v5.0.2
Release Notes
Patch release to fix accidental breaking change related to the type of request that's passed to getCurrentUser and custom authDecoders. None of the standard setups use any of these two, but if you have customizations you could have been impacted by this
This patch release also fixes a correctness issue with request bodies for status codes 204, 205, and 304
Changelog
π Features
feat(api): Nudge users to use request instead of event (#2168) by @Tobbe
event was the older AWS Lambda Request shaped event.
request is the new web standards Request object.
event, and now request, is what you get on the third parameter to getCurrentUser(), and also in your authDecoder, if you have a custom one
β Ά request present (fetch-native paths):
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Call site β Context β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β runtime.ts β buildCedarContext β β Fastify + vite dev middleware passes native Request. β
β getAuthenticationContext(request) β requestToBaseEvent normalizes event, request gets β
β β the raw Request β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β useRedwoodAuthContext.ts β β GraphQL Yoga β getAuthEvent() returns β
β getAuthenticationContext(context.request) β context.request (web Request) β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β initDbAuthMiddleware β getCurrentUser(..., { event: β MiddlewareRequest (superset of Request) β
β req, request: req }) β β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β initSupabaseAuthMiddleware β getCurrentUser(..., { β MiddlewareRequest β
β event: req, request: req }) β β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Ά request absent (Lambda-only paths):
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Call site β Context β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β graphql.ts β getAuthenticationContext(event, context) β Lambda APIGatewayProxyEvent β no Request to pass. β
β β isFetchApiRequest is false, event stays raw Lambda β
β β event, request is undefined β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β useRequireAuth.ts β getAuthenticationContext(event, β Lambda event from legacy requireAuth wrapper β same β
β context) β as above β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββββββββββββββββββββ
So request is populated on all modern fetch paths (buildCedarContext, GraphQL Yoga via web Request, middleware) but absent on the two true Lambda paths (the legacy graphql.ts handler and requireAuth).
π οΈ Fixes
fix(api): don't send body for unsupported status codes (#2139) by @cdubz
The new legacyResultToResponse function defaults to an empty string for response body. If a response status code 204, 205, or 304 the Response instantiation will throw an error because the response body must be null or undefined.
This change accounts for that by selecting the fallback value for body based on result.statusCode.
(The spec also says the body must be null for 1xx status codes, but we can't create Response objects for those codes, as the constructor would throw a RangeError, see https://fetch.spec.whatwg.org/#response-class)
fix(api): Keep passing lambda events to getCurrentUser (#2166) by @Tobbe
Pass both event and request to getCurrentUser and auth decoders
Keep using the old AWS Lambda style event for the event attribute (when we did before - i.e. not for middleware)
