@graphoria/server 0.2.3 → 0.4.0

package/src/configuration/gql/handleGraphQLRequestFactory.ts

@@ -11,11 +11,13 @@ import type { Auth } from "../../types/configuration";
 import type { SessionContext } from "../../utils/sessionVariables";
 
 import { analyzeQuery } from "../../analyzeQuery";
+import { checkQueryCost } from "../../analyzeQuery/costLimit";
 import { depthLimitRule } from "../../analyzeQuery/depthLimit";
 import { resolveVariableRef, resolveVariables } from "../../analyzeQuery/resolveVariables";
 import { callStoredProcedure, executeQueryJSON, generateSQL } from "../../databases";
 import { proxyRemoteField } from "../../remoteSchemas/proxy";
 import { getAgent } from "../../singletons/ai";
+import { actorFromSession, audit } from "../../logging/audit";
 import { databasesConnections, repositoryMap } from "../../singletons/databases";
 import { env } from "../../singletons/env";
 import { queueManager } from "../../singletons/queues";
@@ -43,7 +45,7 @@ export const handleGraphQLRequestFactory = (
       ) => Promise<{ data: object }>
     >
   > = {
-    [EntitySource.QUEUE_PUBLISHER]: async (field, variables) => {
+    [EntitySource.QUEUE_PUBLISHER]: async (field, variables, _queryAnalysis, _req, session) => {
       const data = resolveVariableRef(variables, field.arguments?.data);
 
       const publisher = entities.queuesMap[field.name];
@@ -52,6 +54,12 @@ export const handleGraphQLRequestFactory = (
         throw new Error(`Queue publisher not found: ${field.name}`);
       }
 
+      audit().emit({
+        action: "queue.publish",
+        actor: actorFromSession(session),
+        target: { kind: "publisher", name: publisher.resolverName },
+      });
+
       return {
         data: {
           [field.alias || field.name]: await queueManager?.sendMessage(
@@ -82,7 +90,7 @@ export const handleGraphQLRequestFactory = (
       const result = await operation.handler(
         {
           databases: databasesConnections,
-          gqlQuery: gql.handler,
+          gqlQuery: operatorQuery,
           queues: queueManager,
           repository: repositoryMap,
         },
@@ -99,7 +107,7 @@ export const handleGraphQLRequestFactory = (
       };
     },
 
-    [EntitySource.STORED_PROCEDURE]: async (field, variables, queryAnalysis) => {
+    [EntitySource.STORED_PROCEDURE]: async (field, variables) => {
       const sp = entities.mutationsMap[field.name];
 
       if (!sp) {
@@ -115,7 +123,6 @@ export const handleGraphQLRequestFactory = (
 
       const result = await callStoredProcedure(
         sp,
-        queryAnalysis.operations[0].variables ?? [],
         argumentsReplaced as Record<string, string | number | boolean | null>,
       );
 
@@ -162,6 +169,8 @@ export const handleGraphQLRequestFactory = (
 
   const queryCache = new LRUCache<string, CachedQuery>({ max: 1000 });
 
+  const pageLimits = { defaultPageSize: env.defaultPageSize, maxPageSize: env.maxPageSize };
+
   // undefined = unparseable query (never cached)
   const getCacheEntry = (query: string): CachedQuery | undefined => {
     const hit = queryCache.get(query);
@@ -207,20 +216,54 @@ export const handleGraphQLRequestFactory = (
     // Return the introspection result for clients like GraphiQL or Apollo Client
     introspectionResult: { data: gqlEntities.introspection },
     noDataResult: { data: { _no_data: "No data available" } },
-    hasErrors: (query: string) => {
+    // `enforceDepthLimit: false` and `enforceCostLimit: false` are for
+    // operator-authored queries (REST operations), which are config, not
+    // attacker input. The depth verdict is never cached under them: the cache is
+    // keyed on query text alone, so storing a depth-free verdict would serve a
+    // caller sending the same text over the wire.
+    //
+    // Two flags rather than one because they are exempted for the same reason
+    // but enforced in different places — the depth rule inside the memoised
+    // `validate`, the cost check after it. Overloading one flag would leave the
+    // REST call sites reading as if they only exempted depth.
+    hasErrors: (
+      query: string,
+      options?: {
+        enforceDepthLimit?: boolean;
+        enforceCostLimit?: boolean;
+        variables?: Record<string, unknown>;
+      },
+    ) => {
+      const enforceDepthLimit = options?.enforceDepthLimit ?? true;
+      const enforceCostLimit = options?.enforceCostLimit ?? true;
       const entry = getCacheEntry(query);
       // Unparseable queries aren't cached; let parse surface the syntax error
       const document = entry?.document ?? parse(query);
 
