@voxgig/sdkgen 1.5.0 → 2.0.0

package/project/.sdk/src/cmp/c/fragment/Main.fragment.c

@@ -139,7 +139,29 @@ static voxgig_value* err_map(const char* msg) {
   return cmap(2, "ok", v_bool(false), "err", v_str(msg));
 }
 
-voxgig_value* sdk_direct(ProjectNameSDK* sdk, voxgig_value* fetchargs, PNError** err) {
+// Is this raw-access op permitted by the SDK's allow.op option?
+static bool sdk_op_allowed(ProjectNameSDK* sdk, const char* op) {
+  voxgig_value* allow_op = getpath2(sdk->options, "allow", "op");
+  if (!voxgig_is_string(allow_op)) return false;
+  return NULL != strstr(voxgig_as_string(allow_op), op);
+}
+
+static voxgig_value* sdk_op_denied(ProjectNameSDK* sdk, const char* op) {
+  voxgig_value* allow_op = getpath2(sdk->options, "allow", "op");
+  const char* allow = voxgig_is_string(allow_op) ? voxgig_as_string(allow_op) : "";
+  char msg[512];
+  snprintf(msg, sizeof(msg),
+    "ProjectNameSDK: %s: operation not allowed by"
+    " SDK option allow.op value: \"%s\"", op, allow);
+  return err_map(msg);
+}
+
+// Ungated request path shared by sdk_direct and sdk_graphql, each of which
+// checks its own allow.op token first. Static, rather than a flag on
+// fetchargs: a caller-supplied marker would let anyone opt straight back out
+// of the gate by passing it.
+static voxgig_value* sdk_raw_request(
+  ProjectNameSDK* sdk, voxgig_value* fetchargs, PNError** err) {
   *err = NULL;
   Utility* utility = sdk->utility;
 
@@ -202,6 +224,72 @@ voxgig_value* sdk_direct(ProjectNameSDK* sdk, voxgig_value* fetchargs, PNError**
   return err_map("invalid response type");
 }
 
+// Raw endpoint access is operator-controllable, like every entity op.
+// Blocking it means denying BOTH the 'direct' and 'graphql' tokens, since
+// either one reaches the same endpoint.
+voxgig_value* sdk_direct(ProjectNameSDK* sdk, voxgig_value* fetchargs, PNError** err) {
+  *err = NULL;
+
+  if (!sdk_op_allowed(sdk, "direct")) {
+    return sdk_op_denied(sdk, "direct");
+  }
+
+  return sdk_raw_request(sdk, fetchargs, err);
+}
+
+// Raw GraphQL access: the pressure valve that makes the generated surface's
+// deliberate omissions (per-call selection sets, typed filter builders,
+// batching, subscriptions) livable — the whole schema stays reachable.
+//
+// Thin wrapper over the same prepare/fetch path sdk_direct uses, with the one
+// thing raw direct cannot do for GraphQL: a GraphQL failure rides HTTP 200 as
+// a top-level `errors` array, so status alone would report a failed query as
+// ok.
+//
+// NOTE: like sdk_direct, this bypasses the feature pipeline — no retry,
+// ratelimit or paging features apply.
+voxgig_value* sdk_graphql(ProjectNameSDK* sdk, const char* query,
+                          voxgig_value* variables, voxgig_value* ctrl,
+                          PNError** err) {
+  *err = NULL;
+
+  if (!sdk_op_allowed(sdk, "graphql")) {
+    return sdk_op_denied(sdk, "graphql");
+  }
+
+  voxgig_value* vars = voxgig_is_map(variables) ? v_share(variables) : voxgig_new_map();
+  voxgig_value* ctl = voxgig_is_map(ctrl) ? v_share(ctrl) : voxgig_new_map();
+
+  voxgig_value* fetchargs = cmap(4,
+    "method", v_str("POST"),
+    "headers", cmap(1, "content-type", v_str(GRAPHQL_CONTENT_TYPE)),
+    "body", cmap(2, "query", v_str(query ? query : ""), "variables", vars),
+    "ctrl", ctl);
+
+  voxgig_value* res = sdk_raw_request(sdk, fetchargs, err);
+  if (*err || !voxgig_is_map(res)) return res;
+
+  // Errors are read BEFORE any status check: a GraphQL parse or validation
+  // failure comes back as HTTP 400 carrying the standard { errors: [...] }
+  // body, and the raw path represents a non-2xx as ok:false with no err — so
+  // returning early on status would discard the server's own diagnostics,
+  // which are the only useful part of that response.
+  voxgig_value* errors = getp(getp(res, "data"), "errors");
+
+  if (voxgig_is_list(errors) && 0 < voxgig_as_list(errors)->len) {
+    voxgig_value* first = voxgig_as_list(errors)->items[0];
+    const char* m = get_str(first, "message");
+    if (!m || '\0' == m[0]) m = "graphql error";
+    char msg[512];
+    snprintf(msg, sizeof(msg), "ProjectNameSDK: graphql: %s", m);
+    setp(res, "ok", v_bool(false));
+    setp(res, "err", v_str(msg));
+    setp(res, "graphql", v_share(errors));
+  }
+
+  return res;
+}
+
 // <[SLOT]>
 
