buro26-strapi-graphql 0.0.26 → 0.2.0

package/dist/server/index.d.ts

@@ -1,5 +1,6 @@
 import type { GraphQLExtension } from './types';
-import type { Middleware, ResolveContext } from './utils';
+import type { ResolveContext } from './utils';
+import type { Middleware } from './nexus';
 import type { GraphQLResolveInfo } from 'graphql';
 import type { GraphQLFieldConfig } from 'graphql/type';
 declare const _default: {
@@ -26,7 +27,7 @@ declare const _default: {
         fileService: ({ strapi }: {
             strapi: Required<import("@strapi/types").Strapi>;
         }) => {
-            getAllFilesInGraphQlDirectory(directoryPath: string, collectedExtensions?: GraphQLExtension[]): Promise<GraphQLExtension[]>;
+            getAllFilesInGraphQlDirectory(directoryPath: string): Promise<GraphQLExtension[]>;
         };
         graphQlService: ({ strapi }: {
             strapi: Required<import("@strapi/types").Strapi>;
@@ -39,6 +40,7 @@ declare const _default: {
 export default _default;
 export * from './types';
 export * from './utils';
+export * from './nexus';
 declare module '@strapi/strapi' {
     interface Strapi {
         createGraphQLExtension: (factory: (strapi: Strapi) => GraphQLExtension) => GraphQLExtension;
@@ -59,14 +61,18 @@ declare module 'nexus/dist/core' {
     interface NexusOutputFieldConfig<TypeName extends string, FieldName extends string> {
         extensions?: {
             middlewares?: Middleware[];
+            /**
+             * A function that determines if the current user is authorized to access this field.
+             *
+             * @param parent The parent object.
+             * @param args The arguments passed to the field.
+             * @param context The context object.
+             * @param info The GraphQLResolveInfo object.
+             */
+            authorize?: <Parent extends Object, Args extends Object, Context = ResolveContext>(parent: Parent, args: Args, context: Context, info: GraphQLResolveInfo) => boolean | Promise<boolean>;
         } & GraphQLFieldConfig<any, any>['extensions'];
         /**
-         * A function that determines if the current user is authorized to access this field.
-         *
-         * @param parent The parent object.
-         * @param args The arguments passed to the field.
-         * @param context The context object.
-         * @param info The GraphQLResolveInfo object.
+         * @deprecated Use `authorize` in the extensions config instead.
          */
         authorize?: <Parent extends Object, Args extends Object, Context = ResolveContext>(parent: Parent, args: Args, context: Context, info: GraphQLResolveInfo) => boolean | Promise<boolean>;
     }

package/dist/server/index.js

@@ -41,3 +41,4 @@ exports.default = {
 };
 __exportStar(require("./types"), exports);
 __exportStar(require("./utils"), exports);
+__exportStar(require("./nexus"), exports);

package/dist/server/nexus/index.d.ts

@@ -0,0 +1 @@
+export * from './plugins';

package/dist/server/nexus/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./plugins"), exports);

package/dist/server/nexus/plugins/field-authorize.plugin.d.ts

@@ -0,0 +1,36 @@
+import { ArgsValue, GetGen, MaybePromise, SourceValue } from 'nexus/dist/typegenTypeHelpers';
+import type { GraphQLResolveInfo } from 'graphql';
+export type FieldAuthorizeResolver<TypeName extends string, FieldName extends string> = (root: SourceValue<TypeName>, args: ArgsValue<TypeName, FieldName>, context: GetGen<'context'>, info: GraphQLResolveInfo) => MaybePromise<boolean | Error>;
+export interface FieldAuthorizePluginErrorConfig {
+    error: Error;
+    root: any;
+    args: any;
+    ctx: GetGen<'context'>;
+    info: GraphQLResolveInfo;
+}
+/**
+ * Options for {@link nexusFieldAuthorizePlugin}.
+ */
+export interface FieldAuthorizePluginConfig {
+    /**
+     * Turn a denied authorization into the error sent to the client.
+     * @default {@link defaultFormatError}
+     */
+    formatError?: (authConfig: FieldAuthorizePluginErrorConfig) => Error;
+}
+/**
+ * Default error for denied authorization: a Strapi `ForbiddenError` with the original message and
+ * trace details (type, field, user id, args, timestamp) in `details.trace`.
+ */
+export declare const defaultFormatError: ({ error, root, args, ctx, info }: FieldAuthorizePluginErrorConfig) => Error;
+/**
+ * Field-level authentication and authorization.
+ *
+ * Applies to every field in the schema (including the ones Strapi generates) and combines:
+ * `withAuth(true)` of builder fields, global authorizes, the field's own `authorize` (in `extensions` or
+ * as top-level field option) and `protectFields()` registrations.
+ *
+ * Registered automatically by this Strapi plugin; only add it yourself when building a schema outside
+ * Strapi (e.g. in tests).
+ */
+export declare const nexusFieldAuthorizePlugin: (authConfig?: FieldAuthorizePluginConfig) => import("nexus/dist/plugin").NexusPlugin;

