graphql-http 1.17.1 → 1.18.0

package/lib/handler.mjs

@@ -4,7 +4,7 @@
  *
  */
 import { validate as graphqlValidate, specifiedRules, execute as graphqlExecute, parse as graphqlParse, getOperationAST as graphqlGetOperationAST, GraphQLError, } from 'graphql';
-import { areGraphQLErrors, isAsyncIterable, isExecutionResult, isGraphQLError, isObject, } from './utils.mjs';
+import { areGraphQLErrors, isAsyncIterable, isExecutionResult, isGraphQLError, isObject, jsonErrorReplacer, } from './utils.mjs';
 /**
  * Checks whether the passed value is the `graphql-http` server agnostic response.
  *
@@ -72,7 +72,7 @@ export function isResponse(val) {
  * @category Server
  */
 export function createHandler(options) {
-    const { schema, context, validate = graphqlValidate, validationRules = [], execute = graphqlExecute, parse = graphqlParse, getOperationAST = graphqlGetOperationAST, rootValue, onSubscribe, onOperation, } = options;
+    const { schema, context, validate = graphqlValidate, validationRules = [], execute = graphqlExecute, parse = graphqlParse, getOperationAST = graphqlGetOperationAST, rootValue, onSubscribe, onOperation, formatError = (err) => err, } = options;
     return async function handler(req) {
         var _a, _b;
         const method = req.method;
@@ -173,6 +173,10 @@ export function createHandler(options) {
                     Array.isArray(partParams.variables))) {
                 throw new Error('Invalid variables');
             }
+            if (partParams.operationName != null &&
+                typeof partParams.operationName !== 'string') {
+                throw new Error('Invalid operationName');
+            }
             if (partParams.extensions != null &&
                 (typeof partParams.extensions !== 'object' ||
                     Array.isArray(partParams.extensions))) {
@@ -182,7 +186,7 @@ export function createHandler(options) {
             params = partParams;
         }
         catch (err) {
-            return makeResponse(new GraphQLError(err.message), acceptedMediaType);
+            return makeResponse(err, acceptedMediaType, formatError);
         }
         let args;
         const maybeResErrsOrArgs = await (onSubscribe === null || onSubscribe === void 0 ? void 0 : onSubscribe(req, params));
@@ -190,7 +194,7 @@ export function createHandler(options) {
             return maybeResErrsOrArgs;
         else if (isExecutionResult(maybeResErrsOrArgs) ||
             areGraphQLErrors(maybeResErrsOrArgs))
-            return makeResponse(maybeResErrsOrArgs, acceptedMediaType);
+            return makeResponse(maybeResErrsOrArgs, acceptedMediaType, formatError);
         else if (maybeResErrsOrArgs)
             args = maybeResErrsOrArgs;
         else {
@@ -202,7 +206,7 @@ export function createHandler(options) {
                 document = parse(query);
             }
             catch (err) {
-                return makeResponse(err, acceptedMediaType);
+                return makeResponse(err, acceptedMediaType, formatError);
             }
             const resOrContext = typeof context === 'function' ? await context(req, params) : context;
             if (isResponse(resOrContext))
@@ -231,7 +235,7 @@ export function createHandler(options) {
             }
             const validationErrs = validate(args.schema, args.document, rules);
             if (validationErrs.length) {
-                return makeResponse(validationErrs, acceptedMediaType);
+                return makeResponse(validationErrs, acceptedMediaType, formatError);
             }
         }
         let operation;
@@ -242,10 +246,10 @@ export function createHandler(options) {
             operation = ast.operation;
         }
         catch (_d) {
