Merge branch '4.0.0' into feature/limit-directive

darrellwarde · web-flow · commit d562ef5086ba · 2023-08-18T16:01:32.000+02:00
diff --git a/.changeset/unlucky-foxes-draw.md b/.changeset/unlucky-foxes-draw.md
@@ -0,0 +1,5 @@
+---
+"@neo4j/graphql": patch
+---
+
+If possible, instantiate JWKS endpoint connection on startup, to benefit from caching.
diff --git a/.github/workflows/performance-tests-comment.yml b/.github/workflows/performance-tests-comment.yml
@@ -40,7 +40,7 @@ jobs:
           case "$number" in ''|*[!0-9]*) echo "Provided PR number is not an integer"; exit 1 ;; esac
           echo "pr-number=$number" >> "$GITHUB_OUTPUT"
       - name: Comment on PR
-        uses: marocchino/sticky-pull-request-comment@f6a2580ed520ae15da6076e7410b088d1c5dddd9 # v2.7.0
+        uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd # v2.8.0
         with:
           number: ${{ steps.get-pr-number.outputs.pr-number }}
           header: performance
diff --git a/.github/workflows/post-federation-test-results.yml b/.github/workflows/post-federation-test-results.yml
@@ -48,7 +48,7 @@ jobs:
           case "$number" in ''|*[!0-9]*) echo "Provided PR number is not an integer"; exit 1 ;; esac
           echo "pr-number=$number" >> "$GITHUB_OUTPUT"
       - name: Comment on PR
-        uses: marocchino/sticky-pull-request-comment@f6a2580ed520ae15da6076e7410b088d1c5dddd9 # v2.7.0
+        uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd # v2.8.0
         with:
           number: ${{ steps.get-pr-number.outputs.pr-number }}
           header: federation
diff --git a/.github/workflows/toolbox-publish.yml b/.github/workflows/toolbox-publish.yml
@@ -47,7 +47,7 @@ jobs:
           npm install -g surge
           surge . neo4j-graphql-toolbox-${{ steps.get-pr-number.outputs.pr-number }}.surge.sh --token ${{ secrets.SURGE_TOKEN }}
       - name: Comment on PR
-        uses: marocchino/sticky-pull-request-comment@f6a2580ed520ae15da6076e7410b088d1c5dddd9 # v2.7.0
+        uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd # v2.8.0
         with:
           number: ${{ steps.get-pr-number.outputs.pr-number }}
           header: toolbox
diff --git a/.github/workflows/toolbox-teardown.yml b/.github/workflows/toolbox-teardown.yml
@@ -21,7 +21,7 @@ jobs:
           npm install -g surge
           surge teardown neo4j-graphql-toolbox-${{ github.event.pull_request.number }}.surge.sh --token ${{ secrets.SURGE_TOKEN }}
       - name: Comment on PR
-        uses: marocchino/sticky-pull-request-comment@f6a2580ed520ae15da6076e7410b088d1c5dddd9 # v2.7.0
+        uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd # v2.8.0
         with:
           header: toolbox
           message: |
diff --git a/.yarn/releases/yarn-3.6.2.cjs b/.yarn/releases/yarn-3.6.2.cjs
diff --git a/.yarnrc.yml b/.yarnrc.yml
@@ -8,4 +8,4 @@ plugins:
   - path: .yarn/plugins/@yarnpkg/plugin-typescript.cjs
     spec: "@yarnpkg/plugin-typescript"
 
-yarnPath: .yarn/releases/yarn-3.6.1.cjs
+yarnPath: .yarn/releases/yarn-3.6.2.cjs
diff --git a/README.md b/README.md
@@ -29,6 +29,7 @@ and [development guide](./docs/contributing/DEVELOPING.md) to get started!
 1. [Documentation](https://neo4j.com/docs/graphql-manual/current/)
 2. [Discord](https://discord.gg/neo4j)
 3. [Examples](./examples)
+4. [Hands-on Course](https://graphacademy.neo4j.com/courses/graphql-basics/?ref=graphql)
 
 ## Navigating
 
@@ -46,7 +47,7 @@ visit the [Contributing Guide](./CONTRIBUTING.md).
 ## Media
 
 Blogs, talks and other content surrounding Neo4j GraphQL. Sign up for
-[NODES 2021](https://neo4j.brand.live/c/2021nodes-live) to view even more Neo4j
+[NODES 2023](https://dev.neo4j.com/44xcEfm) to view even more Neo4j
 GraphQL content.
 
