houdini-core 2.0.0-next.32 → 2.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "houdini-core",
-  "version": "2.0.0-next.32",
+  "version": "2.0.1",
   "description": "The core GraphQL client for Houdini",
   "keywords": [
     "graphql",
@@ -21,13 +21,13 @@
     "minimatch": "^10.2.5"
   },
   "optionalDependencies": {
-    "houdini-core-darwin-x64": "2.0.0-next.32",
-    "houdini-core-darwin-arm64": "2.0.0-next.32",
-    "houdini-core-linux-x64": "2.0.0-next.32",
-    "houdini-core-linux-arm64": "2.0.0-next.32",
-    "houdini-core-win32-x64": "2.0.0-next.32",
-    "houdini-core-win32-arm64": "2.0.0-next.32",
-    "houdini-core-wasm": "2.0.0-next.32"
+    "houdini-core-darwin-x64": "2.0.1",
+    "houdini-core-darwin-arm64": "2.0.1",
+    "houdini-core-linux-x64": "2.0.1",
+    "houdini-core-linux-arm64": "2.0.1",
+    "houdini-core-win32-x64": "2.0.1",
+    "houdini-core-win32-arm64": "2.0.1",
+    "houdini-core-wasm": "2.0.1"
   },
   "files": [
     "bin",

package/postInstall.js

@@ -5,7 +5,7 @@ const https = require('https')
 const child_process = require('child_process')
 
 // Adjust the version you want to install. You can also make this dynamic.
-const BINARY_DISTRIBUTION_VERSION = '2.0.0-next.32'
+const BINARY_DISTRIBUTION_VERSION = '2.0.1'
 
 // Windows binaries end with .exe so we need to special case them.
 const binaryName = process.platform === 'win32' ? 'houdini-core.exe' : 'houdini-core'

package/runtime/client.ts

@@ -22,6 +22,7 @@ import {
 	throwOnError as throwOnErrorPlugin,
 	optimisticKeys,
 	cachePolicy,
+	sessionRelay,
 } from './plugins/index.js'
 import pluginsFromPlugins from './plugins/injectedPlugins.js'
 
@@ -30,7 +31,6 @@ export { fetch, mutation, query, subscription } from './plugins/index.js'
 export { DocumentStore, type ClientPlugin, type SendParams } from 'houdini/runtime/documentStore'
 
 export type HoudiniClientConstructorArgs = {
-	url?: string
 	fetchParams?: FetchParamFn
 	plugins?: NestedList<ClientPlugin>
 	pipeline?: NestedList<ClientPlugin>
@@ -49,14 +49,22 @@ export class HoudiniClient extends BaseClient {
 	// store throwOnError operations for access by stores
 	throwOnError_operations: string[] = []
 
-	constructor({
-		url,
-		fetchParams,
-		plugins,
-		pipeline,
-		throwOnError,
-		cache = cacheRef,
-	}: HoudiniClientConstructorArgs = {}) {
+	constructor(args: HoudiniClientConstructorArgs = {}) {
+		// Houdini 2.0 migration guard: the API url is no longer passed to the client. Pre-2.0 apps
+		// did `new HoudiniClient({ url })` (or `new HoudiniClient(url)`); that value would now be
+		// silently ignored, which is one of the widest blast radiuses in the migration — so fail
+		// loudly with the new home for it.
+		const legacyUrl =
+			typeof (args as unknown) === 'string' ? args : (args as { url?: unknown }).url
+		if (legacyUrl != null) {
+			throw new Error(
+				'HoudiniClient no longer accepts a `url`. Set `url` in houdini.config.js for a remote ' +
+					'API, or `endpoint` in src/server/+config to change the local API path.'
+			)
+		}
+
+		const { fetchParams, plugins, pipeline, throwOnError, cache = cacheRef } = args
+
 		// if we were given plugins and pipeline there's an error
 		if (plugins && pipeline) {
 			throw new Error(
@@ -67,12 +75,16 @@ export class HoudiniClient extends BaseClient {
 		const serverPort =
 			globalThis.process?.env?.HOUDINI_PORT ?? globalThis.process?.env?.PORT ?? '5173'
 
