@galaxy-stack/orbit-graphql-federation 0.1.7 → 0.1.8

package/dist/index.js

@@ -446,6 +446,269 @@ class SchemaBuilder {
 // ../graphql/src/module/graphql.module.ts
 import"reflect-metadata";
 import { parse, validate, execute } from "graphql";
+
+// ../common/src/decorators/params.decorator.ts
+import"reflect-metadata";
+var ROUTE_PARAMS_KEY = "orbit:route:params";
+function createParamDecorator2(type) {
+  return (data) => {
+    return (target, propertyKey, parameterIndex) => {
+      if (!propertyKey)
+        return;
+      const existingParams = Reflect.getMetadata(ROUTE_PARAMS_KEY, target, propertyKey) || [];
+      existingParams.push({
+        type,
+        data,
+        index: parameterIndex
+      });
+      Reflect.defineMetadata(ROUTE_PARAMS_KEY, existingParams, target, propertyKey);
+    };
+  };
+}
+var Body = createParamDecorator2("body" /* BODY */);
+var Query = createParamDecorator2("query" /* QUERY */);
+var Param = createParamDecorator2("param" /* PARAM */);
+var Headers2 = createParamDecorator2("headers" /* HEADERS */);
+var Req = createParamDecorator2("request" /* REQUEST */);
+var Res = createParamDecorator2("response" /* RESPONSE */);
+var Ip = createParamDecorator2("ip" /* IP */);
+var Session = createParamDecorator2("session" /* SESSION */);
+var UploadedFile = createParamDecorator2("file" /* FILE */);
+var UploadedFiles = createParamDecorator2("files" /* FILES */);
+// ../common/src/decorators/http-code.decorator.ts
+import"reflect-metadata";
+// ../common/src/decorators/use-guards.decorator.ts
+import"reflect-metadata";
+// ../common/src/decorators/use-pipes.decorator.ts
+import"reflect-metadata";
+// ../common/src/decorators/use-interceptors.decorator.ts
+import"reflect-metadata";
+// ../common/src/decorators/catch.decorator.ts
+import"reflect-metadata";
+// ../common/src/decorators/transform.decorator.ts
+var TRANSFORM_METADATA = Symbol("transform:metadata");
+// ../common/src/security-headers.ts
+var DEFAULTS = {
+  hsts: true,
+  frameguard: "SAMEORIGIN",
+  noSniff: true,
+  referrerPolicy: "no-referrer",
+  crossOriginOpenerPolicy: "same-origin",
+  crossOriginResourcePolicy: "same-origin",
+  hidePoweredBy: true,
+  originAgentCluster: true,
+  permittedCrossDomainPolicies: "none",
+  dnsPrefetchControl: false
+};
+function buildSecureHeaders(options = {}) {
+  const opts = { ...DEFAULTS, ...options };
+  const headers = {};
+  if (opts.hidePoweredBy) {
+    headers["X-Powered-By"] = "";
+  }
+  if (opts.noSniff) {
+    headers["X-Content-Type-Options"] = "nosniff";
+  }
+  if (opts.frameguard) {
+    headers["X-Frame-Options"] = opts.frameguard;
+  }
+  if (opts.hsts) {
+    const hsts = typeof opts.hsts === "object" ? opts.hsts : { maxAge: 15552000, includeSubDomains: true };
+    let value = `max-age=${hsts.maxAge ?? 15552000}`;
+    if (hsts.includeSubDomains !== false)
+      value += "; includeSubDomains";
+    if ("preload" in hsts && hsts.preload)
+      value += "; preload";
+    headers["Strict-Transport-Security"] = value;
+  }
+  if (opts.referrerPolicy) {
+    headers["Referrer-Policy"] = opts.referrerPolicy;
+  }
+  if (opts.crossOriginOpenerPolicy) {
+    headers["Cross-Origin-Opener-Policy"] = opts.crossOriginOpenerPolicy;
+  }
+  if (opts.crossOriginResourcePolicy) {
+    headers["Cross-Origin-Resource-Policy"] = opts.crossOriginResourcePolicy;
+  }
+  if (opts.originAgentCluster) {
+    headers["Origin-Agent-Cluster"] = "?1";
+  }
+  if (opts.permittedCrossDomainPolicies) {
+    headers["X-Permitted-Cross-Domain-Policies"] = opts.permittedCrossDomainPolicies;
+  }
+  if (opts.dnsPrefetchControl) {
+    headers["X-DNS-Prefetch-Control"] = "on";
+  } else {
+    headers["X-DNS-Prefetch-Control"] = "off";
+  }
+  return headers;
+}
+function withSecureHeaders(response, options = {}) {
+  const secure = buildSecureHeaders(options);
+  const headers = new Headers(response.headers);
+  for (const [key, value] of Object.entries(secure)) {
+    if (value === "") {
+      headers.delete(key);
+    } else {
+      headers.set(key, value);