 1. [Neo4j and GraphQL The Past, Present and Future](https://youtu.be/sZ-eBznM71M)
@@ -55,3 +56,7 @@ GraphQL content.
 4. [Migrating To The Official Neo4j GraphQL Library](https://youtu.be/4_rp1ikvFKc)
 5. [Announcing the Stable Release of the Official Neo4j GraphQL Library 1.0.0](https://medium.com/neo4j/announcing-the-stable-release-of-the-official-neo4j-graphql-library-1-0-0-6cdd30cd40b)
 6. [Announcing the Neo4j GraphQL Library Beta Release](https://medium.com/neo4j/announcing-the-neo4j-graphql-library-beta-99ae8541bbe7)
+
+## Learn with GraphAcademy
+
+Learn the fundamentals of GraphQL and how to use the Neo4j GraphQL Toolbox and the Neo4j GraphQL Library to create Neo4j-backed GraphQL APIs with the [Introduction to Neo4j & GraphQL on GraphAcademy](https://graphacademy.neo4j.com/courses/graphql-basics/?ref=graphql).
diff --git a/package.json b/package.json
@@ -40,20 +40,20 @@
         "eslint-plugin-import": "2.28.0",
         "eslint-plugin-jest": "27.2.3",
         "eslint-plugin-jsx-a11y": "6.7.1",
-        "eslint-plugin-react": "7.33.1",
+        "eslint-plugin-react": "7.33.2",
         "eslint-plugin-simple-import-sort": "10.0.0",
         "graphql": "16.8.0",
         "husky": "8.0.3",
         "jest": "29.6.2",
-        "lint-staged": "13.3.0",
+        "lint-staged": "14.0.0",
         "neo4j-driver": "5.11.0",
         "npm-run-all": "4.1.5",
         "prettier": "2.8.8",
         "set-tz": "0.2.0",
         "ts-jest": "29.1.1",
         "typescript": "5.1.6"
     },
-    "packageManager": "yarn@3.6.1",
+    "packageManager": "yarn@3.6.2",
     "dependencies": {
         "@changesets/changelog-github": "0.4.8",
         "@changesets/cli": "2.26.2"
diff --git a/packages/apollo-federation-subgraph-compatibility/package.json b/packages/apollo-federation-subgraph-compatibility/package.json
@@ -1,7 +1,7 @@
 {
     "name": "apollo-federation-subgraph-compatibility",
     "version": "1.0.0",
-    "packageManager": "yarn@3.6.1",
+    "packageManager": "yarn@3.6.2",
     "scripts": {
         "build": "webpack --config webpack.config.js",
         "test:docker": "yarn build && fedtest docker --compose docker-compose.yml --schema schema.graphql",
diff --git a/packages/graphql-toolbox/package.json b/packages/graphql-toolbox/package.json
@@ -45,7 +45,7 @@
         "@codemirror/autocomplete": "6.9.0",
         "@codemirror/commands": "6.2.4",
         "@codemirror/lang-javascript": "6.1.9",
-        "@codemirror/language": "6.8.0",
+        "@codemirror/language": "6.9.0",
         "@dnd-kit/core": "6.0.8",
         "@dnd-kit/modifiers": "6.0.1",
         "@dnd-kit/sortable": "7.0.2",
@@ -71,7 +71,7 @@
         "zustand": "4.4.1"
     },
     "devDependencies": {
-        "@playwright/test": "1.37.0",
+        "@playwright/test": "1.37.1",
         "@tsconfig/create-react-app": "2.0.1",
         "@types/codemirror": "5.60.8",
         "@types/lodash.debounce": "4.0.7",
@@ -93,7 +93,7 @@
         "jest-environment-jsdom": "29.6.2",
         "node-polyfill-webpack-plugin": "2.0.1",
         "parse5": "7.1.2",
-        "postcss": "8.4.27",
+        "postcss": "8.4.28",
         "postcss-loader": "7.3.3",
         "randomstring": "1.3.0",
         "style-loader": "3.3.3",
diff --git a/packages/graphql/package.json b/packages/graphql/package.json
@@ -75,7 +75,7 @@
         "koa-router": "12.0.0",
         "libnpmsearch": "6.0.2",
         "mock-jwks": "1.0.10",
-        "nock": "13.3.2",
+        "nock": "13.3.3",
         "npm-run-all": "4.1.5",
         "randomstring": "1.3.0",
         "rimraf": "5.0.1",
diff --git a/packages/graphql/src/classes/authorization/Neo4jGraphQLAuthorization.ts b/packages/graphql/src/classes/authorization/Neo4jGraphQLAuthorization.ts
@@ -18,11 +18,11 @@
  */
 
 import Debug from "debug";
-import type { Key, Neo4jAuthorizationSettings } from "../../types";
+import type { Key, Neo4jAuthorizationSettings, RemoteJWKS } from "../../types";
 
 import { AUTHORIZATION_UNAUTHENTICATED, DEBUG_AUTH } from "../../constants";
 import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
-import type { JWTPayload } from "jose";
+import type { JWTPayload, JWTVerifyGetKey } from "jose";
 import { parseBearerToken } from "./parse-request-token";
 import { Neo4jGraphQLError } from "../Error";
 import type { Neo4jGraphQLContext } from "../../types/neo4j-graphql-context";
@@ -32,7 +32,18 @@ const debug = Debug(DEBUG_AUTH);
 export class Neo4jGraphQLAuthorization {
     private authorization: Neo4jAuthorizationSettings;
 
