@strapi/plugin-graphql 5.52.1 → 5.52.3

package/dist/server/bootstrap.js

@@ -20,6 +20,19 @@ const merge = fp.mergeWith((a, b)=>{
         return a.concat(b);
     }
 });
+const getOperationLimitsWarning = ({ depthLimit: configuredDepthLimit, maxLimit })=>{
+    const unboundedOrInvalidKeys = [];
+    if (typeof configuredDepthLimit !== 'number' || !Number.isFinite(configuredDepthLimit) || configuredDepthLimit <= 0) {
+        unboundedOrInvalidKeys.push('depthLimit');
+    }
+    if (typeof maxLimit !== 'number' || !Number.isFinite(maxLimit) || maxLimit <= 0) {
+        unboundedOrInvalidKeys.push('maxLimit');
+    }
+    if (unboundedOrInvalidKeys.length === 0) {
+        return undefined;
+    }
+    return `Built-in GraphQL operation limits are unbounded or invalid for: ${unboundedOrInvalidKeys.join(', ')}. Configure these limits (for example: defaultLimit: 25, maxLimit: 100, depthLimit: 10). Custom Apollo validation rules may independently enforce limits. See https://docs.strapi.io/cms/configurations/plugins.`;
+};
 const determineLandingPage = (strapi)=>{
     const { config } = strapi.plugin('graphql');
     const utils = strapi.plugin('graphql').service('utils');
@@ -90,6 +103,15 @@ async function bootstrap({ strapi }) {
     }
     const { config } = strapi.plugin('graphql');
     const path = config('endpoint');
+    const configuredDepthLimit = config('depthLimit');
+    const maxLimit = config('maxLimit');
+    const operationLimitsWarning = getOperationLimitsWarning({
+        depthLimit: configuredDepthLimit,
+        maxLimit
+    });
+    if (operationLimitsWarning) {
+        strapi.log.warn(operationLimitsWarning);
+    }
     const landingPage = determineLandingPage(strapi);
     /**
    * We need the arguments passed to the root query to be available in the association resolver
@@ -125,8 +147,10 @@ async function bootstrap({ strapi }) {
         // Schema
         schema,
         // Validation
+        // Keep v5 compatibility: depthLimit is passed through unchanged, so an unset or invalid value
+        // does not become an enforced finite limit during an upgrade.
         validationRules: [
-            depthLimit__default.default(config('depthLimit'))
+            depthLimit__default.default(configuredDepthLimit)
         ],
         // Errors
         formatError: formatGraphqlError.formatGraphqlError,
@@ -218,4 +242,5 @@ async function bootstrap({ strapi }) {
 
 exports.bootstrap = bootstrap;
 exports.determineLandingPage = determineLandingPage;
+exports.getOperationLimitsWarning = getOperationLimitsWarning;
 //# sourceMappingURL=bootstrap.js.map

package/dist/server/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sources":["../../server/src/bootstrap.ts"],"sourcesContent":["import { isEmpty, mergeWith, isArray, isObject, isFunction } from 'lodash/fp';\nimport { ApolloServer, type ApolloServerPlugin, type ApolloServerOptions } from '@apollo/server';\nimport {\n  ApolloServerPluginLandingPageLocalDefault,\n  ApolloServerPluginLandingPageProductionDefault,\n} from '@apollo/server/plugin/landingPage/default';\nimport { koaMiddleware } from '@as-integrations/koa';\nimport depthLimit from 'graphql-depth-limit';\nimport bodyParser from 'koa-bodyparser';\nimport cors from '@koa/cors';\n\nimport type { Core } from '@strapi/types';\nimport type { Options } from '@koa/cors';\nimport type { BaseContext, DefaultContextExtends, DefaultStateExtends } from 'koa';\n\nimport { formatGraphqlError } from './format-graphql-error';\n\nconst merge = mergeWith((a, b) => {\n  if (isArray(a) && isArray(b)) {\n    return a.concat(b);\n  }\n});\n\ntype StrapiGraphQLContext = BaseContext & {\n  rootQueryArgsByPath?: Map<string | number, Record<string, unknown>>;\n};\n\nexport const determineLandingPage = (\n  strapi: Core.Strapi\n): ApolloServerPlugin<StrapiGraphQLContext> => {\n  const { config } = strapi.plugin('graphql');\n  const utils = strapi.plugin('graphql').service('utils');\n\n  /**\n   * configLanding page may be one of the following:\n   *\n   * - true: always use \"playground\" even in production\n   * - false: never show \"playground\" even in non-production\n   * - undefined: default Apollo behavior (hide playground on production)\n   * - a function that returns an Apollo plugin that implements renderLandingPage\n   ** */\n  const configLandingPage = config('landingPage');\n\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const localLanding = () => {\n    strapi.log.debug('Apollo landing page: local');\n    utils.playground.setEnabled(true);\n    return ApolloServerPluginLandingPageLocalDefault();\n  };\n\n  const prodLanding = () => {\n    strapi.log.debug('Apollo landing page: production');\n    utils.playground.setEnabled(false);\n    return ApolloServerPluginLandingPageProductionDefault();\n  };\n\n  const userLanding = (userFunction: (strapi?: Core.Strapi) => ApolloServerPlugin | boolean) => {\n    strapi.log.debug('Apollo landing page: from user-defined function...');\n    const result = userFunction(strapi);\n    if (result === true) {\n      return localLanding();\n    }\n    if (result === false) {\n      return prodLanding();\n    }\n    strapi.log.debug('Apollo landing page: user-defined');\n    return result;\n  };\n\n  // DEPRECATED, remove in Strapi v6\n  const playgroundAlways = config('playgroundAlways');\n  if (playgroundAlways !== undefined) {\n    strapi.log.warn(\n      'The graphql config playgroundAlways is deprecated. This will be removed in Strapi 6. Please use landingPage instead. '\n    );\n  }\n  if (playgroundAlways === false) {\n    strapi.log.warn(\n      'graphql config playgroundAlways:false has no effect, please use landingPage:false to disable Graphql Playground in all environments'\n    );\n  }\n\n  if (playgroundAlways || configLandingPage === true) {\n    return localLanding();\n  }\n\n  // if landing page has been disabled, use production\n  if (configLandingPage === false) {\n    return prodLanding();\n  }\n\n  // If user did not define any settings, use our defaults\n  if (configLandingPage === undefined) {\n    return isProduction ? prodLanding() : localLanding();\n  }\n\n  // if user provided a landing page function, return that\n  if (isFunction(configLandingPage)) {\n    return userLanding(configLandingPage);\n  }\n\n  // If no other setting could be found, default to production settings\n  strapi.log.warn(\n    'Your Graphql landing page has been disabled because there is a problem with your Graphql settings'\n  );\n  return prodLanding();\n};\n\nexport async function bootstrap({ strapi }: { strapi: Core.Strapi }) {\n  // Generate the GraphQL schema for the content API\n  const schema = strapi.plugin('graphql').service('content-api').buildSchema();\n\n  if (isEmpty(schema)) {\n    strapi.log.warn('The GraphQL schema has not been generated because it is empty');\n\n    return;\n  }\n\n  const { config } = strapi.plugin('graphql');\n\n  const path: string = config('endpoint');\n\n  const landingPage = determineLandingPage(strapi);\n  /**\n   * We need the arguments passed to the root query to be available in the association resolver\n   * so we can forward those arguments along to any relations.\n   *\n   * In order to do that we are currently storing the arguments in context.\n   * There is likely a better solution, but for now this is the simplest fix we could find.\n   *\n   * @see https://github.com/strapi/strapi/issues/23524\n   */\n  const pluginAddRootQueryArgs: ApolloServerPlugin<StrapiGraphQLContext> = {\n    async requestDidStart() {\n      return {\n        async executionDidStart() {\n          return {\n            willResolveField({ source, args, contextValue, info }) {\n              if (!source && info.operation.operation === 'query') {\n                // Key args per root field (alias)\n                if (!contextValue.rootQueryArgsByPath) {\n                  contextValue.rootQueryArgsByPath = new Map();\n                }\n                contextValue.rootQueryArgsByPath.set(info.path.key, {\n                  ...args,\n                  _originField: info.fieldName,\n                });\n              }\n            },\n          };\n        },\n      };\n    },\n  };\n\n  type CustomOptions = {\n    cors?: boolean | Options;\n    uploads: boolean;\n    bodyParserConfig: boolean;\n  };\n\n  const defaultServerConfig: ApolloServerOptions<StrapiGraphQLContext> & CustomOptions = {\n    // Schema\n    schema,\n\n    // Validation\n    validationRules: [depthLimit(config('depthLimit') as number) as any],\n\n    // Errors\n    formatError: formatGraphqlError,\n\n    // Misc\n    cors: undefined,\n    uploads: false,\n    bodyParserConfig: true,\n    // send 400 http status instead of 200 for input validation errors\n    status400ForVariableCoercionErrors: true,\n    plugins: [landingPage, pluginAddRootQueryArgs],\n\n    cache: 'bounded' as const,\n  };\n\n  const serverConfig = merge(\n    defaultServerConfig,\n    config('apolloServer')\n  ) as ApolloServerOptions<StrapiGraphQLContext> & CustomOptions;\n\n  // Create a new Apollo server\n  const server = new ApolloServer(serverConfig);\n\n  try {\n    // server.start() must be called before using server.applyMiddleware()\n    await server.start();\n  } catch (error) {\n    if (error instanceof Error) {\n      strapi.log.error('Failed to start the Apollo server', error.message);\n    }\n\n    throw error;\n  }\n\n  // Create the route handlers for Strapi\n  const handler: Core.MiddlewareHandler[] = [];\n\n  // add cors middleware\n  if (serverConfig.cors === false) {\n    // Explicitly disabled - don't add middleware\n  } else if (serverConfig.cors === undefined || serverConfig.cors === true) {\n    // enable with defaults (backwards compatible)\n    handler.push(cors());\n  } else {\n    // Custom options object\n    handler.push(cors(serverConfig.cors));\n  }\n\n  // add koa bodyparser middleware\n  if (isObject(serverConfig.bodyParserConfig)) {\n    handler.push(bodyParser(serverConfig.bodyParserConfig));\n  } else if (serverConfig.bodyParserConfig) {\n    handler.push(bodyParser());\n  } else {\n    strapi.log.debug('Body parser has been disabled for Apollo server');\n  }\n\n  // add the Strapi auth middleware\n  handler.push((ctx, next) => {\n    ctx.state.route = {\n      info: {\n        // Indicate it's a content API route\n        type: 'content-api',\n      },\n    };\n\n    const isPlaygroundRequest =\n      ctx.request.method === 'GET' &&\n      ctx.request.url === path && // Matches the GraphQL endpoint\n      strapi.plugin('graphql').service('utils').playground.isEnabled() && // Only allow if the Playground is enabled\n      ctx.request.header.accept?.includes('text/html'); // Specific to Playground UI loading\n\n    // Skip authentication for the GraphQL Playground UI\n    if (isPlaygroundRequest) {\n      return next();\n    }\n\n    return strapi.auth.authenticate(ctx, next);\n  });\n\n  // add the graphql server for koa\n  handler.push(\n    koaMiddleware<DefaultStateExtends, DefaultContextExtends>(server, {\n      // Initialize loaders for this request.