@graphoria/server 0.2.3 → 0.4.0

package/src/authentication/paseto.ts

@@ -1,5 +1,4 @@
-import { timingSafeEqual } from "crypto";
-
+import { PasetoDecryptionFailed, PasetoSignatureInvalid } from "paseto-ts/lib/errors";
 import { decrypt, encrypt, sign, verify } from "paseto-ts/v4";
 
 import type { Env } from "../types/env";
@@ -8,6 +7,7 @@ import type { TokenRepository } from "./tokenRepository";
 import type { TokenGenerationParameters, TokenOptions, TokenResponse, TokenService } from "./types";
 
 import { parseDurationToSeconds, toPasetoDuration } from "./duration";
+import { matchesAnySecret } from "./secrets";
 import { createTokenRepository } from "./tokenRepository";
 import { logger } from "../logging";
 
@@ -15,18 +15,6 @@ import { logger } from "../logging";
 const ACCESS_TOKEN_AUDIENCE = "access";
 const REFRESH_TOKEN_AUDIENCE = "refresh";
 
-// Timing-safe string comparison to prevent timing attacks
-const safeCompare = (a: string, b: string): boolean => {
-  try {
-    const bufA = Buffer.from(a);
-    const bufB = Buffer.from(b);
-    if (bufA.length !== bufB.length) return false;
-    return timingSafeEqual(bufA, bufB);
-  } catch {
-    return false;
-  }
-};
-
 type PasetoPayload = {
   sub: string;
   role: string;
@@ -56,7 +44,12 @@ export const createPASETOService = (
 ): TokenService => {
   const tokenRepository = tokenRepositoryOverride ?? createTokenRepository(env.cache.redisUrl);
 
-  // Token creation and verification functions based on mode
+  // In local mode the first key encrypts and every key decrypts. In public
+  // mode the secret key signs and every public key verifies. Either way a
+  // rotation can overlap.
+  const verifyingKeys = mode === "local" ? env.paseto.localKeys : env.paseto.publicKeys;
+  const signingKey = mode === "local" ? env.paseto.localKeys[0] : env.paseto.secretKey;
+
   const createPasetoToken = async (
     payload: Record<string, unknown>,
     expiry: string,
@@ -66,19 +59,37 @@ export const createPASETOService = (
       exp: toPasetoDuration(expiry),
     };
 
+    if (!signingKey) throw new Error("No PASETO key configured");
     if (mode === "local") {
-      return encrypt(env.paseto.localKey!, pasetoPayload);
+      return encrypt(signingKey, pasetoPayload);
     }
-    return sign(env.paseto.secretKey!, pasetoPayload);
+    return sign(signingKey, pasetoPayload);
   };
 
   const verifyPasetoToken = async (token: string): Promise<PasetoPayload> => {
-    if (mode === "local") {
-      const { payload } = await decrypt<PasetoPayload>(env.paseto.localKey!, token);
-      return payload;
+    let lastError: unknown = new Error("No PASETO key configured");
+    for (const [index, key] of verifyingKeys.entries()) {
+      try {
+        const { payload } =
+          mode === "local"
+            ? await decrypt<PasetoPayload>(key, token)
+            : await verify<PasetoPayload>(key, token);
+        if (index > 0) {
+          logger("auth")
+            .child({ strategy: "paseto" })
+            .debug({ index }, "token verified with a previous key");
+        }
+        return payload;
+      } catch (error) {
+        // Only a key mismatch means "try the next key"; a claim failure came
+        // from the key that did produce this token.
+        const keyMismatch =
+          error instanceof PasetoDecryptionFailed || error instanceof PasetoSignatureInvalid;
+        if (!keyMismatch) throw error;
+        lastError = error;
+      }
     }
-    const { payload } = await verify<PasetoPayload>(env.paseto.publicKey!, token);
-    return payload;
+    throw lastError;
   };
 
   const createToken = async (
@@ -132,8 +143,7 @@ export const createPASETOService = (
     authHeader: string | null,
     adminSecretHeader: string | null,
   ): Promise<string> => {
-    if (env.admin.secret && adminSecretHeader && safeCompare(adminSecretHeader, env.admin.secret))
-      return env.superadmin.role;
+    if (matchesAnySecret(adminSecretHeader, env.admin.secrets)) return env.superadmin.role;
 
     if (!authHeader) return env.anonymousRole;
 
