Upgrade to Apollo v4 #19173

innerdvations · 2024-01-09T08:37:04Z

What does it do?

Upgrade from Apollo v3 to Apollo v4

Some significant changes:

Apollo v4 has many breaking changes such as server config options
upgrade from graphql v15 to v16 which has its own long list of breaking changes
upgrade from graphql-upload v13 to v15 (note: didn't use v16 because it's esm only)
Graphql Playground replaced with Apollo LandingLocal
- Add helmet exceptions for it
- Add service to check that landing page is enabled (so it can be detected outside the plugin, eg for core/security to configure helmet as needed)
added some test utility functionality so request agent can send specific headers globally or per-request

Follow-up in later PRs:

helmet exceptions on a per-route basis rather than for all special paths
investigate if the changes to Apollo v4 configuration and our current method of merging user config with default config have made anything 'impossible'; for example, context no longer exists in ApolloConfig and moved to the KoaMiddleware, so we may need to provide a mechanism for users to inject code and configuration there as well
investigate what codemods can mitigate the breaking changes in user code
rename all references to 'playground' since it's no longer accurate (Playground is EOL, only LandingLocalDefault is supported)
- boolean 'playgroundAlways' will become strings productionLandingPage and landingPage with options 'LocalDefault' and 'ProductionDefault' (so that in the future we can then support other landing pages)
- 'isPlaygroundEnabled' will then become 'landingPage' and return the current landing page being used
add documentation to strapi/documentation for at least the following breaking changes:
- all the package upgrades themselves
- the need for the x-apollo-operation-name header in multipart requests
- the replacement of playground

Why is it needed?

Apollo v3 is already EOL, so Strapi v5 must support Apollo v4.

How to test it?

Going to /graphql should load the graphql landing page (which is now different than the old playground) and work (schemas loading, queries work, etc)
The Graphql API should still work the same as before
The graphql server within Strapi should still be accessible as before and user code should generally work, as long as it's not using Apollo v3 specific functionality
API tests should all still pass
try changing some plugins.js apollo configuration settings -- all the ones that weren't breaking changes should still work

Related issue(s)/PR(s)

#19202 - First follow-up on this to improve the helmet security config

BREAKING CHANGE: Update from 'apollo-server-koa' to '@apollo/server' and '@as-integrations/koa'

github-actions · 2024-01-09T08:45:14Z

Size Change: +2.15 kB (0%)

Total Size: 1.32 MB

Filename	Size	Change
`examples/getstarted/build/main.********.js`	1.31 MB	+2.08 kB (0%)
`examples/getstarted/build/runtime~main.********.js`	4.27 kB	+76 B (+2%)

ℹ️ View Unchanged

Filename	Size	Change
`examples/getstarted/build/bb4d0d527bdfb161bc5a.svg`	2.33 kB	0 B
`examples/getstarted/build/index.html`	608 B	-3 B (0%)

_{compressed-size-action}

joshuaellis · 2024-01-10T11:30:10Z

Few thoughts - is it worth abstracting the configs so we can upgrade this library without mass breaking changes?

Has there been any discussion on how we might tackle the ESM issue? This is one of a few packages we now have this issue with (prettier being the other off the top of my head). I'm concerned were gonna lock ourselves into a position where there are security issues but we can't fix them.

innerdvations · 2024-01-10T11:52:12Z

Few thoughts - is it worth abstracting the configs so we can upgrade this library without mass breaking changes?

I don't think so, most of the config is going to be specific to the graphql server used, and if we try to build in auto-fixes for breaking changes here it could just confuse people and create a headache for us to maintain. TBH, considering the amount of breaking changes they made here and what they plan for Apollo v5, Strapi v6 may shift to a different graphql server package altogether

We could potentially provide a legacy graphql plugin that would still support Apollo v3, seeing that they've extended EOL from Oct 2023 to Oct 2024. Or maybe we deprecate @strapi/graphql and create a new @strapi/graphql-apollo-v4 that strapi defaults to? I will bring it up with @marcoautiero

Has there been any discussion on how we might tackle the ESM issue? This is one of a few packages we now have this issue with (prettier being the other off the top of my head). I'm concerned were gonna lock ourselves into a position where there are security issues but we can't fix them.

This is definitely something we need to open a discussion on, doing this migration brought it even more to my attention. Let's sync on this asap!

…de-apollo-v4

innerdvations · 2024-01-11T12:22:07Z

packages/core/core/src/middlewares/security.ts

    }

+    // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that


Note: this and the TODO below are handled in #19202

packages/core/content-type-builder/server/src/controllers/component-categories.ts

Convly

Nice work!

packages/core/core/src/middlewares/security.ts

packages/plugins/graphql/server/src/bootstrap.ts

packages/plugins/graphql/server/src/format-graphql-error.ts

packages/plugins/graphql/package.json

Convly · 2024-01-12T10:49:38Z

packages/plugins/i18n/server/src/controllers/content-types.ts

@@ -16,7 +16,7 @@ const getFirstLevelPath = map((path: string) => path.split('.')[0]);
 const controller = {
  async getNonLocalizedAttributes(ctx) {
    const { user } = ctx.state;
-    const { model, id, locale } = ctx.request.body;
+    const { model, id, locale } = ctx.request.body as any; // TODO: add correct typings


I guess this shouldn't really be part (as any other change in i18n types) of the PR and will be fixed directly in main. Do we need to keep those changes anyway?

I'll revert them and update from v5/main now that it's apparently fixed there

(Update)
Narrator: It was not fixed there.

