Yoga
On this page

@envelop/extended-validation

Changelog for @envelop/extended-validation: every release with its changes and the pull requests behind them.

8.0.0

Major Changes

  • #4574 79b0e8b Thanks @egoodwinx! - ### Breaking Changes

    • Node: minimum supported version is now Node 22. Node 18 and 20 are no longer supported. Future releases will only support Node >=22.
    • GraphQL: minimum supported version is now GraphQL 16. GraphQL 14 and 15 are no longer supported.
    • Request body parsing: Yoga now limits request bodies to 25,000,000 bytes by default. Enforcing this limit streams the body through a byte counter, making POST body parsing asynchronous even for an in-memory body. As a result, yoga.fetch() can return a Promise where it previously returned a synchronous Response, even when all resolvers and plugins are synchronous.

    Migration

    • If you’re on Node 18/20, upgrade to Node 22 or later before upgrading this package.
    • If you’re on graphql 14/15, upgrade to graphql 16 or 17 first.
    • Await yoga.fetch() and response body parsing instead of relying on synchronous results. Set maxRequestBodySize: false in createYoga to disable the body-size limit and preserve synchronous parsing for in-memory bodies, but only if you enforce an appropriate request-body limit elsewhere.

  • #4623 be89d05 Thanks @ardatan! - ### Dependencies

    • Bump @graphql-tools/utils to ^13.1.1, @graphql-tools/schema to ^11.0.0, and @graphql-tools/executor to ^4.1.2.

    Incremental delivery

    Yoga maps the GraphQL HTTP Accept header through INCREMENTAL_DELIVERY_SPECS from @graphql-tools/utils onto executor incrementalSpec. multipart/mixed;incrementalSpec=v0.2 runs the v0.2 payload format and echoes that spec on Content-Type. multipart/mixed;deferSpec=20220824 or bare multipart/mixed stays on v0.1. An unsupported incremental spec yields 406.

    A later incremental spec is a graphql-tools table row plus an executor publisher. Yoga, Hive Gateway, and HTTP executors pick it up by bumping @graphql-tools/utils / @graphql-tools/executor.

    Breaking Changes

    • createGraphQLError is removed. Use new GraphQLError(message, options) from graphql. To attach Yoga’s experimental schema coordinate, use withSchemaCoordinate(error, coordinate) and read with getSchemaCoordinate from @graphql-tools/utils.
    • mapMaybePromise is removed (was exported from Yoga / @envelop/core). Use handleMaybePromise from @whatwg-node/promise-helpers.
    • Yoga no longer re-exports helpers that already live upstream:
      • getSchemaCoordinate -> @graphql-tools/utils
      • mergeSchemas -> @graphql-tools/schema
      • DisposableSymbols -> @whatwg-node/server
      • mapAsyncIterator / isPromise / fakePromise / handleMaybePromise / MaybePromise -> @whatwg-node/promise-helpers
    • @envelop/core utils no longer re-exports mapAsyncIterator or isPromise. Import from @whatwg-node/promise-helpers.
    • Use asGetArgumentValuesVariables / coerceGetVariableValuesResult from @graphql-tools/utils for GraphQL 16/17 VariableValues compatibility.

    Migration

    import { GraphQLError } from 'graphql'
import { withSchemaCoordinate } from 'graphql-yoga'
import { mergeSchemas } from '@graphql-tools/schema'
import { getSchemaCoordinate } from '@graphql-tools/utils'
import { handleMaybePromise, isPromise, type MaybePromise } from '@whatwg-node/promise-helpers'
import { DisposableSymbols } from '@whatwg-node/server'

throw withSchemaCoordinate(new GraphQLError('not found'), 'Query.user')

Patch Changes

7.2.3

Patch Changes

7.2.2

Patch Changes

7.2.1

Patch Changes

7.2.0

Minor Changes

  • #4545 94ebe5b Thanks @egoodwinx! - Update to support graphql-js 17

    Bump package versions, fix expected typing, and update compatability with subscribe.

Patch Changes

  • Updated dependencies [94ebe5b]:
    • @envelop/core@5.6.0

7.1.1

Patch Changes

  • Updated dependencies [0bfde27]:
    • @envelop/core@5.5.1

7.1.0

Patch Changes

7.0.0

Patch Changes

  • Updated dependencies [0434fbd]:
    • @envelop/core@5.4.0

6.1.0

Minor Changes

  • #2742 62a8915 Thanks @enisdenjo! - Introduce new option onDocument

    It’s a callback that is invoked when the document is assembled by the visitor.

