fix: do not allow reserved context keys in ServerContext or UserContext

.changeset/eight-poets-run.md

@@ -0,0 +1,23 @@
+---
+'graphql-yoga': patch
+---
+
+Do not allow reserved context keys in UserContext and ServerContext if they don't match
+
+For example, you cannot have `request` as a key in UserContext or ServerContext unless it is `Request` like below;
+```ts
+// @ts-expect-error Not allowed
+createYoga<{
+    request: FastifyRequest
+}>(/* ... */);
+
+// But allowed
+createYoga<{
+    req: FastifyRequest
+}>(/* ... */);
+
+// Also allowed
+createYoga<{
+    request: Request // From Fetch API
+}>(/* ... */);
+```

packages/graphql-yoga/src/server.ts

@@ -602,20 +602,23 @@ export class YogaServer<
   };
 }
 
+export type ContextBase = {
+  [key: Exclude<string, keyof YogaInitialContext>]: unknown;
+} & Partial<YogaInitialContext>;
+
 /* eslint-disable */
 export type YogaServerInstance<
-  TServerContext extends Record<string, any>,
-  TUserContext extends Record<string, any>,
+  TServerContext extends ContextBase,
+  TUserContext extends ContextBase,
 > = ServerAdapter<TServerContext, YogaServer<TServerContext, TUserContext>>;
 
 export function createYoga<
-  TServerContext extends Record<string, any> = {},
-  TUserContext extends Record<string, any> = {},
+  TServerContext extends ContextBase = {},
+  TUserContext extends ContextBase = {},
 >(options: YogaServerOptions<TServerContext, TUserContext>) {
   const server = new YogaServer<TServerContext, TUserContext>(options);
   return createServerAdapter<TServerContext, YogaServer<TServerContext, TUserContext>>(server, {
     fetchAPI: server.fetchAPI,
     plugins: server['plugins'],
-  }) as unknown as YogaServerInstance<TServerContext, TUserContext>;
-  // TODO: Fix in @whatwg-node/server later
+  });
 }

packages/graphql-yoga/type-api-check.ts

@@ -2,7 +2,7 @@
 import { ClientRequest } from 'node:http';
 import type { GraphQLSchema } from 'graphql';
 import { IResolvers } from '@graphql-tools/utils';
-import { createSchema, createYoga, YogaInitialContext } from './src/index.js';
+import { createSchema, createYoga, GraphQLParams, YogaInitialContext } from './src/index.js';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const schema: GraphQLSchema = null as any;
@@ -41,6 +41,54 @@ const request: Request = null as any;
   server.handleRequest(request, { req: clientRequest });
 }
 
+// Do not allow reserved context keys
+{
+  // @ts-expect-error ServerContext type cannot contain reserved key 'request'.
+  createYoga<{}, { request: { myParam: string } }>({
+    schema,
+  });
+}
+{
+  // @ts-expect-error ServerContext type cannot contain reserved key 'params'.
+  createYoga<{}, { params: { myParam: string } }>({
+    schema,
+  });
+}
+{
+  // @ts-expect-error ServerContext type cannot contain reserved key 'request'.
+  createYoga<{}, { request: { myParam: string } }>({
+    schema,
+  });
+}
+{
+  // @ts-expect-error ServerContext type cannot contain reserved key 'params'.
+  createYoga<{ params: { myParam: string } }>({
+    schema,
+  });
+}
+// Allow reserved context keys if they match in ServerContext
+{
+  createYoga<{ request: Request }>({
+    schema,
+  });
+}
+{
+  createYoga<{ params: GraphQLParams }>({
+    schema,
+  });
+}
+// Allow reserved context keys if they match in UserContext
+{
+  createYoga<{}, { request: Request }>({
+    schema,
+  });
+}
+{
+  createYoga<{}, { params: GraphQLParams }>({
+    schema,
+  });
+}
+
 /**
  * Context + Resolvers
  */