@graphql-yoga/plugin-csrf-prevention 3.18.0 → 3.18.1-alpha-20260116132831-dc9fc0ad2f1ad6ee99bc438c173cf8496ae505a7

package/dist/index.cjs

@@ -0,0 +1,34 @@
+let graphql_yoga = require("graphql-yoga");
+
+//#region src/index.ts
+const NON_PREFLIGHTED_CONTENT_TYPES = [
+	"application/x-www-form-urlencoded",
+	"multipart/form-data",
+	"text/plain"
+];
+/**
+* If you have CORS enabled, almost all requests coming from the browser will have a
+* preflight request - however, some requests are deemed "simple" and don't make a preflight.
+*
+* One example of such a request is a good ol' GET request without any headers, this request can
+* be marked as "simple" and have preflight CORS checks skipped therefore skipping the CORS check.
+*
+* This attack can be mitigated by saying: "all GET requests must have a custom header set". This
+* would force all clients to manipulate the headers of GET requests, marking them as "_not-_simple"
+* and therefore always executing a preflight request.
+*/
+function useCSRFPrevention(options = {}) {
+	const { requestHeaders = ["x-graphql-yoga-csrf"] } = options;
+	return { onRequestParse({ request }) {
+		if (wasTheRequestAlreadyPreflightChecked(request.headers?.get("content-type"))) return;
+		if (requestHeaders.some((headerName) => request.headers.has(headerName))) return;
+		throw (0, graphql_yoga.createGraphQLError)("Required CSRF header(s) not present", { extensions: { http: { status: 403 } } });
+	} };
+}
+const wasTheRequestAlreadyPreflightChecked = (contentType) => {
+	if (!contentType) return false;
+	return !NON_PREFLIGHTED_CONTENT_TYPES.some((nonPreflightContentType) => contentType.toLowerCase().startsWith(nonPreflightContentType));
+};
+
+//#endregion
+exports.useCSRFPrevention = useCSRFPrevention;

package/{typings → dist}/index.d.cts

@@ -1,11 +1,13 @@
-import { Plugin, YogaInitialContext } from 'graphql-yoga';
-export interface CSRFPreventionPluginOptions {
-    /**
-     * List of headers that are required to be set on every request.
-     *
-     * @default 'x-graphql-yoga-csrf'
-     */
-    requestHeaders?: string[];
+import { Plugin, YogaInitialContext } from "graphql-yoga";
+
+//#region src/index.d.ts
+interface CSRFPreventionPluginOptions {
+  /**
+   * List of headers that are required to be set on every request.
+   *
+   * @default 'x-graphql-yoga-csrf'
+   */
+  requestHeaders?: string[];
 }
 /**
  * If you have CORS enabled, almost all requests coming from the browser will have a
@@ -18,4 +20,6 @@ export interface CSRFPreventionPluginOptions {
  * would force all clients to manipulate the headers of GET requests, marking them as "_not-_simple"
  * and therefore always executing a preflight request.
  */
-export declare function useCSRFPrevention(options?: CSRFPreventionPluginOptions): Plugin<YogaInitialContext>;
+declare function useCSRFPrevention(options?: CSRFPreventionPluginOptions): Plugin<YogaInitialContext>;
+//#endregion
+export { CSRFPreventionPluginOptions, useCSRFPrevention };

package/{typings/index.d.ts → dist/index.d.mts}

@@ -1,11 +1,13 @@
-import { Plugin, YogaInitialContext } from 'graphql-yoga';
-export interface CSRFPreventionPluginOptions {
-    /**
-     * List of headers that are required to be set on every request.
-     *
-     * @default 'x-graphql-yoga-csrf'
-     */
-    requestHeaders?: string[];
+import { Plugin, YogaInitialContext } from "graphql-yoga";
+
+//#region src/index.d.ts
+interface CSRFPreventionPluginOptions {
+  /**
+   * List of headers that are required to be set on every request.
+   *
+   * @default 'x-graphql-yoga-csrf'
+   */
+  requestHeaders?: string[];
 }
 /**
  * If you have CORS enabled, almost all requests coming from the browser will have a
@@ -18,4 +20,6 @@ export interface CSRFPreventionPluginOptions {
  * would force all clients to manipulate the headers of GET requests, marking them as "_not-_simple"
  * and therefore always executing a preflight request.
  */
-export declare function useCSRFPrevention(options?: CSRFPreventionPluginOptions): Plugin<YogaInitialContext>;
+declare function useCSRFPrevention(options?: CSRFPreventionPluginOptions): Plugin<YogaInitialContext>;
+//#endregion
+export { CSRFPreventionPluginOptions, useCSRFPrevention };