6.0.0

Patch Changes

  • Updated dependencies [3ebaa3b]:
    • @envelop/core@5.3.0

5.1.3

Patch Changes

5.1.2

Patch Changes

5.1.1

Patch Changes

5.1.0

Patch Changes

5.0.1

Patch Changes

  • Updated dependencies [5b6a166]:
    • @envelop/core@5.1.1

5.0.0

Patch Changes

  • Updated dependencies [9bd1b20]:
    • @envelop/core@5.1.0

4.1.0

Minor Changes

  • #2281 70d4d7a Thanks @UserType;! - Refactor Generic Auth plugin;

    • [BREAKING] - Now @auth directive is renamed to @authenticated. If you want to keep the old name you can configure the plugin to use the old name.
    useGenericAuth({
  // ...
  authDirectiveName: 'auth'
})
    • [BREAKING] - Now directiveOrExtensionFieldName is renamed to authDirectiveName.
    useGenericAuth({
  // ...
- directiveOrExtensionFieldName: 'auth',
+ authDirectiveName: 'auth',
});
    • Now auth directives support OBJECT and INTERFACE locations, so you can use the auth directive on types as well.
    directive @authenticated on OBJECT | INTERFACE

type User @authenticated {
  id: ID!
  name: String!
}
    • validateUser function does not receive fieldAuthDirectiveNode and fieldAuthExtension anymore. Instead, it takes fieldAuthArgs which is an object that contains the arguments of the auth directive or extension. So you don’t need to parse the arguments manually anymore.
    const validateUser: ValidateUserFn = params => {
  if (!params.fieldAuthArgs.roles.includes('admin')) {
    return createUnauthorizedError(params)
  }
}
    • validateUser’s objectType parameter is now renamed to parentType. And it takes the original composite type instead of the GraphQLObjectType instance. Now it can be GraphQLInterfaceType as well.
    • validateUser’s current parameters are now;
    export type ValidateUserFnParams<UserType> = {
  /** The user object. */

  /** The field node from the operation that is being validated. */
  fieldNode: FieldNode
  /** The parent type which has the field that is being validated. */
  parentType: GraphQLObjectType | GraphQLInterfaceType
  /** The auth directive arguments for the type */
  typeAuthArgs?: Record<string, any>
  /** The directives for the type */
  typeDirectives?: ReturnType<typeof getDirectiveExtensions>
  /** Scopes that type requires */
  typeScopes?: string[][]
  /** Policies that type requires */
  typePolicies?: string[][]
  /** The object field */
  field: GraphQLField<any, any>
  /** The auth directive arguments for the field */
  fieldAuthArgs?: Record<string, any>
  /** The directives for the field */
  fieldDirectives?: ReturnType<typeof getDirectiveExtensions>
  /** Scopes that field requires */
  fieldScopes?: string[][]
  /** Policies that field requires */
  fieldPolicies?: string[][]
  /** Extracted scopes from the user object */
  userScopes: string[]
  /** Policies for the user */
  userPolicies: string[]
  /** The args passed to the execution function (including operation context and variables) **/
  executionArgs: ExecutionArgs
  /** Resolve path */
  path: ReadonlyArray<string | number>
}
    • New directives for role-based auth are added @requiresScopes and @policy for more granular control over the auth logic.
    directive @requiresScopes(scopes: [String!]!) on OBJECT | INTERFACE | FIELD_DEFINITION

directive @policy(policy: String!) on OBJECT | INTERFACE | FIELD_DEFINITION

    Check README for more information.

4.0.0

Major Changes

3.0.3

Patch Changes

3.0.2

Patch Changes

  • Updated dependencies [db20864a]:
    • @envelop/core@4.0.2

3.0.1

Patch Changes

  • Updated dependencies []:
    • @envelop/core@4.0.1

3.0.0

Major Changes

Patch Changes

2.0.6

Patch Changes

2.0.5

Patch Changes

  • Updated dependencies [270249cf]:
    • @envelop/core@3.0.5

2.0.4

Patch Changes

  • Updated dependencies []:
    • @envelop/core@3.0.4

2.0.3

Patch Changes

  • Updated dependencies [6b48ef96]:
    • @envelop/core@3.0.3

2.0.2

Patch Changes

  • Updated dependencies [22f5ccfb]:
    • @envelop/core@3.0.2

2.0.0

Major Changes

1.9.0

Minor Changes

  • #1499 1f7af02b Thanks @viniciuspalma! - Adding tslib to package dependencies

    Projects that currently are using yarn Berry with PnP or any strict dependency resolver, that requires that all dependencies are specified on package.json otherwise it would endue in an error if not treated correct

    Since https://www.typescriptlang.org/tsconfig#importHelpers is currently being used, tslib should be exported as a dependency to external runners get the proper import.