+    }
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+// ../graphql/src/security/validation-rules.ts
+import {
+  GraphQLError,
+  Kind
+} from "graphql";
+function depthLimit(maxDepth) {
+  return (context) => {
+    const definedFragments = new Map;
+    for (const def of context.getDocument().definitions) {
+      if (def.kind === Kind.FRAGMENT_DEFINITION) {
+        definedFragments.set(def.name.value, def);
+      }
+    }
+    const fragmentDepths = new Map;
+    const visiting = new Set;
+    const measureSelections = (selections, depth) => {
+      let deepest = depth;
+      for (const node of selections) {
+        if (node.kind === Kind.FIELD) {
+          const field = node;
+          if (field.name.value === "__typename")
+            continue;
+          deepest = Math.max(deepest, measureSelections(field.selectionSet?.selections ?? [], depth + 1));
+        } else if (node.kind === Kind.INLINE_FRAGMENT) {
+          deepest = Math.max(deepest, measureSelections(node.selectionSet.selections, depth));
+        } else if (node.kind === Kind.FRAGMENT_SPREAD) {
+          const name = node.name.value;
+          if (visiting.has(name))
+            continue;
+          const frag = definedFragments.get(name);
+          if (!frag)
+            continue;
+          const cached = fragmentDepths.get(name);
+          const fragDepth = cached !== undefined ? cached : (() => {
+            visiting.add(name);
+            const d = measureSelections(frag.selectionSet.selections, depth);
+            visiting.delete(name);
+            fragmentDepths.set(name, d);
+            return d;
+          })();
+          deepest = Math.max(deepest, fragDepth);
+        }
+      }
+      return deepest;
+    };
+    return {
+      OperationDefinition(node) {
+        const depth = measureSelections(node.selectionSet.selections, 0);
+        if (depth > maxDepth) {
+          context.reportError(new GraphQLError(`Query exceeds maximum depth of ${maxDepth} (got ${depth}).`, { nodes: node }));
+        }
+      }
+    };
+  };
+}
+function complexityLimit(options) {
+  const {
+    maxComplexity,
+    defaultFieldCost = 1,
+    defaultListFactor = 10,
+    fieldCosts = {},
+    listFactors = {}
+  } = options;
+  return (context) => {
+    const definedFragments = new Map;
+    for (const def of context.getDocument().definitions) {
+      if (def.kind === Kind.FRAGMENT_DEFINITION) {
+        definedFragments.set(def.name.value, def);
+      }
+    }
+    const fragmentCosts = new Map;
+    const visiting = new Set;
+    const measureSelections = (selections, multiplier) => {
+      let total = 0;
+      for (const node of selections) {
+        if (node.kind === Kind.FIELD) {
+          const field = node;
+          if (field.name.value === "__typename")
+            continue;
+          const cost = fieldCosts[field.name.value] ?? defaultFieldCost;
+          const isList = Boolean(field.selectionSet) && (listFactors[field.name.value] ?? defaultListFactor);
+          const factor = field.selectionSet ? listFactors[field.name.value] ?? defaultListFactor : 1;
+          const childCost = field.selectionSet ? measureSelections(field.selectionSet.selections, multiplier * factor) : 0;
+          total += cost * multiplier + childCost;
+        } else if (node.kind === Kind.INLINE_FRAGMENT) {
+          total += measureSelections(node.selectionSet.selections, multiplier);
+        } else if (node.kind === Kind.FRAGMENT_SPREAD) {
+          const name = node.name.value;
+          if (visiting.has(name))
+            continue;
+          const frag = definedFragments.get(name);
+          if (!frag)
+            continue;
+          const cached = fragmentCosts.get(name);
+          const fragCost = cached !== undefined ? cached : (() => {
+            visiting.add(name);
+            const c = measureSelections(frag.selectionSet.selections, multiplier);
+            visiting.delete(name);
+            fragmentCosts.set(name, c);
+            return c;
+          })();
+          total += fragCost;
