houdini 2.0.0-next.9 → 2.0.1

package/build/router/server.d.ts

@@ -0,0 +1,57 @@
+import { createServerAdapter } from '@whatwg-node/server';
+import type { ServerAdapterRequestHandler } from '@whatwg-node/server';
+import type { GraphQLSchema } from 'graphql';
+import { YogaServer, type YogaServerOptions as YogaConfig } from 'graphql-yoga';
+import type { ConfigFile, ServerConfigFile } from '../lib/config.js';
+import type { HoudiniClient } from '../runtime/client.js';
+import { signFormToken } from './auth-token.js';
+import type { RouterManifest, RouterPageManifest, YogaServerOptions } from './types.js';
+export { signFormToken };
+export type FormResult = Record<string, {
+    data: any;
+    errors: any;
+}>;
+export declare function _serverHandler<ComponentType = unknown>({ schema, server, client, production, manifest, graphqlEndpoint, on_render, componentCache, config_file, server_config, }: {
+    schema?: GraphQLSchema | null;
+    server?: Server<any, any>;
+    client: HoudiniClient;
+    production: boolean;
+    manifest: RouterManifest<ComponentType> | null;
+    assetPrefix: string;
+    graphqlEndpoint: string;
+    componentCache: Record<string, any>;
+    on_render: (args: {
+        url: string;
+        match: RouterPageManifest<ComponentType> | null;
+        is404: boolean;
+        manifest: RouterManifest<unknown>;
+        session: App.Session;
+        componentCache: Record<string, any>;
+        headers: Record<string, string>;
+        formResult?: FormResult;
+        formToken?: string;
+        authUrl?: string;
+    }) => Response | Promise<Response | undefined> | undefined;
+    config_file: ConfigFile;
+    server_config?: ServerConfigFile;
+} & Omit<YogaServerOptions, 'schema'>): (request: Request, ...extraContext: Array<any>) => Promise<Response>;
+export declare const serverAdapterFactory: (args: Parameters<typeof _serverHandler>[0]) => ReturnType<typeof createServerAdapter>;
+export declare function collect_response_headers(match: {
+    headers?: Array<() => Promise<(() => unknown) | undefined>>;
+} | null): Promise<Record<string, string>>;
+export declare function apply_antiframing_defaults(headers: Record<string, string>): void;
+export type ServerAdapterFactory = typeof serverAdapterFactory;
+type YogaParams = Required<ConstructorParameters<typeof YogaServer>>[0];
+type YogaSchemaDefinition<TContext> = NonNullable<YogaConfig<any, TContext>['schema']>;
+type ConstructorParams = Omit<YogaParams, 'schema' | 'graphqlEndpoint'>;
+export declare class Server<ServerContext extends Record<string, any>, UserContext extends Record<string, any>> {
+    opts: ConstructorParams | null;
+    _yoga: YogaServer<any, any> | null;
+    constructor(opts?: ConstructorParams);
+    init({ endpoint, schema, getSession, }: {
+        schema: YogaSchemaDefinition<any>;
+        endpoint: string;
+        getSession: (request: Request) => Promise<UserContext>;
+    }): import("@whatwg-node/server").ServerAdapter<ServerContext, Server<ServerContext, UserContext>>;
+    handle: ServerAdapterRequestHandler<ServerContext>;
+}

package/build/router/server.js

@@ -0,0 +1,500 @@
+import { createServerAdapter } from "@whatwg-node/server";
+import {
+  YogaServer
+} from "graphql-yoga";
+import { getAuthUrl, resolveApiEndpoint, setAuthUrl } from "../runtime/config.js";
+import { interpolateRedirect, valueAtPath } from "../runtime/endpoint.js";
+import { coerceFormData } from "../runtime/formData.js";
+import { buildGraphQLBody } from "../runtime/multipart.js";
+import { marshalInputs } from "../runtime/scalars.js";
+import { CSRF_FIELD, signFormToken, verifyFormToken, signSessionToken } from "./auth-token.js";
+import { serialize as encodeCookie } from "./cookies.js";
+import { find_match, find_prefix_match } from "./match.js";
+import {
+  applySessionToken,
+  clear_session,
+  get_session,
+  handle_request,
+  isAllowedOrigin,
+  session_cookie_name,
+  set_session,
