@nifrajs/graphql 3.3.0 → 4.0.0

package/dist/ws.js

@@ -12,13 +12,124 @@
  * `graphql-ws` is an optional peer dependency: import this module only when you need subscriptions, and
  * the dependency (and its bundle weight) stays off every app that doesn't.
  */
-import { execute, subscribe } from "graphql";
+import { execute, GraphQLError, parse, specifiedRules, subscribe, validate, } from "graphql";
 import { GRAPHQL_TRANSPORT_WS_PROTOCOL, makeServer, } from "graphql-ws";
 import { buildContext } from "./context.js";
+import { documentLimitError, documentMetrics, graphqlLimits, requestLimitError, } from "./limits.js";
 /** A frame is a string for JSON control messages; graphql-ws only speaks text frames. */
 function asText(data) {
     return typeof data === "string" ? data : new TextDecoder().decode(data);
 }
+function recordOf(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function graphqlWsLimits(options) {
+    return graphqlLimits(options);
+}
+function assertWsNumber(value, name, minimum) {
+    if (!Number.isSafeInteger(value) || value < minimum) {
+        throw new RangeError(`GraphQL ${name} must be a safe integer >= ${minimum}`);
+    }
+}
+function subscriptionFrameError(message, schema, limits) {
+    let frame;
+    try {
+        frame = JSON.parse(message);
+    }
+    catch {
+        return undefined;
+    }
+    const envelope = recordOf(frame);
+    if (envelope?.type !== "subscribe")
+        return undefined;
+    const id = envelope.id;
+    const payload = recordOf(envelope.payload);
+    const query = payload?.query;
+    if (typeof query !== "string")
+        return { id, message: "A subscription query is required." };
+    const variablesValue = payload?.variables;
+    const variables = variablesValue === undefined || variablesValue === null ? null : recordOf(variablesValue);
+    if (variablesValue !== undefined && variablesValue !== null && variables === undefined) {
+        return { id, message: "Subscription variables must be an object." };
+    }
+    const requestError = requestLimitError(query, variables ?? null, limits);
+    if (requestError !== undefined)
+        return { id, message: requestError };
+    let document;
+    try {
+        document = parse(query);
+    }
+    catch (error) {
+        return { id, message: error instanceof GraphQLError ? error.message : "Invalid GraphQL query." };
+    }
+    const validationErrors = validate(schema, document, specifiedRules);
+    if (validationErrors.length > 0)
+        return { id, message: validationErrors[0]?.message ?? "Invalid GraphQL query." };
+    const limitError = documentLimitError(documentMetrics(document), limits);
+    return limitError === undefined ? undefined : { id, message: limitError };
+}
+function maskWsError(error) {
+    const record = recordOf(error);
+    if (record === undefined)
+        return { message: "Internal server error." };
+    return {
+        message: "Internal server error.",
+        ...(record.locations === undefined ? {} : { locations: record.locations }),
+        ...(Array.isArray(record.path) ? { path: record.path } : {}),
+    };
+}
+/**
+ * A frame graphql-ws sends, execution errors masked. A `complete` or `error` frame ends its operation,
+ * so the id stops counting against `maxSubscriptions`: a client is not expected to complete an
+ * operation the server already ended.
+ */
+function outboundFrame(message, subscriptions) {
+    try {
+        const parsed = recordOf(JSON.parse(message));
+        if (parsed === undefined)
+            return message;
+        if ((parsed.type === "complete" || parsed.type === "error") && typeof parsed.id === "string") {
+            subscriptions.delete(parsed.id);
+        }
+        if (parsed.type === "next") {
+            const payload = recordOf(parsed.payload);
+            if (payload !== undefined && Array.isArray(payload.errors)) {
+                return JSON.stringify({
+                    ...parsed,
+                    payload: { ...payload, errors: payload.errors.map(maskWsError) },
+                });
+            }
+        }
+        if (parsed.type === "error" && Array.isArray(parsed.payload)) {
+            return JSON.stringify({ ...parsed, payload: parsed.payload.map(maskWsError) });
+        }
+    }
+    catch {
+        return message;
+    }
+    return message;
+}
+/**
+ * A timeout is that operation's error result. graphql-ws does not catch a rejected execute or
+ * subscribe, so a rejection would end the whole socket instead of the one operation.
+ */
+async function withWsTimeout(work, timeoutMs) {
+    if (!(work instanceof Promise) || timeoutMs === 0)
+        return work;
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve({ errors: [new GraphQLError("Execution timed out.")] }), timeoutMs);
+    });
+    try {
+        return await Promise.race([work, timeout]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
 /**
  * Build a nifra {@link WebSocketHandler} that terminates the `graphql-transport-ws` protocol. Register
  * it on a route enabled with `.use(websocket())`:
@@ -34,23 +145,38 @@ function asText(data) {
  * `graphql-ws` client to connect.
  */
 export function graphqlWebSocket(options) {
+    const limits = graphqlWsLimits(options);