-      let validationErrors = entry?.validationErrors;
+      let validationErrors = enforceDepthLimit ? entry?.validationErrors : undefined;
       if (!validationErrors) {
-        const rules =
-          env.maxQueryDepth > 0
-            ? [...specifiedRules, depthLimitRule(env.maxQueryDepth)]
-            : undefined; // undefined = use default specifiedRules
+        const maxDepth = enforceDepthLimit ? env.maxQueryDepth : 0;
+        const rules = maxDepth > 0 ? [...specifiedRules, depthLimitRule(maxDepth)] : undefined; // undefined = use default specifiedRules
 
         validationErrors = validate(gqlEntities.schema, document, rules);
-        if (entry) entry.validationErrors = validationErrors;
+        if (entry && enforceDepthLimit) entry.validationErrors = validationErrors;
+      }
+
+      // Outside the block above, and never cached: the estimate depends on the
+      // request's variable values, so the same query text has different verdicts
+      // for different callers. Only for a query that already typechecks — an
+      // estimate drawn from a document that does not resolve against the schema
+      // would bury the error that actually explains the rejection.
+      if (enforceCostLimit && env.maxQueryCost > 0 && validationErrors.length === 0) {
+        const costError = checkQueryCost(
+          document,
+          gqlEntities.schema,
+          options?.variables ?? {},
+          pageLimits,
+          env.maxQueryCost,
+        );
+
+        if (costError) validationErrors = [costError];
       }
 
       return {
@@ -234,6 +277,18 @@ export const handleGraphQLRequestFactory = (
       variables: Record<string, unknown> = {},
       req?: BunRequest,
       session?: SessionContext,
+      // `enforcePageLimits: false` is for operator-authored queries (REST
+      // operations, cron jobs, the `gqlQuery` handed to operation hooks). They
+      // are configuration, not caller input, so a page cap could only reject
+      // the operator's own intent. Use `gql.operatorQuery` rather than passing
+      // this by hand.
+      //
+      // `timeoutMs` is the per-operation override only. Left undefined, each
+      // engine stays on its own default — the pool's on Postgres and SQL
+      // Server, QUERY_TIMEOUT_MS on MySQL, which has no pool-level route — so
+      // an ordinary caller query is bounded without the factory resolving
+      // anything.
+      options?: { enforcePageLimits?: boolean; timeoutMs?: number },
       // oxlint-disable-next-line typescript/no-explicit-any
     ): Promise<{ data: any }> => {
       const log = logger("graphql").child({ role: session?.role });
@@ -315,8 +370,14 @@ export const handleGraphQLRequestFactory = (
         let aiData: Record<string, unknown> = {};
         for (const field of aiFields) {
           const alias = field.alias || field.name;
-          const prompt = field.arguments?.prompt;
-          aiData[alias] = await getAgent()(String(prompt ?? ""));
+          const prompt = String(field.arguments?.prompt ?? "");
+          audit().emit({
+            action: "ai.ask",
+            actor: actorFromSession(session),
+            target: { kind: "ai", via: "graphql" },
+            prompt,
+          });
+          aiData[alias] = await getAgent()(prompt);
         }
 
         // Skip SQL generation if there are no table fields
@@ -339,7 +400,14 @@ export const handleGraphQLRequestFactory = (
           ],
         };
 
