naystack 1.8.0 → 1.8.1

package/dist/graphql/index.cjs.js

@@ -770,8 +770,16 @@ function resolver(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getAuthCaller(fn),
-    call: options.authorized ? getAuthCaller(fn) : getCaller(fn)
+    authCall: getAuthCaller(
+      fn,
+      options.authorized
+    ),
+    call: options.authorized ? getAuthCaller(
+      fn,
+      options.authorized
+    ) : getCaller(
+      fn
+    )
   };
 }
 var getUserId = async () => {
@@ -779,11 +787,13 @@ var getUserId = async () => {
   const refresh = Cookie.get(REFRESH_COOKIE_NAME)?.value;
   return refresh ? getUserIdFromRefreshToken(refresh) : null;
 };
-function getAuthCaller(fn) {
+function getAuthCaller(fn, authorized) {
   return (0, import_react.cache)(
     async (data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(ctx, data);
@@ -801,11 +811,13 @@ function getCaller(fn) {
     }
   );
 }
-function getFieldAuthCaller(fn) {
+function getFieldAuthCaller(fn, authorized) {
   return (0, import_react.cache)(
     async (root, data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(root, ctx, data);
@@ -827,8 +839,8 @@ function field(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getFieldAuthCaller(fn),
-    call: options.authorized ? getFieldAuthCaller(fn) : getFieldCaller(
+    authCall: getFieldAuthCaller(fn, options.authorized),
+    call: options.authorized ? getFieldAuthCaller(fn, options.authorized) : getFieldCaller(
       fn
     )
   };
@@ -903,8 +915,12 @@ function FieldLibrary(type, queries) {
     const def = queries[key];
     if (!def) continue;
     Object.defineProperty(GeneratedResolver.prototype, key, {
+      // `alwaysResolve` fields must run `fn` even when the parent pre-hydrated
+      // `root[key]`: they gate on `ctx`, and the short-circuit would return the
+      // pre-hydrated value without ever applying that check. Such a resolver is
+      // responsible for reusing `root[key]` itself, so the N+1 win is preserved.
       value: async function(root, ctx, input) {
-        if (root[key]) return root[key];
+        if (!def.alwaysResolve && root[key]) return root[key];
         return def.fn(root, ctx, input);
       },
       writable: false

package/dist/graphql/index.esm.js

@@ -764,8 +764,16 @@ function resolver(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getAuthCaller(fn),
-    call: options.authorized ? getAuthCaller(fn) : getCaller(fn)
+    authCall: getAuthCaller(
+      fn,
+      options.authorized
+    ),
+    call: options.authorized ? getAuthCaller(
+      fn,
+      options.authorized
+    ) : getCaller(
+      fn
+    )
   };
 }
 var getUserId = async () => {
@@ -773,11 +781,13 @@ var getUserId = async () => {
   const refresh = Cookie.get(REFRESH_COOKIE_NAME)?.value;
   return refresh ? getUserIdFromRefreshToken(refresh) : null;
 };
-function getAuthCaller(fn) {
+function getAuthCaller(fn, authorized) {
   return cache(
     async (data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(ctx, data);
@@ -795,11 +805,13 @@ function getCaller(fn) {
     }
   );
 }
-function getFieldAuthCaller(fn) {
+function getFieldAuthCaller(fn, authorized) {
   return cache(
     async (root, data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(root, ctx, data);
@@ -821,8 +833,8 @@ function field(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getFieldAuthCaller(fn),
-    call: options.authorized ? getFieldAuthCaller(fn) : getFieldCaller(
+    authCall: getFieldAuthCaller(fn, options.authorized),
+    call: options.authorized ? getFieldAuthCaller(fn, options.authorized) : getFieldCaller(
       fn
     )
   };
@@ -897,8 +909,12 @@ function FieldLibrary(type, queries) {
     const def = queries[key];
     if (!def) continue;
     Object.defineProperty(GeneratedResolver.prototype, key, {
+      // `alwaysResolve` fields must run `fn` even when the parent pre-hydrated
+      // `root[key]`: they gate on `ctx`, and the short-circuit would return the
+      // pre-hydrated value without ever applying that check. Such a resolver is
+      // responsible for reusing `root[key]` itself, so the N+1 win is preserved.
       value: async function(root, ctx, input) {
-        if (root[key]) return root[key];
+        if (!def.alwaysResolve && root[key]) return root[key];
         return def.fn(root, ctx, input);
       },
       writable: false