+    const maxSubscriptions = options.maxSubscriptions ?? 20;
+    assertWsNumber(maxSubscriptions, "maxSubscriptions", 1);
+    const executionTimeoutMs = options.executionTimeoutMs ?? 10_000;
+    assertWsNumber(executionTimeoutMs, "executionTimeoutMs", 0);
+    const executeWithTimeout = (args) => withWsTimeout(execute(args), executionTimeoutMs);
+    const subscribeWithTimeout = (args) => withWsTimeout(subscribe(args), executionTimeoutMs);
     const gqlServer = makeServer({
+        // Keep the raw escape hatch for auxiliary graphql-ws hooks, but make the package's safety
+        // controls authoritative: callers cannot accidentally replace the bounded execute/subscribe
+        // wrappers or the context/authentication seams with an unbounded implementation.
+        ...options.serverOptions,
         schema: options.schema,
-        execute,
-        subscribe,
+        execute: executeWithTimeout,
+        subscribe: subscribeWithTimeout,
         onConnect: options.onConnect
             ? async (ctx) => {
-                return await options.onConnect?.(ctx.connectionParams, ctx.extra.request);
+                try {
+                    return await options.onConnect?.(ctx.connectionParams, ctx.extra.request);
+                }
+                catch {
+                    return false;
+                }
             }
             : undefined,
         context: options.context
             ? async (ctx) => await buildContext(options.context, { request: ctx.extra.request })
             : undefined,
-        ...options.serverOptions,
     });
     return {
         upgrade(c) {
-            return { request: c.req };
+            return { request: c.req, subscriptions: new Set() };
         },
         open(ws) {
             const protocol = ws.raw?.protocol ?? GRAPHQL_TRANSPORT_WS_PROTOCOL;
@@ -58,7 +184,7 @@ export function graphqlWebSocket(options) {
             const closed = gqlServer.opened({
                 protocol,
                 send: async (data) => {
-                    ws.send(data);
+                    ws.send(outboundFrame(data, ws.data.subscriptions));
                 },
                 close: (code, reason) => {
                     ws.close(code, reason);
@@ -68,17 +194,58 @@ export function graphqlWebSocket(options) {
                 },
             }, { request: ws.data.request });
             ws.data.closed = closed;
-            ws.data.dispatch = (message) => onFrame?.(message);
+            ws.data.dispatch = async (message) => {
+                try {
+                    await onFrame?.(message);
+                }
+                catch {
+                    // graphql-ws leaves a failed frame (a throwing context builder, say) to its socket adapter.
+                    // Unhandled, the rejection would end a Bun or Node process; the protocol closes one socket.
+                    ws.close(4500, "Internal server error");
+                }
+            };
         },
         message(ws, data) {
             // Fire-and-forget: graphql-ws's per-message handler does not resolve until a subscription's
             // iterator completes (`await for await`), so awaiting it here would block every later frame on
             // this socket - including the client's `Complete` that stops the subscription. graphql-ws drives
             // its own sends and error frames from inside that loop; we only feed it inbound frames.
-            void ws.data.dispatch?.(asText(data));
+            const message = asText(data);
+            const rejected = subscriptionFrameError(message, options.schema, limits);
+            if (rejected !== undefined) {
+                ws.send(JSON.stringify({
+                    id: rejected.id,
+                    type: "error",
+                    payload: [{ message: rejected.message }],
+                }));
+                return;
+            }
+            try {
+                const frame = recordOf(JSON.parse(message));
+                if (frame?.type === "subscribe" && typeof frame.id === "string") {
+                    if (ws.data.subscriptions.size >= maxSubscriptions) {
+                        ws.send(JSON.stringify({
+                            id: frame.id,
+                            type: "error",
+                            payload: [{ message: "Subscription limit exceeded." }],
+                        }));
+                        return;
+                    }
+                    ws.data.subscriptions.add(frame.id);
+                }
+                else if (frame?.type === "complete" && typeof frame.id === "string") {
+                    ws.data.subscriptions.delete(frame.id);
+                }
+            }
+            catch {
+                // graphql-ws owns malformed protocol-frame handling; pass it through unchanged.
+            }
+            void ws.data.dispatch?.(message);
         },
         close(ws, code, reason) {
-            void ws.data.closed?.(code, reason);
+            ws.data.subscriptions.clear();
+            // The socket is gone: a failing iterator return() or onClose hook has no one left to answer.
+            void Promise.resolve(ws.data.closed?.(code, reason)).catch(() => { });
         },
     };
 }