+    // Assigned if input is a static symmetric secret or JWKS details
+    private resolvedKey: Uint8Array | JWTVerifyGetKey | undefined;
+    // Assigned if input is dynamic key which needs to be fetched using context details
+    private unresolvedKey: ((context: Neo4jGraphQLContext) => Key) | undefined;
+
     constructor(authorization: Neo4jAuthorizationSettings) {
+        if (typeof authorization.key === "function") {
+            this.unresolvedKey = authorization.key;
+        } else {
+            this.resolvedKey = this.serializeKey(authorization.key);
+        }
+
         this.authorization = authorization;
     }
 
@@ -62,19 +73,6 @@ export class Neo4jGraphQLAuthorization {
         }
     }
 
-    public decodeBearerToken(bearerToken: string): JWTPayload | undefined {
-        const token = parseBearerToken(bearerToken);
-        if (!token) {
-            throw new Neo4jGraphQLError(AUTHORIZATION_UNAUTHENTICATED);
-        }
-        try {
-            return decodeJwt(token);
-        } catch (error) {
-            debug("%s", error);
-            throw new Neo4jGraphQLError(AUTHORIZATION_UNAUTHENTICATED);
-        }
-    }
-
     public async decodeBearerTokenWithVerify(bearerToken: string | undefined): Promise<JWTPayload | undefined> {
         if (!bearerToken) {
             throw new Neo4jGraphQLError(AUTHORIZATION_UNAUTHENTICATED);
@@ -89,22 +87,44 @@ export class Neo4jGraphQLAuthorization {
                 debug("Skipping verifying JWT as verify is set to false");
                 return decodeJwt(token);
             }
-            return await this.verify(token, this.authorization.key as Key);
+            return await this.verifyBearerToken(token, this.authorization.key as Key);
         } catch (error) {
             debug("%s", error);
             throw new Neo4jGraphQLError(AUTHORIZATION_UNAUTHENTICATED);
         }
     }
 
-    private resolveKey(context: Neo4jGraphQLContext): Key {
-        if (typeof this.authorization.key === "function") {
-            return this.authorization.key(context);
+    private serializeKey(key: string | RemoteJWKS): Uint8Array | JWTVerifyGetKey {
+        if (typeof key === "string") {
+            return Buffer.from(key);
         } else {
-            return this.authorization.key;
+            return createRemoteJWKSet(new URL(key.url), key.options);
         }
     }
 
-    private async verify(token: string, secret: Key): Promise<JWTPayload> {
+    private resolveKey(context: Neo4jGraphQLContext): Uint8Array | JWTVerifyGetKey {
+        if (this.resolvedKey) {
+            return this.resolvedKey;
+        } else {
+            // this.unresolvedKey is definitely defined due to typings and if/else
+            const resolved = this.unresolvedKey!(context);
+
+            return this.serializeKey(resolved);
+        }
+    }
+
+    private async verify(token: string, secret: Uint8Array | JWTVerifyGetKey): Promise<JWTPayload> {
+        if (secret instanceof Uint8Array) {
+            debug("Verifying JWT using secret");
+            const { payload } = await jwtVerify(token, secret, this.authorization.verifyOptions);
+            return payload;
+        }
+        debug("Verifying JWKS using url");
+        const { payload } = await jwtVerify(token, secret, this.authorization.verifyOptions);
+        return payload;
+    }
+
+    private async verifyBearerToken(token: string, secret: Key): Promise<JWTPayload> {
         if (typeof secret === "string") {
             debug("Verifying JWT using secret");
             const { payload } = await jwtVerify(token, Buffer.from(secret), this.authorization.verifyOptions);
diff --git a/yarn.lock b/yarn.lock

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"@neo4j/graphql": patch
 +---
++
 +If possible, instantiate JWKS endpoint connection on startup, to benefit from caching.
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "apollo-federation-subgraph-compatibility",`
`3`	`3`	`"version": "1.0.0",`
`4`		`- "packageManager": "yarn@3.6.1",`
	`4`	`+ "packageManager": "yarn@3.6.2",`
`5`	`5`	`"scripts": {`
`6`	`6`	`"build": "webpack --config webpack.config.js",`
`7`	`7`	`"test:docker": "yarn build && fedtest docker --compose docker-compose.yml --schema schema.graphql",`