+		// resolve the endpoint from config (no `url` arg anymore). An absolute endpoint (a remote
+		// api) is used as-is; a relative one (the local mount) is prefixed with the origin on SSR.
+		const endpoint = localApiEndpoint()
+		const resolvedUrl = /^https?:\/\//.test(endpoint)
+			? endpoint
+			: (globalThis.window ? '' : `http://localhost:${serverPort}`) + endpoint
+
 		super({
 			config: getCurrentConfig,
-			url:
-				url ??
-				(globalThis.window ? '' : `http://localhost:${serverPort}`) +
-					localApiEndpoint(getCurrentConfig()),
+			url: resolvedUrl,
 			plugins: flatten(
 				([] as NestedList<ClientPlugin>).concat(
 					// if they specified a throw behavior
@@ -85,6 +97,8 @@ export class HoudiniClient extends BaseClient {
 						(
 							[
 								optimisticKeys(cache ?? cacheRef),
+								// relay an @session mutation's mint token to the auth endpoint (sets the cookie)
+								sessionRelay(),
 								// make sure that documents always work
 								queryPlugin(cache ?? cacheRef),
 								mutationPlugin(cache ?? cacheRef),

package/runtime/config.ts

@@ -1,4 +1,5 @@
 import type { ConfigFile } from 'houdini'
+import { resolveApiEndpoint } from 'houdini/runtime'
 
 import config from './imports/config.js'
 import pluginConfigs from './imports/pluginConfig.js'
@@ -49,8 +50,10 @@ export function computeID(configFile: ConfigFile, type: string, data: any): stri
 // only compute the config file once
 let _configFile: ConfigFile | null = null
 
-export function localApiEndpoint(configFile: ConfigFile) {
-	return configFile.router?.apiEndpoint ?? '/_api'
+// the GraphQL endpoint comes straight from the public config bundle (no injection): the remote
+// `url`, the local mount `apiURL`, or the default — see resolveApiEndpoint.
+export function localApiEndpoint() {
+	return resolveApiEndpoint(getCurrentConfig())
 }
 
 export function getCurrentConfig(): ConfigFile {

package/runtime/plugins/fetch.ts

@@ -1,7 +1,10 @@
+import { getAuthUrl } from 'houdini/runtime'
 import type { ClientPlugin, ClientPluginContext } from 'houdini/runtime/documentStore'
 import { ArtifactKind, DataSource } from 'houdini/runtime/types'
 import type { RequestPayload, FetchContext } from 'houdini/runtime/types'
 
+import { getCurrentConfig } from '../config.js'
+
 export const fetch = (target?: RequestHandler | string): ClientPlugin => {
 	return () => {
 		return {
@@ -38,6 +41,28 @@ export const fetch = (target?: RequestHandler | string): ClientPlugin => {
 					}
 				}
 
+				// a @session mutation against a REMOTE api has to go through Houdini's same-origin
+				// proxy so the server can sit in the request path and write the session cookie
+				// server-authoritatively. The app is remote exactly when `url` is set in the public
+				// config (with a local schema the mutation hits the local Yoga and the mint plugin
+				// signs inline). The proxy lives under the session endpoint. We override the URL but
+				// never a user-supplied custom fetch function (it owns transport).
+				const artifact = ctx.artifact as typeof ctx.artifact & { sessionPath?: string }
+				if (
+					getCurrentConfig().url &&
+					artifact.kind === ArtifactKind.Mutation &&
+					artifact.sessionPath &&
+					typeof target !== 'function'
+				) {
+					// tell the proxy which operation this is via a header so it never has to parse the
+					// (possibly multipart) body to find the session path. Must stay in sync with
+					// HOUDINI_OPERATION_HEADER in router/server.ts.
+					fetchFn = defaultFetch(getAuthUrl() + '/proxy', {
+						...ctx.fetchParams,
+						headers: { ...ctx.fetchParams?.headers, 'x-houdini-operation': ctx.name },
+					})
+				}
+
 				const result = await fetchFn({
 					// wrap the user's fetch function so we can identify SSR by checking
 					// the response.url
@@ -61,6 +86,9 @@ export const fetch = (target?: RequestHandler | string): ClientPlugin => {
 					variables: ctx.variables ?? {},
 					data: result.data,
 					errors: !result.errors || result.errors.length === 0 ? null : result.errors,
+					// surface response-level extensions (e.g. the @session mint
+					// token) so the runtime/hooks can read them off the result
+					extensions: result.extensions,
 					partial: false,
 					stale: false,
 					source: DataSource.Network,
@@ -90,6 +118,11 @@ const defaultFetch = (
 			headers: {
 				Accept: 'application/graphql+json, application/json',
 				'Content-Type': 'application/json',
+				// a header a cross-origin <form>/simple request cannot set. The server
+				// requires it for CORS-simple POSTs to the graphql endpoint (uploads use
+				// multipart, which bypasses preflight) so it can't be a CSRF channel. Must
+				// stay in sync with HOUDINI_REQUEST_HEADER in router/server.ts.
+				'x-houdini-request': 'true',
 				...params?.headers,
 			},
 		})