package/dist/server/nexus/plugins/field-authorize.plugin.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nexusFieldAuthorizePlugin = exports.runAuthorization = exports.defaultFormatError = void 0;
+const nexus_1 = require("nexus");
+const utils_1 = require("nexus/dist/utils");
+const utils_2 = require("@strapi/utils");
+const graphql_1 = require("graphql");
+const resolve_field_1 = require("../../utils/registry/resolve-field");
+const fieldDefTypes = (0, utils_1.printedGenTyping)({
+    optional: true,
+    name: 'authorize',
+    description: `
+    Authorization for an individual field. Returning "true"
+    or "Promise<true>" means the field can be accessed.
+    Returning "false" or "Promise<false>" will respond
+    with a "Not Authorized" error for the field.
+    Returning or throwing an error will also prevent the
+    resolver from executing.
+  `,
+    type: 'FieldAuthorizeResolver<TypeName, FieldName>',
+});
+/**
+ * Default error for denied authorization: a Strapi `ForbiddenError` with the original message and
+ * trace details (type, field, user id, args, timestamp) in `details.trace`.
+ */
+const defaultFormatError = ({ error, root, args, ctx, info }) => {
+    var _a, _b;
+    // Add rich tracing info
+    const trace = {
+        type: info.parentType.name,
+        field: info.fieldName,
+        user: (_b = (_a = ctx === null || ctx === void 0 ? void 0 : ctx.state) === null || _a === void 0 ? void 0 : _a.user) === null || _b === void 0 ? void 0 : _b.id,
+        args,
+        timestamp: new Date().toISOString(),
+        originalError: error
+    };
+    // Use Strapi's ForbiddenError and attach trace info
+    return new utils_2.errors.ForbiddenError((error === null || error === void 0 ? void 0 : error.message) || 'Not authorized', { trace });
+};
+exports.defaultFormatError = defaultFormatError;
+/**
+ * Run the authentication + authorization part of a field pipeline.
+ * Resolves when allowed, rejects with the (formatted) error otherwise.
+ *
+ * @internal Used by the authorize plugin and `.test()`.
+ */
+const runAuthorization = async (pipeline, root, args, ctx, info, formatError = exports.defaultFormatError) => {
+    var _a, _b;
+    const fail = (error) => {
+        const finalErr = formatError({ error, root, args, ctx, info });
+        if (finalErr instanceof Error) {
+            throw finalErr;
+        }
+        console.error(`Non-Error value ${finalErr} returned from custom formatError in authorize plugin`);
+        throw new utils_2.errors.ForbiddenError('Not authorized');
+    };
+    if (pipeline.requireAuth && !((_a = ctx === null || ctx === void 0 ? void 0 : ctx.state) === null || _a === void 0 ? void 0 : _a.user)) {
+        // Same error as before, but now evaluated before any authorize function runs
+        throw new utils_2.errors.ForbiddenError('Not authenticated');
+    }
+    for (const authorize of pipeline.authorizes) {
+        let authResult;
+        try {
+            authResult = await authorize(root, args, ctx, info);
+        }
+        catch (e) {
+            fail(e instanceof Error ? e : new utils_2.errors.ForbiddenError(String(e)));
+        }
+        if (authResult === true)
+            continue;