package/dist/graphql/utils.cjs.js

@@ -117,8 +117,16 @@ function resolver(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getAuthCaller(fn),
-    call: options.authorized ? getAuthCaller(fn) : getCaller(fn)
+    authCall: getAuthCaller(
+      fn,
+      options.authorized
+    ),
+    call: options.authorized ? getAuthCaller(
+      fn,
+      options.authorized
+    ) : getCaller(
+      fn
+    )
   };
 }
 var getUserId = async () => {
@@ -126,11 +134,13 @@ var getUserId = async () => {
   const refresh = Cookie.get(REFRESH_COOKIE_NAME)?.value;
   return refresh ? getUserIdFromRefreshToken(refresh) : null;
 };
-function getAuthCaller(fn) {
+function getAuthCaller(fn, authorized) {
   return (0, import_react.cache)(
     async (data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(ctx, data);
@@ -148,11 +158,13 @@ function getCaller(fn) {
     }
   );
 }
-function getFieldAuthCaller(fn) {
+function getFieldAuthCaller(fn, authorized) {
   return (0, import_react.cache)(
     async (root, data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(root, ctx, data);
@@ -174,8 +186,8 @@ function field(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getFieldAuthCaller(fn),
-    call: options.authorized ? getFieldAuthCaller(fn) : getFieldCaller(
+    authCall: getFieldAuthCaller(fn, options.authorized),
+    call: options.authorized ? getFieldAuthCaller(fn, options.authorized) : getFieldCaller(
       fn
     )
   };
@@ -250,8 +262,12 @@ function FieldLibrary(type, queries) {
     const def = queries[key];
     if (!def) continue;
     Object.defineProperty(GeneratedResolver.prototype, key, {
+      // `alwaysResolve` fields must run `fn` even when the parent pre-hydrated
+      // `root[key]`: they gate on `ctx`, and the short-circuit would return the
+      // pre-hydrated value without ever applying that check. Such a resolver is
+      // responsible for reusing `root[key]` itself, so the N+1 win is preserved.
       value: async function(root, ctx, input) {
-        if (root[key]) return root[key];
+        if (!def.alwaysResolve && root[key]) return root[key];
         return def.fn(root, ctx, input);
       },
       writable: false