package/dist/ws.js.map

@@ -1 +1 @@
-{"version":3,"file":"ws.js","sourceRoot":"","sources":["../src/ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,OAAO,EAAsB,SAAS,EAAE,MAAM,SAAS,CAAA;AAChE,OAAO,EAEL,6BAA6B,EAE7B,UAAU,GAEX,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,YAAY,EAA8B,MAAM,cAAc,CAAA;AA8BvE,yFAAyF;AACzF,SAAS,MAAM,CAAC,IAAyB;IACvC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAkC;IAElC,MAAM,SAAS,GAAG,UAAU,CAAgD;QAC1E,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,SAAS;QACT,SAAS,EAAE,OAAO,CAAC,SAAS;YAC1B,CAAC,CAAC,KAAK,EAAE,GAAoE,EAAE,EAAE;gBAC7E,OAAO,MAAM,OAAO,CAAC,SAAS,EAAE,CAC9B,GAAG,CAAC,gBAAoD,EACxD,GAAG,CAAC,KAAK,CAAC,OAAO,CAClB,CAAA;YACH,CAAC;YACH,CAAC,CAAC,SAAS;QACb,OAAO,EAAE,OAAO,CAAC,OAAO;YACtB,CAAC,CAAC,KAAK,EAAE,GAAoE,EAAE,EAAE,CAC7E,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACvE,CAAC,CAAC,SAAS;QACb,GAAG,OAAO,CAAC,aAAa;KACzB,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,CAAC,CAAmB;YACzB,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;QAC3B,CAAC;QAED,IAAI,CAAC,EAAuC;YAC1C,MAAM,QAAQ,GACX,EAAE,CAAC,GAAyC,EAAE,QAAQ,IAAI,6BAA6B,CAAA;YAC1F,IAAI,OAAgE,CAAA;YACpE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAC7B;gBACE,QAAQ;gBACR,IAAI,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE;oBAC3B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACf,CAAC;gBACD,KAAK,EAAE,CAAC,IAAY,EAAE,MAAc,EAAE,EAAE;oBACtC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;gBACxB,CAAC;gBACD,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;oBAChB,OAAO,GAAG,EAAE,CAAA;gBACd,CAAC;aACF,EACD,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAC7B,CAAA;YACD,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;YACvB,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAA;QAC5D,CAAC;QAED,OAAO,CAAC,EAAuC,EAAE,IAAyB;YACxE,4FAA4F;YAC5F,+FAA+F;YAC/F,iGAAiG;YACjG,wFAAwF;YACxF,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QACvC,CAAC;QAED,KAAK,CAAC,EAAuC,EAAE,IAAY,EAAE,MAAc;YACzE,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACrC,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"ws.js","sourceRoot":"","sources":["../src/ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAGL,OAAO,EACP,YAAY,EAEZ,KAAK,EACL,cAAc,EACd,SAAS,EACT,QAAQ,GACT,MAAM,SAAS,CAAA;AAChB,OAAO,EAEL,6BAA6B,EAE7B,UAAU,GAEX,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,YAAY,EAA8B,MAAM,cAAc,CAAA;AACvE,OAAO,EACL,kBAAkB,EAClB,eAAe,EAEf,aAAa,EACb,iBAAiB,GAClB,MAAM,aAAa,CAAA;AA0CpB,yFAAyF;AACzF,SAAS,MAAM,CAAC,IAAyB;IACvC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,eAAe,CAAC,OAAyB;IAChD,OAAO,aAAa,CAAC,OAAO,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,IAAY,EAAE,OAAe;IAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAAC,WAAW,IAAI,8BAA8B,OAAO,EAAE,CAAC,CAAA;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAe,EACf,MAAqB,EACrB,MAAqB;IAErB,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,QAAQ,EAAE,IAAI,KAAK,WAAW;QAAE,OAAO,SAAS,CAAA;IACpD,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAA;IACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAA;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;IAC1F,MAAM,cAAc,GAAG,OAAO,EAAE,SAAS,CAAA;IACzC,MAAM,SAAS,GACb,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IAC3F,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACvF,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAA;IACrE,CAAC;IACD,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,EAAE,SAAS,IAAI,IAAI,EAAE,MAAM,CAAC,CAAA;IACxE,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IACpE,IAAI,QAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAA;IAClG,CAAC;IACD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;IACnE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wBAAwB,EAAE,CAAA;IAClF,MAAM,UAAU,GAAG,kBAAkB,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;IACxE,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;IACtE,OAAO;QACL,OAAO,EAAE,wBAAwB;QACjC,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,aAA0B;IAChE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QAC5C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAA;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC7F,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACxC,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,SAAS,CAAC;oBACpB,GAAG,MAAM;oBACT,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;iBACjE,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,IAAoB,EACpB,SAAiB;IAEjB,IAAI,CAAC,CAAC,IAAI,YAAY,OAAO,CAAC,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9D,IAAI,KAAgD,CAAA;IACpD