@strapi/plugin-graphql 4.9.0-alpha.0 → 4.9.0-beta.2

package/admin/src/translations/dk.json

@@ -1,4 +1,5 @@
 {
   "plugin.description.long": "Tilføjer GraphQL endpoint med standard API metoder.",
-  "plugin.description.short": "Tilføjer GraphQL endpoint med standard API metoder."
+  "plugin.description.short": "Tilføjer GraphQL endpoint med standard API metoder.",
+  "plugin.name": "GraphQL"
 }

package/admin/src/translations/en.json

@@ -1,4 +1,5 @@
 {
   "plugin.description.long": "Adds GraphQL endpoint with default API methods.",
-  "plugin.description.short": "Adds GraphQL endpoint with default API methods."
+  "plugin.description.short": "Adds GraphQL endpoint with default API methods.",
+  "plugin.name": "GraphQL"
 }

package/admin/src/translations/es.json

@@ -1,4 +1,5 @@
 {
   "plugin.description.long": "Agrega un endpoint GraphQL con métodos de API predeterminados.",
-  "plugin.description.short": "Agrega un endpoint GraphQL con métodos de API predeterminados."
+  "plugin.description.short": "Agrega un endpoint GraphQL con métodos de API predeterminados.",
+  "plugin.name": "GraphQL"
 }

package/admin/src/translations/fr.json

@@ -1,4 +1,5 @@
 {
   "plugin.description.long": "Crée un endpoint GraphQL supportant les méthodes par défaut de l'API.",
-  "plugin.description.short": "Crée un endpoint GraphQL supportant les méthodes par défaut de l'API."
+  "plugin.description.short": "Crée un endpoint GraphQL supportant les méthodes par défaut de l'API.",
+  "plugin.name": "GraphQL"
 }

package/admin/src/translations/pl.json

@@ -1,4 +1,5 @@
 {
   "plugin.description.long": "Dodaje GraphQL endpoint z domyślnymi metodami API.",
-  "plugin.description.short": "Dodaje GraphQL endpoint z domyślnymi metodami API."
+  "plugin.description.short": "Dodaje GraphQL endpoint z domyślnymi metodami API.",
+  "plugin.name": "GraphQL"
 }

package/admin/src/translations/ru.json

@@ -0,0 +1,5 @@
+{
+  "plugin.description.long": "Добавляет конечную точку для GraphQL с методами API по умолчанию.",
+  "plugin.description.short": "Добавляет конечную точку для GraphQL с методами API по умолчанию.",
+  "plugin.name": "GraphQL"
+}

package/admin/src/translations/sv.json

@@ -1,4 +1,5 @@
 {
   "plugin.description.long": "Lägger till en GraphQL-rutt med standard API-metoder.",
-  "plugin.description.short": "Lägger till en GraphQL-rutt med standard API-metoder."
+  "plugin.description.short": "Lägger till en GraphQL-rutt med standard API-metoder.",
+  "plugin.name": "GraphQL"
 }

package/admin/src/translations/tr.json

@@ -1,4 +1,5 @@
 {
   "plugin.description.long": "Varsayılan API metodları ile bir GraphQL uç noktası ekler.",
-  "plugin.description.short": "Varsayılan API metodları ile bir GraphQL uç noktası ekler."
+  "plugin.description.short": "Varsayılan API metodları ile bir GraphQL uç noktası ekler.",
+  "plugin.name": "GraphQL"
 }

package/admin/src/translations/zh-Hans.json

@@ -1,4 +1,5 @@
 {
   "plugin.description.long": "为默认API方法添加GraphQL端点",
-  "plugin.description.short": "为默认API方法添加GraphQL端点"
+  "plugin.description.short": "为默认API方法添加GraphQL端点",
+  "plugin.name": "GraphQL"
 }