-        const sqlQueries = generateSQL(entities, tableQueryAnalysis, resolved.allVariables);
+        const sqlQueries = generateSQL(
+          entities,
+          tableQueryAnalysis,
+          resolved.allVariables,
+          false,
+          (options?.enforcePageLimits ?? true) ? pageLimits : null,
+          options?.timeoutMs,
+        );
 
         const data = await Promise.all<object>(
           sqlQueries.map(([db, query]) =>
@@ -348,6 +416,7 @@ export const handleGraphQLRequestFactory = (
               db,
               resolved.variables,
               resolved.allVariables as Record<string, string | number | boolean | null>,
+              options?.timeoutMs,
             ),
           ),
         );
@@ -409,7 +478,20 @@ export const handleGraphQLRequestFactory = (
     },
   };
 
-  return gql;
+  /**
+   * `handler` for operator-authored queries — REST operations, cron jobs, and
+   * the `gqlQuery` handed to operation hooks and handlers. Their text comes from
+   * configuration, never from a caller, so page limits do not apply.
+   */
+  const operatorQuery = (
+    query: Parameters<typeof gql.handler>[0],
+    variables?: Parameters<typeof gql.handler>[1],
+    req?: Parameters<typeof gql.handler>[2],
+    session?: Parameters<typeof gql.handler>[3],
+    timeoutMs?: number,
+  ) => gql.handler(query, variables, req, session, { enforcePageLimits: false, timeoutMs });
+
+  return { ...gql, operatorQuery };
 };
 
 export type HandleGraphQLRequest = ReturnType<typeof handleGraphQLRequestFactory>;

package/src/configuration/gql/handleGraphQLSubscriptionFactory.ts

@@ -1,4 +1,5 @@
 import type { ServerWebSocket, WebSocketHandler } from "bun";
+import type { AnalysisResult } from "../../analyzeQuery/types";
 import type { AnalyzedConfiguration } from "../../configuration";
 import type { SubscriptionContext } from "../../subscriptions";
 import type { SessionContext } from "../../utils/sessionVariables";
@@ -9,6 +10,7 @@ import { getTokenService } from "../../singletons/authentication";
 import { createSubscriptionStrategyRegistry, getStrategyForSource } from "../../subscriptions";
 import { createQueryEventEmitter } from "../../utils/event-emitter";
 import { logger } from "../../logging";
+import { audit } from "../../logging/audit";
 
 export const queryEventEmitter = createQueryEventEmitter();
 
@@ -59,6 +61,14 @@ const handleGraphQLSubscriptionFactory = (
 
         subscriptionMapping.set(ws, session);
 
+        if (session.authMethod === "admin_secret") {
+          audit().emit({
+            action: "admin_secret.used",
+            actor: { type: "admin_secret", ip: ws.remoteAddress },
+            target: { kind: "websocket" },
+          });
+        }
+
         logger("subscriptions").debug({ role: session.role }, "client connected");
 
         ws.send(
@@ -96,7 +106,9 @@ const handleGraphQLSubscriptionFactory = (
         const schemaEntity = roles[session.role!];
 
         // Validate query
-        const { hasErrors, validationErrors } = schemaEntity.handlers.gql.hasErrors(query);
+        const { hasErrors, validationErrors } = schemaEntity.handlers.gql.hasErrors(query, {
+          variables,
+        });
 
         if (hasErrors) {
           queryEventEmitter.sendErrorToSingleClient(ws, id, validationErrors);
@@ -146,15 +158,32 @@ const handleGraphQLSubscriptionFactory = (
           return;
         }
 
+        // The SQL builders read `$n` from a definition's index in the
+        // operation's own variable list, so the analysis handed to them has to
+        // be the resolved one — the raw analysis knows nothing of the statics
+        // that binding a role filter mints. Same construction as the HTTP path.
+        const resolvedAnalysis: AnalysisResult = {
+          ...analysis,
+          operations: [
+            {
+              ...operation,
+              fields: resolved.fields,
+              variables: resolved.variables,
+            },
+            ...analysis.operations.slice(1),
+          ],
+        };
+
         // Build context for the strategy
         const context: SubscriptionContext = {
           ws,
           subscriptionId: id,
-          analysis,
+          analysis: resolvedAnalysis,
           field: resolved.fields[0],
           variableDefinitions: resolved.variables,
           variables: resolved.allVariables,
           schemaEntity,
+          session,
           eventEmitter: queryEventEmitter,
         };
 

package/src/configuration/index.ts

@@ -19,6 +19,7 @@ import {
   virtualColumnExpression,
   virtualColumnFunction,
 } from "../types/configuration";
+import { collectCrossReferenceErrors } from "./crossReferences";
 import { getSchema, getSchemas } from "./getSchemas";
 import { generateOpenAPI } from "./rest/generateOpenAPI";
 