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,EAAE;QACvD,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,EACrE,SAAS,CACV,CAAA;IACH,CAAC,CAAC,CAAA;IACF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;IAC5C,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAkC;IAElC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAA;IACvD,cAAc,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAA;IACvD,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,MAAM,CAAA;IAC/D,cAAc,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;IAC3D,MAAM,kBAAkB,GAAmB,CAAC,IAAI,EAAE,EAAE,CAClD,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAA;IAClD,MAAM,oBAAoB,GAAqB,CAAC,IAAI,EAAE,EAAE,CACtD,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,UAAU,CAAgD;QAC1E,0FAA0F;QAC1F,4FAA4F;QAC5F,iFAAiF;QACjF,GAAG,OAAO,CAAC,aAAa;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,kBAAkB;QAC3B,SAAS,EAAE,oBAAoB;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC1B,CAAC,CAAC,KAAK,EAAE,GAAoE,EAAE,EAAE;gBAC7E,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,SAAS,EAAE,CAC9B,GAAG,CAAC,gBAAoD,EACxD,GAAG,CAAC,KAAK,CAAC,OAAO,CAClB,CAAA;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YACH,CAAC,CAAC,SAAS;QACb,OAAO,EAAE,OAAO,CAAC,OAAO;YACtB,CAAC,CAAC,KAAK,EAAE,GAAoE,EAAE,EAAE,CAC7E,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACvE,CAAC,CAAC,SAAS;KACd,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,CAAC,CAAmB;YACzB,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,GAAG,EAAE,EAAE,CAAA;QACrD,CAAC;QAED,IAAI,CAAC,EAAuC;YAC1C,MAAM,QAAQ,GACX,EAAE,CAAC,GAAyC,EAAE,QAAQ,IAAI,6BAA6B,CAAA;YAC1F,IAAI,OAAgE,CAAA;YACpE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAC7B;gBACE,QAAQ;gBACR,IAAI,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE;oBAC3B,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;gBACrD,CAAC;gBACD,KAAK,EAAE,CAAC,IAAY,EAAE,MAAc,EAAE,EAAE;oBACtC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;gBACxB,CAAC;gBACD,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;oBAChB,OAAO,GAAG,EAAE,CAAA;gBACd,CAAC;aACF,EACD,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAC7B,CAAA;YACD,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;YACvB,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,EAAE,OAAe,EAAE,EAAE;gBAC3C,IAAI,CAAC;oBACH,MAAM,OAAO,EAAE,CAAC,OAAO,CAAC,CAAA;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,4FAA4F;oBAC5F,4FAA4F;oBAC5F,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;gBACzC,CAAC;YACH,CAAC,CAAA;QACH,CAAC;QAED,OAAO,CAAC,EAAuC,EAAE,IAAyB;YACxE,4FAA4F;YAC5F,+FAA+F;YAC/F,iGAAiG;YACjG,wFAAwF;YACxF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;YAC5B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,EAAE,CAAC,IAAI,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;iBACzC,CAAC,CACH,CAAA;gBACD,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;gBAC3C,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;oBAChE,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;wBACnD,EAAE,CAAC,IAAI,CACL,IAAI,CAAC,SAAS,CAAC;4BACb,EAAE,EAAE,KAAK,CAAC,EAAE;4BACZ,IAAI,EAAE,OAAO;4BACb,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;yBACvD,CAAC,CACH,CAAA;wBACD,OAAM;oBACR,CAAC;oBACD,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC;qBAAM,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACtE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBACxC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gFAAgF;YAClF,CAAC;YACD,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;QAED,KAAK,CAAC,EAAuC,EAAE,IAAY,EAAE,MAAc;YACzE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAA;YAC7B,6FAA6F;YAC7F,KAAK,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACtE,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/graphql",
-  "version": "3.3.0",
+  "version": "4.0.0",
   "description": "Mount a GraphQL endpoint on a nifra app - a spec-compliant GraphQL-over-HTTP handler you mount at POST /graphql, graphql-ws subscriptions over nifra's native WebSocket lane, and typed nifra context piped straight into your resolvers. Uses graphql's own execute/subscribe; no server framework re-bundled.",
   "keywords": [
     "bun",
@@ -14,6 +14,9 @@
     "api"
   ],
   "type": "module",
+  "nifra": {
+    "environment": "library"
+  },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -43,7 +46,7 @@
     "build": "tsc -p tsconfig.build.json && bun run ../../scripts/fix-dts.ts dist"
   },
   "peerDependencies": {
-    "@nifrajs/core": "^3.3.0",
+    "@nifrajs/core": "^4.0.0",
     "graphql": "^17.0.0",
     "graphql-ws": "^6.0.0"
   },