package/admin/src/translations/zh.json

@@ -1,4 +1,5 @@
 {
   "plugin.description.long": "新增使用預設 API 方法的 GraphQL 端點。",
-  "plugin.description.short": "新增使用預設 API 方法的 GraphQL 端點。"
+  "plugin.description.short": "新增使用預設 API 方法的 GraphQL 端點。",
+  "plugin.name": "GraphQL"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/plugin-graphql",
-  "version": "4.9.0-alpha.0",
+  "version": "4.9.0-beta.2",
   "description": "Adds GraphQL endpoint with default API methods.",
   "repository": {
     "type": "git",
@@ -29,7 +29,10 @@
   "dependencies": {
     "@graphql-tools/schema": "8.5.1",
     "@graphql-tools/utils": "^8.12.0",
-    "@strapi/utils": "4.9.0-alpha.0",
+    "@strapi/design-system": "1.6.6",
+    "@strapi/helper-plugin": "4.9.0-beta.2",
+    "@strapi/icons": "1.6.6",
+    "@strapi/utils": "4.9.0-beta.2",
     "apollo-server-core": "3.11.1",
     "apollo-server-koa": "3.10.0",
     "glob": "^7.1.7",
@@ -41,15 +44,22 @@
     "koa-compose": "^4.1.0",
     "lodash": "4.17.21",
     "nexus": "1.3.0",
-    "pluralize": "^8.0.0",
-    "subscriptions-transport-ws": "0.9.19"
+    "pluralize": "^8.0.0"
   },
   "devDependencies": {
     "cross-env": "^7.0.3",
-    "koa": "^2.13.4"
+    "koa": "^2.13.4",
+    "react": "^17.0.2",
+    "react-dom": "^17.0.2",
+    "react-router-dom": "5.3.4",
+    "styled-components": "5.3.3"
   },
   "peerDependencies": {
-    "@strapi/strapi": "^4.0.0"
+    "@strapi/strapi": "^4.0.0",
+    "react": "^17.0.2",
+    "react-dom": "^17.0.2",
+    "react-router-dom": "5.3.4",
+    "styled-components": "5.3.3"
   },
   "engines": {
     "node": ">=14.19.1 <=18.x.x",
@@ -61,5 +71,5 @@
     "description": "Adds GraphQL endpoint with default API methods.",
     "kind": "plugin"
   },
-  "gitHead": "35f783d0dc07db101e7e62cb4d682f751551f452"
+  "gitHead": "d893ead642592a15a95fefb71c544aaabe4db20b"
 }

package/server/bootstrap.js

@@ -1,8 +1,6 @@
 'use strict';
 
 const { isEmpty, mergeWith, isArray } = require('lodash/fp');
-const { execute, subscribe } = require('graphql');
-const { SubscriptionServer } = require('subscriptions-transport-ws');
 const { ApolloServer } = require('apollo-server-koa');
 const {
   ApolloServerPluginLandingPageDisabled,
@@ -81,24 +79,6 @@ module.exports = async ({ strapi }) => {
 
   const serverConfig = merge(defaultServerConfig, config('apolloServer'));
 
-  // Handle subscriptions
-  if (config('subscriptions')) {
-    const subscriptionServer = SubscriptionServer.create(
-      { schema, execute, subscribe },
-      { server: strapi.server.httpServer, path }
-    );
-
-    serverConfig.plugins.push({
-      async serverWillStart() {
-        return {
-          async drainServer() {
-            subscriptionServer.close();
-          },
-        };
-      },
-    });
-  }
-
   // Create a new Apollo server
   const server = new ApolloServer(serverConfig);
 

package/server/services/builders/mutations/collection-type.js

@@ -123,14 +123,14 @@ module.exports = ({ strapi }) => {
         // ...uniqueAttributes,
       },
 
-      async resolve(parent, args) {
+      async resolve(parent, args, ctx) {
         const transformedArgs = transformArgs(args, { contentType });
 
         const { delete: deleteResolver } = getService('builders')
           .get('content-api')
           .buildMutationsResolvers({ contentType });
 
-        const value = await deleteResolver(parent, args);
+        const value = await deleteResolver(parent, args, ctx);
 
         return toEntityResponse(value, { args: transformedArgs, resourceUID: uid });
       },

package/server/services/builders/mutations/single-type.js

@@ -53,8 +53,15 @@ module.exports = ({ strapi }) => {
           .get('content-api')
           .buildMutationsResolvers({ contentType });
 