@@ -60,12 +61,29 @@ export const analyzeConfiguration = async (configuration: Configuration, options
   // Use pre-calculated enabledDatabases from configuration parsing
   const enabledDatabases = configuration.enabledDatabases;
 
-  const [{ tables, storedProcedures }, resolvedRemoteSchemas, resolvedRemoteREST] =
-    await Promise.all([
-      getDatabasesStructure(enabledDatabases, configuration.auth),
-      resolveRemoteSchemas(configuration.remoteSchemas ?? []),
-      resolveRemoteRESTApis(configuration.remoteREST ?? []),
-    ]);
+  const [
+    { tables, storedProcedures, tableNamesByDatabase },
+    resolvedRemoteSchemas,
+    resolvedRemoteREST,
+  ] = await Promise.all([
+    getDatabasesStructure(enabledDatabases, configuration.auth),
+    resolveRemoteSchemas(configuration.remoteSchemas ?? []),
+    resolveRemoteRESTApis(configuration.remoteREST ?? []),
+  ]);
+
+  const crossReferenceErrors = collectCrossReferenceErrors(configuration, {
+    tables,
+    storedProcedures,
+    tableNamesByDatabase,
+  });
+
+  if (crossReferenceErrors.length) {
+    throw new Error(
+      `Configuration references ${crossReferenceErrors.length} name${
+        crossReferenceErrors.length === 1 ? "" : "s"
+      } that do not exist:\n${crossReferenceErrors.map((error) => `  - ${error}`).join("\n")}`,
+    );
+  }
 
   const operationsWithRestEndpoints = Object.fromEntries(
     Object.entries(configuration.operations).filter(([, operationConfig]) => operationConfig.rest),

package/src/configuration/rest/generateOpenAPI.ts

@@ -1,38 +1,77 @@
+import { GraphQLObjectType } from "graphql";
+
+import type { GraphQLType } from "graphql";
 import type { OpenAPIV3_1 } from "openapi-types";
 import type { SelectionAnalysis } from "../../analyzeQuery/types";
 import type { GetSchemaReturn } from "../../configuration/getSchemas";
 import type { RemoteRESTResolved } from "../../remoteREST/types";
 import type { Env } from "../../types/env";
 
+import { getFieldType, unwrapType } from "../../analyzeQuery/typeUtils";
 import { convertFromZod, errors } from "./openApiErrors";
 
+// Deliberately coarse: Int and Float both map to "number", so a column keeps
+// the OpenAPI type it had when types were read off the SQL data type.
+const openApiTypeOf = (namedType: GraphQLType | undefined) => {
+  const name = namedType && "name" in namedType ? namedType.name : undefined;
+
+  switch (name) {
+    case "Int":
+    case "Float":
+      return "number";
+    case "Boolean":
+      return "boolean";
+    default:
+      return "string";
+  }
+};
+
+const resolveFieldType = (parentType: GraphQLObjectType | undefined, fieldName: string) => {
+  const fieldType = parentType && getFieldType(parentType, fieldName);
+  const namedType = fieldType ? unwrapType(fieldType).type : undefined;
+
+  return {
+    namedType,
+    objectType: namedType instanceof GraphQLObjectType ? namedType : undefined,
+  };
+};
+
+/**
+ * Resolves selections against the GraphQL schema rather than against a table
+ * name. `<table>_aggregate` returns a GroupBy wrapper whose fields — `key`,
+ * `count`, `items`, `min`/`max`/`sum`/`avg` — are not tables, so looking a
+ * selection's parent name up in the entity map typed everything under an
+ * aggregate as a string. Walking the schema also makes sanitised column names
+ * resolve, since the schema is what the client actually queries.
+ */
 const processSelections = (
-  schema: GetSchemaReturn,
-  name: string,
-  selections: SelectionAnalysis[] = [],
+  parentType: GraphQLObjectType | undefined,
+  fieldParent: SelectionAnalysis,
 ) =>
-  selections.reduce<Record<string, unknown>>((acc, field) => {
-    const type = schema.getColumnTypeForOpenApi(name, field.name);
+  fieldParent.selections?.reduce<Record<string, unknown>>((acc, field) => {
+    const { namedType, objectType } = resolveFieldType(parentType, field.name);
 
