@m1212e/rumble 0.23.18 → 0.23.20

package/out/index.mjs

@@ -1,6 +1,6 @@
 import { t as lazy } from "./lazy-C7IyM4M4.mjs";
 import { t as generateFromSchema } from "./generate-0QFVc3Sg.mjs";
-import { GraphQLError, GraphQLSchema, execute as defaultExecute, getOperationAST, print, subscribe as defaultSubscribe } from "graphql";
+import { GraphQLError, GraphQLScalarType, GraphQLSchema, Kind, execute as defaultExecute, getOperationAST, print, subscribe as defaultSubscribe } from "graphql";
 import { EnvelopArmorPlugin } from "@escape.tech/graphql-armor";
 import { useDisableIntrospection } from "@graphql-yoga/plugin-disable-introspection";
 import { SpanStatusCode, isSpanContextValid, trace } from "@opentelemetry/api";
@@ -18,8 +18,12 @@ import SchemaBuilder, { BasePlugin } from "@pothos/core";
 import DrizzlePlugin from "@pothos/plugin-drizzle";
 import SmartSubscriptionsPlugin, { subscribeOptionsFromIterator } from "@pothos/plugin-smart-subscriptions";
 import TracingPlugin, { isRootField, wrapResolver } from "@pothos/plugin-tracing";
-import { BigIntResolver, ByteResolver, DateResolver, DateTimeISOResolver, JSONResolver } from "graphql-scalars";
+import ValidationPlugin from "@pothos/plugin-validation";
+import { BigIntResolver, ByteResolver, DateResolver, DateTimeISOResolver, EmailAddressResolver, JSONResolver, LocaleResolver } from "graphql-scalars";
 import DataLoader from "dataloader";
+import { AddressValidationError, CountryMissingError, InvalidStateError, InvalidZipError, MissingFieldError, isValidCountryCode, validateAddress } from "lib-address";
+import { z } from "zod";
+import { parsePhoneNumberFromString } from "libphonenumber-js";
 //#region lib/types/rumbleError.ts
 /**
 * An error that gets raised by rumble whenever something does not go according to plan.
@@ -182,7 +186,7 @@ function mapNullFieldsToUndefined(obj) {
 }
 //#endregion
 //#region package.json
-var version = "0.23.18";
+var version = "0.23.20";
 //#endregion
 //#region lib/helpers/errorLogging.ts
 function hasMessage(error) {
@@ -563,6 +567,24 @@ function recordSpanErrors(span, errors) {
 function recordSpanError(span, error) {
 	recordSpanErrors(span, [error]);
 }
+/**
+* Errors the operation wrapper has already reported.
+*
+* A transport can see the same failure twice: sofa, for instance, hands
+* `result.errors` to its error handler *after* execute has returned, so without
+* this the very same error would produce two log lines and two exception events,
+* which quietly doubles error counts in dashboards. A WeakSet keeps this free of
+* bookkeeping — entries disappear with the errors themselves.
+*/
+const reportedErrors = /* @__PURE__ */ new WeakSet();
+function markErrorsReported(errors) {
+	for (const error of errors) if (typeof error === "object" && error !== null) reportedErrors.add(error);
+}
+/** True when every error was already reported by the operation wrapper. */
+function errorsAlreadyReported(errors) {
+	if (errors.length === 0) return false;
+	return errors.every((error) => typeof error === "object" && error !== null && reportedErrors.has(error));
+}
 function safeJsonStringify(value) {
 	try {
 		return JSON.stringify(value, (_key, inner) => typeof inner === "bigint" ? inner.toString() : inner) ?? "null";
@@ -1603,6 +1625,7 @@ function buildTracedExecute(executeFn, rumbleInput, transport) {
 						...errorsLogField(result.errors)
 					}, "graphql execute completed with errors");
 					recordSpanErrors(span, result.errors);
+					markErrorsReported(result.errors);
 				} else log?.info({
 					...telemetry.logFields,
 					[FIELD_DURATION_MS]: durationMs(start)
@@ -1615,6 +1638,7 @@ function buildTracedExecute(executeFn, rumbleInput, transport) {
 					...errorLogField(error)
 				}, "graphql execute threw");
 				recordSpanError(span, error);
