graphql-http 1.19.0 → 1.21.0

package/lib/handler.js

@@ -5,24 +5,19 @@
  *
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.makeResponse = exports.getAcceptableMediaType = exports.createHandler = exports.isResponse = void 0;
+exports.createHandler = void 0;
 const graphql_1 = require("graphql");
 const utils_1 = require("./utils");
-/**
- * Checks whether the passed value is the `graphql-http` server agnostic response.
- *
- * @category Server
- */
+/** Checks whether the passed value is the `graphql-http` server agnostic response. */
 function isResponse(val) {
     // TODO: make sure the contents of init match ResponseInit
     return (Array.isArray(val) &&
         (typeof val[0] === 'string' || val[0] === null) &&
         (0, utils_1.isObject)(val[1]));
 }
-exports.isResponse = isResponse;
 /**
  * Makes a GraphQL over HTTP spec compliant server handler. The handler can
- * be used with your favourite server library.
+ * be used with your favorite server library.
  *
  * Beware that the handler resolves only after the whole operation completes.
  *
@@ -76,23 +71,32 @@ exports.isResponse = isResponse;
  * @category Server
  */
 function createHandler(options) {
-    const { schema, context, validate = graphql_1.validate, validationRules = [], execute = graphql_1.execute, parse = graphql_1.parse, getOperationAST = graphql_1.getOperationAST, rootValue, onSubscribe, onOperation, formatError = (err) => err, } = options;
+    const { schema, context, validate = graphql_1.validate, validationRules = [], execute = graphql_1.execute, parse = graphql_1.parse, getOperationAST = graphql_1.getOperationAST, rootValue, onSubscribe, onOperation, formatError = (err) => err, parseRequestParams = defaultParseRequestParams, } = options;
     return async function handler(req) {
-        var _a, _b;
-        const method = req.method;
-        if (method !== 'GET' && method !== 'POST') {
-            return [
-                null,
-                {
-                    status: 405,
-                    statusText: 'Method Not Allowed',
-                    headers: {
-                        allow: 'GET, POST',
-                    },
-                },
-            ];
+        let acceptedMediaType = null;
+        const accepts = (getHeader(req, 'accept') || '*/*')
+            .replace(/\s/g, '')
+            .toLowerCase()
+            .split(',');
+        for (const accept of accepts) {
+            // accept-charset became obsolete, shouldnt be used (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Charset)
+            // TODO: handle the weight parameter "q"
+            const [mediaType, ...params] = accept.split(';');
+            const charset = (params === null || params === void 0 ? void 0 : params.find((param) => param.includes('charset='))) || 'charset=utf8'; // utf-8 is assumed when not specified;
+            if (mediaType === 'application/graphql-response+json' &&
+                charset === 'charset=utf8') {
+                acceptedMediaType = 'application/graphql-response+json';
+                break;
+            }
+            // application/json should be the default until watershed
+            if ((mediaType === 'application/json' ||
+                mediaType === 'application/*' ||
+                mediaType === '*/*') &&
+                charset === 'charset=utf8') {
+                acceptedMediaType = 'application/json';
+                break;
+            }
         }
-        const acceptedMediaType = getAcceptableMediaType(getHeader(req, 'accept'));
         if (!acceptedMediaType) {
             return [
                 null,
@@ -105,89 +109,14 @@ function createHandler(options) {
                 },
             ];
         }
-        // TODO: should graphql-http care about content-encoding? I'd say unzipping should happen before handler is reached
-        const [mediaType, charset = 'charset=utf-8', // utf-8 is assumed when not specified. this parameter is either "charset" or "boundary" (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Length)
-        ] = (getHeader(req, 'content-type') || '')
-            .replace(/\s/g, '')
-            .toLowerCase()
-            .split(';');
         let params;
         try {
-            const partParams = {};
-            switch (true) {
-                case method === 'GET': {
-                    // TODO: what if content-type is specified and is not application/x-www-form-urlencoded?