-        const findParams = omit(['data', 'files'], transformedArgs);
-        const entity = await strapi.entityService.findMany(uid, findParams);
+        const sanitizedQuery = await sanitize.contentAPI.query(
+          omit(['data', 'files'], transformedArgs),
+          contentType,
+          {
+            auth,
+          }
+        );
+
+        const entity = await strapi.entityService.findMany(uid, sanitizedQuery);
 
         // Create or update
         const value = isNil(entity)
@@ -77,14 +84,18 @@ module.exports = ({ strapi }) => {
 
       args: {},
 
-      async resolve(parent, args) {
+      async resolve(parent, args, ctx) {
         const transformedArgs = transformArgs(args, { contentType });
 
         const { delete: deleteResolver } = getService('builders')
           .get('content-api')
           .buildMutationsResolvers({ contentType });
 
-        const entity = await strapi.entityService.findMany(uid, transformedArgs);
+        const sanitizedQuery = await sanitize.contentAPI.query(transformedArgs, contentType, {
+          auth: ctx?.state?.auth,
+        });
+
+        const entity = await strapi.entityService.findMany(uid, sanitizedQuery);
 
         if (!entity) {
           throw new NotFoundError('Entity not found');

package/server/services/builders/queries/collection-type.js

@@ -72,14 +72,15 @@ module.exports = ({ strapi }) => {
 
       args: getContentTypeArgs(contentType, { multiple: false }),
 
-      async resolve(parent, args) {
+      async resolve(parent, args, ctx) {
         const transformedArgs = transformArgs(args, { contentType });
 
         const { findOne } = getService('builders')
           .get('content-api')
           .buildQueriesResolvers({ contentType });
 
-        const value = findOne(parent, transformedArgs);
+        // queryResolvers will sanitize params
+        const value = findOne(parent, transformedArgs, ctx);
 
         return toEntityResponse(value, { args: transformedArgs, resourceUID: uid });
       },
@@ -102,14 +103,15 @@ module.exports = ({ strapi }) => {
 
       args: getContentTypeArgs(contentType),
 
-      async resolve(parent, args) {
+      async resolve(parent, args, ctx) {
         const transformedArgs = transformArgs(args, { contentType, usePagination: true });
 
         const { find } = getService('builders')
           .get('content-api')
           .buildQueriesResolvers({ contentType });
 
-        const nodes = await find(parent, transformedArgs);
+        // queryResolvers will sanitize params
+        const nodes = await find(parent, transformedArgs, ctx);
 
         return toEntityResponseCollection(nodes, { args: transformedArgs, resourceUID: uid });
       },

package/server/services/builders/queries/single-type.js

@@ -52,14 +52,15 @@ module.exports = ({ strapi }) => {
 
       args: getContentTypeArgs(contentType),
 
-      async resolve(parent, args) {
+      async resolve(parent, args, ctx) {
         const transformedArgs = transformArgs(args, { contentType });
 
         const queriesResolvers = getService('builders')
           .get('content-api')
           .buildQueriesResolvers({ contentType });
 
-        const value = queriesResolvers.find(parent, transformedArgs);
+        // queryResolvers will sanitize params
+        const value = queriesResolvers.find(parent, transformedArgs, ctx);
 
         return toEntityResponse(value, { args: transformedArgs, resourceUID: uid });
       },

package/server/services/builders/resolvers/association.js

@@ -41,15 +41,19 @@ module.exports = ({ strapi }) => {
           usePagination: true,
         });
 
+        const sanitizedQuery = await sanitize.contentAPI.query(transformedArgs, targetContentType, {
+          auth,
+        });
+
         const data = await strapi.entityService.load(
           contentTypeUID,
           parent,
           attributeName,
-          transformedArgs
+          sanitizedQuery
         );
 
         const info = {
-          args: transformedArgs,
+          args: sanitizedQuery,
           resourceUID: targetUID,
         };
 

package/server/services/builders/resolvers/component.js

@@ -1,18 +1,22 @@
 'use strict';
 