@@ -153,8 +163,8 @@ export const createPASETOService = (
     authHeader: string | null,
     adminSecretHeader: string | null,
   ): Promise<SessionContext> => {
-    if (env.admin.secret && adminSecretHeader && safeCompare(adminSecretHeader, env.admin.secret))
-      return { sub: "superadmin", role: env.superadmin.role };
+    if (matchesAnySecret(adminSecretHeader, env.admin.secrets))
+      return { sub: "superadmin", role: env.superadmin.role, authMethod: "admin_secret" };
 
     if (!authHeader || !authHeader.startsWith("Bearer "))
       return { sub: "anonymous", role: env.anonymousRole };

package/src/authentication/secrets.ts

@@ -0,0 +1,30 @@
+import { timingSafeEqual } from "crypto";
+
+import { logger } from "../logging";
+
+// Timing-safe string comparison to prevent timing attacks
+export const safeCompare = (a: string, b: string): boolean => {
+  try {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length) return false;
+    return timingSafeEqual(bufA, bufB);
+  } catch {
+    return false;
+  }
+};
+
+/**
+ * True when `candidate` equals any entry of a rotating secret set. The first
+ * entry is the current secret; a match further along means a caller still
+ * holds a previous one, which is logged so the operator knows when it is safe
+ * to drop it.
+ */
+export const matchesAnySecret = (candidate: string | null, secrets: string[]): boolean => {
+  if (!candidate) return false;
+
+  const index = secrets.findIndex((secret) => safeCompare(candidate, secret));
+  if (index > 0) logger("auth").debug({ index }, "matched a previous secret");
+
+  return index >= 0;
+};

package/src/config/types/auth.ts

@@ -137,6 +137,13 @@ export const RolePermissionZod = z
       .union([z.array(z.string()), z.literal("ALL")])
       .optional()
       .default([]),
+    /** Request ceiling for this role, overriding RATE_LIMIT_MAX. 0 disables it */
+    rateLimit: z
+      .strictObject({
+        max: z.number().int().min(0),
+        windowMs: z.number().int().positive().optional(),
+      })
+      .optional(),
   })
   .default({
     tables: [],

package/src/config/types/db.ts

@@ -168,11 +168,18 @@ export const MSSQLConnectionOptionsZod = z.strictObject({
       min: z.number().int().nonnegative().default(0),
       /** Maximum time in seconds a connection can be idle before being closed */
       idleTimeout: z.number().nonnegative().default(30),
+      /**
+       * Maximum time in seconds to wait for a free connection when the pool is
+       * saturated. Without a bound, a slow-query storm queues callers instead of
+       * failing them. Bun's SQL driver exposes no equivalent, so this is MSSQL only.
+       */
+      acquireTimeout: z.number().positive().default(30),
     })
     .default({
       max: 10,
       min: 0,
       idleTimeout: 30,
+      acquireTimeout: 30,
     }),
   /** Maximum time in seconds to wait when establishing a connection */
   connectionTimeout: z.number().nonnegative().default(30),

package/src/config/types/operation.ts

@@ -108,6 +108,8 @@ export const OperationZod = z
     rest: OperationRestConfigZod.optional(),
     graphql: OperationGraphQLConfigZod.optional().default({ enabled: true }),
     cache: OperationCacheConfigZod.optional(),
+    /** Statement timeout in milliseconds. Overrides QUERY_TIMEOUT_MS for this operation. */
+    timeout: z.number().int().positive().optional(),
   })
   .refine(
     (operation) => {
@@ -249,6 +251,8 @@ export type BaseOperation<TInput, TOutput, TInitData> = {
   graphql?: OperationGraphQLConfig;
   /** Cache configuration */
   cache?: OperationCacheConfig;
+  /** Statement timeout in milliseconds. Overrides `QUERY_TIMEOUT_MS` for this operation. */
+  timeout?: number;
 };
 