\n      context: async ({ ctx }) => ({\n        state: ctx.state,\n        koaContext: ctx,\n      }),\n    })\n  );\n\n  // now that handlers are set up, add the graphql route to our apollo server\n  strapi.server.routes([\n    {\n      method: 'ALL',\n      path,\n      handler,\n      config: {\n        auth: false,\n      },\n    },\n  ]);\n\n  // Register destroy behavior\n  // We're doing it here instead of exposing a destroy method to the strapi-server.js\n  // file since we need to have access to the ApolloServer instance\n  strapi.plugin('graphql').destroy = async () => {\n    await server.stop();\n  };\n}\n"],"names":["merge","mergeWith","a","b","isArray","concat","determineLandingPage","strapi","config","plugin","utils","service","configLandingPage","isProduction","process","env","NODE_ENV","localLanding","log","debug","playground","setEnabled","ApolloServerPluginLandingPageLocalDefault","prodLanding","ApolloServerPluginLandingPageProductionDefault","userLanding","userFunction","result","playgroundAlways","undefined","warn","isFunction","bootstrap","schema","buildSchema","isEmpty","path","landingPage","pluginAddRootQueryArgs","requestDidStart","executionDidStart","willResolveField","source","args","contextValue","info","operation","rootQueryArgsByPath","Map","set","key","_originField","fieldName","defaultServerConfig","validationRules","depthLimit","formatError","formatGraphqlError","cors","uploads","bodyParserConfig","status400ForVariableCoercionErrors","plugins","cache","serverConfig","server","ApolloServer","start","error","Error","message","handler","push","isObject","bodyParser","ctx","next","state","route","type","isPlaygroundRequest","request","method","url","isEnabled","header","accept","includes","auth","authenticate","koaMiddleware","context","koaContext","routes","destroy","stop"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAMA,KAAAA,GAAQC,YAAAA,CAAU,CAACC,CAAAA,EAAGC,CAAAA,GAAAA;IAC1B,IAAIC,UAAAA,CAAQF,CAAAA,CAAAA,IAAME,UAAAA,CAAQD,CAAAA,CAAAA,EAAI;QAC5B,OAAOD,CAAAA,CAAEG,MAAM,CAACF,CAAAA,CAAAA;AAClB,IAAA;AACF,CAAA,CAAA;AAMO,MAAMG,uBAAuB,CAClCC,MAAAA,GAAAA;AAEA,IAAA,MAAM,EAAEC,MAAM,EAAE,GAAGD,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA;AACjC,IAAA,MAAMC,QAAQH,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA,CAAWE,OAAO,CAAC,OAAA,CAAA;AAE/C;;;;;;;SAQA,MAAMC,oBAAoBJ,MAAAA,CAAO,aAAA,CAAA;AAEjC,IAAA,MAAMK,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,YAAAA,GAAe,IAAA;QACnBV,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,4BAAA,CAAA;QACjBT,KAAAA,CAAMU,UAAU,CAACC,UAAU,CAAC,IAAA,CAAA;QAC5B,OAAOC,kDAAAA,EAAAA;AACT,IAAA,CAAA;AAEA,IAAA,MAAMC,WAAAA,GAAc,IAAA;QAClBhB,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,iCAAA,CAAA;QACjBT,KAAAA,CAAMU,UAAU,CAACC,UAAU,CAAC,KAAA,CAAA;QAC5B,OAAOG,uDAAAA,EAAAA;AACT,IAAA,CAAA;AAEA,IAAA,MAAMC,cAAc,CAACC,YAAAA,GAAAA;QACnBnB,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,oDAAA,CAAA;AACjB,QAAA,MAAMQ,SAASD,YAAAA,CAAanB,MAAAA,CAAAA;AAC5B,QAAA,IAAIoB,WAAW,IAAA,EAAM;YACnB,OAAOV,YAAAA,EAAAA;AACT,QAAA;AACA,QAAA,IAAIU,WAAW,KAAA,EAAO;YACpB,OAAOJ,WAAAA,EAAAA;AACT,QAAA;QACAhB,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,mCAAA,CAAA;QACjB,OAAOQ,MAAAA;AACT,IAAA,CAAA;;AAGA,IAAA,MAAMC,mBAAmBpB,MAAAA,CAAO,kBAAA,CAAA;AAChC,IAAA,IAAIoB,qBAAqBC,SAAAA,EAAW;QAClCtB,MAAAA,CAAOW,GAAG,CAACY,IAAI,CACb,uHAAA,CAAA;AAEJ,IAAA;AACA,IAAA,IAAIF,qBAAqB,KAAA,EAAO;QAC9BrB,MAAAA,CAAOW,GAAG,CAACY,IAAI,CACb,qIAAA,CAAA;AAEJ,IAAA;IAEA,IAAIF,gBAAAA,IAAoBhB,sBAAsB,IAAA,EAAM;QAClD,OAAOK,YAAAA,EAAAA;AACT,IAAA;;AAGA,IAAA,IAAIL,sBAAsB,KAAA,EAAO;QAC/B,OAAOW,WAAAA,EAAAA;AACT,IAAA;;AAGA,IAAA,IAAIX,sBAAsBiB,SAAAA,EAAW;AACnC,QAAA,OAAOhB,eAAeU,WAAAA,EAAAA,GAAgBN,YAAAA,EAAAA;AACxC,IAAA;;AAGA,IAAA,IAAIc,cAAWnB,iBAAAA,CAAAA,EAAoB;AACjC,QAAA,OAAOa,WAAAA,CAAYb,iBAAAA,CAAAA;AACrB,IAAA;;IAGAL,MAAAA,CAAOW,GAAG,CAACY,IAAI,CACb,mGAAA,CAAA;IAEF,OAAOP,WAAAA,EAAAA;AACT;AAEO,eAAeS,SAAAA,CAAU,EAAEzB,MAAM,EAA2B,EAAA;;IAEjE,MAAM0B,MAAAA,GAAS1B,OAAOE,MAAM,CAAC,WAAWE,OAAO,CAAC,eAAeuB,WAAW,EAAA;AAE1E,IAAA,IAAIC,WAAQF,MAAAA,CAAAA,EAAS;QACnB1B,MAAAA,CAAOW,GAAG,CAACY,IAAI,CAAC,+DAAA,CAAA;AAEhB,QAAA;AACF,IAAA;AAEA,IAAA,MAAM,EAAEtB,MAAM,EAAE,GAAGD,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA;AAEjC,IAAA,MAAM2B,OAAe5B,MAAAA,CAAO,UAAA,CAAA;AAE5B,IAAA,MAAM6B,cAAc/B,oBAAAA,CAAqBC,MAAAA,CAAAA;AACzC;;;;;;;;AAQC,MACD,MAAM+B,sBAAAA,GAAmE;QACvE,MAAMC,eAAAA,CAAAA,GAAAA;YACJ,OAAO;gBACL,MAAMC,iBAAAA,CAAAA,GAAAA;oBACJ,OAAO;wBACLC,gBAAAA,CAAAA,CAAiB,EAAEC,MAAM,EAAEC,IAAI,EAAEC,YAAY,EAAEC,IAAI,EAAE,EAAA;AACnD,4BAAA,IAAI,CAACH,MAAAA,IAAUG,IAAAA,CAAKC,SAAS,CAACA,SAAS,KAAK,OAAA,EAAS;;gCAEnD,IAAI,CAACF,YAAAA,CAAaG,mBAAmB,EAAE;oCACrCH,YAAAA,CAAaG,mBAAmB,GAAG,IAAIC,GAAAA,EAAAA;AACzC,gCAAA;gCACAJ,YAAAA,CAAaG,mBAAmB,CAACE,GAAG,CAACJ,KAAKT,IAAI,CAACc,GAAG,EAAE;AAClD,oCAAA,GAAGP,IAAI;AACPQ,oCAAAA,YAAAA,EAAcN,KAAKO;AACrB,iCAAA,CAAA;AACF,4BAAA;AACF,wBAAA;AACF,qBAAA;AACF,gBAAA;AACF,aAAA;AACF,QAAA;AACF,KAAA;AAQA,IAAA,MAAMC,mBAAAA,GAAiF;;AAErFpB,QAAAA,MAAAA;;QAGAqB,eAAAA,EAAiB;AAACC,YAAAA,2BAAAA,CAAW/C,MAAAA,CAAO,YAAA,CAAA;AAAgC,SAAA;;QAGpEgD,WAAAA,EAAaC,qCAAAA;;QAGbC,IAAAA,EAAM7B,SAAAA;QACN8B,OAAAA,EAAS,KAAA;QACTC,gBAAAA,EAAkB,IAAA;;QAElBC,kCAAAA,EAAoC,IAAA;QACpCC,OAAAA,EAAS;AAACzB,YAAAA,WAAAA;AAAaC,YAAAA;AAAuB,SAAA;QAE9CyB,KAAAA,EAAO;AACT,KAAA;IAEA,MAAMC,YAAAA,GAAehE,KAAAA,CACnBqD,mBAAAA,EACA7C,MAAAA,CAAO,cAAA,CAAA,CAAA;;IAIT,MAAMyD,QAAAA,GAAS,IAAIC,mBAAAA,CAAaF,YAAAA,CAAAA;IAEhC,IAAI;;AAEF,QAAA,MAAMC,SAAOE,KAAK,EAAA;AACpB,IAAA,CAAA,CAAE,OAAOC,KAAAA,EAAO;AACd,QAAA,IAAIA,iBAAiBC,KAAAA,EAAO;AAC1B9D,YAAAA,MAAAA,CAAOW,GAAG,CAACkD,KAAK,CAAC,mCAAA,EAAqCA,MAAME,OAAO,CAAA;AACrE,QAAA;QAEA,MAAMF,KAAAA;AACR,IAAA;;AAGA,IAAA,MAAMG,UAAoC,EAAE;;IAG5C,IAAIP,YAAAA,CAAaN,IAAI,KAAK,KAAA,EAAO,CAEjC,MAAO,IAAIM,aAAaN,IAAI,KAAK7B,aAAamC,YAAAA,CAAaN,IAAI,KAAK,IAAA,EAAM;;AAExEa,QAAAA,OAAAA,CAAQC,IAAI,CAACd,qBAAAA,EAAAA,CAAAA;IACf,CAAA,MAAO;;AAELa,QAAAA,OAAAA,CAAQC,IAAI,CAACd,qBAAAA,CAAKM,YAAAA,CAAaN,IAAI,CAAA,CAAA;AACrC,IAAA;;IAGA,IAAIe,WAAAA,CAAST,YAAAA,CAAaJ,gBAAgB,CAAA,EAAG;AAC3CW,QAAAA,OAAAA,CAAQC,IAAI,CAACE,2BAAAA,CAAWV,YAAAA,CAAaJ,gBAAgB,CAAA,CAAA;IACvD,CAAA,MAAO,IAAII,YAAAA,CAAaJ,gBAAgB,EAAE;AACxCW,QAAAA,OAAAA,CAAQC,IAAI,CAACE,2BAAAA,EAAAA,CAAAA;IACf,CAAA,MAAO;QACLnE,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,iDAAA,CAAA;AACnB,IAAA;;IAGAoD,OAAAA,CAAQC,IAAI,CAAC,CAACG,GAAAA,EAAKC,IAAAA,GAAAA;QACjBD,GAAAA,CAAIE,KAAK,CAACC,KAAK,GAAG;YAChBjC,IAAAA,EAAM;;gBAEJkC,IAAAA,EAAM;AACR;AACF,SAAA;AAEA,QAAA,MAAMC,mBAAAA,GACJL,GAAAA,CAAIM,OAAO,CAACC,MAAM,KAAK,KAAA,IACvBP,GAAAA,CAAIM,OAAO,CAACE,GAAG,KAAK/C;QACpB7B,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA,CAAWE,OAAO,CAAC,SAASS,UAAU,CAACgE,SAAS,EAAA;QAC9DT,GAAAA,CAAIM,OAAO,CAACI,MAAM,CAACC,MAAM,EAAEC,QAAAA,CAAS;;AAGtC,QAAA,IAAIP,mBAAAA,EAAqB;YACvB,OAAOJ,IAAAA,EAAAA;AACT,QAAA;AAEA,QAAA,OAAOrE,MAAAA,CAAOiF,IAAI,CAACC,YAAY,CAACd,GAAAA,EAAKC,IAAAA,CAAAA;AACvC,IAAA,CAAA,CAAA;;IAGAL,OAAAA,CAAQC,IAAI,CACVkB,iBAAAA,CAA0DzB,QAAAA,EAAQ;;AAEhE0B,QAAAA,OAAAA,EAAS,OAAO,EAAEhB,GAAG,EAAE,IAAM;AAC3BE,gBAAAA,KAAAA,EAAOF,IAAIE,KAAK;gBAChBe,UAAAA,EAAYjB;aACd;AACF,KAAA,CAAA,CAAA;;IAIFpE,MAAAA,CAAO0D,MAAM,CAAC4B,MAAM,CAAC;AACnB,QAAA;YACEX,MAAAA,EAAQ,KAAA;AACR9C,YAAAA,IAAAA;AACAmC,YAAAA,OAAAA;YACA/D,MAAAA,EAAQ;gBACNgF,IAAAA,EAAM;AACR;AACF;AACD,KAAA,CAAA;;;;AAKDjF,IAAAA,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA,CAAWqF,OAAO,GAAG,UAAA;AACjC,QAAA,MAAM7B,SAAO8B,IAAI,EAAA;AACnB,IAAA,CAAA;AACF;;;;;"}
