@graphoria/server 0.1.0

package/src/configuration/getSchemas/type-definition-generator/index.ts

@@ -0,0 +1,511 @@
+import type { OpenAPIV3_1 } from "openapi-types";
+
+import { SqlTypeCategory, categorizeSqlType, isNumericType } from "../../../databases/sqlTypeUtils";
+import { convertFromZod } from "../../rest/openApiErrors";
+import { type MergedEntities } from "../mergeEntities";
+
+// Map JSON Schema type to GraphQL type
+export const mapJSONSchemaToGraphQLType = (schema: OpenAPIV3_1.SchemaObject): string => {
+  if (!schema) return "String";
+
+  // Handle arrays
+  if (schema.type === "array") {
+    const itemsSchema = schema.items as OpenAPIV3_1.SchemaObject | undefined;
+    const itemType = itemsSchema ? mapJSONSchemaToGraphQLType(itemsSchema) : "String";
+    return `[${itemType}]`;
+  }
+
+  // Handle basic types
+  switch (schema.type) {
+    case "integer":
+      return "Int";
+    case "number":
+      return "Float";
+    case "boolean":
+      return "Boolean";
+    case "string":
+    default:
+      return "String";
+  }
+};
+
+// Map SQL data types to GraphQL types
+export const mapSQLTypeToGraphQLType = (sqlType: string | null): string => {
+  if (!sqlType) return "String";
+
+  const category = categorizeSqlType(sqlType);
+
+  switch (category) {
+    case SqlTypeCategory.INTEGER:
+      return "Int";
+    case SqlTypeCategory.FLOAT:
+      return "Float";
+    case SqlTypeCategory.BOOLEAN:
+      return "Boolean";
+    case SqlTypeCategory.DATE_TIME:
+    case SqlTypeCategory.STRING:
+    default:
+      return "String";
+  }
+};
+
+// Map SQL data types to condition types
+export const mapSQLTypeToConditionType = (sqlType: string): string => {
+  const category = categorizeSqlType(sqlType);
+
+  switch (category) {
+    case SqlTypeCategory.INTEGER:
+      return "IntCondition";
+    case SqlTypeCategory.FLOAT:
+      return "FloatCondition";
+    case SqlTypeCategory.BOOLEAN:
+      return "BooleanCondition";
+    case SqlTypeCategory.DATE_TIME:
+    case SqlTypeCategory.STRING:
+    default:
+      return "StringCondition";
+  }
+};
+
+// Join elements of an array with a newline character
+export const lj = <T>(keys: T[], cb?: (value: T) => string) => {
+  if (cb) {
+    return keys
+      .map((i) => cb(i))
+      .filter((a) => a.trim())
+      .join("\n");
+  }
+
+  return keys.filter((a) => (a as string).trim()).join("\n");
+};
+
+// Render an SDL block-string description, escaping any embedded triple-quote.
+const sdlDesc = (description?: string | null): string =>
+  description ? `"""${description.replaceAll('"""', '\\"""')}"""\n` : "";
+
+export const generateTableType = (mergedEntities: MergedEntities) =>
+  lj(
+    mergedEntities.tables,
+    ({ resolverName, columns, relationships, relationshipsReversed, tableDescription }) => `
+      ${sdlDesc(tableDescription)}type ${`${resolverName}`} {
+        ${lj([
+          lj(
+            columns,
+            ({ name, dataType, isNullable, description }) =>
+              `${sdlDesc(description)}${name}: ${mapSQLTypeToGraphQLType(dataType)}${isNullable ? "" : "!"}`,
+          ),
+          lj(
+            relationships,
+            ({ toResolverName, toInternalName }) =>
+              `${toResolverName}(where: ${toInternalName}WhereInput): ${toInternalName}`,
+          ),
+          lj(
+            relationshipsReversed,
+            ({ fromResolverName, fromInternalName }) =>
+              `${fromResolverName}(where: ${fromInternalName}WhereInput, orderBy: [${fromInternalName}OrderByInput]): [${fromInternalName}]`,
+          ),
+        ])}
+      }
+    `,
+  );
+
+export const generateWhereInputType = (mergedEntities: MergedEntities) =>
+  lj(
+    mergedEntities.tables.map(
+      ({ resolverName, columns, relationships, relationshipsReversed }) => `
+        input ${resolverName}WhereInput {
+          ${lj([
