graphql-http 1.19.0 → 1.20.0

package/README.md

@@ -61,7 +61,7 @@ import { schema } from './previous-step';
 // Create the GraphQL over HTTP Node request handler
 const handler = createHandler({ schema });
 
-// Create a HTTP server using the listner on `/graphql`
+// Create a HTTP server using the listener on `/graphql`
 const server = http.createServer((req, res) => {
   if (req.url.startsWith('/graphql')) {
     handler(req, res);
@@ -560,8 +560,8 @@ const client = createClient({
 
 </details>
 
-<details id="migrating-express-grpahql">
-<summary><a href="#migrating-express-grpahql">🔗</a> Server handler migration from <a href="https://github.com/graphql/express-graphql">express-graphql</a></summary>
+<details id="migrating-express-graphql">
+<summary><a href="#migrating-express-graphql">🔗</a> Server handler migration from <a href="https://github.com/graphql/express-graphql">express-graphql</a></summary>
 
 ```diff
 import express from 'express';
@@ -630,7 +630,7 @@ const handler = createHandler({
   context: async (req, args) => {
     return getDynamicContext(req, args);
   },
-  // or static context by supplying the value direcly
+  // or static context by supplying the value directly
 });
 ```
 
@@ -725,6 +725,78 @@ console.log('Listening to port 4000');
 
 </details>
 
+<details id="graphql-upload-http">
+<summary><a href="#graphql-upload-http">🔗</a> Server handler usage with <a href="https://github.com/jaydenseric/graphql-upload">graphql-upload</a> and <a href="https://nodejs.org/api/http.html">http</a></summary>
+
+```js
+import http from 'http';
+import { createHandler } from 'graphql-http/lib/use/http';
+import processRequest from 'graphql-upload/processRequest.mjs'; // yarn add graphql-upload
+import { schema } from './my-graphql';
+
+const handler = createHandler({
+  schema,
+  async parseRequestParams(req) {
+    const params = await processRequest(req.raw, req.context.res);
+    if (Array.isArray(params)) {
+      throw new Error('Batching is not supported');
+    }
+    return {
+      ...params,
+      // variables must be an object as per the GraphQL over HTTP spec
+      variables: Object(params.variables),
+    };
+  },
+});
+
+const server = http.createServer((req, res) => {
+  if (req.url.startsWith('/graphql')) {
+    handler(req, res);
+  } else {
+    res.writeHead(404).end();
+  }
+});
+
+server.listen(4000);
+console.log('Listening to port 4000');
+```
+
+</details>
+
+<details id="graphql-upload-express">
+<summary><a href="#graphql-upload-express">🔗</a> Server handler usage with <a href="https://github.com/jaydenseric/graphql-upload">graphql-upload</a> and <a href="https://expressjs.com/">express</a></summary>
+
+```js
+import express from 'express'; // yarn add express
+import { createHandler } from 'graphql-http/lib/use/express';
+import processRequest from 'graphql-upload/processRequest.mjs'; // yarn add graphql-upload
+import { schema } from './my-graphql';
+
+const app = express();
+app.all(
+  '/graphql',
+  createHandler({
+    schema,
+    async parseRequestParams(req) {
+      const params = await processRequest(req.raw, req.context.res);
+      if (Array.isArray(params)) {
+        throw new Error('Batching is not supported');
+      }
+      return {
+        ...params,
+        // variables must be an object as per the GraphQL over HTTP spec
+        variables: Object(params.variables),
+      };
+    },
+  }),
+);
+
+app.listen({ port: 4000 });
+console.log('Listening to port 4000');
+```
+
+</details>
+
 <details id="audit-jest">
 <summary><a href="#audit-jest">🔗</a> Audit for servers usage in <a href="https://jestjs.io">Jest</a> environment</summary>
 

package/lib/client.d.mts

@@ -76,7 +76,7 @@ export interface ClientOptions {
      *
      * You may implement your own waiting strategy by timing the resolution of the returned promise.
      *
-     * Useful for retrying requests that failed because the service is temporarely unavailable.
+     * Useful for retrying requests that failed because the service is temporarily unavailable.
      *
      * `retries` argument counts actual retries, so it will begin with
      * 0 after the first failed request.
@@ -135,7 +135,7 @@ export declare function createClient(options: ClientOptions): Client;
  */
 export declare class NetworkError<Response extends ResponseLike = ResponseLike> extends Error {
     /**
-     * The underlyig response thats considered an error.
+     * The underlying response thats considered an error.
      *
      * Will be undefined when no response is received,
      * instead an unexpected network error.

package/lib/client.d.ts

@@ -76,7 +76,7 @@ export interface ClientOptions {
      *
      * You may implement your own waiting strategy by timing the resolution of the returned promise.
      *
-     * Useful for retrying requests that failed because the service is temporarely unavailable.
+     * Useful for retrying requests that failed because the service is temporarily unavailable.
      *
      * `retries` argument counts actual retries, so it will begin with
      * 0 after the first failed request.
@@ -135,7 +135,7 @@ export declare function createClient(options: ClientOptions): Client;
  */
 export declare class NetworkError<Response extends ResponseLike = ResponseLike> extends Error {
     /**
-     * The underlyig response thats considered an error.
+     * The underlying response thats considered an error.
      *
      * Will be undefined when no response is received,
      * instead an unexpected network error.