package/dist/graphql/utils.d.mts

@@ -26,6 +26,16 @@ type ParsedGQLTypeWithArray<T, MergeNullUndefined extends boolean> = T extends A
 type ParsedGQLTypeWithNullability<T, IsNullable extends boolean, MergeNullUndefined extends boolean> = IsNullable extends true ? ParsedGQLTypeWithArray<T, MergeNullUndefined> | null | undefined : ParsedGQLTypeWithArray<T, MergeNullUndefined>;
 /** Allows resolver to return T or Promise<T>. */
 type Promisify<T> = T | Promise<T>;
+/**
+ * Return type of `.authCall()` / `.call()` for a definition.
+ *
+ * `authorized: true` promises the resolver an `AuthorizedContext` (non-null
+ * `userId`). Server-side callers can't be forced to hold a session, so when
+ * there's no refresh cookie the only way to keep that promise is to not call the
+ * resolver at all — hence the added `null`, which surfaces the logged-out case in
+ * the types instead of passing a null `userId` through the cast.
+ */
+type AuthCallReturn<IsAuth extends boolean, R> = IsAuth extends true ? Awaited<R> | null : Awaited<R>;
 /** Base for query/field definition (output, input, options). */
 interface BaseDefinition<T, U, IsAuth extends boolean = false, OutputNullable extends boolean = false, InputNullable extends boolean = false> {
     output: T;
@@ -42,10 +52,16 @@ interface BaseDefinition<T, U, IsAuth extends boolean = false, OutputNullable ex
  */
 interface QueryDefinition<T, U, IsAuth extends boolean = false, OutputNullable extends boolean = false, InputNullable extends boolean = false, R extends Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>> = Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>>> extends BaseDefinition<T, U, IsAuth, OutputNullable, InputNullable> {
     fn: (ctx: IsAuth extends true ? AuthorizedContext : Context, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => R;
-    /** Calls the resolver server-side. For authorized queries, reads the refresh cookie; for non-authorized, passes null userId. */
-    call: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
-    /** Calls the resolver server-side with authentication (always reads the refresh cookie). Use in Server Components. */
-    authCall: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
+    /**
+     * Calls the resolver server-side. For authorized queries, reads the refresh cookie; for non-authorized, passes null userId.
+     * Resolves to `null` when `authorized: true` and there is no session.
+     */
+    call: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
+    /**
+     * Calls the resolver server-side with authentication (always reads the refresh cookie). Use in Server Components.
+     * Resolves to `null` when `authorized: true` and there is no session — guard it, or gate the page ahead of it.
+     */
+    authCall: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
     mutation?: boolean;
 }
 /**
@@ -109,10 +125,26 @@ declare function resolver<T, U, IsAuth extends boolean = false, OutputNullable e
  */
 interface FieldResolverDefinition<T, U, Root, IsAuth extends boolean = false, OutputNullable extends boolean = false, InputNullable extends boolean = false, R extends Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>> = Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>>> extends BaseDefinition<T, U, IsAuth, OutputNullable, InputNullable> {
     fn: (root: Root, ctx: IsAuth extends true ? AuthorizedContext : Context, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => R;
-    /** Calls the field resolver server-side. For authorized fields, reads the refresh cookie. */
-    call: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
-    /** Calls the field resolver server-side with authentication (always reads the refresh cookie). */
-    authCall: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
+    /**
+     * Calls the field resolver server-side. For authorized fields, reads the refresh cookie.
+     * Resolves to `null` when `authorized: true` and there is no session.
+     */
+    call: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
+    /**
+     * Calls the field resolver server-side with authentication (always reads the refresh cookie).
+     * Resolves to `null` when `authorized: true` and there is no session.
+     */
+    authCall: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
+    /**
+     * Skip `FieldLibrary`'s short-circuit, which returns a pre-hydrated `root[key]`
+     * without ever calling this resolver.
+     *
+     * Set this on any field that gates on `ctx` — an auth check inside the resolver
+     * is silently bypassed the moment a parent query selects the field's value into
+     * its own columns. The resolver stays responsible for reusing `root[key]` when
+     * present, so hydration still avoids the N+1.
+     */
+    alwaysResolve?: boolean;
 }
 /**
  * Defines a type-graphql field resolver with typed root, context, and input.

package/dist/graphql/utils.d.ts

@@ -26,6 +26,16 @@ type ParsedGQLTypeWithArray<T, MergeNullUndefined extends boolean> = T extends A
 type ParsedGQLTypeWithNullability<T, IsNullable extends boolean, MergeNullUndefined extends boolean> = IsNullable extends true ? ParsedGQLTypeWithArray<T, MergeNullUndefined> | null | undefined : ParsedGQLTypeWithArray<T, MergeNullUndefined>;
 /** Allows resolver to return T or Promise<T>. */
 type Promisify<T> = T | Promise<T>;
+/**
+ * Return type of `.authCall()` / `.call()` for a definition.
+ *
+ * `authorized: true` promises the resolver an `AuthorizedContext` (non-null
+ * `userId`). Server-side callers can't be forced to hold a session, so when
+ * there's no refresh cookie the only way to keep that promise is to not call the
+ * resolver at all — hence the added `null`, which surfaces the logged-out case in
+ * the types instead of passing a null `userId` through the cast.
+ */
+type AuthCallReturn<IsAuth extends boolean, R> = IsAuth extends true ? Awaited<R> | null : Awaited<R>;
 /** Base for query/field definition (output, input, options). */
 interface BaseDefinition<T, U, IsAuth extends boolean = false, OutputNullable extends boolean = false, InputNullable extends boolean = false> {
     output: T;
@@ -42,10 +52,16 @@ interface BaseDefinition<T, U, IsAuth extends boolean = false, OutputNullable ex
  */
 interface QueryDefinition<T, U, IsAuth extends boolean = false, OutputNullable extends boolean = false, InputNullable extends boolean = false, R extends Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>> = Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>>> extends BaseDefinition<T, U, IsAuth, OutputNullable, InputNullable> {
     fn: (ctx: IsAuth extends true ? AuthorizedContext : Context, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => R;
-    /** Calls the resolver server-side. For authorized queries, reads the refresh cookie; for non-authorized, passes null userId. */
-    call: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
-    /** Calls the resolver server-side with authentication (always reads the refresh cookie). Use in Server Components. */
-    authCall: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
+    /**
+     * Calls the resolver server-side. For authorized queries, reads the refresh cookie; for non-authorized, passes null userId.
+     * Resolves to `null` when `authorized: true` and there is no session.
+     */
+    call: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
+    /**
+     * Calls the resolver server-side with authentication (always reads the refresh cookie). Use in Server Components.
+     * Resolves to `null` when `authorized: true` and there is no session — guard it, or gate the page ahead of it.
+     */
+    authCall: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
     mutation?: boolean;
 }
 /**
@@ -109,10 +125,26 @@ declare function resolver<T, U, IsAuth extends boolean = false, OutputNullable e
  */
 interface FieldResolverDefinition<T, U, Root, IsAuth extends boolean = false, OutputNullable extends boolean = false, InputNullable extends boolean = false, R extends Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>> = Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>>> extends BaseDefinition<T, U, IsAuth, OutputNullable, InputNullable> {
     fn: (root: Root, ctx: IsAuth extends true ? AuthorizedContext : Context, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => R;
-    /** Calls the field resolver server-side. For authorized fields, reads the refresh cookie. */
-    call: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
-    /** Calls the field resolver server-side with authentication (always reads the refresh cookie). */
-    authCall: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
+    /**
+     * Calls the field resolver server-side. For authorized fields, reads the refresh cookie.
+     * Resolves to `null` when `authorized: true` and there is no session.
+     */
+    call: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
+    /**
+     * Calls the field resolver server-side with authentication (always reads the refresh cookie).
+     * Resolves to `null` when `authorized: true` and there is no session.
+     */
+    authCall: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
+    /**
+     * Skip `FieldLibrary`'s short-circuit, which returns a pre-hydrated `root[key]`
+     * without ever calling this resolver.
+     *
+     * Set this on any field that gates on `ctx` — an auth check inside the resolver
+     * is silently bypassed the moment a parent query selects the field's value into
+     * its own columns. The resolver stays responsible for reusing `root[key]` when
+     * present, so hydration still avoids the N+1.
+     */
+    alwaysResolve?: boolean;
 }
 /**
  * Defines a type-graphql field resolver with typed root, context, and input.