     if (field.isArray) {
       acc[field.alias || field.name] = {
         type: "array",
         items: {
           type: "object",
-          properties: processSelections(schema, field.name, field.selections),
+          properties: processSelections(objectType, field),
           required: (field.selections ?? [])
             .filter((f) => f.isRequired)
             .map((f) => f.alias || f.name),
+          nullable: !field.isRequired,
         },
       };
     } else {
       acc[field.alias || field.name] = field.selections
         ? {
             type: "object",
-            properties: processSelections(schema, field.name, field.selections),
+            properties: processSelections(objectType, field),
             required: field.selections.filter((f) => f.isRequired).map((f) => f.alias || f.name),
+            nullable: !field.isRequired,
           }
-        : { type };
+        : { type: openApiTypeOf(namedType), nullable: !field.isRequired };
     }
 
     return acc;
@@ -137,7 +176,12 @@ export const generateOpenAPI = ({
         const responseDataSchema = value.output
           ? convertFromZod(value.output)
           : (() => {
-              const fields = value.queryStructure!.operations[0].fields;
+              const operation = value.queryStructure!.operations[0];
+              const fields = operation.fields;
+              const rootType =
+                (operation.operation === "mutation"
+                  ? schema.schema.getMutationType()
+                  : schema.schema.getQueryType()) ?? undefined;
               return {
                 type: "object" as const,
                 properties: fields.reduce<Record<string, unknown>>((acc, field) => {
@@ -146,7 +190,10 @@ export const generateOpenAPI = ({
                       type: "array",
                       items: {
                         type: "object",
-                        properties: processSelections(schema, field.name, field.selections!),
+                        properties: processSelections(
+                          resolveFieldType(rootType, field.name).objectType,
+                          field,
+                        ),
                         required: (field.selections ?? [])
                           .filter((f) => f.isRequired)
                           .map((f) => f.alias || f.name),
@@ -155,7 +202,10 @@ export const generateOpenAPI = ({
                   } else {
                     acc[field.alias || field.name] = {
                       type: "object",
-                      properties: processSelections(schema, field.name, field.selections!),
+                      properties: processSelections(
+                        resolveFieldType(rootType, field.name).objectType,
+                        field,
+                      ),
                       required: (field.selections ?? [])
                         .filter((f) => f.isRequired)
                         .map((f) => f.alias || f.name),

package/src/configuration/rest/handleRESTRequestFactory.ts

@@ -12,6 +12,7 @@ import type { HandleGraphQLRequest } from "../gql/handleGraphQLRequestFactory";
 import { analyzeQuery } from "../../analyzeQuery";
 import { checkUserCredentials } from "../../databases";
 import { proxyRemoteRESTRequest } from "../../remoteREST/proxy";
+import { actorFromSession, audit } from "../../logging/audit";
 import { getTokenService } from "../../singletons/authentication";
 import { getCache } from "../../singletons/cache";
 import { databasesConnections, repositoryMap } from "../../singletons/databases";
@@ -108,7 +109,7 @@ export const handleRESTRequestFactory = (
 
       if (routesInitDataPromises[route.routeKey] === undefined) {
         routesInitDataPromises[route.routeKey] = await route.hooks?.init?.({
-          gqlQuery: gqlSuperadminHandler?.handler ?? gql.handler,
+          gqlQuery: gqlSuperadminHandler?.operatorQuery ?? gql.operatorQuery,
           databases: databasesConnections,
           queues: queueManager,
           repository: repositoryMap,
@@ -174,9 +175,23 @@ export const handleRESTRequestFactory = (
 
             const result = await checkUserCredentials(auth, username, password);
 