package/lib/common.d.mts

@@ -11,10 +11,10 @@
  * @category Common
  */
 export interface RequestParams {
-    operationName?: string | undefined;
+    operationName?: string | null | undefined;
     query: string;
-    variables?: Record<string, unknown> | undefined;
-    extensions?: Record<string, unknown> | undefined;
+    variables?: Record<string, unknown> | null | undefined;
+    extensions?: Record<string, unknown> | null | undefined;
 }
 /**
  * A representation of any set of values over any amount of time.
@@ -24,7 +24,7 @@ export interface RequestParams {
 export interface Sink<T = unknown> {
     /** Next value arriving. */
     next(value: T): void;
-    /** An error that has occured. This function "closes" the sink. */
+    /** An error that has occurred. This function "closes" the sink. */
     error(error: unknown): void;
     /** The sink has completed. This function "closes" the sink. */
     complete(): void;

package/lib/common.d.ts

@@ -11,10 +11,10 @@
  * @category Common
  */
 export interface RequestParams {
-    operationName?: string | undefined;
+    operationName?: string | null | undefined;
     query: string;
-    variables?: Record<string, unknown> | undefined;
-    extensions?: Record<string, unknown> | undefined;
+    variables?: Record<string, unknown> | null | undefined;
+    extensions?: Record<string, unknown> | null | undefined;
 }
 /**
  * A representation of any set of values over any amount of time.
@@ -24,7 +24,7 @@ export interface RequestParams {
 export interface Sink<T = unknown> {
     /** Next value arriving. */
     next(value: T): void;
-    /** An error that has occured. This function "closes" the sink. */
+    /** An error that has occurred. This function "closes" the sink. */
     error(error: unknown): void;
     /** The sink has completed. This function "closes" the sink. */
     complete(): void;

package/lib/handler.d.mts

@@ -84,16 +84,10 @@ export interface ResponseInit {
  * @category Server
  */
 export type Response = readonly [body: ResponseBody | null, init: ResponseInit];
-/**
- * Checks whether the passed value is the `graphql-http` server agnostic response.
- *
- * @category Server
- */
-export declare function isResponse(val: unknown): val is Response;
 /**
  * A concrete GraphQL execution context value type.
  *
- * Mainly used because TypeScript collapes unions
+ * Mainly used because TypeScript collapses unions
  * with `any` or `unknown` to `any` or `unknown`. So,
  * we use a custom type to allow definitions such as
  * the `context` server option.
@@ -107,6 +101,25 @@ export type OperationContext = Record<PropertyKey, unknown> | symbol | number |
  * @category Server
  */
 export type FormatError = (err: Readonly<GraphQLError | Error>) => GraphQLError | Error;
+/**
+ * The request parser for an incoming GraphQL request. It parses and validates the
+ * request itself, including the request method and the content-type of the body.
+ *
+ * In case you are extending the server to handle more request types, this is the
+ * perfect place to do so.
+ *
+ * If an error is thrown, it will be formatted using the provided {@link FormatError}
+ * and handled following the spec to be gracefully reported to the client.
+ *
+ * Throwing an instance of `Error` will _always_ have the client respond with a `400: Bad Request`
+ * and the error's message in the response body; however, if an instance of `GraphQLError` is thrown,
+ * it will be reported depending on the accepted content-type.
+ *
+ * If you return nothing, the default parser will be used instead.
+ *
+ * @category Server
+ */
+export type ParseRequestParams<RequestRaw = unknown, RequestContext = unknown> = (req: Request<RequestRaw, RequestContext>) => Promise<RequestParams | Response | void> | RequestParams | Response | void;
 /** @category Server */
 export type OperationArgs<Context extends OperationContext = undefined> = ExecutionArgs & {
     contextValue?: Context;
@@ -223,15 +236,21 @@ export interface HandlerOptions<RequestRaw = unknown, RequestContext = unknown,
     onOperation?: (req: Request<RequestRaw, RequestContext>, args: OperationArgs<Context>, result: ExecutionResult) => Promise<ExecutionResult | Response | void> | ExecutionResult | Response | void;
     /**
      * Format handled errors to your satisfaction. Either GraphQL errors
-     * or safe request processing errors are meant by "handleded errors".
+     * or safe request processing errors are meant by "handled errors".
      *
-     * If multiple errors have occured, all of them will be mapped using
+     * If multiple errors have occurred, all of them will be mapped using
      * this formatter.
      */
     formatError?: FormatError;
+    /**
+     * The request parser for an incoming GraphQL request.
+     *
+     * Read more about it in {@link ParseRequestParams}.
+     */
+    parseRequestParams?: ParseRequestParams<RequestRaw, RequestContext>;
 }
 /**
- * The ready-to-use handler. Simply plug it in your favourite HTTP framework
+ * The ready-to-use handler. Simply plug it in your favorite HTTP framework
  * and enjoy.
  *
  * Errors thrown from **any** of the provided options or callbacks (or even due to
@@ -243,7 +262,7 @@ export interface HandlerOptions<RequestRaw = unknown, RequestContext = unknown,
 export type Handler<RequestRaw = unknown, RequestContext = unknown> = (req: Request<RequestRaw, RequestContext>) => Promise<Response>;
 /**
  * Makes a GraphQL over HTTP spec compliant server handler. The handler can
- * be used with your favourite server library.
+ * be used with your favorite server library.
  *
  * Beware that the handler resolves only after the whole operation completes.
  *
@@ -297,30 +316,3 @@ export type Handler<RequestRaw = unknown, RequestContext = unknown> = (req: Requ
  * @category Server
  */
 export declare function createHandler<RequestRaw = unknown, RequestContext = unknown, Context extends OperationContext = undefined>(options: HandlerOptions<RequestRaw, RequestContext, Context>): Handler<RequestRaw, RequestContext>;
-/**
- * Request's Media-Type that the server accepts.
- *
- * @category Server
- */
-export type AcceptableMediaType = 'application/graphql-response+json' | 'application/json';
-/**
- * Inspects the request and detects the appropriate/acceptable Media-Type
- * looking at the `Accept` header while complying with the GraphQL over HTTP spec.
- *
- * @category Server
- */
-export declare function getAcceptableMediaType(acceptHeader: string | null | undefined): AcceptableMediaType | null;
-/**
- * Creates an appropriate GraphQL over HTTP response following the provided arguments.
- *
- * If the first argument is an `ExecutionResult`, the operation will be treated as "successful".
- *
- * If the first argument is (an array of) `GraphQLError`, or an `ExecutionResult` without the `data` field, it will be treated
- * the response will be constructed with the help of `acceptedMediaType` complying with the GraphQL over HTTP spec.
- *
- * If the first argument is an `Error`, the operation will be treated as a bad request responding with `400: Bad Request` and the
- * error will be present in the `ExecutionResult` style.
- *
- * @category Server
- */
-export declare function makeResponse(resultOrErrors: Readonly<ExecutionResult> | Readonly<GraphQLError[]> | Readonly<GraphQLError> | Readonly<Error>, acceptedMediaType: AcceptableMediaType, formatError: FormatError): Response;