package/src/http.ts

@@ -44,6 +44,14 @@ import {
   type GraphqlContextInput,
   type NifraContextLike,
 } from "./context.ts"
+import {
+  documentLimitError,
+  documentMetrics,
+  type GraphqlLimits,
+  graphqlLimits,
+  requestLimitError,
+  safeFormattedError,
+} from "./limits.ts"
 
 const DEFAULT_MAX_BODY_BYTES = 1_000_000
 const GRAPHQL_RESPONSE_JSON = "application/graphql-response+json; charset=utf-8"
@@ -64,6 +72,20 @@ export interface GraphqlHttpOptions<Context = unknown, Env = unknown> {
   readonly nifra?: NifraContextLike<Env>
   /** Maximum request body size in bytes. Default 1 MB. Rejected bodies answer 413. */
   readonly maxBodyBytes?: number
+  /** Maximum UTF-8 query size. Default 64 KiB, applied to POST and GET. */
+  readonly maxQueryBytes?: number
+  /** Maximum UTF-8 serialized variables size. Default 256 KiB. */
+  readonly maxVariablesBytes?: number
+  /** Maximum expanded field depth. Default 20. */
+  readonly maxDepth?: number
+  /** Maximum aliases in one document. Default 100. */
+  readonly maxAliases?: number
+  /** Maximum simple field complexity in one document. Default 1,000. */
+  readonly maxComplexity?: number
+  /** Maximum operation definitions in one document. Default 10. */
+  readonly maxOperations?: number
+  /** Maximum asynchronous resolver execution time. Default 10 seconds. */
+  readonly executionTimeoutMs?: number
   /** Prototype-pollution policy for the parsed JSON body. Default `"reject"`. */
   readonly protoPoisoning?: ProtoPoisoning
   /** Optional root value passed to the executor. */
@@ -80,6 +102,8 @@ export interface GraphqlHttpOptions<Context = unknown, Env = unknown> {
   readonly authorize?: (request: Request) => boolean | Promise<boolean>
   /** Emit the legacy always-200 `application/json` response shape instead of `application/graphql-response+json`. */
   readonly legacyJsonResponse?: boolean
+  /** Format request/execution errors. The default masks resolver messages and preserves request errors. */
+  readonly formatError?: (error: GraphQLError, phase: "request" | "execution") => unknown
 }
 
 /** A parsed GraphQL request payload (POST body or GET query string), before validation. */
@@ -95,6 +119,12 @@ function assertByteLimit(value: number): void {
   }
 }
 
