@strapi/plugin-graphql 4.7.0 → 4.7.2-exp.175f7ac70ee76d6c825e4429e15fc85ee78d23bb

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/plugin-graphql",
-  "version": "4.7.0",
+  "version": "4.7.2-exp.175f7ac70ee76d6c825e4429e15fc85ee78d23bb",
   "description": "Adds GraphQL endpoint with default API methods.",
   "repository": {
     "type": "git",
@@ -29,7 +29,10 @@
   "dependencies": {
     "@graphql-tools/schema": "8.5.1",
     "@graphql-tools/utils": "^8.12.0",
-    "@strapi/utils": "4.7.0",
+    "@strapi/design-system": "1.6.3",
+    "@strapi/helper-plugin": "4.7.2-exp.175f7ac70ee76d6c825e4429e15fc85ee78d23bb",
+    "@strapi/icons": "1.6.3",
+    "@strapi/utils": "4.7.2-exp.175f7ac70ee76d6c825e4429e15fc85ee78d23bb",
     "apollo-server-core": "3.11.1",
     "apollo-server-koa": "3.10.0",
     "glob": "^7.1.7",
@@ -46,10 +49,18 @@
   },
   "devDependencies": {
     "cross-env": "^7.0.3",
-    "koa": "^2.13.4"
+    "koa": "^2.13.4",
+    "react": "^17.0.2",
+    "react-dom": "^17.0.2",
+    "react-router-dom": "5.3.4",
+    "styled-components": "5.3.3"
   },
   "peerDependencies": {
-    "@strapi/strapi": "^4.0.0"
+    "@strapi/strapi": "^4.0.0",
+    "react": "^17.0.2",
+    "react-dom": "^17.0.2",
+    "react-router-dom": "5.3.4",
+    "styled-components": "5.3.3"
   },
   "engines": {
     "node": ">=14.19.1 <=18.x.x",
@@ -61,5 +72,5 @@
     "description": "Adds GraphQL endpoint with default API methods.",
     "kind": "plugin"
   },
-  "gitHead": "948dbb3121330ffd43f3a4f55522c797770e0b2a"
+  "gitHead": "175f7ac70ee76d6c825e4429e15fc85ee78d23bb"
 }

package/server/services/builders/mutations/collection-type.js

@@ -123,14 +123,14 @@ module.exports = ({ strapi }) => {
         // ...uniqueAttributes,
       },
 
-      async resolve(parent, args) {
+      async resolve(parent, args, ctx) {
         const transformedArgs = transformArgs(args, { contentType });
 
         const { delete: deleteResolver } = getService('builders')
           .get('content-api')
           .buildMutationsResolvers({ contentType });
 
-        const value = await deleteResolver(parent, args);
+        const value = await deleteResolver(parent, args, ctx);
 
         return toEntityResponse(value, { args: transformedArgs, resourceUID: uid });
       },

package/server/services/builders/mutations/single-type.js

@@ -53,8 +53,15 @@ module.exports = ({ strapi }) => {
           .get('content-api')
           .buildMutationsResolvers({ contentType });
 
-        const findParams = omit(['data', 'files'], transformedArgs);
-        const entity = await strapi.entityService.findMany(uid, findParams);
+        const sanitizedParams = await sanitize.contentAPI.params(
+          omit(['data', 'files'], transformedArgs),
+          contentType,
+          {
+            auth,
+          }
+        );
+
+        const entity = await strapi.entityService.findMany(uid, sanitizedParams);
 
         // Create or update
         const value = isNil(entity)
@@ -77,14 +84,18 @@ module.exports = ({ strapi }) => {
 
       args: {},
 
-      async resolve(parent, args) {
+      async resolve(parent, args, ctx) {
         const transformedArgs = transformArgs(args, { contentType });
 
         const { delete: deleteResolver } = getService('builders')
           .get('content-api')
           .buildMutationsResolvers({ contentType });
 
-        const entity = await strapi.entityService.findMany(uid, transformedArgs);
+        const sanitizedParams = await sanitize.contentAPI.params(transformedArgs, contentType, {
+          auth: ctx?.state?.auth,
+        });
+
+        const entity = await strapi.entityService.findMany(uid, sanitizedParams);
 
         if (!entity) {
           throw new NotFoundError('Entity not found');

package/server/services/builders/queries/collection-type.js

@@ -72,14 +72,15 @@ module.exports = ({ strapi }) => {
 
       args: getContentTypeArgs(contentType, { multiple: false }),
 
-      async resolve(parent, args) {
+      async resolve(parent, args, ctx) {
         const transformedArgs = transformArgs(args, { contentType });
 
         const { findOne } = getService('builders')
           .get('content-api')
           .buildQueriesResolvers({ contentType });
 
-        const value = findOne(parent, transformedArgs);
+        // queryResolvers will sanitize params
+        const value = findOne(parent, transformedArgs, ctx);
 
         return toEntityResponse(value, { args: transformedArgs, resourceUID: uid });
       },
@@ -102,14 +103,15 @@ module.exports = ({ strapi }) => {
 
       args: getContentTypeArgs(contentType),
 
-      async resolve(parent, args) {
+      async resolve(parent, args, ctx) {
         const transformedArgs = transformArgs(args, { contentType, usePagination: true });
 
         const { find } = getService('builders')
           .get('content-api')
           .buildQueriesResolvers({ contentType });
 