package/lib/handler.d.ts

@@ -84,16 +84,10 @@ export interface ResponseInit {
  * @category Server
  */
 export type Response = readonly [body: ResponseBody | null, init: ResponseInit];
-/**
- * Checks whether the passed value is the `graphql-http` server agnostic response.
- *
- * @category Server
- */
-export declare function isResponse(val: unknown): val is Response;
 /**
  * A concrete GraphQL execution context value type.
  *
- * Mainly used because TypeScript collapes unions
+ * Mainly used because TypeScript collapses unions
  * with `any` or `unknown` to `any` or `unknown`. So,
  * we use a custom type to allow definitions such as
  * the `context` server option.
@@ -107,6 +101,25 @@ export type OperationContext = Record<PropertyKey, unknown> | symbol | number |
  * @category Server
  */
 export type FormatError = (err: Readonly<GraphQLError | Error>) => GraphQLError | Error;
+/**
+ * The request parser for an incoming GraphQL request. It parses and validates the
+ * request itself, including the request method and the content-type of the body.
+ *
+ * In case you are extending the server to handle more request types, this is the
+ * perfect place to do so.
+ *
+ * If an error is thrown, it will be formatted using the provided {@link FormatError}
+ * and handled following the spec to be gracefully reported to the client.
+ *
+ * Throwing an instance of `Error` will _always_ have the client respond with a `400: Bad Request`
+ * and the error's message in the response body; however, if an instance of `GraphQLError` is thrown,
+ * it will be reported depending on the accepted content-type.
+ *
+ * If you return nothing, the default parser will be used instead.
+ *
+ * @category Server
+ */
+export type ParseRequestParams<RequestRaw = unknown, RequestContext = unknown> = (req: Request<RequestRaw, RequestContext>) => Promise<RequestParams | Response | void> | RequestParams | Response | void;
 /** @category Server */
 export type OperationArgs<Context extends OperationContext = undefined> = ExecutionArgs & {
     contextValue?: Context;
@@ -223,15 +236,21 @@ export interface HandlerOptions<RequestRaw = unknown, RequestContext = unknown,
     onOperation?: (req: Request<RequestRaw, RequestContext>, args: OperationArgs<Context>, result: ExecutionResult) => Promise<ExecutionResult | Response | void> | ExecutionResult | Response | void;
     /**
      * Format handled errors to your satisfaction. Either GraphQL errors
-     * or safe request processing errors are meant by "handleded errors".
+     * or safe request processing errors are meant by "handled errors".
      *
-     * If multiple errors have occured, all of them will be mapped using
+     * If multiple errors have occurred, all of them will be mapped using
      * this formatter.
      */
     formatError?: FormatError;
+    /**
+     * The request parser for an incoming GraphQL request.
+     *
+     * Read more about it in {@link ParseRequestParams}.
+     */
+    parseRequestParams?: ParseRequestParams<RequestRaw, RequestContext>;
 }
 /**
- * The ready-to-use handler. Simply plug it in your favourite HTTP framework
+ * The ready-to-use handler. Simply plug it in your favorite HTTP framework
  * and enjoy.
  *
  * Errors thrown from **any** of the provided options or callbacks (or even due to
@@ -243,7 +262,7 @@ export interface HandlerOptions<RequestRaw = unknown, RequestContext = unknown,
 export type Handler<RequestRaw = unknown, RequestContext = unknown> = (req: Request<RequestRaw, RequestContext>) => Promise<Response>;
 /**
  * Makes a GraphQL over HTTP spec compliant server handler. The handler can
- * be used with your favourite server library.
+ * be used with your favorite server library.
  *
  * Beware that the handler resolves only after the whole operation completes.
  *
@@ -297,30 +316,3 @@ export type Handler<RequestRaw = unknown, RequestContext = unknown> = (req: Requ
  * @category Server
  */
 export declare function createHandler<RequestRaw = unknown, RequestContext = unknown, Context extends OperationContext = undefined>(options: HandlerOptions<RequestRaw, RequestContext, Context>): Handler<RequestRaw, RequestContext>;
-/**
- * Request's Media-Type that the server accepts.
- *
- * @category Server
- */
-export type AcceptableMediaType = 'application/graphql-response+json' | 'application/json';
-/**
- * Inspects the request and detects the appropriate/acceptable Media-Type
- * looking at the `Accept` header while complying with the GraphQL over HTTP spec.
- *
- * @category Server
- */
-export declare function getAcceptableMediaType(acceptHeader: string | null | undefined): AcceptableMediaType | null;
-/**
- * Creates an appropriate GraphQL over HTTP response following the provided arguments.
- *
- * If the first argument is an `ExecutionResult`, the operation will be treated as "successful".
- *
- * If the first argument is (an array of) `GraphQLError`, or an `ExecutionResult` without the `data` field, it will be treated
- * the response will be constructed with the help of `acceptedMediaType` complying with the GraphQL over HTTP spec.
- *
- * If the first argument is an `Error`, the operation will be treated as a bad request responding with `400: Bad Request` and the
- * error will be present in the `ExecutionResult` style.
- *
- * @category Server
- */
-export declare function makeResponse(resultOrErrors: Readonly<ExecutionResult> | Readonly<GraphQLError[]> | Readonly<GraphQLError> | Readonly<Error>, acceptedMediaType: AcceptableMediaType, formatError: FormatError): Response;