package/dist/graphql/utils.esm.js

@@ -102,8 +102,16 @@ function resolver(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getAuthCaller(fn),
-    call: options.authorized ? getAuthCaller(fn) : getCaller(fn)
+    authCall: getAuthCaller(
+      fn,
+      options.authorized
+    ),
+    call: options.authorized ? getAuthCaller(
+      fn,
+      options.authorized
+    ) : getCaller(
+      fn
+    )
   };
 }
 var getUserId = async () => {
@@ -111,11 +119,13 @@ var getUserId = async () => {
   const refresh = Cookie.get(REFRESH_COOKIE_NAME)?.value;
   return refresh ? getUserIdFromRefreshToken(refresh) : null;
 };
-function getAuthCaller(fn) {
+function getAuthCaller(fn, authorized) {
   return cache(
     async (data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(ctx, data);
@@ -133,11 +143,13 @@ function getCaller(fn) {
     }
   );
 }
-function getFieldAuthCaller(fn) {
+function getFieldAuthCaller(fn, authorized) {
   return cache(
     async (root, data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(root, ctx, data);
@@ -159,8 +171,8 @@ function field(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getFieldAuthCaller(fn),
-    call: options.authorized ? getFieldAuthCaller(fn) : getFieldCaller(
+    authCall: getFieldAuthCaller(fn, options.authorized),
+    call: options.authorized ? getFieldAuthCaller(fn, options.authorized) : getFieldCaller(
       fn
     )
   };
@@ -235,8 +247,12 @@ function FieldLibrary(type, queries) {
     const def = queries[key];
     if (!def) continue;
     Object.defineProperty(GeneratedResolver.prototype, key, {
+      // `alwaysResolve` fields must run `fn` even when the parent pre-hydrated
+      // `root[key]`: they gate on `ctx`, and the short-circuit would return the
+      // pre-hydrated value without ever applying that check. Such a resolver is
+      // responsible for reusing `root[key]` itself, so the N+1 win is preserved.
       value: async function(root, ctx, input) {
-        if (root[key]) return root[key];
+        if (!def.alwaysResolve && root[key]) return root[key];
         return def.fn(root, ctx, input);
       },
       writable: false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naystack",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "A stack built with Next + GraphQL + S3 + Auth",
   "main": "dist/index.cjs.js",
   "module": "dist/index.esm.js",