 ProjectNameSDK* test_sdk(voxgig_value* testopts, voxgig_value* sdkopts) {

package/project/.sdk/src/cmp/clojure/Main_clojure.ts

@@ -69,6 +69,7 @@ const Main = cmp(async function Main(props: any) {
 (def make-sdk client/make-sdk)
 (def test-sdk client/test-sdk)
 (def direct client/direct)
+(def graphql client/graphql)
 (def prepare client/prepare)
 (def options-map client/options-map)
 `)

package/project/.sdk/src/cmp/csharp/fragment/Main.fragment.cs

@@ -162,7 +162,44 @@ public class ProjectNameSDK
         return utility.MakeFetchDef(ctx);
     }
 
+    // Raw endpoint access is operator-controllable, like every entity op.
+    // Blocking it means denying BOTH the 'direct' and 'graphql' tokens,
+    // since either one reaches the same endpoint.
     public Dictionary<string, object?> Direct(Dictionary<string, object?>? fetchargs)
+    {
+        if (!OpAllowed("direct"))
+        {
+            return OpDenied("direct");
+        }
+
+        return RawRequest(fetchargs);
+    }
+
+    // Is this raw-access op permitted by the SDK's allow.op option?
+    private bool OpAllowed(string op)
+    {
+        return StructUtils.GetPath(_options, StructUtils.Jt("allow", "op"))
+            is string allow && allow.Contains(op);
+    }
+
+    private Dictionary<string, object?> OpDenied(string op)
+    {
+        var allow = StructUtils.GetPath(_options, StructUtils.Jt("allow", "op"))
+            as string ?? "";
+        return new Dictionary<string, object?>
+        {
+            ["ok"] = false,
+            ["err"] = new Exception("ProjectNameSDK: " + op +
+                ": operation not allowed by SDK option allow.op value: \"" +
+                allow + "\""),
+        };
+    }
+
+    // Ungated request path shared by Direct and Graphql, each of which
+    // checks its own allow.op token first. Private, rather than a flag on
+    // fetchargs: a caller-supplied marker would let anyone opt straight back
+    // out of the gate by passing it.
+    private Dictionary<string, object?> RawRequest(Dictionary<string, object?>? fetchargs)
     {
         var utility = _utility;
 