+        if (authResult instanceof Error)
+            fail(authResult);
+        if (authResult === false)
+            fail(new utils_2.errors.ForbiddenError('Not authorized'));
+        fail(new utils_2.errors.ForbiddenError(`Authorize for ${(_b = info === null || info === void 0 ? void 0 : info.parentType) === null || _b === void 0 ? void 0 : _b.name}.${info === null || info === void 0 ? void 0 : info.fieldName} Expected a boolean or Error, saw ${authResult}`));
+    }
+};
+exports.runAuthorization = runAuthorization;
+/**
+ * Field-level authentication and authorization.
+ *
+ * Applies to every field in the schema (including the ones Strapi generates) and combines:
+ * `withAuth(true)` of builder fields, global authorizes, the field's own `authorize` (in `extensions` or
+ * as top-level field option) and `protectFields()` registrations.
+ *
+ * Registered automatically by this Strapi plugin; only add it yourself when building a schema outside
+ * Strapi (e.g. in tests).
+ */
+const nexusFieldAuthorizePlugin = (authConfig = {}) => {
+    const { formatError = exports.defaultFormatError } = authConfig;
+    return (0, nexus_1.plugin)({
+        name: 'CustomFieldAuthorize',
+        description: 'Custom field-level authorization for Strapi GraphQL, with tracing.',
+        fieldDefTypes: fieldDefTypes,
+        onCreateFieldResolver(config) {
+            var _a, _b, _c;
+            // @ts-ignore
+            const extensions = config.fieldConfig.extensions;
+            if ((extensions === null || extensions === void 0 ? void 0 : extensions.authorize) != null && typeof extensions.authorize !== 'function') {
+                console.error(new Error(`The authorize property provided to ${config.fieldConfig.name} with type ${config.fieldConfig.type} should be a function, saw ${typeof extensions.authorize}`));
+                // Fail closed: a broken authorize must not silently disable the other checks on this field
+                return async function () {
+                    throw new utils_2.errors.ForbiddenError('Not authorized');
+                };
+            }
+            const pipeline = (0, resolve_field_1.resolveFieldPipeline)(config.parentTypeConfig.name, config.fieldConfig.name, extensions);
+            if (!pipeline.requireAuth && pipeline.authorizes.length === 0) {
+                return;
+            }
+            if (pipeline.isProtected && (0, graphql_1.isNonNullType)(config.fieldConfig.type)) {
+                const warn = (_c = (_b = (_a = globalThis.strapi) === null || _a === void 0 ? void 0 : _a.log) === null || _b === void 0 ? void 0 : _b.warn) !== null && _c !== void 0 ? _c : console.warn;
+                warn(`[buro26-strapi-graphql] protectFields: "${config.parentTypeConfig.name}.${config.fieldConfig.name}" is non-null; ` +
+                    `when access is denied GraphQL nulls the parent object instead of only this field.`);
+            }
+            return async function (root, args, ctx, info, next) {
+                await (0, exports.runAuthorization)(pipeline, root, args, ctx, info, formatError);
+                return next(root, args, ctx, info);
+            };
+        }
+    });
+};
+exports.nexusFieldAuthorizePlugin = nexusFieldAuthorizePlugin;