 /**

package/src/configuration/crossReferences.ts

@@ -0,0 +1,340 @@
+import { isString } from "es-toolkit/compat";
+
+import type { Configuration } from "../types/configuration";
+import type { ProcedureResolver, TableResolver } from "../types/db";
+
+import { FILTER_OPERATORS } from "../config/types/auth";
+import { columnFieldName } from "../databases/transformers/graphqlName";
+
+/**
+ * Everything the configuration is allowed to point at that only exists once the
+ * databases have been introspected.
+ */
+export type KnownEntities = {
+  tables: TableResolver[];
+  storedProcedures: ProcedureResolver[];
+  /**
+   * Every table name a database reported, keyed by database name and recorded
+   * *before* exclusions are applied. `excludedTables` names are absent from
+   * `tables` by construction, so they cannot be resolved against it.
+   */
+  tableNamesByDatabase: Record<string, string[]>;
+};
+
+const OPERATORS = new Set<string>(FILTER_OPERATORS);
+
+const isOperatorObject = (value: object): boolean =>
+  Object.keys(value).some((key) => OPERATORS.has(key));
+
+const editDistance = (a: string, b: string): number => {
+  if (a === b) return 0;
+  if (!a.length) return b.length;
+  if (!b.length) return a.length;
+
+  let previous = Array.from({ length: b.length + 1 }, (_, i) => i);
+
+  for (let i = 1; i <= a.length; i++) {
+    const current = [i];
+
+    for (let j = 1; j <= b.length; j++) {
+      current[j] = Math.min(
+        previous[j]! + 1,
+        current[j - 1]! + 1,
+        previous[j - 1]! + (a[i - 1] === b[j - 1] ? 0 : 1),
+      );
+    }
+
+    previous = current;
+  }
+
+  return previous[b.length]!;
+};
+
+/**
+ * Closest candidate, or nothing when none is close enough. The budget — half the
+ * misspelling's length, never more than three edits — is what keeps the hint
+ * honest: without it every unresolved name draws a confident suggestion picked
+ * from whatever happened to be shortest.
+ */
+const nearest = (value: string, candidates: readonly string[]): string | undefined => {
+  const needle = value.toLowerCase();
+
+  let best: string | undefined;
+  let bestDistance = Number.POSITIVE_INFINITY;
+
+  for (const candidate of candidates) {
+    const distance = editDistance(needle, candidate.toLowerCase());
+
+    if (distance < bestDistance) {
+      bestDistance = distance;
+      best = candidate;
+    }
+  }
+
+  const budget = Math.min(3, Math.max(1, Math.floor(needle.length / 2)));
+
+  return best !== undefined && bestDistance <= budget ? best : undefined;
+};
+
+const segment = (key: string): string =>
+  /^[A-Za-z_][A-Za-z0-9_]*$/.test(key) ? `.${key}` : `[${JSON.stringify(key)}]`;
+
+const unresolved = (
+  path: string,
+  kind: string,
+  value: string,
+  candidates: readonly string[],
+): string => {
+  const suggestion = nearest(value, candidates);
+
+  return `${path} — no ${kind} named ${JSON.stringify(value)}${
+    suggestion ? ` (did you mean ${JSON.stringify(suggestion)}?)` : ""
+  }`;
+};
+
+/**
+ * Column references are matched case-insensitively against both the GraphQL
+ * field name and the raw SQL name. That is looser than the query builder, which
+ * compares field names exactly — deliberately so. A boot-blocking check that is
+ * stricter than the runtime would refuse configurations that work today; one
+ * that is slightly looser still catches every genuine typo.
+ */
+const columnNames = (table: TableResolver): string[] =>
+  table.columns.flatMap((column) => {
+    const field = columnFieldName(column);
+
+    return field === column.name ? [field] : [field, column.name];
+  });
+
+const hasColumn = (table: TableResolver, name: string): boolean =>
+  columnNames(table).some((candidate) => candidate.toLowerCase() === name.toLowerCase());