+  sign_session
+} from "./session.js";
+const HOUDINI_REQUEST_HEADER = "x-houdini-request";
+const HOUDINI_OPERATION_HEADER = "x-houdini-operation";
+async function readBodyWithLimit(request, maxBytes) {
+  if (!request.body) {
+    return request;
+  }
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) {
+      break;
+    }
+    if (value) {
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel();
+        return null;
+      }
+      chunks.push(value);
+    }
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new Request(request.url, {
+    method: request.method,
+    headers: request.headers,
+    body
+  });
+}
+function sessionMintPlugin(manifest, sessionKeys) {
+  return {
+    onExecute() {
+      return {
+        async onExecuteDone({ args, result, setResult }) {
+          if (!result || typeof result[Symbol.asyncIterator] === "function" || !result.data) {
+            return;
+          }
+          if (args?.contextValue?.request?.headers?.get(INTERNAL_FORM_HEADER)) {
+            return;
+          }
+          const token = await mintSessionToken({
+            data: result.data,
+            errors: result.errors,
+            operationName: operationNameOf(args),
+            requestHeaders: args.contextValue.request.headers,
+            manifest,
+            sessionKeys
+          });
+          if (!token) {
+            return;
+          }
+          setResult({
+            ...result,
+            extensions: { ...result.extensions, houdiniSession: token }
+          });
+        }
+      };
+    }
+  };
+}
+async function mintSessionToken({
+  data,
+  errors,
+  operationName,
+  requestHeaders,
+  manifest,
+  sessionKeys
+}) {
+  if (errors?.length) {
+    return null;
+  }
+  const session = operationName ? manifest?.sessionMutations?.[operationName] : void 0;
+  if (!session) {
+    return null;
+  }
+  const value = valueAtPath(data, session.sessionPath.split("."));
+  const priorSession = await get_session(requestHeaders, sessionKeys);
+  return await signSessionToken(
+    value ?? null,
+    sessionKeys,
+    session.merge,
+    priorSession
+  );
+}
+const INTERNAL_FORM_HEADER = "x-houdini-internal-form";
+function operationNameOf(args) {
+  if (args?.operationName) {
+    return args.operationName;
+  }
+  const ops = (args?.document?.definitions ?? []).filter(
+    (def) => def.kind === "OperationDefinition"
+  );
+  if (ops.length === 1 && ops[0].name?.value) {
+    return ops[0].name.value;
+  }
+  return null;
+}
+function _serverHandler({
+  schema,
+  server,
+  client,
+  production,
+  manifest,
+  graphqlEndpoint,
+  on_render,
+  componentCache,
+  config_file,
+  server_config
+}) {
+  const session_keys = localApiSessionKeys(server_config);
+  setAuthUrl(server_config?.auth?.url);
+  const sessionProxyPath = schema ? void 0 : getAuthUrl() + "/proxy";
+  if (session_keys.length === 0) {
+    session_keys.push(crypto.randomUUID());
+  }
+  if (schema && !server) {
+    server = new Server({
+      landingPage: !production
+    });
+  }
+  if (server instanceof Server) {
+    server.opts = {
+      ...server.opts ?? {},
+      plugins: [...server.opts?.plugins ?? [], sessionMintPlugin(manifest, session_keys)]
+    };
+  }
+  let requestHandler = null;
+  if (server && schema) {
+    requestHandler = server.init({
+      schema,
+      endpoint: graphqlEndpoint,
+      getSession: (request) => get_session(request.headers, session_keys)
+    });
+  }
+  client.componentCache = componentCache;
+  if (requestHandler) {
+    client.registerProxy(graphqlEndpoint, async ({ query, variables, session }) => {
+      const response = await requestHandler(
+        new Request(`http://localhost/${graphqlEndpoint}`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            // sign the session so the local handler's get_session (a signed-JWT verify)
+            // accepts it — a raw JSON cookie is rejected and would run session-less.