+				markErrorsReported([error]);
 				throw error;
 			}
 		};
@@ -1656,6 +1680,7 @@ function buildTracedSubscribe(subscribeFn, rumbleInput, transport) {
 							...errorsLogField(execResult.errors)
 						}, "graphql subscribe completed with errors");
 						recordSpanErrors(span, execResult.errors);
+						markErrorsReported(execResult.errors);
 					}
 					return execResult;
 				}
@@ -1677,6 +1702,7 @@ function buildTracedSubscribe(subscribeFn, rumbleInput, transport) {
 					...errorLogField(error)
 				}, "graphql subscribe threw");
 				recordSpanError(span, error);
+				markErrorsReported([error]);
 				throw error;
 			}
 		};
@@ -2584,8 +2610,191 @@ function registerRuntimeFiltersPlugin() {
 	}
 }
 //#endregion
+//#region lib/scalars/addressValidation.ts
+const FIELD_PATH_MAP = {
+	addressLine1: "streetAddress",
+	addressLine2: "streetAddress",
+	addressLine3: "streetAddress",
+	city: "locality",
+	dependentLocality: "locality",
+	state: "region",
+	zip: "postalCode",
+	sortingCode: "postalCode"
+};
+/**
+* Fixes the unambiguous, purely-cosmetic issues (stray surrounding whitespace, wrong case)
+* before validation runs, rather than rejecting a request over them. This runs as a Zod
+* `transform`, and `@pothos/plugin-validation` uses a transform's *output* as the field's
+* actual value — so the corrected value, not the original one, is what resolvers receive.
+*
+* `countryCode` and `postalCode` are uppercased since their canonical forms always are (ISO
+* 3166-1 codes, and postal codes in every country that mixes letters and digits, e.g. GB/CA/NL).
+* `region`/`locality` are only trimmed, not case-changed: unlike country/postal codes, a region
+* is sometimes a free-text place name rather than a code (lib-address's own subdivision lookup
+* is already case-insensitive, so case coercion there wouldn't fix anything a rejection-worthy
+* case wouldn't already pass).
+*/
+const normalizeAddress = (address) => ({
+	streetAddress: address.streetAddress.split("\n").map((line) => line.trim()).filter((line) => line.length > 0).join("\n") || null,
+	locality: address.locality?.trim() || null,
+	region: address.region?.trim() || null,
+	postalCode: address.postalCode?.trim().toUpperCase() || null,
+	countryCode: address.countryCode.trim().toUpperCase()
+});
+const addressValidationSchema = z.object({
+	streetAddress: z.string(),
+	locality: z.string().nullable().optional(),
+	region: z.string().nullable().optional(),
+	postalCode: z.string().nullable().optional(),
+	countryCode: z.string()
+}).transform(normalizeAddress).superRefine((address, ctx) => {
+	if (!address.countryCode) {
+		ctx.addIssue({
+			code: "custom",
+			path: ["countryCode"],
+			message: "countryCode is required."
+		});
+		return;
+	}
+	if (!isValidCountryCode(address.countryCode)) {
+		ctx.addIssue({
+			code: "custom",
+			path: ["countryCode"],
+			message: `Unknown country code: ${address.countryCode}`
+		});
+		return;
+	}
+	const [addressLine1, addressLine2, addressLine3] = address.streetAddress ? address.streetAddress.split("\n") : [];
+	try {
+		validateAddress({
+			country: address.countryCode,
+			addressLine1,
+			addressLine2,
+			addressLine3,
+			city: address.locality ?? void 0,
+			state: address.region?.toUpperCase() ?? void 0,
+			zip: address.postalCode ?? void 0
+		});
+	} catch (error) {
+		if (error instanceof CountryMissingError) {
+			ctx.addIssue({
+				code: "custom",
+				path: ["countryCode"],
+				message: error.message
+			});
+			return;
+		}
+		if (!(error instanceof AddressValidationError)) throw error;
+		for (const subError of error.errors) if (subError instanceof MissingFieldError) {
+			const path = FIELD_PATH_MAP[subError.field];
+			if (!path) continue;
+			ctx.addIssue({
+				code: "custom",
+				path: [path],