+{"version":3,"file":"bootstrap.js","sources":["../../server/src/bootstrap.ts"],"sourcesContent":["import { isEmpty, mergeWith, isArray, isObject, isFunction } from 'lodash/fp';\nimport { ApolloServer, type ApolloServerPlugin, type ApolloServerOptions } from '@apollo/server';\nimport {\n  ApolloServerPluginLandingPageLocalDefault,\n  ApolloServerPluginLandingPageProductionDefault,\n} from '@apollo/server/plugin/landingPage/default';\nimport { koaMiddleware } from '@as-integrations/koa';\nimport depthLimit from 'graphql-depth-limit';\nimport bodyParser from 'koa-bodyparser';\nimport cors from '@koa/cors';\n\nimport type { Core } from '@strapi/types';\nimport type { Options } from '@koa/cors';\nimport type { BaseContext, DefaultContextExtends, DefaultStateExtends } from 'koa';\n\nimport { formatGraphqlError } from './format-graphql-error';\n\nconst merge = mergeWith((a, b) => {\n  if (isArray(a) && isArray(b)) {\n    return a.concat(b);\n  }\n});\n\ntype StrapiGraphQLContext = BaseContext & {\n  rootQueryArgsByPath?: Map<string | number, Record<string, unknown>>;\n};\n\ntype OperationLimitConfig = {\n  depthLimit?: unknown;\n  maxLimit?: unknown;\n};\n\nexport const getOperationLimitsWarning = ({\n  depthLimit: configuredDepthLimit,\n  maxLimit,\n}: OperationLimitConfig): string | undefined => {\n  const unboundedOrInvalidKeys: string[] = [];\n\n  if (\n    typeof configuredDepthLimit !== 'number' ||\n    !Number.isFinite(configuredDepthLimit) ||\n    configuredDepthLimit <= 0\n  ) {\n    unboundedOrInvalidKeys.push('depthLimit');\n  }\n\n  if (typeof maxLimit !== 'number' || !Number.isFinite(maxLimit) || maxLimit <= 0) {\n    unboundedOrInvalidKeys.push('maxLimit');\n  }\n\n  if (unboundedOrInvalidKeys.length === 0) {\n    return undefined;\n  }\n\n  return `Built-in GraphQL operation limits are unbounded or invalid for: ${unboundedOrInvalidKeys.join(', ')}. Configure these limits (for example: defaultLimit: 25, maxLimit: 100, depthLimit: 10). Custom Apollo validation rules may independently enforce limits. See https://docs.strapi.io/cms/configurations/plugins.`;\n};\n\nexport const determineLandingPage = (\n  strapi: Core.Strapi\n): ApolloServerPlugin<StrapiGraphQLContext> => {\n  const { config } = strapi.plugin('graphql');\n  const utils = strapi.plugin('graphql').service('utils');\n\n  /**\n   * configLanding page may be one of the following:\n   *\n   * - true: always use \"playground\" even in production\n   * - false: never show \"playground\" even in non-production\n   * - undefined: default Apollo behavior (hide playground on production)\n   * - a function that returns an Apollo plugin that implements renderLandingPage\n   ** */\n  const configLandingPage = config('landingPage');\n\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const localLanding = () => {\n    strapi.log.debug('Apollo landing page: local');\n    utils.playground.setEnabled(true);\n    return ApolloServerPluginLandingPageLocalDefault();\n  };\n\n  const prodLanding = () => {\n    strapi.log.debug('Apollo landing page: production');\n    utils.playground.setEnabled(false);\n    return ApolloServerPluginLandingPageProductionDefault();\n  };\n\n  const userLanding = (userFunction: (strapi?: Core.Strapi) => ApolloServerPlugin | boolean) => {\n    strapi.log.debug('Apollo landing page: from user-defined function...');\n    const result = userFunction(strapi);\n    if (result === true) {\n      return localLanding();\n    }\n    if (result === false) {\n      return prodLanding();\n    }\n    strapi.log.debug('Apollo landing page: user-defined');\n    return result;\n  };\n\n  // DEPRECATED, remove in Strapi v6\n  const playgroundAlways = config('playgroundAlways');\n  if (playgroundAlways !== undefined) {\n    strapi.log.warn(\n      'The graphql config playgroundAlways is deprecated. This will be removed in Strapi 6. Please use landingPage instead. '\n    );\n  }\n  if (playgroundAlways === false) {\n    strapi.log.warn(\n      'graphql config playgroundAlways:false has no effect, please use landingPage:false to disable Graphql Playground in all environments'\n    );\n  }\n\n  if (playgroundAlways || configLandingPage === true) {\n    return localLanding();\n  }\n\n  // if landing page has been disabled, use production\n  if (configLandingPage === false) {\n    return prodLanding();\n  }\n\n  // If user did not define any settings, use our defaults\n  if (configLandingPage === undefined) {\n    return isProduction ? prodLanding() : localLanding();\n  }\n\n  // if user provided a landing page function, return that\n  if (isFunction(configLandingPage)) {\n    return userLanding(configLandingPage);\n  }\n\n  // If no other setting could be found, default to production settings\n  strapi.log.warn(\n    'Your Graphql landing page has been disabled because there is a problem with your Graphql settings'\n  );\n  return prodLanding();\n};\n\nexport async function bootstrap({ strapi }: { strapi: Core.Strapi }) {\n  // Generate the GraphQL schema for the content API\n  const schema = strapi.plugin('graphql').service('content-api').buildSchema();\n\n  if (isEmpty(schema)) {\n    strapi.log.warn('The GraphQL schema has not been generated because it is empty');\n\n    return;\n  }\n\n  const { config } = strapi.plugin('graphql');\n\n  const path: string = config('endpoint');\n  const configuredDepthLimit = config('depthLimit');\n  const maxLimit = config('maxLimit');\n  const operationLimitsWarning = getOperationLimitsWarning({\n    depthLimit: configuredDepthLimit,\n    maxLimit,\n  });\n\n  if (operationLimitsWarning) {\n    strapi.log.warn(operationLimitsWarning);\n  }\n\n  const landingPage = determineLandingPage(strapi);\n  /**\n   * We need the arguments passed to the root query to be available in the association resolver\n   * so we can forward those arguments along to any relations.\n   *\n   * In order to do that we are currently storing the arguments in context.\n   * There is likely a better solution, but for now this is the simplest fix we could find.\n   *\n   * @see https://github.com/strapi/strapi/issues/23524\n   */\n  const pluginAddRootQueryArgs: ApolloServerPlugin<StrapiGraphQLContext> = {\n    async requestDidStart() {\n      return {\n        async executionDidStart() {\n          return {\n            willResolveField({ source, args, contextValue, info }) {\n              if (!source && info.operation.operation === 'query') {\n                // Key args per root field (alias)\n                if (!contextValue.rootQueryArgsByPath) {\n                  contextValue.rootQueryArgsByPath = new Map();\n                }\n                contextValue.rootQueryArgsByPath.set(info.path.key, {\n                  ...args,\n                  _originField: info.fieldName,\n                });\n              }\n            },\n          };\n        },\n      };\n    },\n  };\n\n  type CustomOptions = {\n    cors?: boolean | Options;\n    uploads: boolean;\n    bodyParserConfig: boolean;\n  };\n\n  const defaultServerConfig: ApolloServerOptions<StrapiGraphQLContext> & CustomOptions = {\n    // Schema\n    schema,\n\n    // Validation\n    // Keep v5 compatibility: depthLimit is passed through unchanged, so an unset or invalid value\n    // does not become an enforced finite limit during an upgrade.\n    validationRules: [depthLimit(configuredDepthLimit as number) as any],\n\n    // Errors\n    formatError: formatGraphqlError,\n\n    // Misc\n    cors: undefined,\n    uploads: false,\n    bodyParserConfig: true,\n    // send 400 http status instead of 200 for input validation errors\n    status400ForVariableCoercionErrors: true,\n    plugins: [landingPage, pluginAddRootQueryArgs],\n\n    cache: 'bounded' as const,\n  };\n\n  const serverConfig = merge(\n    defaultServerConfig,\n    config('apolloServer')\n  ) as ApolloServerOptions<StrapiGraphQLContext> & CustomOptions;\n\n  // Create a new Apollo server\n  const server = new ApolloServer(serverConfig);\n\n  try {\n    // server.start() must be called before using server.applyMiddleware()\n    await server.start();\n  } catch (error) {\n    if (error instanceof Error) {\n      strapi.log.error('Failed to start the Apollo server', error.message);\n    }\n\n    throw error;\n  }\n\n  // Create the route handlers for Strapi\n  const handler: Core.MiddlewareHandler[] = [];\n\n  // add cors middleware\n  if (serverConfig.cors === false) {\n    // Explicitly disabled - don't add middleware\n  } else if (serverConfig.cors === undefined || serverConfig.cors === true) {\n    // enable with defaults (backwards compatible)\n    handler.push(cors());\n  } else {\n    // Custom options object\n    handler.push(cors(serverConfig.cors));\n  }\n\n  // add koa bodyparser middleware\n  if (isObject(serverConfig.bodyParserConfig)) {\n    handler.push(bodyParser(serverConfig.bodyParserConfig));\n  } else if (serverConfig.bodyParserConfig) {\n    handler.push(bodyParser());\n  } else {\n    strapi.log.debug('Body parser has been disabled for Apollo server');\n  }\n\n  // add the Strapi auth middleware\n  handler.push((ctx, next) => {\n    ctx.state.route = {\n      info: {\n        // Indicate it's a content API route\n        type: 'content-api',\n      },\n    };\n\n    const isPlaygroundRequest =\n      ctx.request.method === 'GET' &&\n      ctx.request.url === path && // Matches the GraphQL endpoint\n      strapi.plugin('graphql').service('utils').playground.isEnabled() && // Only allow if the Playground is enabled\n      ctx.request.header.accept?.includes('text/html'); // Specific to Playground UI loading\n\n    // Skip authentication for the GraphQL Playground UI\n    if (isPlaygroundRequest) {\n      return next();\n    }\n\n    return strapi.auth.authenticate(ctx, next);\n  });\n\n  // add the graphql server for koa\n  handler.push(\n    koaMiddleware<DefaultStateExtends, DefaultContextExtends>(server, {\n      // Initialize loaders for this request.