package/runtime/plugins/index.ts

@@ -6,4 +6,5 @@ export * from './mutation.js'
 export * from './subscription.js'
 export * from './throwOnError.js'
 export * from './fetchParams.js'
+export * from './sessionRelay.js'
 export { optimisticKeys } from './optimisticKeys.js'

package/runtime/plugins/sessionRelay.ts

@@ -0,0 +1,60 @@
+import { getAuthUrl, HOUDINI_SESSION_EVENT, valueAtPath } from 'houdini/runtime'
+import type { ClientPlugin } from 'houdini/runtime/documentStore'
+import { ArtifactKind } from 'houdini/runtime/types'
+
+// sessionRelay is the client half of @session. When a session mutation executes, the server
+// signs the resolver's session subtree into a token in the response extensions
+// (extensions.houdiniSession). This plugin relays that token to the auth endpoint, which
+// verifies it and sets the httpOnly cookie — JS can't set httpOnly cookies itself — and then
+// mirrors the same write into local state (a window event the router listens for) so
+// useSession() updates without a refresh.
+//
+// It runs in the document pipeline, so it fires for ANY @session mutation execution
+// (useMutation, useMutationForm, a raw send), not just form submits: session-by-mutation
+// isn't tied to forms. The no-JS form path never reaches here (the server writes the cookie
+// directly and marks its internal request so no token is minted).
+export const sessionRelay = (): ClientPlugin => () => ({
+	async end(ctx, { value, resolve }) {
+		const artifact = ctx.artifact as typeof ctx.artifact & {
+			sessionPath?: string
+			sessionMerge?: boolean
+		}
+		const result = value as { data?: any; extensions?: Record<string, any> } | null
+		// the local-Yoga path mints a token here for the client to relay; the remote-api proxy
+		// instead writes the cookie itself and signals it with houdiniSessionApplied. Either way the
+		// session changed and useSession() must mirror it.
+		const token = result?.extensions?.houdiniSession
+		const proxyApplied = result?.extensions?.houdiniSessionApplied === true
+		const isSessionMutation = artifact.kind === ArtifactKind.Mutation && !!artifact.sessionPath
+		if (isSessionMutation && typeof window !== 'undefined' && (token || proxyApplied)) {
+			// relay the minted token to the auth endpoint to set the cookie. The proxy path already
+			// set the cookie server-side (proxyApplied, no token), so there's nothing to relay there.
+			if (token) {
+				try {
+					await fetch(getAuthUrl(), {
+						method: 'POST',
+						body: JSON.stringify({ token }),
+						headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+					})
+				} catch {
+					// best-effort — if the relay fails the cookie just isn't updated this time
+				}
+			}
+
+			// mirror the write into local state so useSession() updates without a refresh. A null
+			// subtree clears (replace with {}); otherwise merge upserts and the default replaces. The
+			// cookie (set by the relay or the proxy) stays the source of truth; this just reflects it.
+			const next = valueAtPath(result?.data, artifact.sessionPath!.split('.'))
+			window.dispatchEvent(
+				new CustomEvent(HOUDINI_SESSION_EVENT, {
+					bubbles: true,
+					detail: {
+						session: next ?? {},
+						merge: next != null && !!artifact.sessionMerge,
+					},
+				})
+			)
+		}
+		resolve(ctx)
+	},
+})