+            lj(columns, ({ name, dataType }) => `${name}: ${mapSQLTypeToConditionType(dataType)}`),
+            lj(
+              relationships,
+              ({ toResolverName, toInternalName }) =>
+                `${toResolverName}: ${toInternalName}WhereInput`,
+            ),
+            lj(
+              relationshipsReversed,
+              ({ fromResolverName, fromInternalName }) =>
+                `${fromResolverName}: ${fromInternalName}WhereInput`,
+            ),
+          ])}
+        }
+      `,
+    ),
+  );
+
+// Generate OrderByInput type for each table
+export const generateOrderByInputType = (mergedEntities: MergedEntities) =>
+  lj(
+    mergedEntities.tables.map(
+      ({ internalName, columns }) => `
+      input ${internalName}OrderByInput {
+        ${lj(columns, ({ name }) => `${name}: OrderByEnum`)}
+      }`,
+    ),
+  );
+
+const aggTypes: string[] = ["Min", "Max", "Sum", "Avg"];
+
+// Generate aggregation types for each table
+export const generateAggregationTypes = (mergedEntities: MergedEntities) => {
+  const aggregationTypes = lj(mergedEntities.tables, ({ resolverName, columns }) => {
+    const numericColumns = columns.filter((col) => isNumericType(col.dataType));
+
+    return `
+      ${
+        numericColumns.length
+          ? aggTypes
+              .map(
+                (agg) =>
+                  `
+                  type ${resolverName}${agg} {
+                    ${lj(numericColumns, ({ name }) => `${name}: ${mapSQLTypeToGraphQLType(columns.find((c) => c.name === name)?.dataType || "")}`)}
+                  }
+                `,
+              )
+              .join("\n")
+          : ""
+      }
+      
+      type ${resolverName}GroupBy {
+        key: ${resolverName}
+        count: Int
+        ${
+          numericColumns.length
+            ? aggTypes.map((agg) => `${agg.toLowerCase()}: ${resolverName}${agg}`).join("\n")
+            : ""
+        }
+        items: [${resolverName}]
+      }
+      
+      enum ${resolverName}GroupByKeys {
+        ${columns.map((c) => c.name).join("\n")}
+      }
+      `;
+  });
+
+  return aggregationTypes;
+};
+
+export const generateAuthTypes = (hasRoles: boolean = false) =>
+  hasRoles
+    ? `
+  type AuthUser {
+    id: Int
+    username: String
+    role: String
+  }
+  type AuthToken {
+    access_token: String
+    expires_in: Int
+    role: String
+  }
+  `
+    : "";
+
+export const generateQueryType = (mergedEntities: MergedEntities, hasRoles: boolean = false) => {
+  const hasRemoteQueries = mergedEntities.remoteSchemas.some((rs) => rs.queryFields.length > 0);
+
+  if (!mergedEntities.tables.length && !hasRoles && !hasRemoteQueries && !mergedEntities.ai)
+    return `type Query {
+    _no_data: String
+  }`;
+
+  return `
+    type Query {
+      ${lj(
+        mergedEntities.tables,
+        ({ resolverName }) =>
+          `
+            ${resolverName}(where: ${resolverName}WhereInput, orderBy: [${resolverName}OrderByInput], limit: Int, offset: Int): [${resolverName}!]!
+            ${resolverName}_single(where: ${resolverName}WhereInput): ${resolverName}!
+            ${resolverName}_aggregate(where: ${resolverName}WhereInput, orderBy: [${resolverName}OrderByInput], groupBy: [${resolverName}GroupByKeys]!, limit: Int, offset: Int): [${resolverName}GroupBy!]!
+          `,
+      )}
+      ${
+        hasRoles
+          ? `
+              auth_me: AuthUser
+            `
+          : ""
+      }
+      ${mergedEntities.ai ? "ask(prompt: String!): String!" : ""}
+      ${mergedEntities.remoteSchemas.map((rs) => rs.queryFields.map((f) => f.sdl).join("\n      ")).join("\n      ")}
+    }
+`;
+};
+
+export const generateSubscriptionType = (mergedEntities: MergedEntities) => {
+  return `
+    ${
+      mergedEntities.tables.length || mergedEntities.queues.map((q) => q.queues).flat().length
+        ? `
+        type QueueMutationResponse {
+          id: String!