package/lib/handler.js

@@ -5,24 +5,19 @@
  *
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.makeResponse = exports.getAcceptableMediaType = exports.createHandler = exports.isResponse = void 0;
+exports.createHandler = void 0;
 const graphql_1 = require("graphql");
 const utils_1 = require("./utils");
-/**
- * Checks whether the passed value is the `graphql-http` server agnostic response.
- *
- * @category Server
- */
+/** Checks whether the passed value is the `graphql-http` server agnostic response. */
 function isResponse(val) {
     // TODO: make sure the contents of init match ResponseInit
     return (Array.isArray(val) &&
         (typeof val[0] === 'string' || val[0] === null) &&
         (0, utils_1.isObject)(val[1]));
 }
-exports.isResponse = isResponse;
 /**
  * Makes a GraphQL over HTTP spec compliant server handler. The handler can
- * be used with your favourite server library.
+ * be used with your favorite server library.
  *
  * Beware that the handler resolves only after the whole operation completes.
  *
@@ -76,23 +71,32 @@ exports.isResponse = isResponse;
  * @category Server
  */
 function createHandler(options) {
-    const { schema, context, validate = graphql_1.validate, validationRules = [], execute = graphql_1.execute, parse = graphql_1.parse, getOperationAST = graphql_1.getOperationAST, rootValue, onSubscribe, onOperation, formatError = (err) => err, } = options;
+    const { schema, context, validate = graphql_1.validate, validationRules = [], execute = graphql_1.execute, parse = graphql_1.parse, getOperationAST = graphql_1.getOperationAST, rootValue, onSubscribe, onOperation, formatError = (err) => err, parseRequestParams = defaultParseRequestParams, } = options;
     return async function handler(req) {
-        var _a, _b;
-        const method = req.method;
-        if (method !== 'GET' && method !== 'POST') {
-            return [
-                null,
-                {
-                    status: 405,
-                    statusText: 'Method Not Allowed',
-                    headers: {
-                        allow: 'GET, POST',
-                    },
-                },
-            ];
+        let acceptedMediaType = null;
+        const accepts = (getHeader(req, 'accept') || '*/*')
+            .replace(/\s/g, '')
+            .toLowerCase()
+            .split(',');
+        for (const accept of accepts) {
+            // accept-charset became obsolete, shouldnt be used (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Charset)
+            // TODO: handle the weight parameter "q"
+            const [mediaType, ...params] = accept.split(';');
+            const charset = (params === null || params === void 0 ? void 0 : params.find((param) => param.includes('charset='))) || 'charset=utf8'; // utf-8 is assumed when not specified;
+            if (mediaType === 'application/graphql-response+json' &&
+                charset === 'charset=utf8') {
+                acceptedMediaType = 'application/graphql-response+json';
+                break;
+            }
+            // application/json should be the default until watershed
+            if ((mediaType === 'application/json' ||
+                mediaType === 'application/*' ||
+                mediaType === '*/*') &&
+                charset === 'charset=utf8') {
+                acceptedMediaType = 'application/json';
+                break;
+            }
         }
-        const acceptedMediaType = getAcceptableMediaType(getHeader(req, 'accept'));
         if (!acceptedMediaType) {
             return [
                 null,
@@ -105,89 +109,14 @@ function createHandler(options) {
                 },
             ];
         }
-        // TODO: should graphql-http care about content-encoding? I'd say unzipping should happen before handler is reached
-        const [mediaType, charset = 'charset=utf-8', // utf-8 is assumed when not specified. this parameter is either "charset" or "boundary" (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Length)
-        ] = (getHeader(req, 'content-type') || '')
-            .replace(/\s/g, '')
-            .toLowerCase()
-            .split(';');
         let params;
         try {
-            const partParams = {};
-            switch (true) {
-                case method === 'GET': {
-                    // TODO: what if content-type is specified and is not application/x-www-form-urlencoded?
-                    try {
-                        const [, search] = req.url.split('?');
-                        const searchParams = new URLSearchParams(search);
-                        partParams.operationName =
-                            (_a = searchParams.get('operationName')) !== null && _a !== void 0 ? _a : undefined;
-                        partParams.query = (_b = searchParams.get('query')) !== null && _b !== void 0 ? _b : undefined;
-                        const variables = searchParams.get('variables');
-                        if (variables)
-                            partParams.variables = JSON.parse(variables);
-                        const extensions = searchParams.get('extensions');
-                        if (extensions)
-                            partParams.extensions = JSON.parse(extensions);
-                    }
-                    catch (_c) {
-                        throw new Error('Unparsable URL');
-                    }
-                    break;
-                }
-                case method === 'POST' &&
-                    mediaType === 'application/json' &&
-                    charset === 'charset=utf-8':
-                    {
-                        if (!req.body) {
-                            throw new Error('Missing body');
-                        }
-                        let data;
-                        try {
-                            const body = typeof req.body === 'function' ? await req.body() : req.body;
-                            data = typeof body === 'string' ? JSON.parse(body) : body;
-                        }
-                        catch (err) {
-                            throw new Error('Unparsable JSON body');
-                        }
-                        if (!(0, utils_1.isObject)(data)) {
-                            throw new Error('JSON body must be an object');
-                        }
-                        partParams.operationName = data.operationName;
-                        partParams.query = data.query;
-                        partParams.variables = data.variables;
-                        partParams.extensions = data.extensions;
-                        break;
-                    }
-                default: // graphql-http doesnt support any other content type
-                    return [
-                        null,
-                        {
-                            status: 415,
-                            statusText: 'Unsupported Media Type',
-                        },
-                    ];
-            }
-            if (partParams.query == null)
-                throw new Error('Missing query');
-            if (typeof partParams.query !== 'string')
-                throw new Error('Invalid query');
-            if (partParams.variables != null &&
-                (typeof partParams.variables !== 'object' ||
-                    Array.isArray(partParams.variables))) {
-                throw new Error('Invalid variables');
-            }
-            if (partParams.operationName != null &&
-                typeof partParams.operationName !== 'string') {
-                throw new Error('Invalid operationName');
-            }
-            if (partParams.extensions != null &&
-                (typeof partParams.extensions !== 'object' ||
-                    Array.isArray(partParams.extensions))) {