+            const actor = { type: "credentials", sub: username } as const;
             if (!result.valid) {
+              audit().emit({
+                action: "auth.login",
+                outcome: "failure",
+                actor,
+                target: { kind: "auth", via: "rest" },
+                reason: "Invalid username or password",
+              });
               return new S401({ errors: ["Invalid username or password"] });
             }
+            audit().emit({
+              action: "auth.login",
+              outcome: "success",
+              actor,
+              target: { kind: "auth", via: "rest", role: result.role },
+            });
 
             const data = await getTokenService().createTokenPair({
               sub: username,
@@ -229,9 +244,11 @@ export const handleRESTRequestFactory = (
 
           if (route.authOperation === "logout") {
             const tokenService = getTokenService();
+            const revoked: string[] = [];
 
             if (session?.jti) {
               await tokenService.revoke(session.jti);
+              revoked.push(session.jti);
             }
 
             const refreshCookie = req?.cookies?.get("refresh_token");
@@ -241,6 +258,7 @@ export const handleRESTRequestFactory = (
                   audience: "refresh",
                 });
                 await tokenService.revoke(refreshPayload.jti);
+                revoked.push(refreshPayload.jti);
               } catch {
                 // tampered or expired cookie — nothing to revoke
               }
@@ -250,6 +268,14 @@ export const handleRESTRequestFactory = (
               req.cookies.delete("refresh_token");
             }
 
+            if (revoked.length > 0) {
+              audit().emit({
+                action: "auth.logout",
+                actor: actorFromSession(session),
+                target: { kind: "auth", via: "rest", revoked },
+              });
+            }
+
             return new S200({ data: true });
           }
 
@@ -269,7 +295,7 @@ export const handleRESTRequestFactory = (
         try {
           const result = await route.handler(
             {
-              gqlQuery: gqlSuperadminHandler?.handler ?? gql.handler,
+              gqlQuery: gqlSuperadminHandler?.operatorQuery ?? gql.operatorQuery,
               databases: databasesConnections,
               queues: queueManager,
               repository: repositoryMap,
@@ -330,7 +356,7 @@ export const handleRESTRequestFactory = (
           // Execute the GraphQL request, then transform via afterRequest before
           // caching so hits and misses return the same shape.
           const result = await applyAfterRequest(
-            await gql.handler(queryAnalysis!, variables, req, session),
+            await gql.operatorQuery(queryAnalysis!, variables, req, session, route.timeout),
           );
 
           // Cache the (already transformed) result
@@ -344,7 +370,9 @@ export const handleRESTRequestFactory = (
       } else if (queryAnalysis) {
         // No caching for this route, execute normally
         return new S200(
-          await applyAfterRequest(await gql.handler(queryAnalysis, variables, req, session)),
+          await applyAfterRequest(
+            await gql.operatorQuery(queryAnalysis, variables, req, session, route.timeout),
+          ),
         );
       }
 

package/src/configuration/rest/index.ts

@@ -42,11 +42,20 @@ export const buildApiRoutes = (
     let hasError = false;
 
     if (routeConfig.query) {
-      const validationErrors = gql.hasErrors(routeConfig.query);
+      // Operation queries come from the configuration, not from a caller, so the
+      // depth and cost limits do not apply to them — they would turn an
+      // operator's own deep or wide query into a dead route.
+      const validationErrors = gql.hasErrors(routeConfig.query, {
+        enforceDepthLimit: false,
+        enforceCostLimit: false,
+      });
 
       if (validationErrors.hasErrors && gqlSuperadminHandler) {
         // Re-validate with superadmin handler if available
-        const superadminErrors = gqlSuperadminHandler.hasErrors(routeConfig.query);
+        const superadminErrors = gqlSuperadminHandler.hasErrors(routeConfig.query, {
+          enforceDepthLimit: false,
+          enforceCostLimit: false,
+        });
 
         if (superadminErrors.hasErrors) {
           throw new Error(`Endpoint ${routeKey} has invalid query.`);