package/dist/index.mjs

@@ -0,0 +1,34 @@
+import { createGraphQLError } from "graphql-yoga";
+
+//#region src/index.ts
+const NON_PREFLIGHTED_CONTENT_TYPES = [
+	"application/x-www-form-urlencoded",
+	"multipart/form-data",
+	"text/plain"
+];
+/**
+* If you have CORS enabled, almost all requests coming from the browser will have a
+* preflight request - however, some requests are deemed "simple" and don't make a preflight.
+*
+* One example of such a request is a good ol' GET request without any headers, this request can
+* be marked as "simple" and have preflight CORS checks skipped therefore skipping the CORS check.
+*
+* This attack can be mitigated by saying: "all GET requests must have a custom header set". This
+* would force all clients to manipulate the headers of GET requests, marking them as "_not-_simple"
+* and therefore always executing a preflight request.
+*/
+function useCSRFPrevention(options = {}) {
+	const { requestHeaders = ["x-graphql-yoga-csrf"] } = options;
+	return { onRequestParse({ request }) {
+		if (wasTheRequestAlreadyPreflightChecked(request.headers?.get("content-type"))) return;
+		if (requestHeaders.some((headerName) => request.headers.has(headerName))) return;
+		throw createGraphQLError("Required CSRF header(s) not present", { extensions: { http: { status: 403 } } });
+	} };
+}
+const wasTheRequestAlreadyPreflightChecked = (contentType) => {
+	if (!contentType) return false;
+	return !NON_PREFLIGHTED_CONTENT_TYPES.some((nonPreflightContentType) => contentType.toLowerCase().startsWith(nonPreflightContentType));
+};
+
+//#endregion
+export { useCSRFPrevention };

package/package.json

@@ -1,10 +1,8 @@
 {
   "name": "@graphql-yoga/plugin-csrf-prevention",
-  "version": "3.18.0",
+  "version": "3.18.1-alpha-20260116132831-dc9fc0ad2f1ad6ee99bc438c173cf8496ae505a7",
+  "type": "module",
   "description": "CSRF prevention plugin for GraphQL Yoga that requires the clients to have a specific header set.",
-  "peerDependencies": {
-    "graphql-yoga": "^5.18.0"
-  },
   "repository": {
     "type": "git",
     "url": "https://github.com/graphql-hive/graphql-yoga.git",
@@ -15,28 +13,52 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "main": "cjs/index.js",
-  "module": "esm/index.js",
-  "typings": "typings/index.d.ts",
-  "typescript": {
-    "definition": "typings/index.d.ts"
-  },
-  "type": "module",
+  "main": "dist/index.cjs",
+  "typings": "dist/index.d.mts",
+  "module": "dist/index.mjs",
   "exports": {
     ".": {
       "require": {
-        "types": "./typings/index.d.cts",
-        "default": "./cjs/index.js"
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
       },
       "import": {
-        "types": "./typings/index.d.ts",
-        "default": "./esm/index.js"
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
       },
       "default": {
-        "types": "./typings/index.d.ts",
-        "default": "./esm/index.js"
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
       }
     },
     "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsdown",
+    "check": "tsc --pretty --noEmit",
+    "watch": "tsdown --watch"
+  },
+  "peerDependencies": {
+    "graphql": "^15.2.0 || ^16.0.0",
+    "graphql-yoga": "workspace:^"
+  },
+  "devDependencies": {
+    "graphql": "^16.12.0",
+    "graphql-yoga": "workspace:*",
+    "tsdown": "^0.20.0-beta.1",
+    "tslib": "^2.8.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": false,
+  "buildOptions": {
+    "input": "./src/index.ts"
+  },
+  "typescript": {
+    "definition": "dist/index.d.mts"
   }
-}
+}

package/LICENSE

@@ -1,23 +0,0 @@
-MIT License
-
-Copyright (c) 2018-2020 Graphcool
-Copyright (c) 2020-2021 Prisma
-Copyright (c) 2021- The Guild
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/cjs/index.js

