Plugin raw body

[lagden]

I made a plugin to check authentication by signature.
So... It is necessary the raw body to compare the hash.

When add the code block bellow, the next hook(onContextBuilding) isn't trigger:

const rawBody = []
for await (const chunk of serverContext.req) {
	rawBody.push(chunk)
}

Well, is there another way to get raw body?

---

Full plugin code

import * as debug from '@tadashi/debug'
import {createGraphQLError} from 'graphql-yoga'
import auth from '../middleware/auth.js'

function unauthorizedError(message, options = {}) {
	return createGraphQLError(message, {
		extensions: {
			http: {
				status: 401,
			},
		},
		...options,
	})
}

export function useAuth(options) {
	const {extendContextField = '_state'} = options ?? {}
	const payloadByRequest = new WeakMap()
	return {
		async onRequestParse(args) {
			const {request, serverContext} = args
			try {
				const rawBody = []
				for await (const chunk of serverContext.req) {
					rawBody.push(chunk)
				}
				const payload = await auth({request, body: rawBody})
				payloadByRequest.set(request, payload)
			} catch (error) {
				throw unauthorizedError(error.message)
			}
		},
		onContextBuilding({context, extendContext}) {
			if (context.request === undefined) {
				throw new Error('Request is not available on context! Make sure you use this plugin with GraphQL Yoga.')
			}
			const payload = payloadByRequest.get(context.request)
			if (payload) {
				extendContext({
					[extendContextField]: payload,
				})
			}
		},
	}
}

[ardatan]

Could you explain more about your use case please? Because the body is parsed by Yoga. What do you want to get from the body?
There is no req etc in Yoga that you can rely on. Yoga's plugin system is environment agnostic. There is request in the context which is Request

[lagden]

Hi @ardatan

Yes, the body is parsed to javascript object. After that, it is impossible compare the signature.

See the example:

body-a.json

{
    "foo": "bar"
}

cat body-a.json | openssl dgst -hex -sha256 -hmac "secret"
// => SHA2-256(stdin)= 2257bf9d941dd22dcfccc4461b08b8c99f7616e84e19bda45fcb084cd1749f25

---

body-b.json

{"foo": "bar"}

cat body-b.json | openssl dgst -hex -sha256 -hmac "secret"
// => SHA2-256(stdin)= 5910d971d6909f5bce3abc3e035e17faa72249399d6906248ce80dde30a32285

---

If I get the parsed value and run JSON.stringify, the HMAC will never match. Because I don't know if the original value was used tab or space for indentation, for example!

[lagden]

@ardatan

I don't know how I can handle this.
Always gets stuck on onRequest and never goes to the next hook.

I think it's not possible to do this using plugin.

my refs:
https://github.com/dotansimha/graphql-yoga/blob/main/packages/graphql-yoga/src/plugins/use-request-parser.ts
https://github.com/dotansimha/graphql-yoga/blob/main/packages/graphql-yoga/src/plugins/request-parser/post-graphql-string.ts

export function useBody(options) {
	const {extendContextField = 'rawBody'} = options ?? {}
	const bodyByRequest = new WeakMap()
	return {
		async onRequest(args) {
			const {request} = args
			const chunks = []

			for await (const chunk of request.body) {
				chunks.push(new TextDecoder().decode(chunk))
			}

			const body = chunks.join('')
			bodyByRequest.set(request, body)
		},
		onContextBuilding({context, extendContext}) {
			if (context.request === undefined) {
				throw new Error('Request is not available on context! Make sure you use this plugin with GraphQL Yoga.')
			}
			const body = bodyByRequest.get(context.request)
			if (body) {
				extendContext({
					[extendContextField]: body,
				})
			}
		},
	}
}

[lagden]

I tried to use the interface PonyfillRequest via await request.text() and got stuck too, meaning it doesn't go to the next step.

export function useBody(options) {
	const {extendContextField = 'rawBody'} = options ?? {}
	const bodyByRequest = new WeakMap()
	return {
		async onRequest(args) {
			const {request} = args
			const body = await request.text()
			bodyByRequest.set(request, body)
		},
		onContextBuilding({context, extendContext}) {
			if (context.request === undefined) {
				throw new Error('Request is not available on context! Make sure you use this plugin with GraphQL Yoga.')
			}
			const body = bodyByRequest.get(context.request)
			if (body) {
				extendContext({
					[extendContextField]: body,
				})
			}
		},
	}
}

[EmrysMyrddin]

Hi! Sorry for the response delay :-(

A thing to keep in mind is that onRequest is a dangerous hook to use. There is no error handling there, so you have to be very careful with the implementation of this hook. It should never throw an error, otherwise the error will bubble up directly to the HTTP server. What happens next depends on your HTTP server implementation. For example, the standard Node http package will just crash the entire server.

I recommend you to use the onRequestParse hook instead.

You probably have an error thrown from onRequest hook that is silently ignored, which is why no subsequent hooks will be called.