+
+/** Table names reachable from `table` through a relation, in either direction. */
+const relatedTableNames = (table: TableResolver): string[] => [
+  ...table.relationships.map((fk) => fk.toResolverName),
+  ...table.relationshipsReversed.map((fk) => fk.fromResolverName),
+];
+
+const collectListErrors = (
+  path: string,
+  kind: string,
+  permission: "ALL" | string[] | undefined,
+  candidates: readonly string[],
+): string[] => {
+  if (!Array.isArray(permission)) return [];
+
+  const known = new Set(candidates.map((name) => name.toLowerCase()));
+
+  return permission
+    .filter((name) => !known.has(name.toLowerCase()))
+    .map((name) => unresolved(`${path}[${JSON.stringify(name)}]`, kind, name, candidates));
+};
+
+/**
+ * Every name a configuration points at that resolves to nothing, with the config
+ * path that carries it. Returns them all rather than throwing on the first, so a
+ * misconfigured deployment is fixed in one pass.
+ *
+ * A permission naming something that does not exist fails closed — the role
+ * simply loses the entity — which is why these never surfaced on their own: the
+ * rule the operator wrote silently does not apply.
+ */
+export const collectCrossReferenceErrors = (
+  configuration: Configuration,
+  known: KnownEntities,
+): string[] => {
+  const errors: string[] = [];
+
+  const tableNames = known.tables.map((table) => table.resolverName);
+  const tablesByName = new Map(
+    known.tables.map((table) => [table.resolverName.toLowerCase(), table]),
+  );
+  const procedureNames = known.storedProcedures.map((procedure) => procedure.name);
+  const queueNames = configuration.queues.map((queue) => queue.name);
+  const operationNames = Object.keys(configuration.operations);
+  const remoteSchemaNames = (configuration.remoteSchemas ?? []).map((remote) => remote.name);
+  const remoteRESTNames = (configuration.remoteREST ?? []).map((remote) => remote.name);
+
+  const collectFilterErrors = (
+    filter: object,
+    table: TableResolver,
+    path: string,
+    visited: ReadonlySet<string>,
+  ): void => {
+    for (const [key, value] of Object.entries(filter) as [string, unknown][]) {
+      const keyPath = `${path}${segment(key)}`;
+
+      // Mirrors buildConditions: an object carrying a known operator is a column
+      // filter, anything else is a nested relation.
+      if (typeof value !== "object" || value === null || isOperatorObject(value)) {
+        if (!hasColumn(table, key)) {
+          errors.push(
+            unresolved(keyPath, `column on table ${JSON.stringify(table.resolverName)}`, key, [
+              ...columnNames(table),
+              ...relatedTableNames(table),
+            ]),
+          );
+        }
+
+        continue;
+      }
+
+      const related = relatedTableNames(table);
+      const nested = related.includes(key) ? tablesByName.get(key.toLowerCase()) : undefined;
+
+      if (!nested) {
+        errors.push(
+          unresolved(
+            keyPath,
+            `column or relation on table ${JSON.stringify(table.resolverName)}`,
+            key,
+            [...columnNames(table), ...related],
+          ),
+        );
+
+        continue;
+      }
+
+      // A filter that walks back into a table already on the path would recurse
+      // forever; the runtime would too, so stop rather than report it here.
+      if (visited.has(nested.resolverName)) continue;
+
+      collectFilterErrors(value, nested, keyPath, new Set([...visited, nested.resolverName]));
+    }
+  };
+
+  for (const [role, permissions] of Object.entries(configuration.auth.permissions ?? {})) {
+    const base = `auth.permissions${segment(role)}`;
+
+    errors.push(
+      ...collectListErrors(
+        `${base}.storedProcedures`,