-            return makeResponse(new GraphQLError('Unable to detect operation AST'), acceptedMediaType);
+            return makeResponse(new GraphQLError('Unable to detect operation AST'), acceptedMediaType, formatError);
         }
         if (operation === 'subscription') {
-            return makeResponse(new GraphQLError('Subscriptions are not supported'), acceptedMediaType);
+            return makeResponse(new GraphQLError('Subscriptions are not supported'), acceptedMediaType, formatError);
         }
         // mutations cannot happen over GETs
         // https://graphql.github.io/graphql-over-http/draft/#sel-CALFJRPAAELBAAxwP
@@ -279,9 +283,9 @@ export function createHandler(options) {
         else if (maybeResponseOrResult)
             result = maybeResponseOrResult;
         if (isAsyncIterable(result)) {
-            return makeResponse(new GraphQLError('Subscriptions are not supported'), acceptedMediaType);
+            return makeResponse(new GraphQLError('Subscriptions are not supported'), acceptedMediaType, formatError);
         }
-        return makeResponse(result, acceptedMediaType);
+        return makeResponse(result, acceptedMediaType, formatError);
     };
 }
 /**
@@ -321,12 +325,29 @@ export function getAcceptableMediaType(acceptHeader) {
  *
  * If the first argument is an `ExecutionResult`, the operation will be treated as "successful".
  *
- * If the first argument is _any_ object without the `data` field, it will be treated as an error (as per the spec)
- * and the response will be constructed with the help of `acceptedMediaType` complying with the GraphQL over HTTP spec.
+ * If the first argument is (an array of) `GraphQLError`, or an `ExecutionResult` without the `data` field, it will be treated
+ * the response will be constructed with the help of `acceptedMediaType` complying with the GraphQL over HTTP spec.
+ *
+ * If the first argument is an `Error`, the operation will be treated as a bad request responding with `400: Bad Request` and the
+ * error will be present in the `ExecutionResult` style.
  *
  * @category Server
  */
-export function makeResponse(resultOrErrors, acceptedMediaType) {
+export function makeResponse(resultOrErrors, acceptedMediaType, formatError) {
+    if (resultOrErrors instanceof Error &&
+        // because GraphQLError extends the Error class
+        !isGraphQLError(resultOrErrors)) {
+        return [
+            JSON.stringify({ errors: [formatError(resultOrErrors)] }, jsonErrorReplacer),
+            {
+                status: 400,
+                statusText: 'Bad Request',
+                headers: {
+                    'content-type': 'application/json; charset=utf-8',
+                },
+            },
+        ];
+    }
     const errors = isGraphQLError(resultOrErrors)
         ? [resultOrErrors]
         : areGraphQLErrors(resultOrErrors)
@@ -334,7 +355,7 @@ export function makeResponse(resultOrErrors, acceptedMediaType) {
             : null;
     if (errors) {
         return [
-            JSON.stringify({ errors }),
+            JSON.stringify({ errors: errors.map(formatError) }, jsonErrorReplacer),
             Object.assign(Object.assign({}, (acceptedMediaType === 'application/json'
                 ? {
                     status: 200,
@@ -351,7 +372,8 @@ export function makeResponse(resultOrErrors, acceptedMediaType) {
         ];
     }
     return [
-        JSON.stringify(resultOrErrors),
+        JSON.stringify('errors' in resultOrErrors && resultOrErrors.errors
+            ? Object.assign(Object.assign({}, resultOrErrors), { errors: resultOrErrors.errors.map(formatError) }) : resultOrErrors, jsonErrorReplacer),
         {
             status: 200,
             statusText: 'OK',