\n      context: async ({ ctx }) => ({\n        state: ctx.state,\n        koaContext: ctx,\n      }),\n    })\n  );\n\n  // now that handlers are set up, add the graphql route to our apollo server\n  strapi.server.routes([\n    {\n      method: 'ALL',\n      path,\n      handler,\n      config: {\n        auth: false,\n      },\n    },\n  ]);\n\n  // Register destroy behavior\n  // We're doing it here instead of exposing a destroy method to the strapi-server.js\n  // file since we need to have access to the ApolloServer instance\n  strapi.plugin('graphql').destroy = async () => {\n    await server.stop();\n  };\n}\n"],"names":["merge","mergeWith","a","b","isArray","concat","getOperationLimitsWarning","depthLimit","configuredDepthLimit","maxLimit","unboundedOrInvalidKeys","Number","isFinite","push","length","undefined","join","determineLandingPage","strapi","config","plugin","utils","service","configLandingPage","isProduction","process","env","NODE_ENV","localLanding","log","debug","playground","setEnabled","ApolloServerPluginLandingPageLocalDefault","prodLanding","ApolloServerPluginLandingPageProductionDefault","userLanding","userFunction","result","playgroundAlways","warn","isFunction","bootstrap","schema","buildSchema","isEmpty","path","operationLimitsWarning","landingPage","pluginAddRootQueryArgs","requestDidStart","executionDidStart","willResolveField","source","args","contextValue","info","operation","rootQueryArgsByPath","Map","set","key","_originField","fieldName","defaultServerConfig","validationRules","formatError","formatGraphqlError","cors","uploads","bodyParserConfig","status400ForVariableCoercionErrors","plugins","cache","serverConfig","server","ApolloServer","start","error","Error","message","handler","isObject","bodyParser","ctx","next","state","route","type","isPlaygroundRequest","request","method","url","isEnabled","header","accept","includes","auth","authenticate","koaMiddleware","context","koaContext","routes","destroy","stop"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAMA,KAAAA,GAAQC,YAAAA,CAAU,CAACC,CAAAA,EAAGC,CAAAA,GAAAA;IAC1B,IAAIC,UAAAA,CAAQF,CAAAA,CAAAA,IAAME,UAAAA,CAAQD,CAAAA,CAAAA,EAAI;QAC5B,OAAOD,CAAAA,CAAEG,MAAM,CAACF,CAAAA,CAAAA;AAClB,IAAA;AACF,CAAA,CAAA;AAWO,MAAMG,4BAA4B,CAAC,EACxCC,YAAYC,oBAAoB,EAChCC,QAAQ,EACa,GAAA;AACrB,IAAA,MAAMC,yBAAmC,EAAE;IAE3C,IACE,OAAOF,yBAAyB,QAAA,IAChC,CAACG,OAAOC,QAAQ,CAACJ,oBAAAA,CAAAA,IACjBA,oBAAAA,IAAwB,CAAA,EACxB;AACAE,QAAAA,sBAAAA,CAAuBG,IAAI,CAAC,YAAA,CAAA;AAC9B,IAAA;IAEA,IAAI,OAAOJ,aAAa,QAAA,IAAY,CAACE,OAAOC,QAAQ,CAACH,QAAAA,CAAAA,IAAaA,QAAAA,IAAY,CAAA,EAAG;AAC/EC,QAAAA,sBAAAA,CAAuBG,IAAI,CAAC,UAAA,CAAA;AAC9B,IAAA;IAEA,IAAIH,sBAAAA,CAAuBI,MAAM,KAAK,CAAA,EAAG;QACvC,OAAOC,SAAAA;AACT,IAAA;IAEA,OAAO,CAAC,gEAAgE,EAAEL,sBAAAA,CAAuBM,IAAI,CAAC,IAAA,CAAA,CAAM,gNAAgN,CAAC;AAC/T;AAEO,MAAMC,uBAAuB,CAClCC,MAAAA,GAAAA;AAEA,IAAA,MAAM,EAAEC,MAAM,EAAE,GAAGD,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA;AACjC,IAAA,MAAMC,QAAQH,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA,CAAWE,OAAO,CAAC,OAAA,CAAA;AAE/C;;;;;;;SAQA,MAAMC,oBAAoBJ,MAAAA,CAAO,aAAA,CAAA;AAEjC,IAAA,MAAMK,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,YAAAA,GAAe,IAAA;QACnBV,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,4BAAA,CAAA;QACjBT,KAAAA,CAAMU,UAAU,CAACC,UAAU,CAAC,IAAA,CAAA;QAC5B,OAAOC,kDAAAA,EAAAA;AACT,IAAA,CAAA;AAEA,IAAA,MAAMC,WAAAA,GAAc,IAAA;QAClBhB,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,iCAAA,CAAA;QACjBT,KAAAA,CAAMU,UAAU,CAACC,UAAU,CAAC,KAAA,CAAA;QAC5B,OAAOG,uDAAAA,EAAAA;AACT,IAAA,CAAA;AAEA,IAAA,MAAMC,cAAc,CAACC,YAAAA,GAAAA;QACnBnB,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,oDAAA,CAAA;AACjB,QAAA,MAAMQ,SAASD,YAAAA,CAAanB,MAAAA,CAAAA;AAC5B,QAAA,IAAIoB,WAAW,IAAA,EAAM;YACnB,OAAOV,YAAAA,EAAAA;AACT,QAAA;AACA,QAAA,IAAIU,WAAW,KAAA,EAAO;YACpB,OAAOJ,WAAAA,EAAAA;AACT,QAAA;QACAhB,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,mCAAA,CAAA;QACjB,OAAOQ,MAAAA;AACT,IAAA,CAAA;;AAGA,IAAA,MAAMC,mBAAmBpB,MAAAA,CAAO,kBAAA,CAAA;AAChC,IAAA,IAAIoB,qBAAqBxB,SAAAA,EAAW;QAClCG,MAAAA,CAAOW,GAAG,CAACW,IAAI,CACb,uHAAA,CAAA;AAEJ,IAAA;AACA,IAAA,IAAID,qBAAqB,KAAA,EAAO;QAC9BrB,MAAAA,CAAOW,GAAG,CAACW,IAAI,CACb,qIAAA,CAAA;AAEJ,IAAA;IAEA,IAAID,gBAAAA,IAAoBhB,sBAAsB,IAAA,EAAM;QAClD,OAAOK,YAAAA,EAAAA;AACT,IAAA;;AAGA,IAAA,IAAIL,sBAAsB,KAAA,EAAO;QAC/B,OAAOW,WAAAA,EAAAA;AACT,IAAA;;AAGA,IAAA,IAAIX,sBAAsBR,SAAAA,EAAW;AACnC,QAAA,OAAOS,eAAeU,WAAAA,EAAAA,GAAgBN,YAAAA,EAAAA;AACxC,IAAA;;AAGA,IAAA,IAAIa,cAAWlB,iBAAAA,CAAAA,EAAoB;AACjC,QAAA,OAAOa,WAAAA,CAAYb,iBAAAA,CAAAA;AACrB,IAAA;;IAGAL,MAAAA,CAAOW,GAAG,CAACW,IAAI,CACb,mGAAA,CAAA;IAEF,OAAON,WAAAA,EAAAA;AACT;AAEO,eAAeQ,SAAAA,CAAU,EAAExB,MAAM,EAA2B,EAAA;;IAEjE,MAAMyB,MAAAA,GAASzB,OAAOE,MAAM,CAAC,WAAWE,OAAO,CAAC,eAAesB,WAAW,EAAA;AAE1E,IAAA,IAAIC,WAAQF,MAAAA,CAAAA,EAAS;QACnBzB,MAAAA,CAAOW,GAAG,CAACW,IAAI,CAAC,+DAAA,CAAA;AAEhB,QAAA;AACF,IAAA;AAEA,IAAA,MAAM,EAAErB,MAAM,EAAE,GAAGD,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA;AAEjC,IAAA,MAAM0B,OAAe3B,MAAAA,CAAO,UAAA,CAAA;AAC5B,IAAA,MAAMX,uBAAuBW,MAAAA,CAAO,YAAA,CAAA;AACpC,IAAA,MAAMV,WAAWU,MAAAA,CAAO,UAAA,CAAA;AACxB,IAAA,MAAM4B,yBAAyBzC,yBAAAA,CAA0B;QACvDC,UAAAA,EAAYC,oBAAAA;AACZC,QAAAA;AACF,KAAA,CAAA;AAEA,IAAA,IAAIsC,sBAAAA,EAAwB;QAC1B7B,MAAAA,CAAOW,GAAG,CAACW,IAAI,CAACO,sBAAAA,CAAAA;AAClB,IAAA;AAEA,IAAA,MAAMC,cAAc/B,oBAAAA,CAAqBC,MAAAA,CAAAA;AACzC;;;;;;;;AAQC,MACD,MAAM+B,sBAAAA,GAAmE;QACvE,MAAMC,eAAAA,CAAAA,GAAAA;YACJ,OAAO;gBACL,MAAMC,iBAAAA,CAAAA,GAAAA;oBACJ,OAAO;wBACLC,gBAAAA,CAAAA,CAAiB,EAAEC,MAAM,EAAEC,IAAI,EAAEC,YAAY,EAAEC,IAAI,EAAE,EAAA;AACnD,4BAAA,IAAI,CAACH,MAAAA,IAAUG,IAAAA,CAAKC,SAAS,CAACA,SAAS,KAAK,OAAA,EAAS;;gCAEnD,IAAI,CAACF,YAAAA,CAAaG,mBAAmB,EAAE;oCACrCH,YAAAA,CAAaG,mBAAmB,GAAG,IAAIC,GAAAA,EAAAA;AACzC,gCAAA;gCACAJ,YAAAA,CAAaG,mBAAmB,CAACE,GAAG,CAACJ,KAAKV,IAAI,CAACe,GAAG,EAAE;AAClD,oCAAA,GAAGP,IAAI;AACPQ,oCAAAA,YAAAA,EAAcN,KAAKO;AACrB,iCAAA,CAAA;AACF,4BAAA;AACF,wBAAA;AACF,qBAAA;AACF,gBAAA;AACF,aAAA;AACF,QAAA;AACF,KAAA;AAQA,IAAA,MAAMC,mBAAAA,GAAiF;;AAErFrB,QAAAA,MAAAA;;;;QAKAsB,eAAAA,EAAiB;YAAC1D,2BAAAA,CAAWC,oBAAAA;AAAuC,SAAA;;QAGpE0D,WAAAA,EAAaC,qCAAAA;;QAGbC,IAAAA,EAAMrD,SAAAA;QACNsD,OAAAA,EAAS,KAAA;QACTC,gBAAAA,EAAkB,IAAA;;QAElBC,kCAAAA,EAAoC,IAAA;QACpCC,OAAAA,EAAS;AAACxB,YAAAA,WAAAA;AAAaC,YAAAA;AAAuB,SAAA;QAE9CwB,KAAAA,EAAO;AACT,KAAA;IAEA,MAAMC,YAAAA,GAAe1E,KAAAA,CACnBgE,mBAAAA,EACA7C,MAAAA,CAAO,cAAA,CAAA,CAAA;;IAIT,MAAMwD,QAAAA,GAAS,IAAIC,mBAAAA,CAAaF,YAAAA,CAAAA;IAEhC,IAAI;;AAEF,QAAA,MAAMC,SAAOE,KAAK,EAAA;AACpB,IAAA,CAAA,CAAE,OAAOC,KAAAA,EAAO;AACd,QAAA,IAAIA,iBAAiBC,KAAAA,EAAO;AAC1B7D,YAAAA,MAAAA,CAAOW,GAAG,CAACiD,KAAK,CAAC,mCAAA,EAAqCA,MAAME,OAAO,CAAA;AACrE,QAAA;QAEA,MAAMF,KAAAA;AACR,IAAA;;AAGA,IAAA,MAAMG,UAAoC,EAAE;;IAG5C,IAAIP,YAAAA,CAAaN,IAAI,KAAK,KAAA,EAAO,CAEjC,MAAO,IAAIM,aAAaN,IAAI,KAAKrD,aAAa2D,YAAAA,CAAaN,IAAI,KAAK,IAAA,EAAM;;AAExEa,QAAAA,OAAAA,CAAQpE,IAAI,CAACuD,qBAAAA,EAAAA,CAAAA;IACf,CAAA,MAAO;;AAELa,QAAAA,OAAAA,CAAQpE,IAAI,CAACuD,qBAAAA,CAAKM,YAAAA,CAAaN,IAAI,CAAA,CAAA;AACrC,IAAA;;IAGA,IAAIc,WAAAA,CAASR,YAAAA,CAAaJ,gBAAgB,CAAA,EAAG;AAC3CW,QAAAA,OAAAA,CAAQpE,IAAI,CAACsE,2BAAAA,CAAWT,YAAAA,CAAaJ,gBAAgB,CAAA,CAAA;IACvD,CAAA,MAAO,IAAII,YAAAA,CAAaJ,gBAAgB,EAAE;AACxCW,QAAAA,OAAAA,CAAQpE,IAAI,CAACsE,2BAAAA,EAAAA,CAAAA;IACf,CAAA,MAAO;QACLjE,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,iDAAA,CAAA;AACnB,IAAA;;IAGAmD,OAAAA,CAAQpE,IAAI,CAAC,CAACuE,GAAAA,EAAKC,IAAAA,GAAAA;QACjBD,GAAAA,CAAIE,KAAK,CAACC,KAAK,GAAG;YAChB/B,IAAAA,EAAM;;gBAEJgC,IAAAA,EAAM;AACR;AACF,SAAA;AAEA,QAAA,MAAMC,mBAAAA,GACJL,GAAAA,CAAIM,OAAO,CAACC,MAAM,KAAK,KAAA,IACvBP,GAAAA,CAAIM,OAAO,CAACE,GAAG,KAAK9C;QACpB5B,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA,CAAWE,OAAO,CAAC,SAASS,UAAU,CAAC8D,SAAS,EAAA;QAC9DT,GAAAA,CAAIM,OAAO,CAACI,MAAM,CAACC,MAAM,EAAEC,QAAAA,CAAS;;AAGtC,QAAA,IAAIP,mBAAAA,EAAqB;YACvB,OAAOJ,IAAAA,EAAAA;AACT,QAAA;AAEA,QAAA,OAAOnE,MAAAA,CAAO+E,IAAI,CAACC,YAAY,CAACd,GAAAA,EAAKC,IAAAA,CAAAA;AACvC,IAAA,CAAA,CAAA;;IAGAJ,OAAAA,CAAQpE,IAAI,CACVsF,iBAAAA,CAA0DxB,QAAAA,EAAQ;;AAEhEyB,QAAAA,OAAAA,EAAS,OAAO,EAAEhB,GAAG,EAAE,IAAM;AAC3BE,gBAAAA,KAAAA,EAAOF,IAAIE,KAAK;gBAChBe,UAAAA,EAAYjB;aACd;AACF,KAAA,CAAA,CAAA;;IAIFlE,MAAAA,CAAOyD,MAAM,CAAC2B,MAAM,CAAC;AACnB,QAAA;YACEX,MAAAA,EAAQ,KAAA;AACR7C,YAAAA,IAAAA;AACAmC,YAAAA,OAAAA;YACA9D,MAAAA,EAAQ;gBACN8E,IAAAA,EAAM;AACR;AACF;AACD,KAAA,CAAA;;;;AAKD/E,IAAAA,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA,CAAWmF,OAAO,GAAG,UAAA;AACjC,QAAA,MAAM5B,SAAO6B,IAAI,EAAA;AACnB,IAAA,CAAA;AACF;;;;;;"}

package/dist/server/bootstrap.mjs

@@ -12,6 +12,19 @@ const merge = mergeWith((a, b)=>{
         return a.concat(b);
     }
 });
+const getOperationLimitsWarning = ({ depthLimit: configuredDepthLimit, maxLimit })=>{
+    const unboundedOrInvalidKeys = [];
+    if (typeof configuredDepthLimit !== 'number' || !Number.isFinite(configuredDepthLimit) || configuredDepthLimit <= 0) {
+        unboundedOrInvalidKeys.push('depthLimit');
+    }
+    if (typeof maxLimit !== 'number' || !Number.isFinite(maxLimit) || maxLimit <= 0) {
+        unboundedOrInvalidKeys.push('maxLimit');
+    }
+    if (unboundedOrInvalidKeys.length === 0) {
+        return undefined;
+    }
+    return `Built-in GraphQL operation limits are unbounded or invalid for: ${unboundedOrInvalidKeys.join(', ')}. Configure these limits (for example: defaultLimit: 25, maxLimit: 100, depthLimit: 10). Custom Apollo validation rules may independently enforce limits. See https://docs.strapi.io/cms/configurations/plugins.`;
+};
 const determineLandingPage = (strapi)=>{
     const { config } = strapi.plugin('graphql');
     const utils = strapi.plugin('graphql').service('utils');
@@ -82,6 +95,15 @@ async function bootstrap({ strapi }) {
     }
     const { config } = strapi.plugin('graphql');
     const path = config('endpoint');
+    const configuredDepthLimit = config('depthLimit');
+    const maxLimit = config('maxLimit');
+    const operationLimitsWarning = getOperationLimitsWarning({
+        depthLimit: configuredDepthLimit,
+        maxLimit
+    });
+    if (operationLimitsWarning) {
+        strapi.log.warn(operationLimitsWarning);
+    }
     const landingPage = determineLandingPage(strapi);
     /**
    * We need the arguments passed to the root query to be available in the association resolver
@@ -117,8 +139,10 @@ async function bootstrap({ strapi }) {
         // Schema
         schema,
         // Validation
+        // Keep v5 compatibility: depthLimit is passed through unchanged, so an unset or invalid value
+        // does not become an enforced finite limit during an upgrade.