+				message: `${path} is required for country ${address.countryCode}.`
+			});
+		} else if (subError instanceof InvalidZipError) ctx.addIssue({
+			code: "custom",
+			path: ["postalCode"],
+			message: `Invalid postal code for country ${address.countryCode}.`
+		});
+		else if (subError instanceof InvalidStateError) ctx.addIssue({
+			code: "custom",
+			path: ["region"],
+			message: `Invalid region for country ${address.countryCode}.`
+		});
+	}
+});
+//#endregion
+//#region lib/scalars/address.ts
+function implementDefaultAddressTypes(schemaBuilder) {
+	return {
+		Address: schemaBuilder.objectRef("Address").implement({
+			description: "A postal address, modeled after the OIDC `address` claim and schema.org's PostalAddress.",
+			fields: (t) => ({
+				streetAddress: t.exposeString("streetAddress", { nullable: true }),
+				locality: t.exposeString("locality", { nullable: true }),
+				region: t.exposeString("region", { nullable: true }),
+				postalCode: t.exposeString("postalCode", { nullable: true }),
+				countryCode: t.exposeString("countryCode", { nullable: true })
+			})
+		}),
+		AddressInput: schemaBuilder.inputRef("AddressInput").implement({
+			description: "Input counterpart of Address. countryCode and streetAddress are required — countryCode because there is nothing to validate the other fields against without it, and streetAddress because it's the one field required in every country. The remaining fields are optional since their requiredness genuinely varies by country; validated as a whole using Google's libaddressinput metadata (offline).",
+			validate: addressValidationSchema,
+			fields: (t) => ({
+				streetAddress: t.string({ required: true }),
+				locality: t.string({ required: false }),
+				region: t.string({ required: false }),
+				postalCode: t.string({ required: false }),
+				countryCode: t.string({ required: true })
+			})
+		})
+	};
+}
+//#endregion
+//#region lib/scalars/personName.ts
+const MAX_LENGTH = 200;
+const NAME_REGEX = /^[\p{L}\p{M}]+(?:(?:[ '-]|\.\x20?)[\p{L}\p{M}]+)*\.?$/u;
+/**
+* Normalizes and validates a person's name.
+*/
+const normalize = (value) => {
+	if (typeof value !== "string") throw new RumbleErrorSafe(`Name value is not a string: ${value}`);
+	const normalized = value.normalize("NFC").replace(/[\p{Cc}\p{Cf}]/gu, "").replace(/\p{Zs}+/gu, " ").trim().replace(/([-'])\1+/gu, "$1").replace(/^[-']+|[-']+$/gu, "").trim();
+	if (normalized.length === 0) throw new RumbleErrorSafe("Name must not be empty.");
+	if (normalized.length > MAX_LENGTH) throw new RumbleErrorSafe(`Name must not be longer than ${MAX_LENGTH} characters.`);
+	if (!NAME_REGEX.test(normalized)) throw new RumbleErrorSafe(`Invalid name: ${value}. Names may only contain letters and the separators space, apostrophe, hyphen and period, and may not start with or repeat a separator.`);
+	return normalized;
+};
+const PersonNameResolver = new GraphQLScalarType({
+	name: "PersonName",
+	description: "A person's name. Unicode letters from any script are allowed, along with space, apostrophe, hyphen and period as separators between name parts. The value is Unicode NFC normalized, has invisible/control characters stripped, has its whitespace collapsed, and has unambiguous typos (a doubled or stray leading/trailing hyphen/apostrophe) silently corrected rather than rejected.",
+	serialize: normalize,
+	parseValue: normalize,
+	parseLiteral(ast) {
+		if (ast.kind !== Kind.STRING) throw new RumbleErrorSafe(`Can only validate strings as names but got a: ${ast.kind}`);
+		return normalize(ast.value);
+	}
+});
+//#endregion
+//#region lib/scalars/phoneNumber.ts
+/**
+* Parses and validates a phone number using libphonenumber-js (Google's phone number metadata),
+* which checks real per-country validity (length, area code plausibility, ...) rather than just
+* the E.164 shape.