package/dist/server/nexus/plugins/index.d.ts

@@ -0,0 +1,2 @@
+export * from './field-authorize.plugin';
+export * from './middleware.plugin';

package/dist/server/nexus/plugins/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./field-authorize.plugin"), exports);
+__exportStar(require("./middleware.plugin"), exports);

package/dist/server/nexus/plugins/middleware.plugin.d.ts

@@ -0,0 +1,25 @@
+import type { GraphQLResolveInfo } from 'graphql';
+import type { ResolverFunction } from '../../types';
+import type { ResolveContext } from '../../utils';
+/**
+ * The Resolver type represents a GraphQL resolver function.
+ */
+export type Resolver = <Parent extends any, Args extends any, Context = ResolveContext>(parent: Parent, args: Args, context: Context, info: GraphQLResolveInfo) => any | Promise<any>;
+/**
+ * Middleware is a function that takes a resolver and returns a new resolver.
+ */
+export type Middleware<TParent = any, TArgs = any> = (resolver: ResolverFunction<TParent, TArgs>) => ResolverFunction<TParent, TArgs>;
+/**
+ * Field-level middlewares: global middlewares, the field's own `middlewares` (in `extensions` or as
+ * top-level field option) and `protectFields()` middlewares, outermost first.
+ *
+ * Registered automatically by this Strapi plugin; only add it yourself when building a schema outside
+ * Strapi (e.g. in tests).
+ */
+export declare const nexusMiddlewarePlugin: () => import("nexus/dist/plugin").NexusPlugin;
+/**
+ * Example middleware that logs every resolve, including the result.
+ *
+ * Development only: it logs resolved values, which may contain personal data.
+ */
+export declare const loggingMiddleware: Middleware;

package/dist/server/nexus/plugins/middleware.plugin.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loggingMiddleware = exports.nexusMiddlewarePlugin = void 0;
+const nexus_1 = require("nexus");
+const utils_1 = require("nexus/dist/utils");
+const resolve_field_1 = require("../../utils/registry/resolve-field");
+const fieldDefTypes = (0, utils_1.printedGenTyping)({
+    optional: true,
+    name: 'middlewares',
+    description: `
+    Middlewares for an individual field. Each middleware receives the
+    next resolver and returns a new resolver.
+  `,
+    type: 'any'
+});
+/**
+ * Field-level middlewares: global middlewares, the field's own `middlewares` (in `extensions` or as
+ * top-level field option) and `protectFields()` middlewares, outermost first.
+ *
+ * Registered automatically by this Strapi plugin; only add it yourself when building a schema outside
+ * Strapi (e.g. in tests).
+ */
+const nexusMiddlewarePlugin = () => (0, nexus_1.plugin)({
+    name: 'NexusMiddlewarePlugin',
+    description: 'The middleware plugin allows attaching middleware functions to individual fields.',
+    /**
+     * Defines the field definition types for the plugin.
+     */
+    fieldDefTypes: fieldDefTypes,
+    /**
+     * Hook into field resolver creation to apply middleware.
+     */
+    onCreateFieldResolver(config) {
+        const { fieldConfig } = config;
+        const { middlewares } = (0, resolve_field_1.resolveFieldPipeline)(config.parentTypeConfig.name, fieldConfig.name, 
+        // @ts-ignore
+        fieldConfig.extensions);
+        if (middlewares.length === 0) {
+            return undefined; // No middleware to apply
+        }
+        // Outermost first. Each middleware may call the next resolver with changed parent/args/context,
+        // which are passed on (same composition as `.test()`).
+        return (source, args, context, info, next) => {
+            const resolver = middlewares.reduceRight((inner, middleware) => middleware(inner), (s, a, c, i) => next(s, a, c, i));
+            return resolver(source, args, context, info);
+        };
+    }
+});
+exports.nexusMiddlewarePlugin = nexusMiddlewarePlugin;
+/**
+ * Example middleware that logs every resolve, including the result.
+ *
+ * Development only: it logs resolved values, which may contain personal data.
+ */
+const loggingMiddleware = (resolver) => {
+    return async (parent, args, context, info) => {
+        console.log(`Resolving field ${info.parentType.name}.${info.fieldName}`);
+        const result = await resolver(parent, args, context, info);
+        console.log(`Resolved field ${info.parentType.name}.${info.fieldName} with result:`, result);
+        return result;
+    };
+};
+exports.loggingMiddleware = loggingMiddleware;