+        "stored procedure",
+        permissions.storedProcedures,
+        procedureNames,
+      ),
+      ...collectListErrors(`${base}.queues`, "queue", permissions.queues, queueNames),
+      ...collectListErrors(
+        `${base}.operations`,
+        "operation",
+        permissions.operations,
+        operationNames,
+      ),
+      ...collectListErrors(
+        `${base}.remoteSchemas`,
+        "remote schema",
+        permissions.remoteSchemas,
+        remoteSchemaNames,
+      ),
+      ...collectListErrors(
+        `${base}.remoteREST`,
+        "remote REST API",
+        permissions.remoteREST,
+        remoteRESTNames,
+      ),
+    );
+
+    if (isString(permissions.tables)) continue;
+
+    for (const [tableKey, tablePermission] of Object.entries(permissions.tables)) {
+      const tablePath = `${base}.tables${segment(tableKey)}`;
+      const table = tablesByName.get(tableKey.toLowerCase());
+
+      if (!table) {
+        errors.push(unresolved(tablePath, "table or view", tableKey, tableNames));
+
+        continue;
+      }
+
+      if (!isString(tablePermission.columns)) {
+        for (const column of tablePermission.columns) {
+          if (!hasColumn(table, column)) {
+            errors.push(
+              unresolved(
+                `${tablePath}.columns[${JSON.stringify(column)}]`,
+                "column",
+                column,
+                columnNames(table),
+              ),
+            );
+          }
+        }
+      }
+
+      for (const [index, orderBy] of (tablePermission.orderBy ?? []).entries()) {
+        if (!hasColumn(table, orderBy.column)) {
+          errors.push(
+            unresolved(
+              `${tablePath}.orderBy[${index}].column`,
+              "column",
+              orderBy.column,
+              columnNames(table),
+            ),
+          );
+        }
+      }
+
+      if (tablePermission.filter) {
+        collectFilterErrors(
+          tablePermission.filter,
+          table,
+          `${tablePath}.filter`,
+          new Set([table.resolverName]),
+        );
+      }
+    }
+  }
+
+  for (const [index, queue] of configuration.queues.entries()) {
+    const topicNames = Object.keys(queue.topics);
+    const base = `queues[${index}]`;
+
+    for (const [group, entries] of [
+      ["publishers", queue.publishers],
+      ["subscribers", queue.subscribers],
+    ] as const) {
+      for (const [key, entry] of Object.entries(entries)) {
+        if (!topicNames.includes(entry.topic)) {
+          errors.push(
+            unresolved(`${base}.${group}${segment(key)}.topic`, "topic", entry.topic, topicNames),
+          );
+        }
+      }
+    }
+  }
+
+  for (const [index, database] of configuration.enabledDatabases.entries()) {
+    if (!database.schema) continue;
+
+    const introspected = known.tableNamesByDatabase[database.name] ?? [];
+    const base = `databases[${index}].schema`;
+
+    errors.push(
+      ...collectListErrors(
+        `${base}.excludedTables`,
+        "table or view",
+        database.schema.excludedTables,
+        introspected,
+      ),
+    );
+
+    // Exact, unlike every other name here, because the override lookup itself is
+    // exact — two tables can differ only in case, and picking one of them for a
+    // key that matches both would be a guess. A mis-cased key is reported rather
+    // than quietly resolved.
+    for (const tableKey of Object.keys(database.schema.database)) {
+      if (!introspected.includes(tableKey)) {
+        errors.push(
+          unresolved(
+            `${base}.database${segment(tableKey)}`,
+            "table or view",
+            tableKey,
+            introspected,
+          ),
+        );
+      }
+    }
+  }
+
+  return errors;
+};