         validationRules: [
-            depthLimit(config('depthLimit'))
+            depthLimit(configuredDepthLimit)
         ],
         // Errors
         formatError: formatGraphqlError,
@@ -208,5 +232,5 @@ async function bootstrap({ strapi }) {
     };
 }
 
-export { bootstrap, determineLandingPage };
+export { bootstrap, determineLandingPage, getOperationLimitsWarning };
 //# sourceMappingURL=bootstrap.mjs.map

package/dist/server/bootstrap.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.mjs","sources":["../../server/src/bootstrap.ts"],"sourcesContent":["import { isEmpty, mergeWith, isArray, isObject, isFunction } from 'lodash/fp';\nimport { ApolloServer, type ApolloServerPlugin, type ApolloServerOptions } from '@apollo/server';\nimport {\n  ApolloServerPluginLandingPageLocalDefault,\n  ApolloServerPluginLandingPageProductionDefault,\n} from '@apollo/server/plugin/landingPage/default';\nimport { koaMiddleware } from '@as-integrations/koa';\nimport depthLimit from 'graphql-depth-limit';\nimport bodyParser from 'koa-bodyparser';\nimport cors from '@koa/cors';\n\nimport type { Core } from '@strapi/types';\nimport type { Options } from '@koa/cors';\nimport type { BaseContext, DefaultContextExtends, DefaultStateExtends } from 'koa';\n\nimport { formatGraphqlError } from './format-graphql-error';\n\nconst merge = mergeWith((a, b) => {\n  if (isArray(a) && isArray(b)) {\n    return a.concat(b);\n  }\n});\n\ntype StrapiGraphQLContext = BaseContext & {\n  rootQueryArgsByPath?: Map<string | number, Record<string, unknown>>;\n};\n\nexport const determineLandingPage = (\n  strapi: Core.Strapi\n): ApolloServerPlugin<StrapiGraphQLContext> => {\n  const { config } = strapi.plugin('graphql');\n  const utils = strapi.plugin('graphql').service('utils');\n\n  /**\n   * configLanding page may be one of the following:\n   *\n   * - true: always use \"playground\" even in production\n   * - false: never show \"playground\" even in non-production\n   * - undefined: default Apollo behavior (hide playground on production)\n   * - a function that returns an Apollo plugin that implements renderLandingPage\n   ** */\n  const configLandingPage = config('landingPage');\n\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const localLanding = () => {\n    strapi.log.debug('Apollo landing page: local');\n    utils.playground.setEnabled(true);\n    return ApolloServerPluginLandingPageLocalDefault();\n  };\n\n  const prodLanding = () => {\n    strapi.log.debug('Apollo landing page: production');\n    utils.playground.setEnabled(false);\n    return ApolloServerPluginLandingPageProductionDefault();\n  };\n\n  const userLanding = (userFunction: (strapi?: Core.Strapi) => ApolloServerPlugin | boolean) => {\n    strapi.log.debug('Apollo landing page: from user-defined function...');\n    const result = userFunction(strapi);\n    if (result === true) {\n      return localLanding();\n    }\n    if (result === false) {\n      return prodLanding();\n    }\n    strapi.log.debug('Apollo landing page: user-defined');\n    return result;\n  };\n\n  // DEPRECATED, remove in Strapi v6\n  const playgroundAlways = config('playgroundAlways');\n  if (playgroundAlways !== undefined) {\n    strapi.log.warn(\n      'The graphql config playgroundAlways is deprecated. This will be removed in Strapi 6. Please use landingPage instead. '\n    );\n  }\n  if (playgroundAlways === false) {\n    strapi.log.warn(\n      'graphql config playgroundAlways:false has no effect, please use landingPage:false to disable Graphql Playground in all environments'\n    );\n  }\n\n  if (playgroundAlways || configLandingPage === true) {\n    return localLanding();\n  }\n\n  // if landing page has been disabled, use production\n  if (configLandingPage === false) {\n    return prodLanding();\n  }\n\n  // If user did not define any settings, use our defaults\n  if (configLandingPage === undefined) {\n    return isProduction ? prodLanding() : localLanding();\n  }\n\n  // if user provided a landing page function, return that\n  if (isFunction(configLandingPage)) {\n    return userLanding(configLandingPage);\n  }\n\n  // If no other setting could be found, default to production settings\n  strapi.log.warn(\n    'Your Graphql landing page has been disabled because there is a problem with your Graphql settings'\n  );\n  return prodLanding();\n};\n\nexport async function bootstrap({ strapi }: { strapi: Core.Strapi }) {\n  // Generate the GraphQL schema for the content API\n  const schema = strapi.plugin('graphql').service('content-api').buildSchema();\n\n  if (isEmpty(schema)) {\n    strapi.log.warn('The GraphQL schema has not been generated because it is empty');\n\n    return;\n  }\n\n  const { config } = strapi.plugin('graphql');\n\n  const path: string = config('endpoint');\n\n  const landingPage = determineLandingPage(strapi);\n  /**\n   * We need the arguments passed to the root query to be available in the association resolver\n   * so we can forward those arguments along to any relations.\n   *\n   * In order to do that we are currently storing the arguments in context.\n   * There is likely a better solution, but for now this is the simplest fix we could find.\n   *\n   * @see https://github.com/strapi/strapi/issues/23524\n   */\n  const pluginAddRootQueryArgs: ApolloServerPlugin<StrapiGraphQLContext> = {\n    async requestDidStart() {\n      return {\n        async executionDidStart() {\n          return {\n            willResolveField({ source, args, contextValue, info }) {\n              if (!source && info.operation.operation === 'query') {\n                // Key args per root field (alias)\n                if (!contextValue.rootQueryArgsByPath) {\n                  contextValue.rootQueryArgsByPath = new Map();\n                }\n                contextValue.rootQueryArgsByPath.set(info.path.key, {\n                  ...args,\n                  _originField: info.fieldName,\n                });\n              }\n            },\n          };\n        },\n      };\n    },\n  };\n\n  type CustomOptions = {\n    cors?: boolean | Options;\n    uploads: boolean;\n    bodyParserConfig: boolean;\n  };\n\n  const defaultServerConfig: ApolloServerOptions<StrapiGraphQLContext> & CustomOptions = {\n    // Schema\n    schema,\n\n    // Validation\n    validationRules: [depthLimit(config('depthLimit') as number) as any],\n\n    // Errors\n    formatError: formatGraphqlError,\n\n    // Misc\n    cors: undefined,\n    uploads: false,\n    bodyParserConfig: true,\n    // send 400 http status instead of 200 for input validation errors\n    status400ForVariableCoercionErrors: true,\n    plugins: [landingPage, pluginAddRootQueryArgs],\n\n    cache: 'bounded' as const,\n  };\n\n  const serverConfig = merge(\n    defaultServerConfig,\n    config('apolloServer')\n  ) as ApolloServerOptions<StrapiGraphQLContext> & CustomOptions;\n\n  // Create a new Apollo server\n  const server = new ApolloServer(serverConfig);\n\n  try {\n    // server.start() must be called before using server.applyMiddleware()\n    await server.start();\n  } catch (error) {\n    if (error instanceof Error) {\n      strapi.log.error('Failed to start the Apollo server', error.message);\n    }\n\n    throw error;\n  }\n\n  // Create the route handlers for Strapi\n  const handler: Core.MiddlewareHandler[] = [];\n\n  // add cors middleware\n  if (serverConfig.cors === false) {\n    // Explicitly disabled - don't add middleware\n  } else if (serverConfig.cors === undefined || serverConfig.cors === true) {\n    // enable with defaults (backwards compatible)\n    handler.push(cors());\n  } else {\n    // Custom options object\n    handler.push(cors(serverConfig.cors));\n  }\n\n  // add koa bodyparser middleware\n  if (isObject(serverConfig.bodyParserConfig)) {\n    handler.push(bodyParser(serverConfig.bodyParserConfig));\n  } else if (serverConfig.bodyParserConfig) {\n    handler.push(bodyParser());\n  } else {\n    strapi.log.debug('Body parser has been disabled for Apollo server');\n  }\n\n  // add the Strapi auth middleware\n  handler.push((ctx, next) => {\n    ctx.state.route = {\n      info: {\n        // Indicate it's a content API route\n        type: 'content-api',\n      },\n    };\n\n    const isPlaygroundRequest =\n      ctx.request.method === 'GET' &&\n      ctx.request.url === path && // Matches the GraphQL endpoint\n      strapi.plugin('graphql').service('utils').playground.isEnabled() && // Only allow if the Playground is enabled\n      ctx.request.header.accept?.includes('text/html'); // Specific to Playground UI loading\n\n    // Skip authentication for the GraphQL Playground UI\n    if (isPlaygroundRequest) {\n      return next();\n    }\n\n    return strapi.auth.authenticate(ctx, next);\n  });\n\n  // add the graphql server for koa\n  handler.push(\n    koaMiddleware<DefaultStateExtends, DefaultContextExtends>(server, {\n      // Initialize loaders for this request.