@@ -254,6 +291,66 @@ public class ProjectNameSDK
         };
     }
 
+    // Raw GraphQL access: the pressure valve that makes the generated
+    // surface's deliberate omissions (per-call selection sets, typed filter
+    // builders, batching, subscriptions) livable — the whole schema stays
+    // reachable.
+    //
+    // Thin wrapper over the same prepare/fetch path Direct uses, with the
+    // one thing raw Direct cannot do for GraphQL: a GraphQL failure rides
+    // HTTP 200 as a top-level `errors` array, so status alone would report a
+    // failed query as ok.
+    //
+    // NOTE: like Direct, this bypasses the feature pipeline — no retry,
+    // ratelimit or paging features apply.
+    public Dictionary<string, object?> Graphql(string query,
+        Dictionary<string, object?>? variables = null,
+        Dictionary<string, object?>? ctrl = null)
+    {
+        if (!OpAllowed("graphql"))
+        {
+            return OpDenied("graphql");
+        }
+
+        var res = RawRequest(new Dictionary<string, object?>
+        {
+            ["method"] = "POST",
+            ["headers"] = new Dictionary<string, object?>
+            {
+                ["content-type"] = "application/json",
+            },
+            ["body"] = new Dictionary<string, object?>
+            {
+                ["query"] = query,
+                ["variables"] = variables ?? new Dictionary<string, object?>(),
+            },
+            ["ctrl"] = ctrl ?? new Dictionary<string, object?>(),
+        });
+
+        // Errors are read BEFORE any status check: a GraphQL parse or
+        // validation failure comes back as HTTP 400 carrying the standard
+        // { errors: [...] } body, and the raw path represents a non-2xx as
+        // ok:false with no err — so returning early on status would discard
+        // the server's own diagnostics, which are the only useful part of
+        // that response.
+        var errors = StructUtils.GetPath(res, StructUtils.Jt("data", "errors"))
+            as List<object?>;
+
+        if (null != errors && 0 < errors.Count)
+        {
+            var msg = StructUtils.GetProp(errors[0], "message") as string;
+            if (string.IsNullOrEmpty(msg))
+            {
+                msg = "graphql error";
+            }
+            res["ok"] = false;
+            res["err"] = new Exception("ProjectNameSDK: graphql: " + msg);
+            res["graphql"] = errors;
+        }
+
+        return res;
+    }
+
     // <[SLOT]>
 
     public static ProjectNameSDK TestSDK(Dictionary<string, object?>? testopts,

package/project/.sdk/src/cmp/dart/fragment/Main.fragment.dart

@@ -139,7 +139,37 @@ class ProjectNameSDK {
     return makeFetchDef(ctx);
   }
 
+  // Raw endpoint access is operator-controllable, like every entity op.
+  // Blocking it means denying BOTH the 'direct' and 'graphql' tokens, since
+  // either one reaches the same endpoint.
   Future<dynamic> direct([dynamic fetchargs]) async {
+    if (!_opAllowed('direct')) {
+      return _opDenied('direct');
+    }
+
+    return _rawRequest(fetchargs);
+  }
+
+  // Is this raw-access op permitted by the SDK's allow.op option?
+  bool _opAllowed(String op) {
+    final allow = _utility.struct.getpath(_options, 'allow.op');
+    return allow is String && allow.contains(op);
+  }
+
+  dynamic _opDenied(String op) {
+    final allow = _utility.struct.getpath(_options, 'allow.op');
+    return {
+      'ok': false,
+      'err': Exception('ProjectNameSDK: $op: operation not allowed by'
+          ' SDK option allow.op value: "${allow ?? ''}"'),
+    };
+  }
+
+  // Ungated request path shared by direct and graphql, each of which checks
+  // its own allow.op token first. Private, rather than a flag on fetchargs:
+  // a caller-supplied marker would let anyone opt straight back out of the
+  // gate by passing it.
+  Future<dynamic> _rawRequest([dynamic fetchargs]) async {
     final utility = _utility;
     final fetcher = utility.fetcher;
     final makeContext = utility.makeContext;
@@ -203,6 +233,54 @@ class ProjectNameSDK {
     }
   }
 
+  // Raw GraphQL access: the pressure valve that makes the generated
+  // surface's deliberate omissions (per-call selection sets, typed filter
+  // builders, batching, subscriptions) livable — the whole schema stays
+  // reachable.
+  //
+  // Thin wrapper over the same prepare/fetch path direct uses, with the one
+  // thing raw direct cannot do for GraphQL: a GraphQL failure rides HTTP 200
+  // as a top-level `errors` array, so status alone would report a failed
+  // query as ok.
+  //
+  // NOTE: like direct, this bypasses the feature pipeline — no retry,
+  // ratelimit or paging features apply.
+  Future<dynamic> graphql(String query,
+      [dynamic variables, dynamic ctrl]) async {
+    if (!_opAllowed('graphql')) {
+      return _opDenied('graphql');
+    }
+
+    final dynamic res = await _rawRequest({
+      'method': 'POST',
+      'headers': {'content-type': 'application/json'},
+      'body': {'query': query, 'variables': variables ?? {}},
+      'ctrl': ctrl ?? {},
+    });
+
+    if (res is! Map) {
+      return res;
+    }
+
+    // Errors are read BEFORE any status check: a GraphQL parse or validation
+    // failure comes back as HTTP 400 carrying the standard { errors: [...] }
+    // body, and the raw path represents a non-2xx as ok:false with no err —
+    // so returning early on status would discard the server's own
+    // diagnostics, which are the only useful part of that response.
+    final errors = _utility.struct.getpath(res, 'data.errors');
+
+    if (errors is List && 0 < errors.length) {
+      final first = errors[0];
+      final msg = (first is Map ? first['message'] : null);
+      res['ok'] = false;
+      res['err'] = Exception('ProjectNameSDK: graphql: '
+          '${msg is String && msg.isNotEmpty ? msg : 'graphql error'}');
+      res['graphql'] = errors;
+    }
+
+    return res;
+  }
+
   // <[SLOT]>
 
