+        apolloConfig: options.apolloConfig,
+      };
+    } else {
+      this.modeSpecificState = {
+        mode: 'schema',
+        apiSchema: options.apiSchema,
+        // The caller of the constructor expects us to fail early if the schema
+        // given is invalid/has errors, so we call the provider here. We also
+        // pass the result to start(), as the provider can be expensive to call.
+        schemaDerivedData: options.schemaDerivedDataProvider(options.apiSchema),
+      };
+    }
+  }
+
+  /**
+   * Calling start() will:
+   * - Start gateway schema fetching (if a gateway was provided).
+   * - Initialize schema-derived data.
+   * - Synchronously notify onSchemaLoadOrUpdate() listeners of schema load, and
+   *   asynchronously notify them of schema updates.
+   * - If we started a gateway, returns the gateway's executor; otherwise null.
+   */
+  public async start(): Promise<GatewayExecutor | null> {
+    if (this.modeSpecificState.mode === 'gateway') {
+      const gateway = this.modeSpecificState.gateway;
+      if (gateway.onSchemaLoadOrUpdate) {
+        // Use onSchemaLoadOrUpdate, as it reports the core supergraph SDL and
+        // always reports the initial schema load.
+        this.modeSpecificState.unsubscribeFromGateway =
+          gateway.onSchemaLoadOrUpdate((schemaContext) => {
+            this.processSchemaLoadOrUpdateEvent(schemaContext);
+          });
+      } else {
+        throw new Error(
+          "Unexpectedly couldn't find onSchemaLoadOrUpdate on gateway",
+        );
+      }
+
+      const config = await this.modeSpecificState.gateway.load({
+        apollo: this.modeSpecificState.apolloConfig,
+      });
+
+      return config.executor;
+    } else {
+      this.processSchemaLoadOrUpdateEvent(
+        {
+          apiSchema: this.modeSpecificState.apiSchema,
+        },
+        this.modeSpecificState.schemaDerivedData,
+      );
+      return null;
+    }
+  }
+
+  /**
+   * Registers a listener for schema load/update events. Note that the latest
+   * event is buffered, i.e.
+   * - If registered before start(), this method will throw. (We have no need
+   *   for registration before start(), but this is easy enough to change.)
+   * - If registered after start() but before stop(), the callback will be first
+   *   called in this method (for whatever the current schema is), and then
+   *   later for updates.
+   * - If registered after stop(), the callback will never be called.
+   *
+   * For gateways, a core supergraph SDL will be provided to the callback.
+   *
+   * @param callback The listener to execute on schema load/updates.
+   */
+  public onSchemaLoadOrUpdate(
+    callback: (schemaContext: GraphQLSchemaContext) => void,
+  ): GatewayUnsubscriber {
+    if (!this.schemaContext) {
+      throw new Error('You must call start() before onSchemaLoadOrUpdate()');
+    }
+    if (!this.isStopped) {
+      try {
+        callback(this.schemaContext);
+      } catch (e) {
+        // Note that onSchemaLoadOrUpdate() is currently only called from
+        // ApolloServer._start(), so we throw here to alert the user early
+        // that their callback is failing.
+        throw new Error(
+          `An error was thrown from an 'onSchemaLoadOrUpdate' listener: ${
+            (e as Error).message
+          }`,
+        );
+      }
+    }
+    this.onSchemaLoadOrUpdateListeners.add(callback);
+
+    return () => {
+      this.onSchemaLoadOrUpdateListeners.delete(callback);
+    };
+  }
+
+  /**
+   * Get the schema-derived state for the current schema. This throws if called
+   * before start() is called.
+   */
+  public getSchemaDerivedData(): SchemaDerivedData {
+    if (!this.schemaDerivedData) {
+      throw new Error('You must call start() before getSchemaDerivedData()');
+    }
+    return this.schemaDerivedData;
+  }
+
+  /**
+   * Calling stop() will:
+   * - Stop gateway schema fetching (if a gateway was provided).
+   *   - Note that this specific step may not succeed if gateway is old.
+   * - Stop updating schema-derived data.
+   * - Stop notifying onSchemaLoadOrUpdate() listeners.
+   */
+  public async stop(): Promise<void> {
+    this.isStopped = true;
+    if (this.modeSpecificState.mode === 'gateway') {
+      this.modeSpecificState.unsubscribeFromGateway?.();
+      await this.modeSpecificState.gateway.stop?.();
+    }
+  }
+
+  private processSchemaLoadOrUpdateEvent(
+    schemaContext: GraphQLSchemaContext,
+    schemaDerivedData?: SchemaDerivedData,
+  ): void {
+    if (!this.isStopped) {
+      this.schemaDerivedData =
+        schemaDerivedData ??
+        this.schemaDerivedDataProvider(schemaContext.apiSchema);
+      this.schemaContext = schemaContext;
+      this.onSchemaLoadOrUpdateListeners.forEach((listener) => {
+        try {
+          listener(schemaContext);
+        } catch (e) {
+          this.logger.error(
+            "An error was thrown from an 'onSchemaLoadOrUpdate' listener",
+          );
+          this.logger.error(e);
+        }
+      });
+    }
+  }
+}

package/src/utils/urlForHttpServer.ts

@@ -0,0 +1,21 @@
+import type { Server } from 'http';
+import type { AddressInfo } from 'net';
+import { format } from 'url';
+
+export function urlForHttpServer(httpServer: Server): string {
+  const { address, port } = httpServer.address() as AddressInfo;
+
+  // Convert IPs which mean "any address" (IPv4 or IPv6) into localhost
+  // corresponding loopback ip. Note that the url field we're setting is
+  // primarily for consumption by our test suite. If this heuristic is wrong for
+  // your use case, explicitly specify a frontend host (in the `host` option
+  // when listening).
+  const hostname = address === '' || address === '::' ? 'localhost' : address;
+
+  return format({
+    protocol: 'http',
+    hostname,
+    port,
+    pathname: '/',
+  });
+}

package/src/validationRules/NoIntrospection.ts

@@ -0,0 +1,27 @@
+import {
+  GraphQLError,
+  type ValidationRule,
+  type ValidationContext,
+} from 'graphql';
+import { ApolloServerValidationErrorCode } from '../errors/index.js';
+
+export const NoIntrospection: ValidationRule = (
+  context: ValidationContext,
+) => ({
+  Field(node) {
+    if (node.name.value === '__schema' || node.name.value === '__type') {
+      context.reportError(
+        new GraphQLError(
+          'GraphQL introspection is not allowed by Apollo Server, but the query contained __schema or __type. To enable introspection, pass introspection: true to ApolloServer in production',
+          {
+            nodes: [node],
+            extensions: {
+              validationErrorCode:
+                ApolloServerValidationErrorCode.INTROSPECTION_DISABLED,
+            },
+          },
+        ),
+      );
+    }
+  },
+});