-                throw new Error('Invalid extensions');
-            }
-            // request parameters are checked and now complete
-            params = partParams;
+            let paramsOrRes = await parseRequestParams(req);
+            if (!paramsOrRes)
+                paramsOrRes = await defaultParseRequestParams(req);
+            if (isResponse(paramsOrRes))
+                return paramsOrRes;
+            params = paramsOrRes;
         }
         catch (err) {
             return makeResponse(err, acceptedMediaType, formatError);
@@ -249,7 +178,7 @@ function createHandler(options) {
                 throw null;
             operation = ast.operation;
         }
-        catch (_d) {
+        catch (_a) {
             return makeResponse(new graphql_1.GraphQLError('Unable to detect operation AST'), acceptedMediaType, formatError);
         }
         if (operation === 'subscription') {
@@ -257,7 +186,7 @@ function createHandler(options) {
         }
         // mutations cannot happen over GETs
         // https://graphql.github.io/graphql-over-http/draft/#sel-CALFJRPAAELBAAxwP
-        if (operation === 'mutation' && method === 'GET') {
+        if (operation === 'mutation' && req.method === 'GET') {
             return [
                 JSON.stringify({
                     errors: [new graphql_1.GraphQLError('Cannot perform mutations over GET')],
@@ -294,38 +223,109 @@ function createHandler(options) {
 }
 exports.createHandler = createHandler;
 /**
- * Inspects the request and detects the appropriate/acceptable Media-Type
- * looking at the `Accept` header while complying with the GraphQL over HTTP spec.
+ * The default request params parser. Used when no custom one is provided or if it
+ * returns nothing.
  *
- * @category Server
+ * Read more about it in {@link ParseRequestParams}.
+ *
+ * TODO: should graphql-http itself care about content-encoding? I'd say unzipping should happen before handler is reached
  */
-function getAcceptableMediaType(acceptHeader) {
-    let acceptedMediaType = null;
-    const accepts = (acceptHeader || '*/*')
+async function defaultParseRequestParams(req) {
+    var _a, _b;
+    const method = req.method;
+    if (method !== 'GET' && method !== 'POST') {
+        return [
+            null,
+            {
+                status: 405,
+                statusText: 'Method Not Allowed',
+                headers: {
+                    allow: 'GET, POST',
+                },
+            },
+        ];
+    }
+    const [mediaType, charset = 'charset=utf-8', // utf-8 is assumed when not specified. this parameter is either "charset" or "boundary" (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Length)
+    ] = (getHeader(req, 'content-type') || '')
         .replace(/\s/g, '')
         .toLowerCase()
-        .split(',');
-    for (const accept of accepts) {
-        // accept-charset became obsolete, shouldnt be used (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Charset)
-        // TODO: handle the weight parameter "q"
-        const [mediaType, ...params] = accept.split(';');
-        const charset = (params === null || params === void 0 ? void 0 : params.find((param) => param.includes('charset='))) || 'charset=utf8'; // utf-8 is assumed when not specified;
-        if (mediaType === 'application/graphql-response+json' &&
-            charset === 'charset=utf8') {
-            acceptedMediaType = 'application/graphql-response+json';
-            break;
-        }
-        if ((mediaType === 'application/json' ||
-            mediaType === 'application/*' ||
-            mediaType === '*/*') &&
-            charset === 'charset=utf8') {
-            acceptedMediaType = 'application/json';
+        .split(';');
+    const partParams = {};
+    switch (true) {
+        case method === 'GET': {
+            // TODO: what if content-type is specified and is not application/x-www-form-urlencoded?
+            try {
+                const [, search] = req.url.split('?');
+                const searchParams = new URLSearchParams(search);
+                partParams.operationName =
+                    (_a = searchParams.get('operationName')) !== null && _a !== void 0 ? _a : undefined;
+                partParams.query = (_b = searchParams.get('query')) !== null && _b !== void 0 ? _b : undefined;
+                const variables = searchParams.get('variables');
+                if (variables)
+                    partParams.variables = JSON.parse(variables);
+                const extensions = searchParams.get('extensions');
+                if (extensions)
+                    partParams.extensions = JSON.parse(extensions);
+            }
+            catch (_c) {
+                throw new Error('Unparsable URL');
+            }
             break;
         }
+        case method === 'POST' &&
+            mediaType === 'application/json' &&
+            charset === 'charset=utf-8':
+            {
+                if (!req.body) {
+                    throw new Error('Missing body');
+                }
+                let data;
+                try {
+                    const body = typeof req.body === 'function' ? await req.body() : req.body;
+                    data = typeof body === 'string' ? JSON.parse(body) : body;
+                }
+                catch (err) {
+                    throw new Error('Unparsable JSON body');
+                }
+                if (!(0, utils_1.isObject)(data)) {
+                    throw new Error('JSON body must be an object');
+                }
+                partParams.operationName = data.operationName;
+                partParams.query = data.query;
+                partParams.variables = data.variables;
+                partParams.extensions = data.extensions;
+                break;
+            }
+        default: // graphql-http doesnt support any other content type
+            return [
+                null,
+                {
+                    status: 415,
+                    statusText: 'Unsupported Media Type',
+                },
+            ];
+    }
+    if (partParams.query == null)
+        throw new Error('Missing query');
+    if (typeof partParams.query !== 'string')
+        throw new Error('Invalid query');
+    if (partParams.variables != null &&
+        (typeof partParams.variables !== 'object' ||
+            Array.isArray(partParams.variables))) {
+        throw new Error('Invalid variables');
+    }
+    if (partParams.operationName != null &&
+        typeof partParams.operationName !== 'string') {
+        throw new Error('Invalid operationName');
     }
-    return acceptedMediaType;
+    if (partParams.extensions != null &&
+        (typeof partParams.extensions !== 'object' ||
+            Array.isArray(partParams.extensions))) {
+        throw new Error('Invalid extensions');
+    }
+    // request parameters are checked and now complete
+    return partParams;
 }
-exports.getAcceptableMediaType = getAcceptableMediaType;
 /**
  * Creates an appropriate GraphQL over HTTP response following the provided arguments.
  *
@@ -336,8 +336,6 @@ exports.getAcceptableMediaType = getAcceptableMediaType;
  *
  * If the first argument is an `Error`, the operation will be treated as a bad request responding with `400: Bad Request` and the
  * error will be present in the `ExecutionResult` style.
- *
- * @category Server
  */
 function makeResponse(resultOrErrors, acceptedMediaType, formatError) {
     if (resultOrErrors instanceof Error &&
@@ -391,7 +389,6 @@ function makeResponse(resultOrErrors, acceptedMediaType, formatError) {
         },
     ];
 }
-exports.makeResponse = makeResponse;
 function getHeader(req, key) {
     if (typeof req.headers.get === 'function') {
         return req.headers.get(key);