package/dist/server/register.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const nexus_1 = require("nexus");
-const utils_1 = require("./utils");
+const nexus_1 = require("./nexus");
 exports.default = async ({ strapi }) => {
     const fileService = strapi
         .plugin('burotwosix-graphql-plugin')
@@ -14,8 +13,8 @@ exports.default = async ({ strapi }) => {
     ];
     graphQlExtensionService.use(() => ({
         plugins: [
-            (0, nexus_1.fieldAuthorizePlugin)(),
-            (0, utils_1.nexusMiddlewarePlugin)(),
+            (0, nexus_1.nexusFieldAuthorizePlugin)(),
+            (0, nexus_1.nexusMiddlewarePlugin)()
         ]
     }));
     for (const extension of extensions) {
@@ -26,14 +25,14 @@ exports.default = async ({ strapi }) => {
                 typeDefs: (_b = (_a = extension === null || extension === void 0 ? void 0 : extension.typeDefs) === null || _a === void 0 ? void 0 : _a.call(extension)) !== null && _b !== void 0 ? _b : '',
                 types: [
                     ...((_d = (_c = extension === null || extension === void 0 ? void 0 : extension.getTypes) === null || _c === void 0 ? void 0 : _c.call(extension)) !== null && _d !== void 0 ? _d : []),
-                    ...((_f = (_e = extension === null || extension === void 0 ? void 0 : extension.types) === null || _e === void 0 ? void 0 : _e.call(extension)) !== null && _f !== void 0 ? _f : []),
+                    ...((_f = (_e = extension === null || extension === void 0 ? void 0 : extension.types) === null || _e === void 0 ? void 0 : _e.call(extension)) !== null && _f !== void 0 ? _f : [])
                 ],
                 plugins: (_h = (_g = extension === null || extension === void 0 ? void 0 : extension.plugins) === null || _g === void 0 ? void 0 : _g.call(extension)) !== null && _h !== void 0 ? _h : [],
                 resolvers: (_k = (_j = extension === null || extension === void 0 ? void 0 : extension.resolvers) === null || _j === void 0 ? void 0 : _j.call(extension)) !== null && _k !== void 0 ? _k : { Query: {}, Mutation: {} },
                 resolversConfig: {
                     ...(_m = (_l = extension === null || extension === void 0 ? void 0 : extension.getResolverConfig) === null || _l === void 0 ? void 0 : _l.call(extension)) !== null && _m !== void 0 ? _m : {},
-                    ...(_p = (_o = extension === null || extension === void 0 ? void 0 : extension.resolversConfig) === null || _o === void 0 ? void 0 : _o.call(extension)) !== null && _p !== void 0 ? _p : {},
-                },
+                    ...(_p = (_o = extension === null || extension === void 0 ? void 0 : extension.resolversConfig) === null || _o === void 0 ? void 0 : _o.call(extension)) !== null && _p !== void 0 ? _p : {}
+                }
             });
         });
     }

package/dist/server/services/file-service.d.ts

@@ -3,13 +3,14 @@ declare const _default: ({ strapi }: {
     strapi: Strapi;
 }) => {
     /**
-     * Fetch all the files in the graphql directories within the given directory path
-     * Recursively searches for files in the graphql directory
-     * Returns an array of GraphQLExtension objects
+     * Load all extensions from `graphql` folders below `directoryPath` (recursively).
      *
-     * @param directoryPath
-     * @param collectedExtensions
+     * Files are loaded in a stable order (sorted by name, depth-first), so the generated schema and the
+     * order of side effects such as `protectFields()` / `registerGlobalAuthorize()` calls are the same on
+     * every start.
+     *
+     * @param directoryPath - Usually `strapi.dirs.dist.src`.
      */
-    getAllFilesInGraphQlDirectory(directoryPath: string, collectedExtensions?: GraphQLExtension[]): Promise<GraphQLExtension[]>;
+    getAllFilesInGraphQlDirectory(directoryPath: string): Promise<GraphQLExtension[]>;
 };
 export default _default;