\n      context: async ({ ctx }) => ({\n        state: ctx.state,\n        koaContext: ctx,\n      }),\n    })\n  );\n\n  // now that handlers are set up, add the graphql route to our apollo server\n  strapi.server.routes([\n    {\n      method: 'ALL',\n      path,\n      handler,\n      config: {\n        auth: false,\n      },\n    },\n  ]);\n\n  // Register destroy behavior\n  // We're doing it here instead of exposing a destroy method to the strapi-server.js\n  // file since we need to have access to the ApolloServer instance\n  strapi.plugin('graphql').destroy = async () => {\n    await server.stop();\n  };\n}\n"],"names":["merge","mergeWith","a","b","isArray","concat","determineLandingPage","strapi","config","plugin","utils","service","configLandingPage","isProduction","process","env","NODE_ENV","localLanding","log","debug","playground","setEnabled","ApolloServerPluginLandingPageLocalDefault","prodLanding","ApolloServerPluginLandingPageProductionDefault","userLanding","userFunction","result","playgroundAlways","undefined","warn","isFunction","bootstrap","schema","buildSchema","isEmpty","path","landingPage","pluginAddRootQueryArgs","requestDidStart","executionDidStart","willResolveField","source","args","contextValue","info","operation","rootQueryArgsByPath","Map","set","key","_originField","fieldName","defaultServerConfig","validationRules","depthLimit","formatError","formatGraphqlError","cors","uploads","bodyParserConfig","status400ForVariableCoercionErrors","plugins","cache","serverConfig","server","ApolloServer","start","error","Error","message","handler","push","isObject","bodyParser","ctx","next","state","route","type","isPlaygroundRequest","request","method","url","isEnabled","header","accept","includes","auth","authenticate","koaMiddleware","context","koaContext","routes","destroy","stop"],"mappings":";;;;;;;;;AAiBA,MAAMA,KAAAA,GAAQC,SAAAA,CAAU,CAACC,CAAAA,EAAGC,CAAAA,GAAAA;IAC1B,IAAIC,OAAAA,CAAQF,CAAAA,CAAAA,IAAME,OAAAA,CAAQD,CAAAA,CAAAA,EAAI;QAC5B,OAAOD,CAAAA,CAAEG,MAAM,CAACF,CAAAA,CAAAA;AAClB,IAAA;AACF,CAAA,CAAA;AAMO,MAAMG,uBAAuB,CAClCC,MAAAA,GAAAA;AAEA,IAAA,MAAM,EAAEC,MAAM,EAAE,GAAGD,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA;AACjC,IAAA,MAAMC,QAAQH,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA,CAAWE,OAAO,CAAC,OAAA,CAAA;AAE/C;;;;;;;SAQA,MAAMC,oBAAoBJ,MAAAA,CAAO,aAAA,CAAA;AAEjC,IAAA,MAAMK,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,YAAAA,GAAe,IAAA;QACnBV,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,4BAAA,CAAA;QACjBT,KAAAA,CAAMU,UAAU,CAACC,UAAU,CAAC,IAAA,CAAA;QAC5B,OAAOC,yCAAAA,EAAAA;AACT,IAAA,CAAA;AAEA,IAAA,MAAMC,WAAAA,GAAc,IAAA;QAClBhB,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,iCAAA,CAAA;QACjBT,KAAAA,CAAMU,UAAU,CAACC,UAAU,CAAC,KAAA,CAAA;QAC5B,OAAOG,8CAAAA,EAAAA;AACT,IAAA,CAAA;AAEA,IAAA,MAAMC,cAAc,CAACC,YAAAA,GAAAA;QACnBnB,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,oDAAA,CAAA;AACjB,QAAA,MAAMQ,SAASD,YAAAA,CAAanB,MAAAA,CAAAA;AAC5B,QAAA,IAAIoB,WAAW,IAAA,EAAM;YACnB,OAAOV,YAAAA,EAAAA;AACT,QAAA;AACA,QAAA,IAAIU,WAAW,KAAA,EAAO;YACpB,OAAOJ,WAAAA,EAAAA;AACT,QAAA;QACAhB,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,mCAAA,CAAA;QACjB,OAAOQ,MAAAA;AACT,IAAA,CAAA;;AAGA,IAAA,MAAMC,mBAAmBpB,MAAAA,CAAO,kBAAA,CAAA;AAChC,IAAA,IAAIoB,qBAAqBC,SAAAA,EAAW;QAClCtB,MAAAA,CAAOW,GAAG,CAACY,IAAI,CACb,uHAAA,CAAA;AAEJ,IAAA;AACA,IAAA,IAAIF,qBAAqB,KAAA,EAAO;QAC9BrB,MAAAA,CAAOW,GAAG,CAACY,IAAI,CACb,qIAAA,CAAA;AAEJ,IAAA;IAEA,IAAIF,gBAAAA,IAAoBhB,sBAAsB,IAAA,EAAM;QAClD,OAAOK,YAAAA,EAAAA;AACT,IAAA;;AAGA,IAAA,IAAIL,sBAAsB,KAAA,EAAO;QAC/B,OAAOW,WAAAA,EAAAA;AACT,IAAA;;AAGA,IAAA,IAAIX,sBAAsBiB,SAAAA,EAAW;AACnC,QAAA,OAAOhB,eAAeU,WAAAA,EAAAA,GAAgBN,YAAAA,EAAAA;AACxC,IAAA;;AAGA,IAAA,IAAIc,WAAWnB,iBAAAA,CAAAA,EAAoB;AACjC,QAAA,OAAOa,WAAAA,CAAYb,iBAAAA,CAAAA;AACrB,IAAA;;IAGAL,MAAAA,CAAOW,GAAG,CAACY,IAAI,CACb,mGAAA,CAAA;IAEF,OAAOP,WAAAA,EAAAA;AACT;AAEO,eAAeS,SAAAA,CAAU,EAAEzB,MAAM,EAA2B,EAAA;;IAEjE,MAAM0B,MAAAA,GAAS1B,OAAOE,MAAM,CAAC,WAAWE,OAAO,CAAC,eAAeuB,WAAW,EAAA;AAE1E,IAAA,IAAIC,QAAQF,MAAAA,CAAAA,EAAS;QACnB1B,MAAAA,CAAOW,GAAG,CAACY,IAAI,CAAC,+DAAA,CAAA;AAEhB,QAAA;AACF,IAAA;AAEA,IAAA,MAAM,EAAEtB,MAAM,EAAE,GAAGD,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA;AAEjC,IAAA,MAAM2B,OAAe5B,MAAAA,CAAO,UAAA,CAAA;AAE5B,IAAA,MAAM6B,cAAc/B,oBAAAA,CAAqBC,MAAAA,CAAAA;AACzC;;;;;;;;AAQC,MACD,MAAM+B,sBAAAA,GAAmE;QACvE,MAAMC,eAAAA,CAAAA,GAAAA;YACJ,OAAO;gBACL,MAAMC,iBAAAA,CAAAA,GAAAA;oBACJ,OAAO;wBACLC,gBAAAA,CAAAA,CAAiB,EAAEC,MAAM,EAAEC,IAAI,EAAEC,YAAY,EAAEC,IAAI,EAAE,EAAA;AACnD,4BAAA,IAAI,CAACH,MAAAA,IAAUG,IAAAA,CAAKC,SAAS,CAACA,SAAS,KAAK,OAAA,EAAS;;gCAEnD,IAAI,CAACF,YAAAA,CAAaG,mBAAmB,EAAE;oCACrCH,YAAAA,CAAaG,mBAAmB,GAAG,IAAIC,GAAAA,EAAAA;AACzC,gCAAA;gCACAJ,YAAAA,CAAaG,mBAAmB,CAACE,GAAG,CAACJ,KAAKT,IAAI,CAACc,GAAG,EAAE;AAClD,oCAAA,GAAGP,IAAI;AACPQ,oCAAAA,YAAAA,EAAcN,KAAKO;AACrB,iCAAA,CAAA;AACF,4BAAA;AACF,wBAAA;AACF,qBAAA;AACF,gBAAA;AACF,aAAA;AACF,QAAA;AACF,KAAA;AAQA,IAAA,MAAMC,mBAAAA,GAAiF;;AAErFpB,QAAAA,MAAAA;;QAGAqB,eAAAA,EAAiB;AAACC,YAAAA,UAAAA,CAAW/C,MAAAA,CAAO,YAAA,CAAA;AAAgC,SAAA;;QAGpEgD,WAAAA,EAAaC,kBAAAA;;QAGbC,IAAAA,EAAM7B,SAAAA;QACN8B,OAAAA,EAAS,KAAA;QACTC,gBAAAA,EAAkB,IAAA;;QAElBC,kCAAAA,EAAoC,IAAA;QACpCC,OAAAA,EAAS;AAACzB,YAAAA,WAAAA;AAAaC,YAAAA;AAAuB,SAAA;QAE9CyB,KAAAA,EAAO;AACT,KAAA;IAEA,MAAMC,YAAAA,GAAehE,KAAAA,CACnBqD,mBAAAA,EACA7C,MAAAA,CAAO,cAAA,CAAA,CAAA;;IAIT,MAAMyD,MAAAA,GAAS,IAAIC,YAAAA,CAAaF,YAAAA,CAAAA;IAEhC,IAAI;;AAEF,QAAA,MAAMC,OAAOE,KAAK,EAAA;AACpB,IAAA,CAAA,CAAE,OAAOC,KAAAA,EAAO;AACd,QAAA,IAAIA,iBAAiBC,KAAAA,EAAO;AAC1B9D,YAAAA,MAAAA,CAAOW,GAAG,CAACkD,KAAK,CAAC,mCAAA,EAAqCA,MAAME,OAAO,CAAA;AACrE,QAAA;QAEA,MAAMF,KAAAA;AACR,IAAA;;AAGA,IAAA,MAAMG,UAAoC,EAAE;;IAG5C,IAAIP,YAAAA,CAAaN,IAAI,KAAK,KAAA,EAAO,CAEjC,MAAO,IAAIM,aAAaN,IAAI,KAAK7B,aAAamC,YAAAA,CAAaN,IAAI,KAAK,IAAA,EAAM;;AAExEa,QAAAA,OAAAA,CAAQC,IAAI,CAACd,IAAAA,EAAAA,CAAAA;IACf,CAAA,MAAO;;AAELa,QAAAA,OAAAA,CAAQC,IAAI,CAACd,IAAAA,CAAKM,YAAAA,CAAaN,IAAI,CAAA,CAAA;AACrC,IAAA;;IAGA,IAAIe,QAAAA,CAAST,YAAAA,CAAaJ,gBAAgB,CAAA,EAAG;AAC3CW,QAAAA,OAAAA,CAAQC,IAAI,CAACE,UAAAA,CAAWV,YAAAA,CAAaJ,gBAAgB,CAAA,CAAA;IACvD,CAAA,MAAO,IAAII,YAAAA,CAAaJ,gBAAgB,EAAE;AACxCW,QAAAA,OAAAA,CAAQC,IAAI,CAACE,UAAAA,EAAAA,CAAAA;IACf,CAAA,MAAO;QACLnE,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,iDAAA,CAAA;AACnB,IAAA;;IAGAoD,OAAAA,CAAQC,IAAI,CAAC,CAACG,GAAAA,EAAKC,IAAAA,GAAAA;QACjBD,GAAAA,CAAIE,KAAK,CAACC,KAAK,GAAG;YAChBjC,IAAAA,EAAM;;gBAEJkC,IAAAA,EAAM;AACR;AACF,SAAA;AAEA,QAAA,MAAMC,mBAAAA,GACJL,GAAAA,CAAIM,OAAO,CAACC,MAAM,KAAK,KAAA,IACvBP,GAAAA,CAAIM,OAAO,CAACE,GAAG,KAAK/C;QACpB7B,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA,CAAWE,OAAO,CAAC,SAASS,UAAU,CAACgE,SAAS,EAAA;QAC9DT,GAAAA,CAAIM,OAAO,CAACI,MAAM,CAACC,MAAM,EAAEC,QAAAA,CAAS;;AAGtC,QAAA,IAAIP,mBAAAA,EAAqB;YACvB,OAAOJ,IAAAA,EAAAA;AACT,QAAA;AAEA,QAAA,OAAOrE,MAAAA,CAAOiF,IAAI,CAACC,YAAY,CAACd,GAAAA,EAAKC,IAAAA,CAAAA;AACvC,IAAA,CAAA,CAAA;;IAGAL,OAAAA,CAAQC,IAAI,CACVkB,aAAAA,CAA0DzB,MAAAA,EAAQ;;AAEhE0B,QAAAA,OAAAA,EAAS,OAAO,EAAEhB,GAAG,EAAE,IAAM;AAC3BE,gBAAAA,KAAAA,EAAOF,IAAIE,KAAK;gBAChBe,UAAAA,EAAYjB;aACd;AACF,KAAA,CAAA,CAAA;;IAIFpE,MAAAA,CAAO0D,MAAM,CAAC4B,MAAM,CAAC;AACnB,QAAA;YACEX,MAAAA,EAAQ,KAAA;AACR9C,YAAAA,IAAAA;AACAmC,YAAAA,OAAAA;YACA/D,MAAAA,EAAQ;gBACNgF,IAAAA,EAAM;AACR;AACF;AACD,KAAA,CAAA;;;;AAKDjF,IAAAA,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA,CAAWqF,OAAO,GAAG,UAAA;AACjC,QAAA,MAAM7B,OAAO8B,IAAI,EAAA;AACnB,IAAA,CAAA;AACF;;;;"}
+{"version":3,"file":"bootstrap.mjs","sources":["../../server/src/bootstrap.ts"],"sourcesContent":["import { isEmpty, mergeWith, isArray, isObject, isFunction } from 'lodash/fp';\nimport { ApolloServer, type ApolloServerPlugin, type ApolloServerOptions } from '@apollo/server';\nimport {\n  ApolloServerPluginLandingPageLocalDefault,\n  ApolloServerPluginLandingPageProductionDefault,\n} from '@apollo/server/plugin/landingPage/default';\nimport { koaMiddleware } from '@as-integrations/koa';\nimport depthLimit from 'graphql-depth-limit';\nimport bodyParser from 'koa-bodyparser';\nimport cors from '@koa/cors';\n\nimport type { Core } from '@strapi/types';\nimport type { Options } from '@koa/cors';\nimport type { BaseContext, DefaultContextExtends, DefaultStateExtends } from 'koa';\n\nimport { formatGraphqlError } from './format-graphql-error';\n\nconst merge = mergeWith((a, b) => {\n  if (isArray(a) && isArray(b)) {\n    return a.concat(b);\n  }\n});\n\ntype StrapiGraphQLContext = BaseContext & {\n  rootQueryArgsByPath?: Map<string | number, Record<string, unknown>>;\n};\n\ntype OperationLimitConfig = {\n  depthLimit?: unknown;\n  maxLimit?: unknown;\n};\n\nexport const getOperationLimitsWarning = ({\n  depthLimit: configuredDepthLimit,\n  maxLimit,\n}: OperationLimitConfig): string | undefined => {\n  const unboundedOrInvalidKeys: string[] = [];\n\n  if (\n    typeof configuredDepthLimit !== 'number' ||\n    !Number.isFinite(configuredDepthLimit) ||\n    configuredDepthLimit <= 0\n  ) {\n    unboundedOrInvalidKeys.push('depthLimit');\n  }\n\n  if (typeof maxLimit !== 'number' || !Number.isFinite(maxLimit) || maxLimit <= 0) {\n    unboundedOrInvalidKeys.push('maxLimit');\n  }\n\n  if (unboundedOrInvalidKeys.length === 0) {\n    return undefined;\n  }\n\n  return `Built-in GraphQL operation limits are unbounded or invalid for: ${unboundedOrInvalidKeys.join(', ')}. Configure these limits (for example: defaultLimit: 25, maxLimit: 100, depthLimit: 10). Custom Apollo validation rules may independently enforce limits. See https://docs.strapi.io/cms/configurations/plugins.