+            Cookie: encodeCookie(
+              session_cookie_name,
+              await sign_session(session ?? {}, session_keys[0]),
+              { httpOnly: true }
+            )
+          },
+          body: JSON.stringify({
+            query,
+            variables
+          })
+        })
+      );
+      return await response.json();
+    });
+  }
+  const renderPage = async (nonNullManifest, request, url, opts) => {
+    const [exactMatch] = find_match(nonNullManifest, url);
+    const is404 = !exactMatch;
+    const match = exactMatch ?? find_prefix_match(nonNullManifest, url);
+    const headers = await collect_response_headers(match);
+    apply_antiframing_defaults(headers);
+    const session = await get_session(request.headers, session_keys);
+    const formToken = await signFormToken(session, session_keys);
+    const rendered = await on_render({
+      url,
+      match,
+      is404,
+      session,
+      manifest: nonNullManifest,
+      componentCache,
+      headers,
+      formResult: opts?.formResult,
+      formToken,
+      // the session endpoint, injected so the client relay/useSession can reach it (it's
+      // server-only config). The GraphQL endpoint + proxy path are derived client-side from
+      // the public config, so they aren't injected here.
+      authUrl: getAuthUrl()
+    });
+    if (!rendered) {
+      return new Response("404", { status: 404 });
+    }
+    if (opts?.status && opts.status !== rendered.status) {
+      return new Response(rendered.body, { status: opts.status, headers: rendered.headers });
+    }
+    return rendered;
+  };
+  const handleForm = async (nonNullManifest, request, parsedURL, url) => {
+    if (request.method !== "POST") {
+      return null;
+    }
+    const contentType = request.headers.get("content-type") ?? "";
+    if (!contentType.includes("application/x-www-form-urlencoded") && !contentType.includes("multipart/form-data")) {
+      return null;
+    }
+    if (!isAllowedOrigin(request, server_config)) {
+      return new Response("Forbidden", { status: 403 });
+    }
+    const maxBodyBytes = server_config?.formMaxBodyBytes ?? 10 * 1024 * 1024;
+    const contentLength = Number(request.headers.get("content-length"));
+    if (Number.isFinite(contentLength) && contentLength > maxBodyBytes) {
+      return new Response("Payload Too Large", { status: 413 });
+    }
+    const limited = await readBodyWithLimit(request, maxBodyBytes);
+    if (limited === null) {
+      return new Response("Payload Too Large", { status: 413 });
+    }
+    const formData = await limited.formData();
+    const session = await get_session(request.headers, session_keys);
+    if (!await verifyFormToken(formData.get(CSRF_FIELD), session, session_keys)) {
+      return new Response("Forbidden", { status: 403 });
+    }
+    const mutationName = formData.get("__houdini_form");
+    if (typeof mutationName !== "string") {
+      return new Response("Bad Request", { status: 400 });
+    }
+    const formIdValue = formData.get("__houdini_form_id");
+    const formId = typeof formIdValue === "string" && formIdValue ? formIdValue : mutationName;
+    const loadArtifact = nonNullManifest.formActions?.[mutationName];
+    if (!loadArtifact) {
+      return new Response(`Unknown form mutation: ${mutationName}`, { status: 400 });
+    }
+    const handler = requestHandler;
+    if (!handler) {
+      return new Response("Form submissions require a local GraphQL server", { status: 500 });
+    }
+    const { default: artifact } = await loadArtifact();
+    const input = artifact.input ?? { fields: {}, types: {}, defaults: {}, runtimeScalars: {} };
+    const coerced = coerceFormData(formData, input, config_file, artifact.endpoint?.fields);
+    const variables = marshalInputs({ artifact, input: coerced, config: config_file }) ?? {};
+    const { contentType: bodyContentType, body } = buildGraphQLBody(artifact.raw, variables);
+    const response = await handler(
+      new Request(`http://localhost/${graphqlEndpoint}`, {
+        method: "POST",
+        headers: {
+          ...bodyContentType ? { "Content-Type": bodyContentType } : {},
+          // mark this as the no-JS form's internal execution so the session-mint plugin
+          // skips it (we set the cookie directly below)
+          [INTERNAL_FORM_HEADER]: "1",
+          // sign the session so the in-process handler's get_session (a signed-JWT verify)
+          // accepts it — a raw JSON value would fail verification and run session-less