   static ProjectNameSDK test([dynamic testoptsarg, dynamic sdkoptsarg]) {

package/project/.sdk/src/cmp/elixir/fragment/Main.fragment.ex

@@ -151,7 +151,41 @@ defmodule ProjectName do
     fetchdef
   end
 
+  # Raw endpoint access is operator-controllable, like every entity op.
+  # Blocking it means denying BOTH the 'direct' and 'graphql' tokens, since
+  # either one reaches the same endpoint.
   def direct(client, fetchargs \\ nil) do
+    if op_allowed?(client, "direct") do
+      raw_request(client, fetchargs)
+    else
+      op_denied(client, "direct")
+    end
+  end
+
+  # Is this raw-access op permitted by the SDK's allow.op option?
+  defp op_allowed?(client, op) do
+    allow = S.getpath(S.getprop(client, "options"), "allow.op")
+    is_binary(allow) and String.contains?(allow, op)
+  end
+
+  defp op_denied(client, op) do
+    allow = S.getpath(S.getprop(client, "options"), "allow.op")
+    allow = if is_binary(allow), do: allow, else: ""
+
+    S.jm([
+      "ok",
+      false,
+      "err",
+      "ProjectNameSDK: " <> op <> ": operation not allowed by" <>
+        " SDK option allow.op value: \"" <> allow <> "\""
+    ])
+  end
+
+  # Ungated request path shared by direct and graphql, each of which checks
+  # its own allow.op token first. Private, rather than a flag on fetchargs: a
+  # caller-supplied marker would let anyone opt straight back out of the gate
+  # by passing it.
+  defp raw_request(client, fetchargs) do
     fetchdef =
       try do
         prepare(client, fetchargs)
@@ -212,6 +246,56 @@ defmodule ProjectName do
     end
   end
 
+  # Raw GraphQL access: the pressure valve that makes the generated surface's
+  # deliberate omissions (per-call selection sets, typed filter builders,
+  # batching, subscriptions) livable — the whole schema stays reachable.
+  #
+  # Thin wrapper over the same prepare/fetch path direct uses, with the one
+  # thing raw direct cannot do for GraphQL: a GraphQL failure rides HTTP 200
+  # as a top-level `errors` array, so status alone would report a failed
+  # query as ok.
+  #
+  # NOTE: like direct, this bypasses the feature pipeline — no retry,
+  # ratelimit or paging features apply.
+  def graphql(client, query, variables \\ nil, ctrl \\ nil) do
+    if not op_allowed?(client, "graphql") do
+      op_denied(client, "graphql")
+    else
+      res =
+        raw_request(client, S.jm([
+          "method", "POST",
+          "headers", S.jm(["content-type", "application/json"]),
+          "body", S.jm([
+            "query", query,
+            "variables", if(S.ismap(variables), do: variables, else: S.jm([]))
+          ]),
+          "ctrl", if(S.ismap(ctrl), do: ctrl, else: S.jm([]))
+        ]))
+
+      # Errors are read BEFORE any status check: a GraphQL parse or
+      # validation failure comes back as HTTP 400 carrying the standard
+      # { errors: [...] } body, and the raw path represents a non-2xx as
+      # ok:false with no err — so returning early on status would discard the
+      # server's own diagnostics, which are the only useful part of that
+      # response.
+      errors = S.getpath(res, "data.errors")
+      count = if S.islist(errors), do: S.size(errors), else: 0
+
+      if count == 0 do
+        res
+      else
+        first = S.getelem(errors, 0)
+        msg = strp(S.getprop(first, "message"))
+        msg = if msg == "", do: "graphql error", else: msg
+
+        S.setprop(res, "ok", false)
+        S.setprop(res, "err", "ProjectNameSDK: graphql: " <> msg)
+        S.setprop(res, "graphql", errors)
+        res
+      end
+    end
+  end
+
   defp strp(v), do: if(is_binary(v), do: v, else: "")
 