+          message: String!
+        }
+
+        type Subscription {
+          ${lj(
+            mergedEntities.tables,
+            ({ resolverName }) =>
+              `
+                ${resolverName}(where: ${resolverName}WhereInput, orderBy: [${resolverName}OrderByInput], limit: Int, offset: Int): [${resolverName}!]!
+                ${resolverName}_single(where: ${resolverName}WhereInput): ${resolverName}!
+                ${resolverName}_aggregate(where: ${resolverName}WhereInput, orderBy: [${resolverName}OrderByInput], groupBy: [${resolverName}GroupByKeys], limit: Int, offset: Int): [${resolverName}!]!
+              `,
+          )}
+          ${lj(mergedEntities.queues, (queue) => queue.queues.map((q) => `${queue.name}_${q.name}: QueueMutationResponse!`).join("\n"))}
+        }
+    `
+        : ""
+    }`;
+};
+
+const generateGraphQLTypeFromSchema = (
+  schema: OpenAPIV3_1.SchemaObject,
+  typeName: string,
+  collector: string[],
+): string => {
+  if (schema.type === "array") {
+    const items = schema.items as OpenAPIV3_1.SchemaObject | undefined;
+    if (items?.type === "object" && items.properties) {
+      generateGraphQLTypeFromSchema(items, typeName, collector);
+      return `[${typeName}]`;
+    }
+    return `[${mapJSONSchemaToGraphQLType(items ?? {})}]`;
+  }
+
+  if (schema.type === "object" && schema.properties) {
+    const fields = Object.entries(schema.properties).map(([key, propSchema]) => {
+      const prop = propSchema as OpenAPIV3_1.SchemaObject;
+      const isRequired = schema.required?.includes(key) ?? false;
+      const bang = isRequired ? "!" : "";
+
+      if (prop.type === "object" && prop.properties) {
+        const nestedName = `${typeName}${key}`;
+        generateGraphQLTypeFromSchema(prop, nestedName, collector);
+        return `${key}: ${nestedName}${bang}`;
+      }
+
+      if (prop.type === "array") {
+        const items = prop.items as OpenAPIV3_1.SchemaObject | undefined;
+        if (items?.type === "object" && items.properties) {
+          const nestedName = `${typeName}${key}`;
+          generateGraphQLTypeFromSchema(items, nestedName, collector);
+          return `${key}: [${nestedName}]${bang}`;
+        }
+        return `${key}: ${mapJSONSchemaToGraphQLType(prop)}${bang}`;
+      }
+
+      return `${key}: ${mapJSONSchemaToGraphQLType(prop)}${bang}`;
+    });
+
+    collector.push(`type ${typeName} {\n            ${fields.join("\n            ")}\n          }`);
+    return typeName;
+  }
+
+  return mapJSONSchemaToGraphQLType(schema);
+};
+
+export const generateMutationType = (mergedEntities: MergedEntities, hasRoles: boolean = false) => {
+  const authQueries = hasRoles
+    ? `
+      auth_login(username: String, password: String): AuthToken
+      auth_refresh: AuthToken
+      auth_logout: Boolean
+    `
+    : "";
+
+  const atLeastOneSP = mergedEntities.storedProcedures.length > 0;
+
+  const publishers = mergedEntities.queues
+    .map((q) => q.exchanges.map((e) => e.publishers).flat())
+    .flat();
+
+  const atLeastOneQueue = mergedEntities.queues.length > 0 && publishers.length > 0;
+
+  // Filter operations that have GraphQL enabled (default: true)
+  const operationsWithMutations = Object.entries(mergedEntities.operations)
+    .filter(
+      ([, operationConfig]) =>
+        operationConfig.graphql.enabled && (operationConfig.rest?.method || "GET") !== "GET",
+    )
+    .map(([operationName, operationConfig]) => {
+      const inputShape = convertFromZod(operationConfig.input);
+      const outputShape = convertFromZod(operationConfig.output);