    Change on each package:

    // package.json
{
  "dependencies": {
    "tslib": "^2.4.0"
  }
}

  • Updated dependencies [1f7af02b, ae7bc9a3]:

    • @envelop/core@2.6.0

1.8.0

Minor Changes

1.7.2

Patch Changes

  • 071f946: Fix CommonJS TypeScript resolution with moduleResolution node16 or nodenext
  • Updated dependencies [071f946]
    • @envelop/core@2.4.2

1.7.1

Patch Changes

  • Updated dependencies [787d28a2]
    • @envelop/core@2.4.1

1.7.0

Minor Changes

  • 8bb2738: Support TypeScript module resolution.
  • Updated dependencies [8bb2738]
    • @envelop/core@2.4.0

1.6.3

Patch Changes

  • fbf6155: update package.json repository links to point to the new home
  • Updated dependencies [fbf6155]
    • @envelop/core@2.3.3

1.6.2

Patch Changes

  • Updated dependencies [07d029b]
    • @envelop/core@2.3.2

1.6.1

Patch Changes

  • Updated dependencies [d5c2c9a]
    • @envelop/core@2.3.1

1.6.0

Minor Changes

  • Updated dependencies [af23408]
    • @envelop/core@2.3.0

1.5.0

Minor Changes

  • Updated dependencies [ada7fb0]
  • Updated dependencies [d5115b4]
  • Updated dependencies [d5115b4]
    • @envelop/core@2.2.0

1.4.1

Patch Changes

  • 01c8dd6: fix handling of array input (list)

1.4.0

Minor Changes

  • Updated dependencies [78b3db2]
  • Updated dependencies [f5eb436]
    • @envelop/core@2.1.0

Patch Changes

  • 78b3db2: Run extended validation phase for subscription operations.

  • 8030244: Ensure the extended validation phase only runs once.

    Move shared extended validation rules context instantiation to the onContextFactory phase and raise an error when execute is invoked without building and passing the contextValue returned from contextFactory.

1.3.4

Patch Changes

  • f102d38: move @envelop/core dependency to peerDependencies

1.3.3

Patch Changes

  • Updated dependencies [4106e08]
  • Updated dependencies [aac65ef]
  • Updated dependencies [4106e08]
    • @envelop/core@2.0.0

1.3.2

Patch Changes

  • 3dfddb5: Bump graphql-tools/utils to v8.6.1 to address a bug in getArgumentsValues
  • Updated dependencies [3dfddb5]
    • @envelop/core@1.7.1

1.3.1

Patch Changes

  • b1a0331: Properly list @envelop/core as a peerDependency in plugins.

    This resolves issues where the bundled envelop plugins published to npm had logic inlined from the @envelop/core package, causing instanceof check of EnvelopError to fail.

  • 07c39b5: Simplify code and add comments to the code.

  • Updated dependencies [b1a0331]

    • @envelop/core@1.6.1

1.3.0

Minor Changes

  • 090cae4: GraphQL v16 support

1.2.0

Minor Changes

  • 04120de: add support for GraphQL.js 16

Patch Changes

  • a0b2da3: Fix handling of introspection queries and disallow authorization bypassing. Previously, it was possible to bypass authorization by adding \_\_schema to query

1.1.1

Patch Changes

  • 422a6c6: fix ESM

1.1.0

Minor Changes

  • 7c897ae: Added onValidationFailed callback

1.0.0

Major Changes

  • 40bc444: v1 major release for envelop packages

0.2.2

Patch Changes

  • 28ad742: Improve TypeScript types

0.2.1

Patch Changes

  • 7fd2f7b: suuport multiple usages of useExtendedValidation

0.2.0

Minor Changes

  • eb6f53b: ESM Support for all plugins and envelop core

0.1.2

Patch Changes

  • 25bfb47: fix issue with inlining graphql.js code in published bundle

0.1.1

Patch Changes

  • d4fcb9e: Support oneOf validation for input object type fields.

    Correctly handle validation of lists of oneOf input types and input type fields that are of a nullable oneOf input type.

0.1.0

Minor Changes

  • 43010e1: also support oneOf via extensions fields

0.0.1

Patch Changes

  • ced704e: NEW PLUGIN!