   # <[SLOT]>

package/project/.sdk/src/cmp/go/fragment/Main.fragment.go

@@ -2,6 +2,7 @@ package core
 
 import (
 	"fmt"
+	"strings"
 
 	vs "github.com/voxgig/struct"
 )
@@ -174,7 +175,37 @@ func (sdk *ProjectNameSDK) Prepare(fetchargs map[string]any) (map[string]any, er
 	return utility.MakeFetchDef(ctx)
 }
 
+// Raw endpoint access is operator-controllable, like every entity op.
+// Blocking it means denying BOTH the 'direct' and 'graphql' tokens, since
+// either one reaches the same endpoint.
 func (sdk *ProjectNameSDK) Direct(fetchargs map[string]any) (map[string]any, error) {
+	if !sdk.opAllowed("direct") {
+		return sdk.opDenied("direct"), nil
+	}
+
+	return sdk.rawRequest(fetchargs)
+}
+
+// Is this raw-access op permitted by the SDK's allow.op option?
+func (sdk *ProjectNameSDK) opAllowed(op string) bool {
+	allowOp, _ := vs.GetPath([]any{"allow", "op"}, sdk.options).(string)
+	return strings.Contains(allowOp, op)
+}
+
+func (sdk *ProjectNameSDK) opDenied(op string) map[string]any {
+	allowOp, _ := vs.GetPath([]any{"allow", "op"}, sdk.options).(string)
+	return map[string]any{
+		"ok": false,
+		"err": fmt.Errorf("ProjectNameSDK: %s: operation not allowed by"+
+			" SDK option allow.op value: \"%s\"", op, allowOp),
+	}
+}
+
+// Ungated request path shared by Direct and Graphql, each of which checks
+// its own allow.op token first. Unexported, rather than a flag on fetchargs:
+// a caller-supplied marker would let anyone opt straight back out of the
+// gate by passing it.
+func (sdk *ProjectNameSDK) rawRequest(fetchargs map[string]any) (map[string]any, error) {
 	utility := sdk.utility
 
 	fetchdef, err := sdk.Prepare(fetchargs)
@@ -250,6 +281,62 @@ func (sdk *ProjectNameSDK) Direct(fetchargs map[string]any) (map[string]any, err
 	return map[string]any{"ok": false, "err": ctx.MakeError("direct_invalid", "invalid response type")}, nil
 }
 
+// Raw GraphQL access: the pressure valve that makes the generated surface's
+// deliberate omissions (per-call selection sets, typed filter builders,
+// batching, subscriptions) livable — the whole schema stays reachable.
+//
+// Thin wrapper over the same prepare/fetch path Direct uses, with the one
+// thing raw Direct cannot do for GraphQL: a GraphQL failure rides HTTP 200
+// as a top-level `errors` array, so status alone would report a failed query
+// as ok.
+//
+// NOTE: like Direct, this bypasses the feature pipeline — no retry,
+// ratelimit or paging features apply.
+func (sdk *ProjectNameSDK) Graphql(
+	query string, variables map[string]any, ctrl map[string]any,
+) (map[string]any, error) {
+	if !sdk.opAllowed("graphql") {
+		return sdk.opDenied("graphql"), nil
+	}
+
+	if variables == nil {
+		variables = map[string]any{}
+	}
+	if ctrl == nil {
+		ctrl = map[string]any{}
+	}
+
+	res, err := sdk.rawRequest(map[string]any{
+		"method":  "POST",
+		"headers": map[string]any{"content-type": "application/json"},
+		"body":    map[string]any{"query": query, "variables": variables},
+		"ctrl":    ctrl,
+	})
+
+	if err != nil {
+		return res, err
+	}
+
+	// Errors are read BEFORE any status check: a GraphQL parse or validation
+	// failure comes back as HTTP 400 carrying the standard { errors: [...] }
+	// body, and the raw path represents a non-2xx as ok:false with no err —
+	// so returning early on status would discard the server's own
+	// diagnostics, which are the only useful part of that response.
+	errors, _ := vs.GetPath([]any{"data", "errors"}, res).([]any)
+
+	if 0 < len(errors) {
+		msg, _ := vs.GetProp(errors[0], "message").(string)
+		if msg == "" {
+			msg = "graphql error"
+		}
+		res["ok"] = false
+		res["err"] = fmt.Errorf("ProjectNameSDK: graphql: %s", msg)
+		res["graphql"] = errors
+	}
+
+	return res, nil
+}
+
 // <[SLOT]>
 