+function assertExecutionTimeout(value: number): void {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new RangeError("GraphQL executionTimeoutMs must be a non-negative safe integer")
+  }
+}
+
 function corsFor(
   request: Request,
   allowedOrigins: readonly string[] | undefined,
@@ -136,9 +166,15 @@ function requestError(
   legacy: boolean,
   cors: Record<string, string>,
   errors?: readonly GraphQLError[],
+  formatter?: GraphqlHttpOptions["formatError"],
 ): Response {
   const payload = errors ?? [new GraphQLError(message)]
-  return graphqlResponse({ errors: payload.map((e) => e.toJSON()) }, status, legacy, cors)
+  return graphqlResponse(
+    { errors: payload.map((e) => safeFormattedError(e, "request", formatter)) },
+    status,
+    legacy,
+    cors,
+  )
 }
 
 /** Coerce a `?variables=<json>` string (GET) into an object, or throw a GraphQLError on bad JSON. */
@@ -189,18 +225,43 @@ async function run<Context, Env>(
   isGet: boolean,
   legacy: boolean,
   cors: Record<string, string>,
+  limits: GraphqlLimits,
+  executionTimeoutMs: number,
 ): Promise<Response> {
+  const requestLimit = requestLimitError(params.query, params.variables, limits)
+  if (requestLimit !== undefined) {
+    return requestError(
+      requestLimit,
+      413,
+      legacy,
+      cors,
+      [new GraphQLError(requestLimit)],
+      opts.formatError,
+    )
+  }
   let document: DocumentNode
   try {
     document = parse(new Source(params.query, "GraphQL request"))
   } catch (err) {
     const gqlErr = err instanceof GraphQLError ? err : new GraphQLError(String(err))
-    return requestError("", 400, legacy, cors, [gqlErr])
+    return requestError("", 400, legacy, cors, [gqlErr], opts.formatError)
   }
 
   const validationErrors = validate(opts.schema, document, specifiedRules)
   if (validationErrors.length > 0) {
-    return requestError("", 400, legacy, cors, validationErrors)
+    return requestError("", 400, legacy, cors, validationErrors, opts.formatError)
+  }
+
+  const documentLimit = documentLimitError(documentMetrics(document), limits)
+  if (documentLimit !== undefined) {
+    return requestError(
+      documentLimit,
+      400,
+      legacy,
+      cors,
+      [new GraphQLError(documentLimit)],
+      opts.formatError,
+    )
   }
 
   // GET is idempotent and cacheable, so per the GraphQL-over-HTTP spec it may run queries only.
@@ -212,6 +273,7 @@ async function run<Context, Env>(
       legacy,
       { ...cors, allow: "POST" },
       [new GraphQLError("Only query operations are allowed over GET.")],
+      opts.formatError,
     )
   }
 
@@ -223,26 +285,74 @@ async function run<Context, Env>(
   } catch (err) {
     const gqlErr =
       err instanceof GraphQLError ? err : new GraphQLError("Failed to build request context.")
-    return graphqlResponse({ errors: [gqlErr.toJSON()] }, 500, legacy, cors)
+    return graphqlResponse(
+      { errors: [safeFormattedError(gqlErr, "execution", opts.formatError)] },
+      500,
+      legacy,
+      cors,
+    )
   }
 
   let result: ExecutionResult
   try {
-    result = (await execute({
+    const execution = execute({
       schema: opts.schema,
       document,
       rootValue: opts.rootValue,
       contextValue,
       variableValues: params.variables ?? undefined,
       operationName: params.operationName ?? undefined,
-    })) as ExecutionResult
+    })
+    result = (await withExecutionTimeout(execution, executionTimeoutMs)) as ExecutionResult
   } catch (err) {
-    const gqlErr = err instanceof GraphQLError ? err : new GraphQLError("Execution failed.")
-    return graphqlResponse({ errors: [gqlErr.toJSON()] }, 400, legacy, cors)
+    const gqlErr =
+      err instanceof GraphQLError
+        ? err
+        : err instanceof ExecutionTimeoutError
+          ? new GraphQLError("Execution timed out.")
+          : new GraphQLError("Execution failed.")
+    return graphqlResponse(
+      { errors: [safeFormattedError(gqlErr, "execution", opts.formatError)] },
+      err instanceof ExecutionTimeoutError ? 504 : 500,
+      legacy,
+      cors,
+    )
   }
 