+
+      const hasInputProperties =
+        inputShape.type === "object" &&
+        inputShape.properties &&
+        Object.keys(inputShape.properties).length > 0;
+
+      const hasOutputProperties =
+        outputShape.type === "object" &&
+        outputShape.properties &&
+        Object.keys(outputShape.properties).length > 0;
+
+      const mutationName = operationConfig.graphql?.name ?? operationName;
+
+      const output = hasOutputProperties ? `${mutationName}Output` : "Boolean";
+
+      return {
+        input: hasInputProperties
+          ? `
+          input ${mutationName}Input {
+            ${Object.entries(inputShape.properties ?? {})
+              .map(
+                ([key, value]) =>
+                  `${key}: ${mapJSONSchemaToGraphQLType(value as OpenAPIV3_1.SchemaObject)}${inputShape.required?.includes(key) ? "!" : ""}`,
+              )
+              .join("\n")}
+          }
+        `
+          : "",
+        output: (() => {
+          if (!hasOutputProperties) return "";
+          const collector: string[] = [];
+          generateGraphQLTypeFromSchema(outputShape, `${mutationName}Output`, collector);
+          return collector.join("\n");
+        })(),
+        resolver: hasInputProperties
+          ? `
+          ${mutationName}(input: ${mutationName}Input!): ${output}!
+        `
+          : `
+          ${mutationName}: ${output}!
+        `,
+      };
+    });
+
+  const hasOperations = operationsWithMutations.length > 0;
+
+  const remoteMutationSDLs = mergedEntities.remoteSchemas
+    .filter((rs) => rs.mutationFields.length > 0)
+    .map((rs) => rs.mutationFields.map((f) => f.sdl).join("\n          "))
+    .join("\n          ");
+
+  const hasRemoteMutations = remoteMutationSDLs.length > 0;
+
+  return atLeastOneSP || atLeastOneQueue || authQueries || hasOperations || hasRemoteMutations
+    ? `
+        ${operationsWithMutations.map((a) => a.input).join("\n")}
+        ${operationsWithMutations.map((a) => a.output).join("\n")}
+
+        type Mutation {
+          ${lj(mergedEntities.storedProcedures, ({ resolverName, parameters }) => {
+            const parametersFiltered = parameters.filter((p) => p.name);
+
+            return `${resolverName}${
+              parametersFiltered.length
+                ? `(${lj(
+                    parametersFiltered,
+                    ({ name, dataType }) =>
+                      `${name.replaceAll("@", "")}: ${mapSQLTypeToGraphQLType(dataType)}`,
+                  )})`
+                : ""
+            }: Boolean!`;
+          })}
+
+          ${lj(publishers, ({ resolverName }) => `${resolverName}(data: String!): Boolean!`)}
+          ${operationsWithMutations.map((a) => a.resolver).join("\n")}
+          ${authQueries}
+          ${remoteMutationSDLs}
+        }
+`
+    : "";
+};
+
+const conditionTypes = `
+enum OrderByEnum {
+  ASC
+  DESC
+  ASC_NULLS_FIRST
+  ASC_NULLS_LAST
+  DESC_NULLS_FIRST
+  DESC_NULLS_LAST
+}
+
+input IntCondition {
+  eq: Int
+  neq: Int
+  gt: Int
+  gte: Int
+  lt: Int
+  lte: Int
+  in: [Int]
+  between: [Int]
+  is_null: Boolean
+  not_null: Boolean
+}
+
+input FloatCondition {
+  eq: Float
+  neq: Float
+  gt: Float
+  gte: Float
+  lt: Float
+  lte: Float
+  in: [Float]
+  between: [Float]
+  is_null: Boolean
+  not_null: Boolean
+}
+
+input StringCondition {
+  eq: String
+  neq: String
+  like: String
+  in: [String]
+  is_null: Boolean
+  not_null: Boolean
+}
+
+input BooleanCondition {
+  eq: Boolean
+  neq: Boolean
+  is_null: Boolean