package/lib/handler.mjs

@@ -5,12 +5,8 @@
  */
 import { validate as graphqlValidate, specifiedRules, execute as graphqlExecute, parse as graphqlParse, getOperationAST as graphqlGetOperationAST, GraphQLError, } from 'graphql';
 import { areGraphQLErrors, isAsyncIterable, isExecutionResult, isGraphQLError, isObject, jsonErrorReplacer, } from './utils.mjs';
-/**
- * Checks whether the passed value is the `graphql-http` server agnostic response.
- *
- * @category Server
- */
-export function isResponse(val) {
+/** Checks whether the passed value is the `graphql-http` server agnostic response. */
+function isResponse(val) {
     // TODO: make sure the contents of init match ResponseInit
     return (Array.isArray(val) &&
         (typeof val[0] === 'string' || val[0] === null) &&
@@ -18,7 +14,7 @@ export function isResponse(val) {
 }
 /**
  * Makes a GraphQL over HTTP spec compliant server handler. The handler can
- * be used with your favourite server library.
+ * be used with your favorite server library.
  *
  * Beware that the handler resolves only after the whole operation completes.
  *
@@ -72,23 +68,32 @@ export function isResponse(val) {
  * @category Server
  */
 export function createHandler(options) {
-    const { schema, context, validate = graphqlValidate, validationRules = [], execute = graphqlExecute, parse = graphqlParse, getOperationAST = graphqlGetOperationAST, rootValue, onSubscribe, onOperation, formatError = (err) => err, } = options;
+    const { schema, context, validate = graphqlValidate, validationRules = [], execute = graphqlExecute, parse = graphqlParse, getOperationAST = graphqlGetOperationAST, rootValue, onSubscribe, onOperation, formatError = (err) => err, parseRequestParams = defaultParseRequestParams, } = options;
     return async function handler(req) {
-        var _a, _b;
-        const method = req.method;
-        if (method !== 'GET' && method !== 'POST') {
-            return [
-                null,
-                {
-                    status: 405,
-                    statusText: 'Method Not Allowed',
-                    headers: {
-                        allow: 'GET, POST',
-                    },
-                },
-            ];
+        let acceptedMediaType = null;
+        const accepts = (getHeader(req, 'accept') || '*/*')
+            .replace(/\s/g, '')
+            .toLowerCase()
+            .split(',');
+        for (const accept of accepts) {
+            // accept-charset became obsolete, shouldnt be used (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Charset)
+            // TODO: handle the weight parameter "q"
+            const [mediaType, ...params] = accept.split(';');
+            const charset = (params === null || params === void 0 ? void 0 : params.find((param) => param.includes('charset='))) || 'charset=utf8'; // utf-8 is assumed when not specified;
+            if (mediaType === 'application/graphql-response+json' &&
+                charset === 'charset=utf8') {
+                acceptedMediaType = 'application/graphql-response+json';
+                break;
+            }
+            // application/json should be the default until watershed
+            if ((mediaType === 'application/json' ||
+                mediaType === 'application/*' ||
+                mediaType === '*/*') &&
+                charset === 'charset=utf8') {
+                acceptedMediaType = 'application/json';
+                break;
+            }
         }
-        const acceptedMediaType = getAcceptableMediaType(getHeader(req, 'accept'));
         if (!acceptedMediaType) {
             return [
                 null,
@@ -101,89 +106,14 @@ export function createHandler(options) {
                 },
             ];
         }
-        // TODO: should graphql-http care about content-encoding? I'd say unzipping should happen before handler is reached
-        const [mediaType, charset = 'charset=utf-8', // utf-8 is assumed when not specified. this parameter is either "charset" or "boundary" (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Length)
-        ] = (getHeader(req, 'content-type') || '')
-            .replace(/\s/g, '')
-            .toLowerCase()
-            .split(';');
         let params;
         try {
-            const partParams = {};
-            switch (true) {
-                case method === 'GET': {
-                    // TODO: what if content-type is specified and is not application/x-www-form-urlencoded?
-                    try {
-                        const [, search] = req.url.split('?');
-                        const searchParams = new URLSearchParams(search);
-                        partParams.operationName =
-                            (_a = searchParams.get('operationName')) !== null && _a !== void 0 ? _a : undefined;
-                        partParams.query = (_b = searchParams.get('query')) !== null && _b !== void 0 ? _b : undefined;
-                        const variables = searchParams.get('variables');
-                        if (variables)
-                            partParams.variables = JSON.parse(variables);
-                        const extensions = searchParams.get('extensions');
-                        if (extensions)
-                            partParams.extensions = JSON.parse(extensions);
-                    }
-                    catch (_c) {
-                        throw new Error('Unparsable URL');
-                    }
-                    break;
-                }
-                case method === 'POST' &&
-                    mediaType === 'application/json' &&
-                    charset === 'charset=utf-8':
-                    {
-                        if (!req.body) {
-                            throw new Error('Missing body');
-                        }
-                        let data;
-                        try {
-                            const body = typeof req.body === 'function' ? await req.body() : req.body;
-                            data = typeof body === 'string' ? JSON.parse(body) : body;
-                        }
-                        catch (err) {
-                            throw new Error('Unparsable JSON body');
-                        }
-                        if (!isObject(data)) {
-                            throw new Error('JSON body must be an object');
-                        }
-                        partParams.operationName = data.operationName;
-                        partParams.query = data.query;
-                        partParams.variables = data.variables;
-                        partParams.extensions = data.extensions;
-                        break;
-                    }
-                default: // graphql-http doesnt support any other content type
-                    return [
-                        null,
-                        {
-                            status: 415,
-                            statusText: 'Unsupported Media Type',
-                        },
-                    ];
-            }
-            if (partParams.query == null)
-                throw new Error('Missing query');
-            if (typeof partParams.query !== 'string')
-                throw new Error('Invalid query');
-            if (partParams.variables != null &&
-                (typeof partParams.variables !== 'object' ||
-                    Array.isArray(partParams.variables))) {
-                throw new Error('Invalid variables');
-            }
-            if (partParams.operationName != null &&
-                typeof partParams.operationName !== 'string') {
-                throw new Error('Invalid operationName');
-            }
-            if (partParams.extensions != null &&