+          Cookie: encodeCookie(
+            session_cookie_name,
+            await sign_session(session ?? {}, session_keys[0]),
+            { httpOnly: true }
+          )
+        },
+        body
+      })
+    );
+    const result = await response.json();
+    if (result.errors && result.errors.length > 0) {
+      return renderPage(nonNullManifest, request, url, {
+        formResult: { [formId]: { data: result.data ?? null, errors: result.errors } },
+        status: 422
+      });
+    }
+    let location = url;
+    const redirect = artifact.endpoint?.redirect;
+    if (redirect) {
+      const target = interpolateRedirect(redirect, result.data);
+      if (target) {
+        location = target;
+      } else if (!production) {
+        console.warn(
+          `@endpoint redirect for "${mutationName}" resolved to a null value; falling back to the current page`
+        );
+      }
+    }
+    const formResponse = new Response(null, { status: 303, headers: { Location: location } });
+    const sessionWrite = nonNullManifest.sessionMutations?.[mutationName];
+    if (sessionWrite) {
+      const value = valueAtPath(result.data, sessionWrite.sessionPath.split("."));
+      const req = { request, config: config_file, session_keys };
+      if (value == null) {
+        clear_session(formResponse);
+      } else if (sessionWrite.merge) {
+        const existing = await get_session(request.headers, session_keys);
+        await set_session(req, formResponse, { ...existing, ...value });
+      } else {
+        await set_session(req, formResponse, value);
+      }
+    }
+    return formResponse;
+  };
+  const handleSessionProxy = async (request) => {
+    if (!sessionProxyPath || new URL(request.url).pathname !== sessionProxyPath) {
+      return void 0;
+    }
+    if (request.method !== "POST") {
+      return new Response("Method Not Allowed", { status: 405 });
+    }
+    if (!isAllowedOrigin(request, server_config)) {
+      return new Response("Forbidden", { status: 403 });
+    }
+    const maxBodyBytes = server_config?.formMaxBodyBytes ?? 10 * 1024 * 1024;
+    const limited = await readBodyWithLimit(request, maxBodyBytes);
+    if (limited === null) {
+      return new Response("Payload Too Large", { status: 413 });
+    }
+    const bodyBytes = new Uint8Array(await limited.arrayBuffer());
+    const forwardHeaders = new Headers(request.headers);
+    forwardHeaders.delete("cookie");
+    forwardHeaders.delete("host");
+    forwardHeaders.delete("content-length");
+    forwardHeaders.delete(HOUDINI_OPERATION_HEADER);
+    let upstreamResponse;
+    try {
+      upstreamResponse = await fetch(resolveApiEndpoint(config_file), {
+        method: "POST",
+        headers: forwardHeaders,
+        body: bodyBytes
+      });
+    } catch {
+      return new Response("Bad Gateway", { status: 502 });
+    }
+    const upstreamText = await upstreamResponse.text();
+    let payload;
+    try {
+      payload = JSON.parse(upstreamText);
+    } catch {
+      return new Response(upstreamText, {
+        status: upstreamResponse.status,
+        headers: {
+          "content-type": upstreamResponse.headers.get("content-type") ?? "text/plain"
+        }
+      });
+    }
+    const operationName = request.headers.get(HOUDINI_OPERATION_HEADER);
+    const carrier = new Response(null, { status: upstreamResponse.status });
+    let body = payload;
+    const token = await mintSessionToken({
+      data: payload?.data,
+      errors: payload?.errors,
+      operationName,
+      requestHeaders: request.headers,
+      manifest,
+      sessionKeys: session_keys
+    });
+    if (token && await applySessionToken(
+      { request, config: config_file, server_config, session_keys },
+      carrier,
+      token
+    )) {
+      body = {
+        ...payload,
+        extensions: { ...payload?.extensions, houdiniSessionApplied: true }
+      };
+    }
+    carrier.headers.set("content-type", "application/json");
+    return new Response(JSON.stringify(body), {
+      status: upstreamResponse.status,
+      headers: carrier.headers
+    });
+  };
+  return async (request, ...extraContext) => {
+    if (!manifest) {
+      return new Response(
+        "Adapter did not provide the project's manifest. Please open an issue on github.",
+        { status: 500 }
+      );
+    }
+    const parsedURL = new URL(request.url);
+    const url = parsedURL.pathname + parsedURL.search;