+  not_null: Boolean
+}
+`;
+
+const directiveTypes = `
+directive @uppercase on FIELD
+directive @lowercase on FIELD
+directive @truncate(length: Int!) on FIELD
+directive @default(value: String!) on FIELD
+
+directive @trim on FIELD
+directive @ltrim on FIELD
+directive @rtrim on FIELD
+directive @substring(start: Int!, length: Int!) on FIELD
+directive @replace(find: String!, replaceWith: String!) on FIELD
+directive @concat(with: String!, position: String = "after") on FIELD
+directive @pad(length: Int!, char: String = " ", side: String = "left") on FIELD
+
+directive @dateFormat(format: String!) on FIELD
+
+directive @round(decimals: Int = 0) on FIELD
+directive @ceil on FIELD
+directive @floor on FIELD
+directive @abs on FIELD
+directive @multiply(by: Float!) on FIELD
+directive @divide(by: Float!) on FIELD
+
+directive @when(and: [Boolean!], or: [Boolean!]) on FIELD
+`;
+
+export const generateTypeDefs = (mergedEntities: MergedEntities, hasAuth: boolean = false) =>
+  [
+    mergedEntities.tables.length ? conditionTypes : "",
+    mergedEntities.tables.length ? directiveTypes : "",
+    generateTableType(mergedEntities),
+    generateWhereInputType(mergedEntities),
+    generateOrderByInputType(mergedEntities),
+    generateAggregationTypes(mergedEntities),
+    generateAuthTypes(hasAuth),
+    // Append remote schema type definitions (prefixed types, inputs, enums)
+    ...mergedEntities.remoteSchemas.map((rs) => rs.typeDefsSDL),
+    generateQueryType(mergedEntities, hasAuth),
+    generateSubscriptionType(mergedEntities),
+    generateMutationType(mergedEntities, hasAuth),
+  ].join("\n");

package/src/configuration/gql/buildExecute.ts

@@ -0,0 +1,54 @@
+import type { SessionContext } from "../../utils/sessionVariables";
+import type { HandleGraphQLRequest } from "./handleGraphQLRequestFactory";
+
+export type ExecuteOptions = {
+  role?: string;
+  session?: SessionContext;
+};
+
+type RolesWithGqlHandler = Record<string, { handlers: { gql: HandleGraphQLRequest } }>;
+
+/**
+ * Wrap the per-role GraphQL handlers in a single `execute(query, variables, opts)`
+ * function — the same orchestration the `/graphql` POST route performs (introspection
+ * / no-data short-circuits, validation, dispatch) minus the HTTP layer. Lets callers
+ * run a query in-process without standing up a server.
+ *
+ * @param roles - The analyzed-configuration role map (`analyzedConfiguration.roles`).
+ * @param defaultRole - Role used when `opts.role` is omitted (the server passes its
+ *   superadmin role, so in-process execution runs with full privileges).
+ */
+export const buildExecute = (roles: RolesWithGqlHandler, defaultRole: string) => {
+  return async (
+    query: string,
+    variables: Record<string, unknown> = {},
+    opts: ExecuteOptions = {},
+  ) => {
+    const role = opts.role ?? defaultRole;
+    const roleSchema = roles[role];
+
+    if (!roleSchema) {
+      throw new Error(`Unknown role: ${role}`);
+    }
+
+    const { gql } = roleSchema.handlers;
+
+    if (gql.isIntrospectionQuery(query)) return gql.introspectionResult;
+    if (gql.isNoDataQuery(query)) return gql.noDataResult;
+
+    const { hasErrors, validationErrors } = gql.hasErrors(query);
+
+    if (hasErrors) {
+      return {
+        errors: validationErrors.map((error) => ({
+          message: error.message,
+          locations: error.locations,
+        })),
+      };
+    }
+
+    // No BunRequest in-process: request-dependent features (operation `init`/
+    // `beforeRequest` hooks, header-derived session variables) won't run.