Note on this: adding @types/koa-bodyparser to graphql caused it to start working throughout the monorepo, switching the type of body from 'any' to 'unknown'. So I had to "fix" CTB and i18n so that ts:test:back will pass. Functionally there's no difference, just allowing body to be treated as any as it was before this PR (and in the future, new code should treat it as unknown because it is)

api-tests/core/upload/content-api/graphql-upload.test.api.js

…de-apollo-v4

innerdvations added 2 commits January 9, 2024 09:04

feat: update and make build work

278f7e0

BREAKING CHANGE: Update from 'apollo-server-koa' to '@apollo/server' and '@as-integrations/koa'

chore: fix comments

b3eb3a7

innerdvations added 2 commits January 9, 2024 10:21

chore: upgrade graphql-upload package

88e7dd3

chore: fix for body type unknown

ea735d0

innerdvations added this to the 5.0.0 milestone Jan 9, 2024

innerdvations added source: plugin:graphql Source is plugin/graphql package pr: enhancement This PR adds or updates some part of the codebase or features labels Jan 9, 2024

innerdvations self-assigned this Jan 9, 2024

innerdvations added 5 commits January 10, 2024 11:08

chore: remove old comment

6010ef7

chore: clean up error handling

7f82929

chore: fix comment

3dcafe0

fix: http status codes for input validation errors

ad552a5

fix: remove unused import

74844d8

innerdvations added 3 commits January 10, 2024 16:13

fix: remove accidental bodyparser

abbacd5

fix: add new required header to tests

986a5d6

chore: merge remote-tracking branch 'origin/v5/main' into chore/upgra…

d35d0cd

…de-apollo-v4

innerdvations marked this pull request as ready for review January 11, 2024 11:33

vercel bot deployed to Preview January 11, 2024 11:33 View deployment

innerdvations marked this pull request as draft January 11, 2024 11:33

chore: standardize directive key names to be kebab-case

2199adf

innerdvations mentioned this pull request Jan 11, 2024

Reduce helmet exceptions footprint #19202

Closed

innerdvations commented Jan 11, 2024

View reviewed changes

packages/core/content-type-builder/server/src/controllers/component-categories.ts Outdated Show resolved Hide resolved

innerdvations marked this pull request as ready for review January 11, 2024 15:27

innerdvations requested review from christiancp100, Convly and Bassel17 January 11, 2024 15:28

Convly reviewed Jan 12, 2024

View reviewed changes

chore: Merge remote-tracking branch 'origin/v5/main' into chore/upgra…

b2aa601

…de-apollo-v4

innerdvations added the flag: 💥 Breaking change This PR contains breaking changes and should not be merged label Jan 12, 2024

vercel bot deployed to Preview January 12, 2024 11:22 View deployment

innerdvations added 8 commits January 12, 2024 12:28

test: add some extra message validation

2928007

chore: remove devdep for koa-cors typings

fbb5b04

fix: add unknown error name

4c73fcf

fix: yarn.lock

07e467f

fix: add typings

0211ef3

fix: typings

eb905ae

fix: typings again

6c4d5c1

fix: remove unused imports

1b92e51

innerdvations requested a review from Convly January 12, 2024 12:40

innerdvations added 12 commits January 12, 2024 14:13

chore: remove unused import

7c6bd11

chore: move playground check to a service

57c0acc

fix: package imports and versions

0756018

chore: fix yarn.lock

3a08140

chore: fix types

0b45ac4

chore: clean up koa typings

db92421

chore: koa typing cleanup

8362bcc

chore: cleanup koa typings

155ee27

chore: more koa type cleanup

8005ccd

chore: revert missing imports

16cfd30

chore: cleanup koa typings

0724d3f

chore: update yarn.lock

3a6da41

Convly approved these changes Jan 15, 2024

View reviewed changes

innerdvations merged commit 13a2f8b into v5/main Jan 15, 2024
76 of 77 checks passed

innerdvations deleted the chore/upgrade-apollo-v4 branch January 15, 2024 13:55

echoes-hq bot added the echoes/type: maintenance Upkeeping efforts, chores and catch-up corrective improvements that are not features nor bugs label Mar 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade to Apollo v4 #19173

Upgrade to Apollo v4 #19173

innerdvations commented Jan 9, 2024 •

edited

github-actions bot commented Jan 9, 2024 •

edited

joshuaellis commented Jan 10, 2024

innerdvations commented Jan 10, 2024 •

edited

innerdvations Jan 11, 2024 •

edited

Convly left a comment

Convly Jan 12, 2024

innerdvations Jan 12, 2024 •

edited

innerdvations Jan 15, 2024

		}

		// TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that

Upgrade to Apollo v4 #19173

Upgrade to Apollo v4 #19173

Conversation

innerdvations commented Jan 9, 2024 • edited

What does it do?

Why is it needed?

How to test it?

Related issue(s)/PR(s)

github-actions bot commented Jan 9, 2024 • edited

joshuaellis commented Jan 10, 2024

innerdvations commented Jan 10, 2024 • edited

innerdvations Jan 11, 2024 • edited

Choose a reason for hiding this comment

Convly left a comment

Choose a reason for hiding this comment

Convly Jan 12, 2024

Choose a reason for hiding this comment

innerdvations Jan 12, 2024 • edited

Choose a reason for hiding this comment

innerdvations Jan 15, 2024

Choose a reason for hiding this comment

innerdvations commented Jan 9, 2024 •

edited

github-actions bot commented Jan 9, 2024 •

edited

innerdvations commented Jan 10, 2024 •

edited

innerdvations Jan 11, 2024 •

edited

innerdvations Jan 12, 2024 •

edited