-        const nodes = await find(parent, transformedArgs);
+        // queryResolvers will sanitize params
+        const nodes = await find(parent, transformedArgs, ctx);
 
         return toEntityResponseCollection(nodes, { args: transformedArgs, resourceUID: uid });
       },

package/server/services/builders/queries/single-type.js

@@ -52,14 +52,15 @@ module.exports = ({ strapi }) => {
 
       args: getContentTypeArgs(contentType),
 
-      async resolve(parent, args) {
+      async resolve(parent, args, ctx) {
         const transformedArgs = transformArgs(args, { contentType });
 
         const queriesResolvers = getService('builders')
           .get('content-api')
           .buildQueriesResolvers({ contentType });
 
-        const value = queriesResolvers.find(parent, transformedArgs);
+        // queryResolvers will sanitize params
+        const value = queriesResolvers.find(parent, transformedArgs, ctx);
 
         return toEntityResponse(value, { args: transformedArgs, resourceUID: uid });
       },

package/server/services/builders/resolvers/association.js

@@ -41,15 +41,23 @@ module.exports = ({ strapi }) => {
           usePagination: true,
         });
 
+        const sanitizedParams = await sanitize.contentAPI.params(
+          transformedArgs,
+          targetContentType,
+          {
+            auth,
+          }
+        );
+
         const data = await strapi.entityService.load(
           contentTypeUID,
           parent,
           attributeName,
-          transformedArgs
+          sanitizedParams
         );
 
         const info = {
-          args: transformedArgs,
+          args: sanitizedParams,
           resourceUID: targetUID,
         };
 

package/server/services/builders/resolvers/component.js

@@ -1,18 +1,22 @@
 'use strict';
 
+const { sanitize } = require('@strapi/utils');
+
 module.exports = ({ strapi }) => ({
   buildComponentResolver({ contentTypeUID, attributeName }) {
     const { transformArgs } = strapi.plugin('graphql').service('builders').utils;
 
-    return async (parent, args = {}) => {
+    return async (parent, args = {}, ctx) => {
       const contentType = strapi.getModel(contentTypeUID);
 
       const { component: componentName } = contentType.attributes[attributeName];
       const component = strapi.getModel(componentName);
 
       const transformedArgs = transformArgs(args, { contentType: component, usePagination: true });
-
-      return strapi.entityService.load(contentTypeUID, parent, attributeName, transformedArgs);
+      const sanitizedParams = await sanitize.contentAPI.params(transformedArgs, contentType, {
+        auth: ctx?.state?.auth,
+      });
+      return strapi.entityService.load(contentTypeUID, parent, attributeName, sanitizedParams);
     };
   },
 });

package/server/services/builders/resolvers/mutation.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { pick } = require('lodash/fp');
+const { sanitize } = require('@strapi/utils');
 
 const pickCreateArgs = pick(['params', 'data', 'files']);
 
@@ -19,14 +20,15 @@ module.exports = ({ strapi }) => ({
 
       async update(parent, args) {
         const { id, data } = args;
-
         return strapi.entityService.update(uid, id, { data });
       },
 
-      async delete(parent, args) {
+      async delete(parent, args, ctx) {
         const { id, ...rest } = args;
-
-        return strapi.entityService.delete(uid, id, rest);
+        const sanitizedParams = sanitize.contentAPI.params(rest, contentType, {
+          auth: ctx?.state?.auth,
+        });
+        return strapi.entityService.delete(uid, id, sanitizedParams);
       },
     };
   },

package/server/services/builders/resolvers/query.js

@@ -1,18 +1,27 @@
 'use strict';
 
 const { omit } = require('lodash/fp');
+const { sanitize } = require('@strapi/utils');
 
 module.exports = ({ strapi }) => ({
   buildQueriesResolvers({ contentType }) {
     const { uid } = contentType;
 
     return {
-      async find(parent, args) {
-        return strapi.entityService.findMany(uid, args);
+      async find(parent, args, ctx) {
+        const sanitizedParams = await sanitize.contentAPI.params(args, contentType, {
+          auth: ctx?.state?.auth,
+        });
+
+        return strapi.entityService.findMany(uid, sanitizedParams);
       },
 
-      async findOne(parent, args) {
-        return strapi.entityService.findOne(uid, args.id, omit('id', args));
+      async findOne(parent, args, ctx) {
+        const sanitizedParams = await sanitize.contentAPI.params(args, contentType, {
+          auth: ctx?.state?.auth,
+        });
+
+        return strapi.entityService.findOne(uid, args.id, omit('id', sanitizedParams));
       },
     };
   },

package/server/services/internals/types/response-collection-meta.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { objectType } = require('nexus');
+const { sanitize } = require('@strapi/utils');
 
 module.exports = ({ strapi }) => {
   const { RESPONSE_COLLECTION_META_TYPE_NAME, PAGINATION_TYPE_NAME } = strapi
@@ -20,12 +21,15 @@ module.exports = ({ strapi }) => {
         t.nonNull.field('pagination', {
           type: PAGINATION_TYPE_NAME,
 
-          async resolve(parent) {
+          async resolve(parent, _childArgs, ctx) {
             const { args, resourceUID } = parent;
             const { start, limit } = args;
             const safeLimit = Math.max(limit, 1);
 
-            const total = await strapi.entityService.count(resourceUID, args);
+            const filteredArgs = await sanitize.contentAPI.params(args, parent.contentType, {
+              auth: ctx?.state?.auth,
+            });
+            const total = await strapi.entityService.count(resourceUID, filteredArgs);
             const pageSize = limit === -1 ? total - start : safeLimit;
             const pageCount = limit === -1 ? safeLimit : Math.ceil(total / safeLimit);
             const page = limit === -1 ? safeLimit : Math.floor(start / safeLimit) + 1;