`;\n};\n\nexport const determineLandingPage = (\n  strapi: Core.Strapi\n): ApolloServerPlugin<StrapiGraphQLContext> => {\n  const { config } = strapi.plugin('graphql');\n  const utils = strapi.plugin('graphql').service('utils');\n\n  /**\n   * configLanding page may be one of the following:\n   *\n   * - true: always use \"playground\" even in production\n   * - false: never show \"playground\" even in non-production\n   * - undefined: default Apollo behavior (hide playground on production)\n   * - a function that returns an Apollo plugin that implements renderLandingPage\n   ** */\n  const configLandingPage = config('landingPage');\n\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const localLanding = () => {\n    strapi.log.debug('Apollo landing page: local');\n    utils.playground.setEnabled(true);\n    return ApolloServerPluginLandingPageLocalDefault();\n  };\n\n  const prodLanding = () => {\n    strapi.log.debug('Apollo landing page: production');\n    utils.playground.setEnabled(false);\n    return ApolloServerPluginLandingPageProductionDefault();\n  };\n\n  const userLanding = (userFunction: (strapi?: Core.Strapi) => ApolloServerPlugin | boolean) => {\n    strapi.log.debug('Apollo landing page: from user-defined function...');\n    const result = userFunction(strapi);\n    if (result === true) {\n      return localLanding();\n    }\n    if (result === false) {\n      return prodLanding();\n    }\n    strapi.log.debug('Apollo landing page: user-defined');\n    return result;\n  };\n\n  // DEPRECATED, remove in Strapi v6\n  const playgroundAlways = config('playgroundAlways');\n  if (playgroundAlways !== undefined) {\n    strapi.log.warn(\n      'The graphql config playgroundAlways is deprecated. This will be removed in Strapi 6. Please use landingPage instead. '\n    );\n  }\n  if (playgroundAlways === false) {\n    strapi.log.warn(\n      'graphql config playgroundAlways:false has no effect, please use landingPage:false to disable Graphql Playground in all environments'\n    );\n  }\n\n  if (playgroundAlways || configLandingPage === true) {\n    return localLanding();\n  }\n\n  // if landing page has been disabled, use production\n  if (configLandingPage === false) {\n    return prodLanding();\n  }\n\n  // If user did not define any settings, use our defaults\n  if (configLandingPage === undefined) {\n    return isProduction ? prodLanding() : localLanding();\n  }\n\n  // if user provided a landing page function, return that\n  if (isFunction(configLandingPage)) {\n    return userLanding(configLandingPage);\n  }\n\n  // If no other setting could be found, default to production settings\n  strapi.log.warn(\n    'Your Graphql landing page has been disabled because there is a problem with your Graphql settings'\n  );\n  return prodLanding();\n};\n\nexport async function bootstrap({ strapi }: { strapi: Core.Strapi }) {\n  // Generate the GraphQL schema for the content API\n  const schema = strapi.plugin('graphql').service('content-api').buildSchema();\n\n  if (isEmpty(schema)) {\n    strapi.log.warn('The GraphQL schema has not been generated because it is empty');\n\n    return;\n  }\n\n  const { config } = strapi.plugin('graphql');\n\n  const path: string = config('endpoint');\n  const configuredDepthLimit = config('depthLimit');\n  const maxLimit = config('maxLimit');\n  const operationLimitsWarning = getOperationLimitsWarning({\n    depthLimit: configuredDepthLimit,\n    maxLimit,\n  });\n\n  if (operationLimitsWarning) {\n    strapi.log.warn(operationLimitsWarning);\n  }\n\n  const landingPage = determineLandingPage(strapi);\n  /**\n   * We need the arguments passed to the root query to be available in the association resolver\n   * so we can forward those arguments along to any relations.\n   *\n   * In order to do that we are currently storing the arguments in context.\n   * There is likely a better solution, but for now this is the simplest fix we could find.\n   *\n   * @see https://github.com/strapi/strapi/issues/23524\n   */\n  const pluginAddRootQueryArgs: ApolloServerPlugin<StrapiGraphQLContext> = {\n    async requestDidStart() {\n      return {\n        async executionDidStart() {\n          return {\n            willResolveField({ source, args, contextValue, info }) {\n              if (!source && info.operation.operation === 'query') {\n                // Key args per root field (alias)\n                if (!contextValue.rootQueryArgsByPath) {\n                  contextValue.rootQueryArgsByPath = new Map();\n                }\n                contextValue.rootQueryArgsByPath.set(info.path.key, {\n                  ...args,\n                  _originField: info.fieldName,\n                });\n              }\n            },\n          };\n        },\n      };\n    },\n  };\n\n  type CustomOptions = {\n    cors?: boolean | Options;\n    uploads: boolean;\n    bodyParserConfig: boolean;\n  };\n\n  const defaultServerConfig: ApolloServerOptions<StrapiGraphQLContext> & CustomOptions = {\n    // Schema\n    schema,\n\n    // Validation\n    // Keep v5 compatibility: depthLimit is passed through unchanged, so an unset or invalid value\n    // does not become an enforced finite limit during an upgrade.\n    validationRules: [depthLimit(configuredDepthLimit as number) as any],\n\n    // Errors\n    formatError: formatGraphqlError,\n\n    // Misc\n    cors: undefined,\n    uploads: false,\n    bodyParserConfig: true,\n    // send 400 http status instead of 200 for input validation errors\n    status400ForVariableCoercionErrors: true,\n    plugins: [landingPage, pluginAddRootQueryArgs],\n\n    cache: 'bounded' as const,\n  };\n\n  const serverConfig = merge(\n    defaultServerConfig,\n    config('apolloServer')\n  ) as ApolloServerOptions<StrapiGraphQLContext> & CustomOptions;\n\n  // Create a new Apollo server\n  const server = new ApolloServer(serverConfig);\n\n  try {\n    // server.start() must be called before using server.applyMiddleware()\n    await server.start();\n  } catch (error) {\n    if (error instanceof Error) {\n      strapi.log.error('Failed to start the Apollo server', error.message);\n    }\n\n    throw error;\n  }\n\n  // Create the route handlers for Strapi\n  const handler: Core.MiddlewareHandler[] = [];\n\n  // add cors middleware\n  if (serverConfig.cors === false) {\n    // Explicitly disabled - don't add middleware\n  } else if (serverConfig.cors === undefined || serverConfig.cors === true) {\n    // enable with defaults (backwards compatible)\n    handler.push(cors());\n  } else {\n    // Custom options object\n    handler.push(cors(serverConfig.cors));\n  }\n\n  // add koa bodyparser middleware\n  if (isObject(serverConfig.bodyParserConfig)) {\n    handler.push(bodyParser(serverConfig.bodyParserConfig));\n  } else if (serverConfig.bodyParserConfig) {\n    handler.push(bodyParser());\n  } else {\n    strapi.log.debug('Body parser has been disabled for Apollo server');\n  }\n\n  // add the Strapi auth middleware\n  handler.push((ctx, next) => {\n    ctx.state.route = {\n      info: {\n        // Indicate it's a content API route\n        type: 'content-api',\n      },\n    };\n\n    const isPlaygroundRequest =\n      ctx.request.method === 'GET' &&\n      ctx.request.url === path && // Matches the GraphQL endpoint\n      strapi.plugin('graphql').service('utils').playground.isEnabled() && // Only allow if the Playground is enabled\n      ctx.request.header.accept?.includes('text/html'); // Specific to Playground UI loading\n\n    // Skip authentication for the GraphQL Playground UI\n    if (isPlaygroundRequest) {\n      return next();\n    }\n\n    return strapi.auth.authenticate(ctx, next);\n  });\n\n  // add the graphql server for koa\n  handler.push(\n    koaMiddleware<DefaultStateExtends, DefaultContextExtends>(server, {\n      // Initialize loaders for this request.\n      context: async ({ ctx }) => ({\n        state: ctx.state,\n        koaContext: ctx,\n      }),\n    })\n  );\n\n  // now that handlers are set up, add the graphql route to our apollo server\n  strapi.server.routes([\n    {\n      method: 'ALL',\n      path,\n      handler,\n      config: {\n        auth: false,\n      },\n    },\n  ]);\n\n  // Register destroy behavior\n  // We're doing it here instead of exposing a destroy method to the strapi-server.js\n  // file since we need to have access to the ApolloServer instance\n  strapi.plugin('graphql').destroy = async () => {\n    await server.stop();\n  };\n}\n"],"names":["merge","mergeWith","a","b","isArray","concat","getOperationLimitsWarning","depthLimit","configuredDepthLimit","maxLimit","unboundedOrInvalidKeys","Number","isFinite","push","length","undefined","join","determineLandingPage","strapi","config","plugin","utils","service","configLandingPage","isProduction","process","env","NODE_ENV","localLanding","log","debug","playground","setEnabled","ApolloServerPluginLandingPageLocalDefault","prodLanding","ApolloServerPluginLandingPageProductionDefault","userLanding","userFunction","result","playgroundAlways","warn","isFunction","bootstrap","schema","buildSchema","isEmpty","path","operationLimitsWarning","landingPage","pluginAddRootQueryArgs","requestDidStart","executionDidStart","willResolveField","source","args","contextValue","info","operation","rootQueryArgsByPath","Map","set","key","_originField","fieldName","defaultServerConfig","validationRules","formatError","formatGraphqlError","cors","uploads","bodyParserConfig","status400ForVariableCoercionErrors","plugins","cache","serverConfig","server","ApolloServer","start","error","Error","message","handler","isObject","bodyParser","ctx","next","state","route","type","isPlaygroundRequest","request","method","url","isEnabled","header","accept","includes","auth","authenticate","koaMiddleware","context","koaContext","routes","destroy","stop"],"mappings":";;;;;;;;;AAiBA,MAAMA,KAAAA,GAAQC,SAAAA,CAAU,CAACC,CAAAA,EAAGC,CAAAA,GAAAA;IAC1B,IAAIC,OAAAA,CAAQF,CAAAA,CAAAA,IAAME,OAAAA,CAAQD,CAAAA,CAAAA,