@nxgt/janus-graphql 0.6.1 → 0.6.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/guide/errors.md +23 -0
- package/package.json +3 -3
package/docs/guide/errors.md
CHANGED
|
@@ -187,6 +187,29 @@ changes the limit; keep its `window` no longer than the shortest `tokens.*`
|
|
|
187
187
|
lifetime you use. `@nxgt/janus` never sees IP addresses: add a per-IP ceiling
|
|
188
188
|
with `@nxgt/redis` rate limits.
|
|
189
189
|
|
|
190
|
+
A mutation that sends the e-mail off the request — so its time does not tell
|
|
191
|
+
whether the address has an account — calls `prepare` in the resolver and the
|
|
192
|
+
`send()` of its answer after it, so `MAIL_THROTTLED` still reaches the client
|
|
193
|
+
(`@nxgt/janus` 0.20):
|
|
194
|
+
|
|
195
|
+
```ts
|
|
196
|
+
const resolvers = {
|
|
197
|
+
Mutation: {
|
|
198
|
+
async requestSignInLink(_: unknown, { email }: { email: string }) {
|
|
199
|
+
const pending = await auth.magicLink.prepare(email); // counted, nobody looked up: MAIL_THROTTLED → 429
|
|
200
|
+
void pending
|
|
201
|
+
.send() // looked up and issued after the answer; once — a second send() is a TypeError
|
|
202
|
+
.then((issued) => issued && mailer.send(issued.email, linkTo(issued.token)))
|
|
203
|
+
.catch(reportError);
|
|
204
|
+
return true; // the same answer for every address
|
|
205
|
+
},
|
|
206
|
+
},
|
|
207
|
+
};
|
|
208
|
+
```
|
|
209
|
+
|
|
210
|
+
`signInCode.prepare` and `resetPassword.prepare` work the same way; see
|
|
211
|
+
[requests in two steps](https://github.com/softistx/nxgt-janus/blob/develop/packages/janus/docs/guide/email-flows.md#requests-in-two-steps).
|
|
212
|
+
|
|
190
213
|
What the throttle does not see is one password tried against many logins:
|
|
191
214
|
limit a sign-in mutation **per client address** as well, in the resolver,
|
|
192
215
|
with the limiter you already run:
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@nxgt/janus-graphql",
|
|
3
|
-
"version": "0.6.
|
|
3
|
+
"version": "0.6.3",
|
|
4
4
|
"description": "GraphQL for @nxgt/janus: an envelop plugin with the signed-in user on the context, fields guarded by @authenticated, @fresh and @permission, and every error with the status it deserves",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -55,7 +55,7 @@
|
|
|
55
55
|
"devDependencies": {
|
|
56
56
|
"@envelop/core": "^5.6.1",
|
|
57
57
|
"@graphql-tools/utils": "^12.0.1",
|
|
58
|
-
"@nxgt/janus": "^0.
|
|
58
|
+
"@nxgt/janus": "^0.21.0",
|
|
59
59
|
"@types/bun": "^1.4.2",
|
|
60
60
|
"@types/ws": "^8.18.1",
|
|
61
61
|
"graphql": "^17.0.2",
|
|
@@ -67,7 +67,7 @@
|
|
|
67
67
|
"peerDependencies": {
|
|
68
68
|
"@envelop/core": "^5.0.0",
|
|
69
69
|
"@graphql-tools/utils": ">=10.0.0 <13",
|
|
70
|
-
"@nxgt/janus": "^0.
|
|
70
|
+
"@nxgt/janus": "^0.21.0",
|
|
71
71
|
"graphql": "^16.9.0 || ^17.0.0",
|
|
72
72
|
"graphql-ws": "^6.0.0",
|
|
73
73
|
"typescript": "^6.0.3"
|