-                    try {
-                        const [, search] = req.url.split('?');
-                        const searchParams = new URLSearchParams(search);
-                        partParams.operationName =
-                            (_a = searchParams.get('operationName')) !== null && _a !== void 0 ? _a : undefined;
-                        partParams.query = (_b = searchParams.get('query')) !== null && _b !== void 0 ? _b : undefined;
-                        const variables = searchParams.get('variables');
-                        if (variables)
-                            partParams.variables = JSON.parse(variables);
-                        const extensions = searchParams.get('extensions');
-                        if (extensions)
-                            partParams.extensions = JSON.parse(extensions);
-                    }
-                    catch (_c) {
-                        throw new Error('Unparsable URL');
-                    }
-                    break;
-                }
-                case method === 'POST' &&
-                    mediaType === 'application/json' &&
-                    charset === 'charset=utf-8':
-                    {
-                        if (!req.body) {
-                            throw new Error('Missing body');
-                        }
-                        let data;
-                        try {
-                            const body = typeof req.body === 'function' ? await req.body() : req.body;
-                            data = typeof body === 'string' ? JSON.parse(body) : body;
-                        }
-                        catch (err) {
-                            throw new Error('Unparsable JSON body');
-                        }
-                        if (!(0, utils_1.isObject)(data)) {
-                            throw new Error('JSON body must be an object');
-                        }
-                        partParams.operationName = data.operationName;
-                        partParams.query = data.query;
-                        partParams.variables = data.variables;
-                        partParams.extensions = data.extensions;
-                        break;
-                    }
-                default: // graphql-http doesnt support any other content type
-                    return [
-                        null,
-                        {
-                            status: 415,
-                            statusText: 'Unsupported Media Type',
-                        },
-                    ];
-            }
-            if (partParams.query == null)
-                throw new Error('Missing query');
-            if (typeof partParams.query !== 'string')
-                throw new Error('Invalid query');
-            if (partParams.variables != null &&
-                (typeof partParams.variables !== 'object' ||
-                    Array.isArray(partParams.variables))) {
-                throw new Error('Invalid variables');
-            }
-            if (partParams.operationName != null &&
-                typeof partParams.operationName !== 'string') {
-                throw new Error('Invalid operationName');
-            }
-            if (partParams.extensions != null &&
-                (typeof partParams.extensions !== 'object' ||
-                    Array.isArray(partParams.extensions))) {
-                throw new Error('Invalid extensions');
-            }
-            // request parameters are checked and now complete
-            params = partParams;
+            let paramsOrRes = await parseRequestParams(req);
+            if (!paramsOrRes)
+                paramsOrRes = await defaultParseRequestParams(req);
+            if (isResponse(paramsOrRes))
+                return paramsOrRes;
+            params = paramsOrRes;
         }
         catch (err) {
             return makeResponse(err, acceptedMediaType, formatError);
@@ -197,7 +126,7 @@ function createHandler(options) {
         if (isResponse(maybeResErrsOrArgs))
             return maybeResErrsOrArgs;
         else if ((0, utils_1.isExecutionResult)(maybeResErrsOrArgs) ||
-            (0, utils_1.areGraphQLErrors)(maybeResErrsOrArgs))
+            areGraphQLErrors(maybeResErrsOrArgs))
             return makeResponse(maybeResErrsOrArgs, acceptedMediaType, formatError);
         else if (maybeResErrsOrArgs)
             args = maybeResErrsOrArgs;
@@ -249,7 +178,7 @@ function createHandler(options) {
                 throw null;
             operation = ast.operation;
         }
-        catch (_d) {
+        catch (_a) {
             return makeResponse(new graphql_1.GraphQLError('Unable to detect operation AST'), acceptedMediaType, formatError);
         }
         if (operation === 'subscription') {
@@ -257,7 +186,7 @@ function createHandler(options) {
         }
         // mutations cannot happen over GETs
         // https://graphql.github.io/graphql-over-http/draft/#sel-CALFJRPAAELBAAxwP
-        if (operation === 'mutation' && method === 'GET') {
+        if (operation === 'mutation' && req.method === 'GET') {
             return [
                 JSON.stringify({
                     errors: [new graphql_1.GraphQLError('Cannot perform mutations over GET')],
@@ -294,38 +223,109 @@ function createHandler(options) {
 }
 exports.createHandler = createHandler;
 /**
- * Inspects the request and detects the appropriate/acceptable Media-Type
- * looking at the `Accept` header while complying with the GraphQL over HTTP spec.