+const { sanitize } = require('@strapi/utils');
+
 module.exports = ({ strapi }) => ({
   buildComponentResolver({ contentTypeUID, attributeName }) {
     const { transformArgs } = strapi.plugin('graphql').service('builders').utils;
 
-    return async (parent, args = {}) => {
+    return async (parent, args = {}, ctx) => {
       const contentType = strapi.getModel(contentTypeUID);
 
       const { component: componentName } = contentType.attributes[attributeName];
       const component = strapi.getModel(componentName);
 
       const transformedArgs = transformArgs(args, { contentType: component, usePagination: true });
-
-      return strapi.entityService.load(contentTypeUID, parent, attributeName, transformedArgs);
+      const sanitizedQuery = await sanitize.contentAPI.query(transformedArgs, contentType, {
+        auth: ctx?.state?.auth,
+      });
+      return strapi.entityService.load(contentTypeUID, parent, attributeName, sanitizedQuery);
     };
   },
 });

package/server/services/builders/resolvers/mutation.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { pick } = require('lodash/fp');
+const { sanitize } = require('@strapi/utils');
 
 const pickCreateArgs = pick(['params', 'data', 'files']);
 
@@ -19,14 +20,15 @@ module.exports = ({ strapi }) => ({
 
       async update(parent, args) {
         const { id, data } = args;
-
         return strapi.entityService.update(uid, id, { data });
       },
 
-      async delete(parent, args) {
+      async delete(parent, args, ctx) {
         const { id, ...rest } = args;
-
-        return strapi.entityService.delete(uid, id, rest);
+        const sanitizedQuery = sanitize.contentAPI.query(rest, contentType, {
+          auth: ctx?.state?.auth,
+        });
+        return strapi.entityService.delete(uid, id, sanitizedQuery);
       },
     };
   },

package/server/services/builders/resolvers/query.js

@@ -1,18 +1,27 @@
 'use strict';
 
 const { omit } = require('lodash/fp');
+const { sanitize } = require('@strapi/utils');
 
 module.exports = ({ strapi }) => ({
   buildQueriesResolvers({ contentType }) {
     const { uid } = contentType;
 
     return {
-      async find(parent, args) {
-        return strapi.entityService.findMany(uid, args);
+      async find(parent, args, ctx) {
+        const sanitizedQuery = await sanitize.contentAPI.query(args, contentType, {
+          auth: ctx?.state?.auth,
+        });
+
+        return strapi.entityService.findMany(uid, sanitizedQuery);
       },
 
-      async findOne(parent, args) {
-        return strapi.entityService.findOne(uid, args.id, omit('id', args));
+      async findOne(parent, args, ctx) {
+        const sanitizedQuery = await sanitize.contentAPI.query(args, contentType, {
+          auth: ctx?.state?.auth,
+        });
+
+        return strapi.entityService.findOne(uid, args.id, omit('id', sanitizedQuery));
       },
     };
   },

package/server/services/internals/types/response-collection-meta.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { objectType } = require('nexus');
+const { sanitize } = require('@strapi/utils');
 
 module.exports = ({ strapi }) => {
   const { RESPONSE_COLLECTION_META_TYPE_NAME, PAGINATION_TYPE_NAME } = strapi
@@ -20,12 +21,15 @@ module.exports = ({ strapi }) => {
         t.nonNull.field('pagination', {
           type: PAGINATION_TYPE_NAME,
 
-          async resolve(parent) {
+          async resolve(parent, _childArgs, ctx) {
             const { args, resourceUID } = parent;
             const { start, limit } = args;
             const safeLimit = Math.max(limit, 1);
 
-            const total = await strapi.entityService.count(resourceUID, args);
+            const sanitizedQuery = await sanitize.contentAPI.query(args, parent.contentType, {
+              auth: ctx?.state?.auth,
+            });
+            const total = await strapi.entityService.count(resourceUID, sanitizedQuery);
             const pageSize = limit === -1 ? total - start : safeLimit;
             const pageCount = limit === -1 ? safeLimit : Math.ceil(total / safeLimit);
             const page = limit === -1 ? safeLimit : Math.floor(start / safeLimit) + 1;