-                (typeof partParams.extensions !== 'object' ||
-                    Array.isArray(partParams.extensions))) {
-                throw new Error('Invalid extensions');
-            }
-            // request parameters are checked and now complete
-            params = partParams;
+            let paramsOrRes = await parseRequestParams(req);
+            if (!paramsOrRes)
+                paramsOrRes = await defaultParseRequestParams(req);
+            if (isResponse(paramsOrRes))
+                return paramsOrRes;
+            params = paramsOrRes;
         }
         catch (err) {
             return makeResponse(err, acceptedMediaType, formatError);
@@ -245,7 +175,7 @@ export function createHandler(options) {
                 throw null;
             operation = ast.operation;
         }
-        catch (_d) {
+        catch (_a) {
             return makeResponse(new GraphQLError('Unable to detect operation AST'), acceptedMediaType, formatError);
         }
         if (operation === 'subscription') {
@@ -253,7 +183,7 @@ export function createHandler(options) {
         }
         // mutations cannot happen over GETs
         // https://graphql.github.io/graphql-over-http/draft/#sel-CALFJRPAAELBAAxwP
-        if (operation === 'mutation' && method === 'GET') {
+        if (operation === 'mutation' && req.method === 'GET') {
             return [
                 JSON.stringify({
                     errors: [new GraphQLError('Cannot perform mutations over GET')],
@@ -289,36 +219,108 @@ export function createHandler(options) {
     };
 }
 /**
- * Inspects the request and detects the appropriate/acceptable Media-Type
- * looking at the `Accept` header while complying with the GraphQL over HTTP spec.
+ * The default request params parser. Used when no custom one is provided or if it
+ * returns nothing.
  *
- * @category Server
+ * Read more about it in {@link ParseRequestParams}.
+ *
+ * TODO: should graphql-http itself care about content-encoding? I'd say unzipping should happen before handler is reached
  */
-export function getAcceptableMediaType(acceptHeader) {
-    let acceptedMediaType = null;
-    const accepts = (acceptHeader || '*/*')
+async function defaultParseRequestParams(req) {
+    var _a, _b;
+    const method = req.method;
+    if (method !== 'GET' && method !== 'POST') {
+        return [
+            null,
+            {
+                status: 405,
+                statusText: 'Method Not Allowed',
+                headers: {
+                    allow: 'GET, POST',
+                },
+            },
+        ];
+    }
+    const [mediaType, charset = 'charset=utf-8', // utf-8 is assumed when not specified. this parameter is either "charset" or "boundary" (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Length)
+    ] = (getHeader(req, 'content-type') || '')
         .replace(/\s/g, '')
         .toLowerCase()
-        .split(',');
-    for (const accept of accepts) {
-        // accept-charset became obsolete, shouldnt be used (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Charset)
-        // TODO: handle the weight parameter "q"
-        const [mediaType, ...params] = accept.split(';');
-        const charset = (params === null || params === void 0 ? void 0 : params.find((param) => param.includes('charset='))) || 'charset=utf8'; // utf-8 is assumed when not specified;
-        if (mediaType === 'application/graphql-response+json' &&
-            charset === 'charset=utf8') {
-            acceptedMediaType = 'application/graphql-response+json';
-            break;
-        }
-        if ((mediaType === 'application/json' ||
-            mediaType === 'application/*' ||
-            mediaType === '*/*') &&
-            charset === 'charset=utf8') {
-            acceptedMediaType = 'application/json';
+        .split(';');
+    const partParams = {};
+    switch (true) {
+        case method === 'GET': {
+            // TODO: what if content-type is specified and is not application/x-www-form-urlencoded?
+            try {
+                const [, search] = req.url.split('?');
+                const searchParams = new URLSearchParams(search);
+                partParams.operationName =
+                    (_a = searchParams.get('operationName')) !== null && _a !== void 0 ? _a : undefined;
+                partParams.query = (_b = searchParams.get('query')) !== null && _b !== void 0 ? _b : undefined;
+                const variables = searchParams.get('variables');
+                if (variables)
+                    partParams.variables = JSON.parse(variables);
+                const extensions = searchParams.get('extensions');
+                if (extensions)
+                    partParams.extensions = JSON.parse(extensions);
+            }
+            catch (_c) {
+                throw new Error('Unparsable URL');
+            }
             break;
         }
+        case method === 'POST' &&
+            mediaType === 'application/json' &&
+            charset === 'charset=utf-8':
+            {
+                if (!req.body) {
+                    throw new Error('Missing body');
+                }
+                let data;
+                try {
+                    const body = typeof req.body === 'function' ? await req.body() : req.body;
+                    data = typeof body === 'string' ? JSON.parse(body) : body;
+                }
+                catch (err) {
+                    throw new Error('Unparsable JSON body');
+                }
+                if (!isObject(data)) {
+                    throw new Error('JSON body must be an object');
+                }
+                partParams.operationName = data.operationName;
+                partParams.query = data.query;
+                partParams.variables = data.variables;
+                partParams.extensions = data.extensions;
+                break;
+            }
+        default: // graphql-http doesnt support any other content type
+            return [
+                null,
+                {
+                    status: 415,
+                    statusText: 'Unsupported Media Type',
+                },
+            ];
+    }
+    if (partParams.query == null)
+        throw new Error('Missing query');
+    if (typeof partParams.query !== 'string')
+        throw new Error('Invalid query');
+    if (partParams.variables != null &&
+        (typeof partParams.variables !== 'object' ||
+            Array.isArray(partParams.variables))) {
+        throw new Error('Invalid variables');
+    }
+    if (partParams.operationName != null &&
+        typeof partParams.operationName !== 'string') {
+        throw new Error('Invalid operationName');
     }
-    return acceptedMediaType;
+    if (partParams.extensions != null &&
+        (typeof partParams.extensions !== 'object' ||
+            Array.isArray(partParams.extensions))) {
+        throw new Error('Invalid extensions');
+    }
+    // request parameters are checked and now complete
+    return partParams;
 }
 /**
  * Creates an appropriate GraphQL over HTTP response following the provided arguments.
@@ -330,10 +332,8 @@ export function getAcceptableMediaType(acceptHeader) {
  *
  * If the first argument is an `Error`, the operation will be treated as a bad request responding with `400: Bad Request` and the
  * error will be present in the `ExecutionResult` style.
- *
- * @category Server
  */
-export function makeResponse(resultOrErrors, acceptedMediaType, formatError) {
+function makeResponse(resultOrErrors, acceptedMediaType, formatError) {
     if (resultOrErrors instanceof Error &&
         // because GraphQLError extends the Error class
         !isGraphQLError(resultOrErrors)) {