+ * The default request params parser. Used when no custom one is provided or if it
+ * returns nothing.
  *
- * @category Server
+ * Read more about it in {@link ParseRequestParams}.
+ *
+ * TODO: should graphql-http itself care about content-encoding? I'd say unzipping should happen before handler is reached
  */
-function getAcceptableMediaType(acceptHeader) {
-    let acceptedMediaType = null;
-    const accepts = (acceptHeader || '*/*')
+async function defaultParseRequestParams(req) {
+    var _a, _b;
+    const method = req.method;
+    if (method !== 'GET' && method !== 'POST') {
+        return [
+            null,
+            {
+                status: 405,
+                statusText: 'Method Not Allowed',
+                headers: {
+                    allow: 'GET, POST',
+                },
+            },
+        ];
+    }
+    const [mediaType, charset = 'charset=utf-8', // utf-8 is assumed when not specified. this parameter is either "charset" or "boundary" (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Length)
+    ] = (getHeader(req, 'content-type') || '')
         .replace(/\s/g, '')
         .toLowerCase()
-        .split(',');
-    for (const accept of accepts) {
-        // accept-charset became obsolete, shouldnt be used (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Charset)
-        // TODO: handle the weight parameter "q"
-        const [mediaType, ...params] = accept.split(';');
-        const charset = (params === null || params === void 0 ? void 0 : params.find((param) => param.includes('charset='))) || 'charset=utf8'; // utf-8 is assumed when not specified;
-        if (mediaType === 'application/graphql-response+json' &&
-            charset === 'charset=utf8') {
-            acceptedMediaType = 'application/graphql-response+json';
-            break;
-        }
-        if ((mediaType === 'application/json' ||
-            mediaType === 'application/*' ||
-            mediaType === '*/*') &&
-            charset === 'charset=utf8') {
-            acceptedMediaType = 'application/json';
+        .split(';');
+    const partParams = {};
+    switch (true) {
+        case method === 'GET': {
+            // TODO: what if content-type is specified and is not application/x-www-form-urlencoded?
+            try {
+                const [, search] = req.url.split('?');
+                const searchParams = new URLSearchParams(search);
+                partParams.operationName =
+                    (_a = searchParams.get('operationName')) !== null && _a !== void 0 ? _a : undefined;
+                partParams.query = (_b = searchParams.get('query')) !== null && _b !== void 0 ? _b : undefined;
+                const variables = searchParams.get('variables');
+                if (variables)
+                    partParams.variables = JSON.parse(variables);
+                const extensions = searchParams.get('extensions');
+                if (extensions)
+                    partParams.extensions = JSON.parse(extensions);
+            }
+            catch (_c) {
+                throw new Error('Unparsable URL');
+            }
             break;
         }
+        case method === 'POST' &&
+            mediaType === 'application/json' &&
+            charset === 'charset=utf-8':
+            {
+                if (!req.body) {
+                    throw new Error('Missing body');
+                }
+                let data;
+                try {
+                    const body = typeof req.body === 'function' ? await req.body() : req.body;
+                    data = typeof body === 'string' ? JSON.parse(body) : body;
+                }
+                catch (err) {
+                    throw new Error('Unparsable JSON body');
+                }
+                if (!(0, utils_1.isObject)(data)) {
+                    throw new Error('JSON body must be an object');
+                }
+                partParams.operationName = data.operationName;
+                partParams.query = data.query;
+                partParams.variables = data.variables;
+                partParams.extensions = data.extensions;
+                break;
+            }
+        default: // graphql-http doesnt support any other content type
+            return [
+                null,
+                {
+                    status: 415,
+                    statusText: 'Unsupported Media Type',
+                },
+            ];
+    }
+    if (partParams.query == null)
+        throw new Error('Missing query');
+    if (typeof partParams.query !== 'string')
+        throw new Error('Invalid query');
+    if (partParams.variables != null &&
+        (typeof partParams.variables !== 'object' ||
+            Array.isArray(partParams.variables))) {
+        throw new Error('Invalid variables');
+    }
+    if (partParams.operationName != null &&
+        typeof partParams.operationName !== 'string') {
+        throw new Error('Invalid operationName');
     }
-    return acceptedMediaType;
+    if (partParams.extensions != null &&
+        (typeof partParams.extensions !== 'object' ||
+            Array.isArray(partParams.extensions))) {
+        throw new Error('Invalid extensions');
+    }
+    // request parameters are checked and now complete
+    return partParams;
 }
-exports.getAcceptableMediaType = getAcceptableMediaType;
 /**
  * Creates an appropriate GraphQL over HTTP response following the provided arguments.