package/dist/server/services/file-service.js

@@ -25,44 +25,50 @@ var __importStar = (this && this.__importStar) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = require("fs");
 const path = __importStar(require("path"));
+const GRAPHQL_FOLDER = 'graphql';
+const isInGraphQLFolder = (directoryPath) => directoryPath.endsWith(path.sep + GRAPHQL_FOLDER) || directoryPath.includes(path.sep + GRAPHQL_FOLDER + path.sep);
+const isLoadableFile = (file) => file.endsWith('.js');
+/**
+ * Turn a module's export into extensions. Builders (anything with `build()`) are built; arrays are flattened.
+ */
+const toExtensions = (graphqlModule) => {
+    var _a;
+    const exported = (_a = graphqlModule === null || graphqlModule === void 0 ? void 0 : graphqlModule.default) !== null && _a !== void 0 ? _a : graphqlModule;
+    if (!exported)
+        return [];
+    const build = (item) => (item && typeof item.build === 'function' ? item.build() : item);
+    if (Array.isArray(exported)) {
+        return exported.map(build).filter(Boolean);
+    }
+    // Modules without a default export (e.g. one that only calls `protectFields`) yield an empty extension,
+    // which registers nothing.
+    return [build(exported)];
+};
 exports.default = ({ strapi }) => ({
     /**
-     * Fetch all the files in the graphql directories within the given directory path
-     * Recursively searches for files in the graphql directory
-     * Returns an array of GraphQLExtension objects
+     * Load all extensions from `graphql` folders below `directoryPath` (recursively).
+     *
+     * Files are loaded in a stable order (sorted by name, depth-first), so the generated schema and the
+     * order of side effects such as `protectFields()` / `registerGlobalAuthorize()` calls are the same on
+     * every start.
      *
-     * @param directoryPath
-     * @param collectedExtensions
+     * @param directoryPath - Usually `strapi.dirs.dist.src`.
      */
-    async getAllFilesInGraphQlDirectory(directoryPath, collectedExtensions = []) {
-        const fileEntries = await fs_1.promises.readdir(directoryPath);
-        // Create an array of promises for all the files
-        const filePromises = fileEntries.map(async (file) => {
+    async getAllFilesInGraphQlDirectory(directoryPath) {
+        const fileEntries = [...await fs_1.promises.readdir(directoryPath)].sort();
+        const collected = [];
+        for (const file of fileEntries) {
             const filePath = path.join(directoryPath, file);
             const fileStats = await fs_1.promises.stat(filePath);
             if (fileStats.isDirectory()) {
-                // Recursively get files from the directory
-                return this.getAllFilesInGraphQlDirectory(filePath, collectedExtensions);
-            }
-            const folderName = 'graphql';
-            if (!directoryPath.endsWith(path.sep + folderName) &&
-                !directoryPath.includes(path.sep + folderName + path.sep)) {
-                return;
-            }
-            const graphqlModule = require(filePath.replace('.js', ''));
-            if (!graphqlModule) {
-                return;
+                collected.push(...await this.getAllFilesInGraphQlDirectory(filePath));
+                continue;
             }
-            // Support both ES module default export and CommonJS exports
-            let extension = graphqlModule.default || graphqlModule;
-            // If the extension is a builder (has a build function), call build() automatically
-            if (extension && typeof extension.build === 'function') {
-                extension = extension.build();
+            if (!isInGraphQLFolder(directoryPath) || !isLoadableFile(file)) {
+                continue;
             }
-            collectedExtensions.push(extension);
-        });
-        // Wait for all the promises to resolve
-        await Promise.all(filePromises);
-        return collectedExtensions;
+            collected.push(...toExtensions(require(filePath)));
+        }
+        return collected;
     }
 });

package/dist/server/services/index.d.ts

@@ -2,7 +2,7 @@ declare const _default: {
     fileService: ({ strapi }: {
         strapi: Required<import("@strapi/types").Strapi>;
     }) => {
-        getAllFilesInGraphQlDirectory(directoryPath: string, collectedExtensions?: import("..").GraphQLExtension[]): Promise<import("..").GraphQLExtension[]>;
+        getAllFilesInGraphQlDirectory(directoryPath: string): Promise<import("..").GraphQLExtension[]>;
     };
     graphQlService: ({ strapi }: {
         strapi: Required<import("@strapi/types").Strapi>;