@@ -1,46 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.useCSRFPrevention = useCSRFPrevention;
-const graphql_yoga_1 = require("graphql-yoga");
-const NON_PREFLIGHTED_CONTENT_TYPES = [
-    'application/x-www-form-urlencoded',
-    'multipart/form-data',
-    'text/plain',
-];
-/**
- * If you have CORS enabled, almost all requests coming from the browser will have a
- * preflight request - however, some requests are deemed "simple" and don't make a preflight.
- *
- * One example of such a request is a good ol' GET request without any headers, this request can
- * be marked as "simple" and have preflight CORS checks skipped therefore skipping the CORS check.
- *
- * This attack can be mitigated by saying: "all GET requests must have a custom header set". This
- * would force all clients to manipulate the headers of GET requests, marking them as "_not-_simple"
- * and therefore always executing a preflight request.
- */
-function useCSRFPrevention(options = {}) {
-    const { requestHeaders = ['x-graphql-yoga-csrf'] } = options;
-    return {
-        onRequestParse({ request }) {
-            if (wasTheRequestAlreadyPreflightChecked(request.headers?.get('content-type'))) {
-                return;
-            }
-            if (requestHeaders.some(headerName => request.headers.has(headerName))) {
-                return;
-            }
-            throw (0, graphql_yoga_1.createGraphQLError)('Required CSRF header(s) not present', {
-                extensions: {
-                    http: {
-                        status: 403,
-                    },
-                },
-            });
-        },
-    };
-}
-const wasTheRequestAlreadyPreflightChecked = (contentType) => {
-    if (!contentType) {
-        return false;
-    }
-    return !NON_PREFLIGHTED_CONTENT_TYPES.some(nonPreflightContentType => contentType.toLowerCase().startsWith(nonPreflightContentType));
-};

package/cjs/package.json

@@ -1 +0,0 @@
-{"type":"commonjs"}

package/esm/index.js

@@ -1,43 +0,0 @@
-import { createGraphQLError } from 'graphql-yoga';
-const NON_PREFLIGHTED_CONTENT_TYPES = [
-    'application/x-www-form-urlencoded',
-    'multipart/form-data',
-    'text/plain',
-];
-/**
- * If you have CORS enabled, almost all requests coming from the browser will have a
- * preflight request - however, some requests are deemed "simple" and don't make a preflight.
- *
- * One example of such a request is a good ol' GET request without any headers, this request can
- * be marked as "simple" and have preflight CORS checks skipped therefore skipping the CORS check.
- *
- * This attack can be mitigated by saying: "all GET requests must have a custom header set". This
- * would force all clients to manipulate the headers of GET requests, marking them as "_not-_simple"
- * and therefore always executing a preflight request.
- */
-export function useCSRFPrevention(options = {}) {
-    const { requestHeaders = ['x-graphql-yoga-csrf'] } = options;
-    return {
-        onRequestParse({ request }) {
-            if (wasTheRequestAlreadyPreflightChecked(request.headers?.get('content-type'))) {
-                return;
-            }
-            if (requestHeaders.some(headerName => request.headers.has(headerName))) {
-                return;
-            }
-            throw createGraphQLError('Required CSRF header(s) not present', {
-                extensions: {
-                    http: {
-                        status: 403,
-                    },
-                },
-            });
-        },
-    };
-}
-const wasTheRequestAlreadyPreflightChecked = (contentType) => {
-    if (!contentType) {
-        return false;
-    }
-    return !NON_PREFLIGHTED_CONTENT_TYPES.some(nonPreflightContentType => contentType.toLowerCase().startsWith(nonPreflightContentType));
-};