package/lib/utils.js

@@ -48,7 +48,9 @@ function isAsyncIterable(val) {
 }
 exports.isAsyncIterable = isAsyncIterable;
 /** @private */
-function jsonErrorReplacer(_key, val) {
+function jsonErrorReplacer(_key, 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+val) {
     if (val instanceof Error &&
         // GraphQL errors implement their own stringer
         !isGraphQLError(val)) {

package/lib/utils.mjs

@@ -39,7 +39,9 @@ export function isAsyncIterable(val) {
     return typeof Object(val)[Symbol.asyncIterator] === 'function';
 }
 /** @private */
-export function jsonErrorReplacer(_key, val) {
+export function jsonErrorReplacer(_key, 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+val) {
     if (val instanceof Error &&
         // GraphQL errors implement their own stringer
         !isGraphQLError(val)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphql-http",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "description": "Simple, pluggable, zero-dependency, GraphQL over HTTP spec compliant server, client and audit suite.",
   "keywords": [
     "graphql",
@@ -24,7 +24,7 @@
   "engines": {
     "node": ">=12"
   },
-  "packageManager": "yarn@3.6.0",
+  "packageManager": "yarn@3.6.1",
   "main": "lib/index.js",
   "module": "lib/index.mjs",
   "browser": "umd/graphql-http.js",
@@ -91,18 +91,18 @@
     "access": "public"
   },
   "scripts": {
-    "gendocs": "typedoc --options typedoc.js src/",
-    "lint:eslint": "eslint 'src'",
-    "lint:prettier": "prettier --check .",
-    "lint:fix": "yarn lint:eslint --fix && yarn lint:prettier --write",
-    "lint": "yarn lint:eslint && yarn lint:prettier",
-    "type-check": "tsc --noEmit",
+    "check:format": "prettier --check .",
+    "format": "yarn check:format --write",
+    "check:lint": "eslint 'src'",
+    "check:spell": "cspell --gitignore **/*.md",
+    "check:type": "tsc --noEmit",
     "test": "NODE_OPTIONS=--experimental-vm-modules NODE_NO_WARNINGS=1 jest",
-    "build:esm": "tsc -b tsconfig.esm.json && node scripts/esm-post-process.mjs",
+    "build:esm": "tsc -b tsconfig.esm.json && tsx scripts/esm-post-process.ts",
     "build:cjs": "tsc -b tsconfig.cjs.json",
     "build:umd": "rollup --configPlugin typescript --config rollup.config.ts",
     "build": "yarn build:esm && yarn build:cjs && yarn build:umd",
-    "release": "semantic-release"
+    "release": "semantic-release",
+    "gendocs": "typedoc --options typedoc.js src/"
   },
   "workspaces": [
     "implementations/**/*"
@@ -111,49 +111,52 @@
     "graphql": ">=0.11 <=16"
   },
   "devDependencies": {
-    "@babel/core": "^7.22.1",
+    "@babel/core": "^7.22.8",
     "@babel/plugin-proposal-class-properties": "^7.18.6",
     "@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6",
     "@babel/plugin-proposal-object-rest-spread": "^7.20.7",
     "@babel/plugin-proposal-optional-chaining": "^7.21.0",
-    "@babel/preset-env": "^7.22.4",
-    "@babel/preset-typescript": "^7.21.5",
+    "@babel/preset-env": "^7.22.7",
+    "@babel/preset-typescript": "^7.22.5",
+    "@cspell/cspell-types": "^6.31.1",
     "@rollup/plugin-terser": "^0.4.3",
-    "@rollup/plugin-typescript": "^11.1.1",
+    "@rollup/plugin-typescript": "^11.1.2",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
-    "@types/eslint": "^8.40.0",
+    "@types/eslint": "^8.44.0",
     "@types/express": "^4.17.17",
     "@types/glob": "^8.1.0",
     "@types/html-validator": "^5.0.3",
     "@types/jest": "^29.5.2",
-    "@types/k6": "^0.44.2",
+    "@types/k6": "^0.45.0",
     "@types/koa": "^2.13.6",
     "@types/koa-mount": "^4.0.2",
-    "@typescript-eslint/eslint-plugin": "^5.59.8",
-    "@typescript-eslint/parser": "^5.59.8",
-    "@whatwg-node/fetch": "^0.9.2",
-    "babel-jest": "^29.5.0",
-    "eslint": "^8.42.0",
+    "@typescript-eslint/eslint-plugin": "^5.61.0",
+    "@typescript-eslint/parser": "^5.61.0",
+    "@whatwg-node/fetch": "^0.9.7",
+    "babel-jest": "^29.6.1",
+    "cspell": "^6.31.1",
+    "eslint": "^8.44.0",
     "eslint-config-prettier": "^8.8.0",
     "express": "^4.18.2",
-    "fastify": "^4.17.0",
-    "glob": "^10.2.6",
-    "graphql": "^16.6.0",
+    "fastify": "^4.19.2",
+    "glob": "^10.3.2",
+    "graphql": "^16.7.1",
     "html-validator": "^6.0.1",
-    "jest": "^29.5.0",
-    "jest-jasmine2": "^29.5.0",
+    "jest": "^29.6.1",
+    "jest-jasmine2": "^29.6.1",
     "koa": "^2.14.2",
     "koa-mount": "^4.0.0",
     "node-fetch": "^3.3.1",
     "prettier": "^2.8.8",
-    "rollup": "^3.23.1",
+    "rollup": "^3.26.2",
     "rollup-plugin-gzip": "^3.1.0",
-    "semantic-release": "^21.0.3",
-    "tslib": "^2.5.3",
+    "semantic-release": "^21.0.7",
+    "tslib": "^2.6.0",
+    "tsx": "^3.12.7",
     "typedoc": "^0.24.8",
     "typedoc-plugin-markdown": "^3.15.3",
-    "typescript": "^5.1.3",
+    "typescript": "^5.1.6",
     "uWebSockets.js": "uNetworking/uWebSockets.js#v20.30.0"
   }
 }