+    if (requestHandler && parsedURL.pathname === graphqlEndpoint) {
+      if (request.method === "POST") {
+        const contentType = request.headers.get("content-type") ?? "";
+        if (contentType.includes("application/x-www-form-urlencoded")) {
+          return new Response("Unsupported Media Type", { status: 415 });
+        }
+        const corsSimpleBody = contentType === "" || contentType.includes("multipart/form-data") || contentType.includes("text/plain");
+        if (corsSimpleBody && !request.headers.get(HOUDINI_REQUEST_HEADER)) {
+          return new Response("Forbidden", { status: 403 });
+        }
+      }
+      return requestHandler(request, ...extraContext);
+    }
+    const proxyResponse = await handleSessionProxy(request);
+    if (proxyResponse) {
+      return proxyResponse;
+    }
+    const authResponse = await handle_request({
+      request,
+      config: config_file,
+      server_config,
+      session_keys
+    });
+    if (authResponse) {
+      return authResponse;
+    }
+    const formResponse = await handleForm(manifest, request, parsedURL, url);
+    if (formResponse) {
+      return formResponse;
+    }
+    return renderPage(manifest, request, url);
+  };
+}
+const serverAdapterFactory = (args) => {
+  return createServerAdapter(_serverHandler(args));
+};
+async function collect_response_headers(match) {
+  const merged = {};
+  for (const load of match?.headers ?? []) {
+    const fn = await load();
+    if (typeof fn !== "function") {
+      continue;
+    }
+    const result = await fn();
+    if (result && typeof result === "object") {
+      for (const [key, value] of Object.entries(result)) {
+        merged[key] = String(value);
+      }
+    }
+  }
+  return merged;
+}
+function apply_antiframing_defaults(headers) {
+  const has = (name) => Object.keys(headers).some((key) => key.toLowerCase() === name);
+  if (!has("content-security-policy")) {
+    headers["Content-Security-Policy"] = "frame-ancestors 'self'";
+  }
+  if (!has("x-frame-options")) {
+    headers["X-Frame-Options"] = "SAMEORIGIN";
+  }
+}
+function localApiSessionKeys(serverConfig) {
+  return serverConfig?.auth?.sessionKeys ?? [];
+}
+class Server {
+  opts;
+  _yoga = null;
+  constructor(opts) {
+    this.opts = opts ?? null;
+  }
+  init({
+    endpoint,
+    schema,
+    getSession
+  }) {
+    this._yoga = new YogaServer({
+      ...this.opts,
+      schema,
+      graphqlEndpoint: endpoint,
+      context: async (ctx) => {
+        const userContext = !this.opts ? {} : typeof this.opts.context === "function" ? await this.opts.context(ctx) : this.opts.context || {};
+        const sessionContext = await getSession(ctx.request) || {};
+        return {
+          ...userContext,
+          session: sessionContext
+        };
+      }
+    });
+    return createServerAdapter(this, {
+      fetchAPI: this._yoga.fetchAPI,
+      plugins: this._yoga.plugins
+    });
+  }
+  handle = (request, serverContext) => {
+    return this._yoga.handle(request, serverContext);
+  };
+}
+export {
+  Server,
+  _serverHandler,
+  apply_antiframing_defaults,
+  collect_response_headers,
+  serverAdapterFactory,
+  signFormToken
+};

package/build/{runtime/router → router}/session.d.ts

@@ -1,9 +1,12 @@
-import type { ConfigFile } from '../lib';
-type ServerHandlerArgs = {
+import type { ConfigFile, ServerConfigFile } from '../lib/index.js';
+export declare function isAllowedOrigin(request: Request, server_config?: ServerConfigFile): boolean;
+export type ServerHandlerArgs = {
     request: Request;
     config: ConfigFile;
+    server_config?: ServerConfigFile;
     session_keys: string[];
 };
+export declare function applySessionToken(args: ServerHandlerArgs, response: Response, token: unknown): Promise<boolean>;
 export declare function handle_request(args: ServerHandlerArgs): Promise<Response | undefined>;
 export type Server = {
     use(fn: ServerMiddleware): void;
@@ -18,5 +21,7 @@ export type ServerResponse = {
     set_header(name: string, value: string): void;
 };
 export declare const session_cookie_name = "__houdini__";
+export declare function clear_session(response: Response): void;
+export declare function sign_session(session: App.Session, key: string): Promise<string>;
+export declare function set_session(req: ServerHandlerArgs, response: Response, value: App.Session): Promise<void>;
 export declare function get_session(req: Headers, secrets: string[]): Promise<App.Session>;
-export {};