package/src/configuration/getSchemas/mergeEntities/index.ts

@@ -7,23 +7,6 @@ import type { TypedOperation } from "../../../types/zod/operation";
 
 import { EntitySource, createResolverEntry } from "../../../types/resolver";
 import { columnFieldName } from "../../../databases/transformers/graphqlName";
-import { SqlTypeCategory, categorizeSqlType } from "../../../databases/sqlTypeUtils";
-
-const dataTypeToOpenApiType = (dataType: string): string => {
-  const category = categorizeSqlType(dataType);
-
-  switch (category) {
-    case SqlTypeCategory.INTEGER:
-    case SqlTypeCategory.FLOAT:
-      return "number";
-    case SqlTypeCategory.BOOLEAN:
-      return "boolean";
-    case SqlTypeCategory.DATE_TIME:
-    case SqlTypeCategory.STRING:
-    default:
-      return "string";
-  }
-};
 
 export const mergeEntities = (
   entityOfRole: EntitiesOfRole,
@@ -236,15 +219,6 @@ export const mergeEntities = (
      */
     columnSqlName: (table: string, fieldName: string): string =>
       queriesMap[table]?.columns.find((c) => columnFieldName(c) === fieldName)?.name ?? fieldName,
-    getColumnTypeForOpenApi: (table: string, column: string) => {
-      const tableObj = queriesMap[table];
-
-      const columnObj = tableObj?.columns.find((c) => c.name === column);
-
-      if (!columnObj) return "string";
-
-      return dataTypeToOpenApiType(columnObj.dataType);
-    },
   };
 };
 

package/src/configuration/getSchemas/type-definition-generator/index.ts

@@ -103,7 +103,7 @@ export const generateTableType = (mergedEntities: MergedEntities) =>
           lj(
             relationshipsReversed,
             ({ fromResolverName, fromInternalName }) =>
-              `${fromResolverName}(where: ${fromInternalName}WhereInput, orderBy: [${fromInternalName}OrderByInput]): [${fromInternalName}]`,
+              `${fromResolverName}(where: ${fromInternalName}WhereInput, orderBy: [${fromInternalName}OrderByInput], limit: Int, offset: Int): [${fromInternalName}]`,
           ),
         ])}
       }

package/src/configuration/gql/buildExecute.ts

@@ -36,7 +36,7 @@ export const buildExecute = (roles: RolesWithGqlHandler, defaultRole: string) =>
     if (gql.isIntrospectionQuery(query)) return gql.introspectionResult;
     if (gql.isNoDataQuery(query)) return gql.noDataResult;
 
-    const { hasErrors, validationErrors } = gql.hasErrors(query);
+    const { hasErrors, validationErrors } = gql.hasErrors(query, { variables });
 
     if (hasErrors) {
       return {

package/src/configuration/gql/gqlAuthOperations.ts

@@ -5,6 +5,7 @@ import type { SessionContext } from "../../utils/sessionVariables";
 
 import { resolveVariableRef } from "../../analyzeQuery/resolveVariables";
 import { checkUserCredentials } from "../../databases";
+import { actorFromSession, audit } from "../../logging/audit";
 import { getTokenService } from "../../singletons/authentication";
 
 // Handle auth mutations: auth_login / auth_refresh / auth_logout
@@ -35,9 +36,23 @@ export const handleAuthMutation = async (
       passwordValue.toString(),
     );
 
+    const actor = { type: "credentials", sub: usernameValue.toString() } as const;
     if (!result.valid) {
+      audit().emit({
+        action: "auth.login",
+        outcome: "failure",
+        actor,
+        target: { kind: "auth", via: "graphql" },
+        reason: "Invalid username or password",
+      });
       throw new Error("Invalid username or password");
     }
+    audit().emit({
+      action: "auth.login",
+      outcome: "success",
+      actor,
+      target: { kind: "auth", via: "graphql", role: result.role },
+    });
 
     const data = await getTokenService().createTokenPair({
       sub: usernameValue.toString(),
@@ -104,9 +119,11 @@ export const handleAuthMutation = async (
 
   if (field.name === "auth_logout") {
     const tokenService = getTokenService();
+    const revoked: string[] = [];
 
     if (session?.jti) {
       await tokenService.revoke(session.jti);
+      revoked.push(session.jti);
     }
 
     const refreshCookie = req?.cookies?.get("refresh_token");
@@ -116,6 +133,7 @@ export const handleAuthMutation = async (
           audience: "refresh",
         });
         await tokenService.revoke(refreshPayload.jti);
+        revoked.push(refreshPayload.jti);
       } catch {
         // tampered or expired cookie — nothing to revoke
       }
@@ -125,6 +143,14 @@ export const handleAuthMutation = async (
       req.cookies.delete("refresh_token");
     }
 
+    if (revoked.length > 0) {
+      audit().emit({
+        action: "auth.logout",
+        actor: actorFromSession(session),
+        target: { kind: "auth", via: "graphql", revoked },
+      });
+    }
+
     return {
       data: {
         [field.alias || field.name]: true,