  *
@@ -336,15 +336,13 @@ exports.getAcceptableMediaType = getAcceptableMediaType;
  *
  * If the first argument is an `Error`, the operation will be treated as a bad request responding with `400: Bad Request` and the
  * error will be present in the `ExecutionResult` style.
- *
- * @category Server
  */
 function makeResponse(resultOrErrors, acceptedMediaType, formatError) {
     if (resultOrErrors instanceof Error &&
         // because GraphQLError extends the Error class
-        !(0, utils_1.isGraphQLError)(resultOrErrors)) {
+        !isGraphQLError(resultOrErrors)) {
         return [
-            JSON.stringify({ errors: [formatError(resultOrErrors)] }, utils_1.jsonErrorReplacer),
+            JSON.stringify({ errors: [formatError(resultOrErrors)] }, jsonErrorReplacer),
             {
                 status: 400,
                 statusText: 'Bad Request',
@@ -354,14 +352,14 @@ function makeResponse(resultOrErrors, acceptedMediaType, formatError) {
             },
         ];
     }
-    const errors = (0, utils_1.isGraphQLError)(resultOrErrors)
+    const errors = isGraphQLError(resultOrErrors)
         ? [resultOrErrors]
-        : (0, utils_1.areGraphQLErrors)(resultOrErrors)
+        : areGraphQLErrors(resultOrErrors)
             ? resultOrErrors
             : null;
     if (errors) {
         return [
-            JSON.stringify({ errors: errors.map(formatError) }, utils_1.jsonErrorReplacer),
+            JSON.stringify({ errors: errors.map(formatError) }, jsonErrorReplacer),
             Object.assign(Object.assign({}, (acceptedMediaType === 'application/json'
                 ? {
                     status: 200,
@@ -379,7 +377,7 @@ function makeResponse(resultOrErrors, acceptedMediaType, formatError) {
     }
     return [
         JSON.stringify('errors' in resultOrErrors && resultOrErrors.errors
-            ? Object.assign(Object.assign({}, resultOrErrors), { errors: resultOrErrors.errors.map(formatError) }) : resultOrErrors, utils_1.jsonErrorReplacer),
+            ? Object.assign(Object.assign({}, resultOrErrors), { errors: resultOrErrors.errors.map(formatError) }) : resultOrErrors, jsonErrorReplacer),
         {
             status: 200,
             statusText: 'OK',
@@ -391,10 +389,32 @@ function makeResponse(resultOrErrors, acceptedMediaType, formatError) {
         },
     ];
 }
-exports.makeResponse = makeResponse;
 function getHeader(req, key) {
     if (typeof req.headers.get === 'function') {
         return req.headers.get(key);
     }
     return Object(req.headers)[key];
 }
+function areGraphQLErrors(obj) {
+    return (Array.isArray(obj) &&
+        obj.length > 0 &&
+        // if one item in the array is a GraphQLError, we're good
+        obj.some(isGraphQLError));
+}
+function isGraphQLError(obj) {
+    return obj instanceof graphql_1.GraphQLError;
+}
+function jsonErrorReplacer(_key, 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+val) {
+    if (val instanceof Error &&
+        // GraphQL errors implement their own stringer
+        !isGraphQLError(val)) {
+        return {
+            // name: val.name, name is included in message
+            message: val.message,
+            // stack: val.stack, can leak sensitive details
+        };
+    }
+    return val;
+}