+*/
+const parse = (value) => {
+	if (typeof value !== "string") throw new RumbleErrorSafe(`Phone number value is not a string: ${value}`);
+	const phoneNumber = parsePhoneNumberFromString(value);
+	if (!phoneNumber?.isValid()) throw new RumbleErrorSafe(`Invalid phone number: ${value}. Please provide a valid phone number including its country calling code, e.g. +4915123456789.`);
+	return phoneNumber;
+};
+/**
+* Resolvers may either return an already-parsed PhoneNumber (e.g. one obtained via `parse`
+* above) or a raw string, which is parsed and validated the same way input values are.
+*/
+const serialize = (value) => {
+	if (value && typeof value === "object" && typeof value.isValid === "function") {
+		const phoneNumber = value;
+		if (!phoneNumber.isValid()) throw new RumbleErrorSafe(`Invalid phone number: ${phoneNumber.number}`);
+		return phoneNumber.number;
+	}
+	return parse(value).number;
+};
+const PhoneNumberResolver = new GraphQLScalarType({
+	name: "PhoneNumber",
+	description: "A phone number, validated using real per-country validity rules and represented as a parsed libphonenumber-js PhoneNumber. On the wire it is transported as the E.164 format (https://en.wikipedia.org/wiki/E.164), e.g. +4915123456789. The country calling code is required.",
+	serialize,
+	parseValue: parse,
+	parseLiteral(ast) {
+		if (ast.kind !== Kind.STRING) throw new RumbleErrorSafe(`Can only validate strings as phone numbers but got a: ${ast.kind}`);
+		return parse(ast.value);
+	}
+});
+//#endregion
 //#region lib/schemaBuilder.ts
-const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger }) => {
+const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger, validation }) => {
 	const createSpan = otel?.enabled && otel.tracer ? createOpenTelemetryWrapper(otel.tracer, otel.options) : void 0;
 	registerRuntimeFiltersPlugin();
 	const schemaBuilder = new SchemaBuilder({
@@ -2595,6 +2804,7 @@ const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger }) => {
 			DrizzlePlugin,
 			SmartSubscriptionsPlugin,
 			TracingPlugin,
+			ValidationPlugin,
 			...pothosConfig?.plugins ?? []
 		],
 		drizzle: {
@@ -2640,14 +2850,20 @@ const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger }) => {
 			}
 		},
 		otel,
-		logger
+		logger,
+		validation
 	});
 	schemaBuilder.addScalarType("JSON", JSONResolver);
 	schemaBuilder.addScalarType("Date", DateResolver);
 	schemaBuilder.addScalarType("DateTime", DateTimeISOResolver);
 	schemaBuilder.addScalarType("BigInt", BigIntResolver);
 	schemaBuilder.addScalarType("Bytes", ByteResolver);
+	schemaBuilder.addScalarType("EmailAddress", EmailAddressResolver);
+	schemaBuilder.addScalarType("PhoneNumber", PhoneNumberResolver);
+	schemaBuilder.addScalarType("Locale", LocaleResolver);
+	schemaBuilder.addScalarType("PersonName", PersonNameResolver);
 	implementDefaultWhereInputArgs(schemaBuilder);
+	implementDefaultAddressTypes(schemaBuilder);
 	schemaBuilder.queryType({});
 	schemaBuilder.subscriptionType({});
 	schemaBuilder.mutationType({});
@@ -2841,12 +3057,14 @@ export const r = rumble({
 			execute: buildTracedExecute(args.execute ?? defaultExecute, rumbleInput, "rest"),
 			subscribe: buildTracedSubscribe(args.subscribe ?? defaultSubscribe, rumbleInput, "rest"),
 			errorHandler(errors) {
-				recordSpanErrors(trace.getActiveSpan(), errors);
-				telemetryLogger(rumbleInput)?.error({
-					[ATTR_TRANSPORT]: "rest",
-					...traceCorrelationFields(rumbleInput),
-					...errorsLogField(errors)
-				}, "rest request failed");
+				if (!errorsAlreadyReported(errors)) {
+					recordSpanErrors(trace.getActiveSpan(), errors);
+					telemetryLogger(rumbleInput)?.error({
+						[ATTR_TRANSPORT]: "rest",
+						...traceCorrelationFields(rumbleInput),
+						...errorsLogField(errors)
+					}, "rest request failed");
+				}
 				return userErrorHandler?.(errors) ?? sofaErrorResponse(errors);
 			}
 		});