+        }
+      }
+      return total;
+    };
+    return {
+      OperationDefinition(node) {
+        const complexity = measureSelections(node.selectionSet.selections, 1);
+        if (complexity > maxComplexity) {
+          context.reportError(new GraphQLError(`Query complexity ${complexity} exceeds maximum of ${maxComplexity}.`, { nodes: node }));
+        }
+      }
+    };
+  };
+}
+function aliasLimit(maxAliases) {
+  return (context) => {
+    let aliasCount = 0;
+    return {
+      Field(node) {
+        if (node.alias) {
+          aliasCount++;
+          if (aliasCount > maxAliases) {
+            context.reportError(new GraphQLError(`Query exceeds maximum of ${maxAliases} aliases.`, { nodes: node }));
+          }
+        }
+      }
+    };
+  };
+}
+function blockIntrospection() {
+  return (context) => {
+    return {
+      Field(node) {
+        if (node.name.value === "__schema" || node.name.value === "__type") {
+          context.reportError(new GraphQLError("GraphQL introspection is disabled.", { nodes: node }));
+        }
+      }
+    };
+  };
+}
+// ../graphql/src/security/options.ts
+var DEFAULT_GRAPHQL_SECURITY = {
+  maxDepth: 10,
+  maxComplexity: 1000,
+  maxAliases: 30
+};
+
+// ../graphql/src/module/graphql.module.ts
 var GRAPHQL_OPTIONS = Symbol("GRAPHQL_OPTIONS");
 var GRAPHQL_SCHEMA = Symbol("GRAPHQL_SCHEMA");
 
@@ -530,6 +793,11 @@ class GraphQLHandler {
     this.schema = schema;
     this.options = options;
   }
+  wrap(response) {
+    if (this.options.secureHeaders === false)
+      return response;
+    return withSecureHeaders(response);
+  }
   createLoaderContext() {
     const ctx = new DataLoaderContext;
     const loaders = this.options.loaders || {};
@@ -561,14 +829,14 @@ class GraphQLHandler {
         ...userContext
       };
       const document = parse(query);
-      const validationErrors = validate(this.schema, document);
+      const validationErrors = validate(this.schema, document, this.buildSecurityRules());
       if (validationErrors.length > 0) {
-        return new Response(JSON.stringify({
+        return this.wrap(new Response(JSON.stringify({
           errors: validationErrors.map((e) => this.formatError(e))
         }), {
           status: 400,
           headers: { "Content-Type": "application/json" }
-        });
+        }));
       }
       const result = await execute({
         schema: this.schema,
@@ -580,17 +848,35 @@ class GraphQLHandler {
       if (result.errors) {
         result.errors = result.errors.map((e) => this.formatError(e));
       }
-      return new Response(JSON.stringify(result), {
+      return this.wrap(new Response(JSON.stringify(result), {
         headers: { "Content-Type": "application/json" }
-      });
+      }));
     } catch (error) {
-      return new Response(JSON.stringify({
+      return this.wrap(new Response(JSON.stringify({
         errors: [this.formatError(error)]
       }), {
         status: 500,
         headers: { "Content-Type": "application/json" }
-      });
+      }));
+    }
+  }
+  buildSecurityRules() {
+    const sec = this.options.security || {};
+    const introspection = this.options.introspection !== false;
+    const disableIntrospection = sec.disableIntrospection ?? !introspection;
+    const rules = [
+      depthLimit(sec.maxDepth ?? DEFAULT_GRAPHQL_SECURITY.maxDepth),
+      complexityLimit({
+        maxComplexity: sec.maxComplexity ?? DEFAULT_GRAPHQL_SECURITY.maxComplexity,
+        fieldCosts: sec.fieldCosts,
+        listFactors: sec.listFactors
+      }),
+      aliasLimit(sec.maxAliases ?? DEFAULT_GRAPHQL_SECURITY.maxAliases)
+    ];
+    if (disableIntrospection) {
+      rules.push(blockIntrospection());
     }
+    return rules;
   }
   formatError(error) {
     if (this.options.formatError) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galaxy-stack/orbit-graphql-federation",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "GraphQL Federation support for Orbit framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",