package/dist/server/types.d.ts

@@ -1,6 +1,12 @@
 import type { ResolveContext } from './utils';
 import type { GraphQLResolveInfo } from 'graphql';
 export type Strapi = typeof strapi;
+/**
+ * A GraphQL extension as registered with Strapi's GraphQL plugin. Created by
+ * {@link createGraphQLExtension} or by building a field builder.
+ *
+ * @see https://docs.strapi.io/dev-docs/plugins/graphql#customization
+ */
 export interface GraphQLExtension {
     /**
      * Called when the extension is initialized, use this to perform any initialization logic
@@ -16,7 +22,7 @@ export interface GraphQLExtension {
      * Return array the types for the extension
      * Use Nexus to define types
      *
-     * @deprecated Use types() instead
+     * @deprecated Renamed to `types()`; same signature. Will be removed in the next major version.
      */
     getTypes?: () => any[];
     /**
@@ -43,7 +49,7 @@ export interface GraphQLExtension {
      * This is used to configure middlewares and other resolver options
      * @see https://docs.strapi.io/developer-docs/latest/plugins/graphql.html#extending-the-schema
      *
-     * @deprecated Use resolversConfig() instead
+     * @deprecated Renamed to `resolversConfig()`; same signature. Will be removed in the next major version.
      */
     getResolverConfig?: () => any;
     /**
@@ -53,14 +59,20 @@ export interface GraphQLExtension {
      */
     resolversConfig?: () => Record<string, ResolverConfigOption>;
 }
-export type ResolverConfigOption = {
-    auth?: boolean | undefined;
-    policies?: (string | PolicyFunction)[];
-    middlewares?: MiddlewareFunction[];
+/**
+ * Strapi resolver configuration for a `Type.field` path.
+ */
+export type ResolverConfigOption<TParent = any, TArgs = any, TOutput = any> = {
+    /** `false` makes the field public; `{ scope }` requires these users-permissions actions */
+    auth?: boolean | {
+        scope: string[];
+    } | undefined;
+    policies?: (string | PolicyFunction<TParent, TArgs>)[];
+    middlewares?: MiddlewareFunction<TParent, TArgs, TOutput>[];
 };
-export type PolicyFunctionContext = {
-    parent: any;
-    args: any;
+export type PolicyFunctionContext<TParent = any, TArgs = any> = {
+    parent: TParent;
+    args: TArgs;
     context: ResolveContext;
     info: GraphQLResolveInfo;
     state: ResolveContext['state'];
@@ -69,7 +81,10 @@ export type PolicyFunctionContext = {
 export type PolicyFunctionOptions = {
     strapi: Strapi;
 };
-export type PolicyFunction = (context: PolicyFunctionContext, config: any, opts: PolicyFunctionOptions) => boolean | Promise<boolean>;
-export type MiddlewareFunction = (next: MiddlewareNextFunction, parent: any, args: any, context: ResolveContext, info: GraphQLResolveInfo) => any | Promise<any>;
-export type MiddlewareNextFunction = (parent: any, args: any, context: ResolveContext, info: GraphQLResolveInfo) => Promise<any>;
-export type ResolverFunction = (parent: any, args: any, context: ResolveContext, info: GraphQLResolveInfo) => any | Promise<any>;
+export type PolicyFunction<TParent = any, TArgs = any> = (context: PolicyFunctionContext<TParent, TArgs>, config: any, opts: PolicyFunctionOptions) => boolean | Promise<boolean>;
+export type MiddlewareFunction<TParent = any, TArgs = any, TOutput = any> = (next: MiddlewareNextFunction<TParent, TArgs, TOutput>, parent: TParent, args: TArgs, context: ResolveContext, info: GraphQLResolveInfo) => TOutput | Promise<TOutput>;
+export type MiddlewareNextFunction<TParent = any, TArgs = any, TOutput = any> = (parent: TParent, args: TArgs, context: ResolveContext, info: GraphQLResolveInfo) => Promise<TOutput>;
+/**
+ * A GraphQL resolver with Strapi's resolver context.
+ */
+export type ResolverFunction<TParent = any, TArgs = any, TOutput = any> = (parent: TParent, args: TArgs, context: ResolveContext, info: GraphQLResolveInfo) => TOutput | Promise<TOutput>;