 func TestSDK(testopts map[string]any, sdkopts map[string]any) *ProjectNameSDK {

package/project/.sdk/src/cmp/js/fragment/Main.fragment.js

@@ -138,8 +138,29 @@ class ProjectNameSDK {
   }
 
 
+  // Raw endpoint access is operator-controllable, like every entity op.
+  // Blocking it means denying BOTH the 'direct' and 'graphql' tokens, since
+  // either one reaches the same endpoint.
   async direct(fetchargs) {
+    if (!this._options.allow.op.includes('direct')) {
+      return {
+        ok: false,
+        err: new Error('ProjectNameSDK: direct: operation not allowed by' +
+          ' SDK option allow.op value: "' + this._options.allow.op + '"'),
+      }
+    }
+
+    return this._rawRequest(fetchargs)
+  }
+
+
+  // Ungated request path shared by direct() and graphql(), each of which
+  // checks its own allow.op token first. Private, rather than a flag on
+  // fetchargs: a caller-supplied marker would let anyone opt straight back
+  // out of the gate by passing it.
+  async _rawRequest(fetchargs) {
     const utility = this._utility
+
     const fetcher = utility.fetcher
     const makeContext = utility.makeContext
 
@@ -179,6 +200,60 @@ class ProjectNameSDK {
   }
 
 
+
+  // Raw GraphQL access: the pressure valve that makes the generated
+  // surface's deliberate omissions (per-call selection sets, typed filter
+  // builders, batching, subscriptions) livable — the whole schema stays
+  // reachable.
+  //
+  // Thin wrapper over the same prepare/fetch path `direct` uses, with the
+  // one thing raw `direct` cannot do for GraphQL: a GraphQL failure rides
+  // HTTP 200 as a top-level `errors` array, so status alone would report a
+  // failed query as ok.
+  //
+  // NOTE: like `direct`, this bypasses the feature pipeline — no retry,
+  // ratelimit or paging features apply.
+  async graphql(query, variables, ctrl) {
+    const options = this._options
+
+    if (!options.allow.op.includes('graphql')) {
+      return {
+        ok: false,
+        err: new Error('ProjectNameSDK: graphql: operation not allowed by' +
+          ' SDK option allow.op value: "' + options.allow.op + '"'),
+      }
+    }
+
+    const res = await this._rawRequest({
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: { query, variables: variables || {} },
+      ctrl,
+    })
+
+    if (res instanceof Error) {
+      return res
+    }
+
+    // Errors are read BEFORE any status check: a GraphQL parse or validation
+    // failure comes back as HTTP 400 carrying the standard { errors: [...] }
+    // body, and the raw path represents a non-2xx as { ok: false } with no
+    // err — so returning early on status would discard the server's own
+    // diagnostics, which are the only useful part of that response.
+    const errors = null == res.data ? undefined : res.data.errors
+
+    if (null != errors && Array.isArray(errors) && 0 < errors.length) {
+      const first = errors[0] || {}
+      const err = new Error('ProjectNameSDK: graphql: ' +
+        (first.message || 'graphql error'))
+      err.graphql = errors
+      return { ok: false, status: res.status, headers: res.headers, err, data: res.data }
+    }
+
+    return res
+  }
+
+
   // <[SLOT]>