+    return gql.handler(query, variables, undefined, opts.session);
+  };
+};

package/src/configuration/gql/gqlAuthOperations.ts

@@ -0,0 +1,150 @@
+import type { BunRequest } from "bun";
+import type { SelectionAnalysis } from "../../analyzeQuery/types";
+import type { Auth } from "../../types/configuration";
+import type { SessionContext } from "../../utils/sessionVariables";
+
+import { resolveVariableRef } from "../../analyzeQuery/resolveVariables";
+import { checkUserCredentials } from "../../databases";
+import { getTokenService } from "../../singletons/authentication";
+
+// Handle auth mutations: auth_login / auth_refresh / auth_logout
+export const handleAuthMutation = async (
+  field: SelectionAnalysis,
+  variables: Record<string, unknown>,
+  auth: Auth | null,
+  req?: BunRequest,
+  session?: SessionContext,
+): Promise<{ data: object }> => {
+  if (!auth?.enabled) {
+    throw new Error("Authentication is not enabled");
+  }
+
+  if (field.name === "auth_login") {
+    const { username, password } = field.arguments ?? {};
+
+    const usernameValue = resolveVariableRef(variables, username);
+    const passwordValue = resolveVariableRef(variables, password);
+
+    if (!usernameValue || !passwordValue) {
+      throw new Error("Username and password are required");
+    }
+
+    const result = await checkUserCredentials(
+      auth,
+      usernameValue.toString(),
+      passwordValue.toString(),
+    );
+
+    if (!result.valid) {
+      throw new Error("Invalid username or password");
+    }
+
+    const data = await getTokenService().createTokenPair({
+      sub: usernameValue.toString(),
+      role: result.role,
+      claims: result.claims,
+    });
+
+    if (req?.cookies) {
+      // Set the HTTP-only cookie
+      // Implementation to set HTTP-only cookie goes here
+      const cookies = req.cookies;
+
+      cookies.set("refresh_token", data.refresh_token, {
+        httpOnly: true, // Can't be accessed by JS
+        secure: true, // Only sent over HTTPS (disable for localhost dev)
+        sameSite: "strict", // Prevents CSRF
+      });
+    }
+
+    return {
+      data: {
+        [field.alias || field.name]: {
+          access_token: data.access_token,
+          expires_in: data.expires_in,
+          role: result.role,
+        },
+      },
+    };
+  }
+
+  if (field.name === "auth_refresh") {
+    if (req?.cookies) {
+      // Set the HTTP-only cookie
+      // Implementation to set HTTP-only cookie goes here
+      const cookies = req.cookies;
+
+      const tokenValue = cookies.get("refresh_token");
+
+      if (!tokenValue) {
+        throw new Error("Refresh token is required");
+      }
+
+      const result = await getTokenService().refreshAccessToken(tokenValue.toString());
+
+      // Set the HTTP-only cookie
+      // Implementation to set HTTP-only cookie goes here
+      cookies.set("refresh_token", result.refresh_token, {
+        httpOnly: true, // Can't be accessed by JS
+        secure: true, // Only sent over HTTPS (disable for localhost dev)
+        sameSite: "strict", // Prevents CSRF
+      });
+
+      return {
+        data: {
+          [field.alias || field.name]: {
+            access_token: result.access_token,
+            expires_in: result.expires_in,
+            role: result.role,
+          },
+        },
+      };
+    }
+  }
+
+  if (field.name === "auth_logout") {
+    const tokenService = getTokenService();
+
+    if (session?.jti) {
+      await tokenService.revoke(session.jti);
+    }
+
+    const refreshCookie = req?.cookies?.get("refresh_token");
+    if (refreshCookie) {
+      try {
+        const refreshPayload = await tokenService.verifyToken(refreshCookie.toString(), {
+          audience: "refresh",
+        });
+        await tokenService.revoke(refreshPayload.jti);
+      } catch {
+        // tampered or expired cookie — nothing to revoke
+      }
+    }
+
+    if (req?.cookies) {
+      req.cookies.delete("refresh_token");
+    }
+
+    return {
+      data: {
+        [field.alias || field.name]: true,
+      },
+    };
+  }
+
+  return { data: {} };
+};
+
+// Handle the auth_me query — returns { [alias]: { username, role } | null }
+export const handleAuthMeQuery = (
+  field: SelectionAnalysis,
+  session?: SessionContext,
+): Record<string, unknown> => {
+  if (field.name === "auth_me") {
+    const alias = field.alias || field.name;
+    return {
+      [alias]: session?.sub ? { username: session.sub, role: session.role } : null,
+    };
+  }
+  return {};
+};