package/dist/server/utils/collection-type.d.ts

@@ -8,14 +8,18 @@ import { type ResolveArgs } from './types';
  * Create a resolver for a collection of entities
  * Returns a resolver that resolves the entities based on the content type UID
  *
- * @param contentType The content type UID of the entities
+ * @param contentType - Content type UID of the entities.
+ * @returns A resolver taking `{ parent, args, context, info }` that applies Strapi's filters, sort and
+ *   pagination and returns an entity response collection.
  */
 export declare const createEntityCollectionResolver: <ContentType extends Object>(contentType: string) => (resolveArgs: ResolveArgs<ContentType>) => Promise<EntityResponseCollection<ContentType>>;
 /**
  * Create a resolver for a collection of entities related to a parent entity
  * Returns a resolver that resolves the related entities based on the relation field name
  *
- * @param contentType The content type UID of the related entities
+ * @param contentType - Content type UID of the **parent** (owner of the relation).
+ * @deprecated Prefer {@link FieldExtensionBuilder.relation}, which also keeps the `find` permission scope
+ *   and works on Strapi v5.
  */
 export declare function createEntityRelationCollectionResolver<Parent extends object>(contentType: string): <K extends keyof Parent>(relationFieldName: K, resolveArgs: ResolveArgs<Parent>) => Promise<EntityResponseCollection<ExtractRelation<Parent, K>>>;
 type EntityResponseCollection<T extends Object> = {
@@ -26,6 +30,13 @@ type EntityResponseCollection<T extends Object> = {
     };
 };
 type ExtractRelation<Parent, K extends keyof Parent> = Parent[K] extends Array<infer U> ? U extends object ? U : never : Parent[K] extends object ? Parent[K] : never;
+/**
+ * Wrap entities in Strapi's response collection (`{ nodes, info }`), the return shape of
+ * `XEntityResponseCollection` fields.
+ *
+ * @param args - The (transformed) field arguments, used for pagination info.
+ * @param resourceUID - Content type UID of the items.
+ */
 export declare function toEntityResponseCollection<T extends Object>(items: T[], { args, resourceUID }: {
     args: Record<string, any>;
     resourceUID: string;

package/dist/server/utils/collection-type.js

@@ -10,7 +10,9 @@ exports.toEntityResponseCollection = exports.createEntityRelationCollectionResol
  * Create a resolver for a collection of entities
  * Returns a resolver that resolves the entities based on the content type UID
  *
- * @param contentType The content type UID of the entities
+ * @param contentType - Content type UID of the entities.
+ * @returns A resolver taking `{ parent, args, context, info }` that applies Strapi's filters, sort and
+ *   pagination and returns an entity response collection.
  */
 const createEntityCollectionResolver = (contentType) => {
     const { transformArgs } = strapi.plugin('graphql').service('builders').utils;
@@ -36,7 +38,9 @@ exports.createEntityCollectionResolver = createEntityCollectionResolver;
  * Create a resolver for a collection of entities related to a parent entity
  * Returns a resolver that resolves the related entities based on the relation field name
  *
- * @param contentType The content type UID of the related entities
+ * @param contentType - Content type UID of the **parent** (owner of the relation).
+ * @deprecated Prefer {@link FieldExtensionBuilder.relation}, which also keeps the `find` permission scope
+ *   and works on Strapi v5.
  */
 function createEntityRelationCollectionResolver(contentType) {
     return async (relationFieldName, resolveArgs) => {
@@ -52,6 +56,13 @@ function createEntityRelationCollectionResolver(contentType) {
     };
 }
 exports.createEntityRelationCollectionResolver = createEntityRelationCollectionResolver;
+/**
+ * Wrap entities in Strapi's response collection (`{ nodes, info }`), the return shape of
+ * `XEntityResponseCollection` fields.
+ *
+ * @param args - The (transformed) field arguments, used for pagination info.
+ * @param resourceUID - Content type UID of the items.
+ */
 async function toEntityResponseCollection(items, { args, resourceUID }) {
     const { toEntityResponseCollection } = strapi.plugin('graphql').service('format').returnTypes;
     return toEntityResponseCollection(items, {