EAAI;QAC5B,OAAOD,CAAAA,CAAEG,MAAM,CAACF,CAAAA,CAAAA;AAClB,IAAA;AACF,CAAA,CAAA;AAWO,MAAMG,4BAA4B,CAAC,EACxCC,YAAYC,oBAAoB,EAChCC,QAAQ,EACa,GAAA;AACrB,IAAA,MAAMC,yBAAmC,EAAE;IAE3C,IACE,OAAOF,yBAAyB,QAAA,IAChC,CAACG,OAAOC,QAAQ,CAACJ,oBAAAA,CAAAA,IACjBA,oBAAAA,IAAwB,CAAA,EACxB;AACAE,QAAAA,sBAAAA,CAAuBG,IAAI,CAAC,YAAA,CAAA;AAC9B,IAAA;IAEA,IAAI,OAAOJ,aAAa,QAAA,IAAY,CAACE,OAAOC,QAAQ,CAACH,QAAAA,CAAAA,IAAaA,QAAAA,IAAY,CAAA,EAAG;AAC/EC,QAAAA,sBAAAA,CAAuBG,IAAI,CAAC,UAAA,CAAA;AAC9B,IAAA;IAEA,IAAIH,sBAAAA,CAAuBI,MAAM,KAAK,CAAA,EAAG;QACvC,OAAOC,SAAAA;AACT,IAAA;IAEA,OAAO,CAAC,gEAAgE,EAAEL,sBAAAA,CAAuBM,IAAI,CAAC,IAAA,CAAA,CAAM,gNAAgN,CAAC;AAC/T;AAEO,MAAMC,uBAAuB,CAClCC,MAAAA,GAAAA;AAEA,IAAA,MAAM,EAAEC,MAAM,EAAE,GAAGD,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA;AACjC,IAAA,MAAMC,QAAQH,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA,CAAWE,OAAO,CAAC,OAAA,CAAA;AAE/C;;;;;;;SAQA,MAAMC,oBAAoBJ,MAAAA,CAAO,aAAA,CAAA;AAEjC,IAAA,MAAMK,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,YAAAA,GAAe,IAAA;QACnBV,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,4BAAA,CAAA;QACjBT,KAAAA,CAAMU,UAAU,CAACC,UAAU,CAAC,IAAA,CAAA;QAC5B,OAAOC,yCAAAA,EAAAA;AACT,IAAA,CAAA;AAEA,IAAA,MAAMC,WAAAA,GAAc,IAAA;QAClBhB,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,iCAAA,CAAA;QACjBT,KAAAA,CAAMU,UAAU,CAACC,UAAU,CAAC,KAAA,CAAA;QAC5B,OAAOG,8CAAAA,EAAAA;AACT,IAAA,CAAA;AAEA,IAAA,MAAMC,cAAc,CAACC,YAAAA,GAAAA;QACnBnB,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,oDAAA,CAAA;AACjB,QAAA,MAAMQ,SAASD,YAAAA,CAAanB,MAAAA,CAAAA;AAC5B,QAAA,IAAIoB,WAAW,IAAA,EAAM;YACnB,OAAOV,YAAAA,EAAAA;AACT,QAAA;AACA,QAAA,IAAIU,WAAW,KAAA,EAAO;YACpB,OAAOJ,WAAAA,EAAAA;AACT,QAAA;QACAhB,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,mCAAA,CAAA;QACjB,OAAOQ,MAAAA;AACT,IAAA,CAAA;;AAGA,IAAA,MAAMC,mBAAmBpB,MAAAA,CAAO,kBAAA,CAAA;AAChC,IAAA,IAAIoB,qBAAqBxB,SAAAA,EAAW;QAClCG,MAAAA,CAAOW,GAAG,CAACW,IAAI,CACb,uHAAA,CAAA;AAEJ,IAAA;AACA,IAAA,IAAID,qBAAqB,KAAA,EAAO;QAC9BrB,MAAAA,CAAOW,GAAG,CAACW,IAAI,CACb,qIAAA,CAAA;AAEJ,IAAA;IAEA,IAAID,gBAAAA,IAAoBhB,sBAAsB,IAAA,EAAM;QAClD,OAAOK,YAAAA,EAAAA;AACT,IAAA;;AAGA,IAAA,IAAIL,sBAAsB,KAAA,EAAO;QAC/B,OAAOW,WAAAA,EAAAA;AACT,IAAA;;AAGA,IAAA,IAAIX,sBAAsBR,SAAAA,EAAW;AACnC,QAAA,OAAOS,eAAeU,WAAAA,EAAAA,GAAgBN,YAAAA,EAAAA;AACxC,IAAA;;AAGA,IAAA,IAAIa,WAAWlB,iBAAAA,CAAAA,EAAoB;AACjC,QAAA,OAAOa,WAAAA,CAAYb,iBAAAA,CAAAA;AACrB,IAAA;;IAGAL,MAAAA,CAAOW,GAAG,CAACW,IAAI,CACb,mGAAA,CAAA;IAEF,OAAON,WAAAA,EAAAA;AACT;AAEO,eAAeQ,SAAAA,CAAU,EAAExB,MAAM,EAA2B,EAAA;;IAEjE,MAAMyB,MAAAA,GAASzB,OAAOE,MAAM,CAAC,WAAWE,OAAO,CAAC,eAAesB,WAAW,EAAA;AAE1E,IAAA,IAAIC,QAAQF,MAAAA,CAAAA,EAAS;QACnBzB,MAAAA,CAAOW,GAAG,CAACW,IAAI,CAAC,+DAAA,CAAA;AAEhB,QAAA;AACF,IAAA;AAEA,IAAA,MAAM,EAAErB,MAAM,EAAE,GAAGD,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA;AAEjC,IAAA,MAAM0B,OAAe3B,MAAAA,CAAO,UAAA,CAAA;AAC5B,IAAA,MAAMX,uBAAuBW,MAAAA,CAAO,YAAA,CAAA;AACpC,IAAA,MAAMV,WAAWU,MAAAA,CAAO,UAAA,CAAA;AACxB,IAAA,MAAM4B,yBAAyBzC,yBAAAA,CAA0B;QACvDC,UAAAA,EAAYC,oBAAAA;AACZC,QAAAA;AACF,KAAA,CAAA;AAEA,IAAA,IAAIsC,sBAAAA,EAAwB;QAC1B7B,MAAAA,CAAOW,GAAG,CAACW,IAAI,CAACO,sBAAAA,CAAAA;AAClB,IAAA;AAEA,IAAA,MAAMC,cAAc/B,oBAAAA,CAAqBC,MAAAA,CAAAA;AACzC;;;;;;;;AAQC,MACD,MAAM+B,sBAAAA,GAAmE;QACvE,MAAMC,eAAAA,CAAAA,GAAAA;YACJ,OAAO;gBACL,MAAMC,iBAAAA,CAAAA,GAAAA;oBACJ,OAAO;wBACLC,gBAAAA,CAAAA,CAAiB,EAAEC,MAAM,EAAEC,IAAI,EAAEC,YAAY,EAAEC,IAAI,EAAE,EAAA;AACnD,4BAAA,IAAI,CAACH,MAAAA,IAAUG,IAAAA,CAAKC,SAAS,CAACA,SAAS,KAAK,OAAA,EAAS;;gCAEnD,IAAI,CAACF,YAAAA,CAAaG,mBAAmB,EAAE;oCACrCH,YAAAA,CAAaG,mBAAmB,GAAG,IAAIC,GAAAA,EAAAA;AACzC,gCAAA;gCACAJ,YAAAA,CAAaG,mBAAmB,CAACE,GAAG,CAACJ,KAAKV,IAAI,CAACe,GAAG,EAAE;AAClD,oCAAA,GAAGP,IAAI;AACPQ,oCAAAA,YAAAA,EAAcN,KAAKO;AACrB,iCAAA,CAAA;AACF,4BAAA;AACF,wBAAA;AACF,qBAAA;AACF,gBAAA;AACF,aAAA;AACF,QAAA;AACF,KAAA;AAQA,IAAA,MAAMC,mBAAAA,GAAiF;;AAErFrB,QAAAA,MAAAA;;;;QAKAsB,eAAAA,EAAiB;YAAC1D,UAAAA,CAAWC,oBAAAA;AAAuC,SAAA;;QAGpE0D,WAAAA,EAAaC,kBAAAA;;QAGbC,IAAAA,EAAMrD,SAAAA;QACNsD,OAAAA,EAAS,KAAA;QACTC,gBAAAA,EAAkB,IAAA;;QAElBC,kCAAAA,EAAoC,IAAA;QACpCC,OAAAA,EAAS;AAACxB,YAAAA,WAAAA;AAAaC,YAAAA;AAAuB,SAAA;QAE9CwB,KAAAA,EAAO;AACT,KAAA;IAEA,MAAMC,YAAAA,GAAe1E,KAAAA,CACnBgE,mBAAAA,EACA7C,MAAAA,CAAO,cAAA,CAAA,CAAA;;IAIT,MAAMwD,MAAAA,GAAS,IAAIC,YAAAA,CAAaF,YAAAA,CAAAA;IAEhC,IAAI;;AAEF,QAAA,MAAMC,OAAOE,KAAK,EAAA;AACpB,IAAA,CAAA,CAAE,OAAOC,KAAAA,EAAO;AACd,QAAA,IAAIA,iBAAiBC,KAAAA,EAAO;AAC1B7D,YAAAA,MAAAA,CAAOW,GAAG,CAACiD,KAAK,CAAC,mCAAA,EAAqCA,MAAME,OAAO,CAAA;AACrE,QAAA;QAEA,MAAMF,KAAAA;AACR,IAAA;;AAGA,IAAA,MAAMG,UAAoC,EAAE;;IAG5C,IAAIP,YAAAA,CAAaN,IAAI,KAAK,KAAA,EAAO,CAEjC,MAAO,IAAIM,aAAaN,IAAI,KAAKrD,aAAa2D,YAAAA,CAAaN,IAAI,KAAK,IAAA,EAAM;;AAExEa,QAAAA,OAAAA,CAAQpE,IAAI,CAACuD,IAAAA,EAAAA,CAAAA;IACf,CAAA,MAAO;;AAELa,QAAAA,OAAAA,CAAQpE,IAAI,CAACuD,IAAAA,CAAKM,YAAAA,CAAaN,IAAI,CAAA,CAAA;AACrC,IAAA;;IAGA,IAAIc,QAAAA,CAASR,YAAAA,CAAaJ,gBAAgB,CAAA,EAAG;AAC3CW,QAAAA,OAAAA,CAAQpE,IAAI,CAACsE,UAAAA,CAAWT,YAAAA,CAAaJ,gBAAgB,CAAA,CAAA;IACvD,CAAA,MAAO,IAAII,YAAAA,CAAaJ,gBAAgB,EAAE;AACxCW,QAAAA,OAAAA,CAAQpE,IAAI,CAACsE,UAAAA,EAAAA,CAAAA;IACf,CAAA,MAAO;QACLjE,MAAAA,CAAOW,GAAG,CAACC,KAAK,CAAC,iDAAA,CAAA;AACnB,IAAA;;IAGAmD,OAAAA,CAAQpE,IAAI,CAAC,CAACuE,GAAAA,EAAKC,IAAAA,GAAAA;QACjBD,GAAAA,CAAIE,KAAK,CAACC,KAAK,GAAG;YAChB/B,IAAAA,EAAM;;gBAEJgC,IAAAA,EAAM;AACR;AACF,SAAA;AAEA,QAAA,MAAMC,mBAAAA,GACJL,GAAAA,CAAIM,OAAO,CAACC,MAAM,KAAK,KAAA,IACvBP,GAAAA,CAAIM,OAAO,CAACE,GAAG,KAAK9C;QACpB5B,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA,CAAWE,OAAO,CAAC,SAASS,UAAU,CAAC8D,SAAS,EAAA;QAC9DT,GAAAA,CAAIM,OAAO,CAACI,MAAM,CAACC,MAAM,EAAEC,QAAAA,CAAS;;AAGtC,QAAA,IAAIP,mBAAAA,EAAqB;YACvB,OAAOJ,IAAAA,EAAAA;AACT,QAAA;AAEA,QAAA,OAAOnE,MAAAA,CAAO+E,IAAI,CAACC,YAAY,CAACd,GAAAA,EAAKC,IAAAA,CAAAA;AACvC,IAAA,CAAA,CAAA;;IAGAJ,OAAAA,CAAQpE,IAAI,CACVsF,aAAAA,CAA0DxB,MAAAA,EAAQ;;AAEhEyB,QAAAA,OAAAA,EAAS,OAAO,EAAEhB,GAAG,EAAE,IAAM;AAC3BE,gBAAAA,KAAAA,EAAOF,IAAIE,KAAK;gBAChBe,UAAAA,EAAYjB;aACd;AACF,KAAA,CAAA,CAAA;;IAIFlE,MAAAA,CAAOyD,MAAM,CAAC2B,MAAM,CAAC;AACnB,QAAA;YACEX,MAAAA,EAAQ,KAAA;AACR7C,YAAAA,IAAAA;AACAmC,YAAAA,OAAAA;YACA9D,MAAAA,EAAQ;gBACN8E,IAAAA,EAAM;AACR;AACF;AACD,KAAA,CAAA;;;;AAKD/E,IAAAA,MAAAA,CAAOE,MAAM,CAAC,SAAA,CAAA,CAAWmF,OAAO,GAAG,UAAA;AACjC,QAAA,MAAM5B,OAAO6B,IAAI,EAAA;AACnB,IAAA,CAAA;AACF;;;;"}

package/dist/server/src/bootstrap.d.ts

@@ -4,6 +4,11 @@ import type { BaseContext } from 'koa';
 type StrapiGraphQLContext = BaseContext & {
     rootQueryArgsByPath?: Map<string | number, Record<string, unknown>>;
 };
+type OperationLimitConfig = {
+    depthLimit?: unknown;
+    maxLimit?: unknown;
+};
+export declare const getOperationLimitsWarning: ({ depthLimit: configuredDepthLimit, maxLimit, }: OperationLimitConfig) => string | undefined;
 export declare const determineLandingPage: (strapi: Core.Strapi) => ApolloServerPlugin<StrapiGraphQLContext>;
 export declare function bootstrap({ strapi }: {
     strapi: Core.Strapi;

package/dist/server/src/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../server/src/bootstrap.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,kBAAkB,EAA4B,MAAM,gBAAgB,CAAC;AAUjG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,OAAO,KAAK,EAAE,WAAW,EAA8C,MAAM,KAAK,CAAC;AAUnF,KAAK,oBAAoB,GAAG,WAAW,GAAG;IACxC,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrE,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,IAAI,CAAC,MAAM,KAClB,kBAAkB,CAAC,oBAAoB,CA8EzC,CAAC;AAEF,wBAAsB,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE,iBAwKlE"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../server/src/bootstrap.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,kBAAkB,EAA4B,MAAM,gBAAgB,CAAC;AAUjG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,OAAO,KAAK,EAAE,WAAW,EAA8C,MAAM,KAAK,CAAC;AAUnF,KAAK,oBAAoB,GAAG,WAAW,GAAG;IACxC,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrE,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,yBAAyB,GAAI,iDAGvC,oBAAoB,KAAG,MAAM,GAAG,SAoBlC,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,IAAI,CAAC,MAAM,KAClB,kBAAkB,CAAC,oBAAoB,CA8EzC,CAAC;AAEF,wBAAsB,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE,iBAoLlE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/plugin-graphql",
-  "version": "5.52.1",
+  "version": "5.52.3",
   "description": "Adds GraphQL endpoint with default API methods.",
   "homepage": "https://strapi.io",
   "bugs": {
@@ -67,7 +67,7 @@
     "@koa/cors": "5.0.0",
     "@strapi/design-system": "2.2.4",
     "@strapi/icons": "2.2.4",
-    "@strapi/utils": "5.52.1",
+    "@strapi/utils": "5.52.3",
     "graphql": "^16.8.1",
     "graphql-depth-limit": "^1.1.0",
     "graphql-playground-middleware-koa": "^1.6.21",
@@ -79,25 +79,27 @@
     "pluralize": "8.0.0"
   },
   "devDependencies": {
-    "@strapi/strapi": "5.52.1",
-    "@strapi/types": "5.52.1",
+    "@strapi/admin": "5.52.3",
+    "@strapi/strapi": "5.52.3",
+    "@strapi/types": "5.52.3",
     "@types/graphql-depth-limit": "1.1.5",
     "@types/jest": "29.5.2",
     "@types/koa-bodyparser": "4.3.12",
     "@types/koa__cors": "5.0.0",
     "@types/node": "20.19.41",
     "cross-env": "^7.0.3",
-    "eslint-config-custom": "5.52.1",
+    "eslint-config-custom": "5.52.3",
     "jest": "29.6.0",
     "koa": "2.16.4",
     "react": "18.3.1",
     "react-dom": "18.3.1",
     "react-router-dom": "6.30.4",
     "styled-components": "6.4.1",
-    "tsconfig": "5.52.1",
+    "tsconfig": "5.52.3",
     "typescript": "5.9.3"
   },
   "peerDependencies": {
+    "@strapi/admin": "^5.0.0",
     "@strapi/strapi": "^5.0.0",
     "react": "^17.0.0 || ^18.0.0",
     "react-dom": "^17.0.0 || ^18.0.0",