   // Field/execution errors are a normal 200 result with both `data` and `errors`.
-  return graphqlResponse(result, 200, legacy, cors)
+  return graphqlResponse(
+    result.errors === undefined
+      ? result
+      : {
+          ...result,
+          errors: result.errors.map((error) =>
+            safeFormattedError(error, "execution", opts.formatError),
+          ),
+        },
+    200,
+    legacy,
+    cors,
+  )
+}
+
+class ExecutionTimeoutError extends Error {
+  constructor() {
+    super("GraphQL execution timed out")
+    this.name = "ExecutionTimeoutError"
+  }
+}
+
+async function withExecutionTimeout<T>(work: T | Promise<T>, timeoutMs: number): Promise<T> {
+  if (!(work instanceof Promise) || timeoutMs === 0) return work
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const timeout = new Promise<T>((_, reject) => {
+    timer = setTimeout(() => reject(new ExecutionTimeoutError()), timeoutMs)
+  })
+  try {
+    return await Promise.race([work, timeout])
+  } finally {
+    if (timer !== undefined) clearTimeout(timer)
+  }
 }
 
 /**
@@ -256,6 +366,9 @@ export async function respondGraphql<Context = unknown, Env = unknown>(
 ): Promise<Response> {
   const maxBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES
   assertByteLimit(maxBytes)
+  const limits: GraphqlLimits = graphqlLimits(options)
+  const executionTimeoutMs = options.executionTimeoutMs ?? 10_000
+  assertExecutionTimeout(executionTimeoutMs)
   const legacy = options.legacyJsonResponse === true
 
   const cors = corsFor(request, options.allowedOrigins)
@@ -266,7 +379,14 @@ export async function respondGraphql<Context = unknown, Env = unknown>(
   if (options.authorize !== undefined) {
     const ok = await options.authorize(request)
     if (!ok) {
-      return requestError("Unauthorized.", 401, legacy, cors, [new GraphQLError("Unauthorized.")])
+      return requestError(
+        "Unauthorized.",
+        401,
+        legacy,
+        cors,
+        [new GraphQLError("Unauthorized.")],
+        options.formatError,
+      )
     }
   }
 
@@ -276,15 +396,20 @@ export async function respondGraphql<Context = unknown, Env = unknown>(
       params = paramsFromQuery(queryObjectOf(searchOf(request.url)) as Record<string, unknown>)
     } catch (err) {
       const gqlErr = err instanceof GraphQLError ? err : new GraphQLError(String(err))
-      return requestError("", 400, legacy, cors, [gqlErr])
+      return requestError("", 400, legacy, cors, [gqlErr], options.formatError)
     }
-    return run(params, request, options, true, legacy, cors)
+    return run(params, request, options, true, legacy, cors, limits, executionTimeoutMs)
   }
 
   if (request.method !== "POST") {
-    return requestError("Method not allowed.", 405, legacy, { ...cors, allow: "GET, POST" }, [
-      new GraphQLError("Only GET and POST are supported."),
-    ])
+    return requestError(
+      "Method not allowed.",
+      405,
+      legacy,
+      { ...cors, allow: "GET, POST" },
+      [new GraphQLError("Only GET and POST are supported.")],
+      options.formatError,
+    )
   }
 
   // Read the JSON body through core's single bounded + proto-guarded framing lane.
@@ -298,9 +423,9 @@ export async function respondGraphql<Context = unknown, Env = unknown>(
         params = paramsFromBody(parsed)
       } catch (err) {
         const gqlErr = err instanceof GraphQLError ? err : new GraphQLError(String(err))
-        return requestError("", 400, legacy, cors, [gqlErr])
+        return requestError("", 400, legacy, cors, [gqlErr], options.formatError)
       }
-      return run(params, request, options, false, legacy, cors)
+      return run(params, request, options, false, legacy, cors, limits, executionTimeoutMs)
     },
     (response: Response | ResponseResult) => {
       // readBodyFramed's own rejections (413 too-large, 415, proto-guard) - render + attach CORS.
@@ -311,9 +436,14 @@ export async function respondGraphql<Context = unknown, Env = unknown>(
     (err: unknown) => {
       // A body that failed to read (bad JSON / proto-guard) is a request error, not a crash.
       if (err instanceof Response) return err
-      return requestError("Invalid request body.", 400, legacy, cors, [
-        new GraphQLError("Request body could not be read as JSON."),
-      ])
+      return requestError(
+        "Invalid request body.",
+        400,
+        legacy,
+        cors,
+        [new GraphQLError("Request body could not be read as JSON.")],
+        options.formatError,
+      )
     },
   ).catch(() => plainErrorResponse(cors))
 }