package/lib/utils.d.mts

@@ -17,3 +17,5 @@ export declare function isGraphQLError(obj: unknown): obj is GraphQLError;
 export declare function isExecutionResult(val: unknown): val is ExecutionResult;
 /** @private */
 export declare function isAsyncIterable<T = unknown>(val: unknown): val is AsyncIterable<T>;
+/** @private */
+export declare function jsonErrorReplacer(_key: string, val: any): any;

package/lib/utils.d.ts

@@ -17,3 +17,5 @@ export declare function isGraphQLError(obj: unknown): obj is GraphQLError;
 export declare function isExecutionResult(val: unknown): val is ExecutionResult;
 /** @private */
 export declare function isAsyncIterable<T = unknown>(val: unknown): val is AsyncIterable<T>;
+/** @private */
+export declare function jsonErrorReplacer(_key: string, val: any): any;

package/lib/utils.js

@@ -5,7 +5,7 @@
  *
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isAsyncIterable = exports.isExecutionResult = exports.isGraphQLError = exports.areGraphQLErrors = exports.isObject = exports.extendedTypeof = void 0;
+exports.jsonErrorReplacer = exports.isAsyncIterable = exports.isExecutionResult = exports.isGraphQLError = exports.areGraphQLErrors = exports.isObject = exports.extendedTypeof = void 0;
 const graphql_1 = require("graphql");
 /** @private */
 function extendedTypeof(val) {
@@ -47,3 +47,17 @@ function isAsyncIterable(val) {
     return typeof Object(val)[Symbol.asyncIterator] === 'function';
 }
 exports.isAsyncIterable = isAsyncIterable;
+/** @private */
+function jsonErrorReplacer(_key, val) {
+    if (val instanceof Error &&
+        // GraphQL errors implement their own stringer
+        !isGraphQLError(val)) {
+        return {
+            // name: val.name, name is included in message
+            message: val.message,
+            // stack: val.stack, can leak sensitive details
+        };
+    }
+    return val;
+}
+exports.jsonErrorReplacer = jsonErrorReplacer;

package/lib/utils.mjs

@@ -38,3 +38,16 @@ export function isExecutionResult(val) {
 export function isAsyncIterable(val) {
     return typeof Object(val)[Symbol.asyncIterator] === 'function';
 }
+/** @private */
+export function jsonErrorReplacer(_key, val) {
+    if (val instanceof Error &&
+        // GraphQL errors implement their own stringer
+        !isGraphQLError(val)) {
+        return {
+            // name: val.name, name is included in message
+            message: val.message,
+            // stack: val.stack, can leak sensitive details
+        };
+    }
+    return val;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphql-http",
-  "version": "1.17.1",
+  "version": "1.18.0",
   "description": "Simple, pluggable, zero-dependency, GraphQL over HTTP spec compliant server, client and audit suite.",
   "keywords": [
     "graphql",
@@ -113,8 +113,8 @@
     "@babel/plugin-proposal-optional-chaining": "^7.21.0",
     "@babel/preset-env": "^7.21.4",
     "@babel/preset-typescript": "^7.21.4",
-    "@rollup/plugin-terser": "^0.4.0",
-    "@rollup/plugin-typescript": "^11.0.0",
+    "@rollup/plugin-terser": "^0.4.1",
+    "@rollup/plugin-typescript": "^11.1.0",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
     "@types/eslint": "^8.37.0",
@@ -124,29 +124,30 @@
     "@types/jest": "^29.5.0",
     "@types/koa": "^2.13.6",
     "@types/koa-mount": "^4.0.2",
-    "@typescript-eslint/eslint-plugin": "^5.57.0",
-    "@typescript-eslint/parser": "^5.57.0",
+    "@typescript-eslint/eslint-plugin": "^5.58.0",
+    "@typescript-eslint/parser": "^5.58.0",
     "@whatwg-node/fetch": "^0.8.4",
     "babel-jest": "^29.5.0",
-    "eslint": "^8.37.0",
+    "eslint": "^8.38.0",
     "eslint-config-prettier": "^8.8.0",
     "express": "^4.18.2",
     "fastify": "^4.15.0",
+    "glob": "^10.0.0",
     "graphql": "^16.6.0",
     "html-validator": "^6.0.1",
     "jest": "^29.5.0",
     "jest-jasmine2": "^29.5.0",
-    "koa": "^2.14.1",
+    "koa": "^2.14.2",
     "koa-mount": "^4.0.0",
     "node-fetch": "^3.3.1",
     "prettier": "^2.8.7",
     "rollup": "^3.20.2",
     "rollup-plugin-gzip": "^3.1.0",
-    "semantic-release": "^21.0.0",
+    "semantic-release": "^21.0.1",
     "tslib": "^2.5.0",
-    "typedoc": "^0.23.28",
-    "typedoc-plugin-markdown": "^3.14.0",
-    "typescript": "^5.0.3"
+    "typedoc": "^0.24.1",
+    "typedoc-plugin-markdown": "^3.15.1",
+    "typescript": "^5.0.4"
   },
   "resolutions": {
     "npm/libnpmversion": "^3.0.6"