chore: sync latest from wundergraph/cosmo

.github/workflows/router-ci.yaml

@@ -156,6 +156,16 @@ jobs:
         with:
           cache-dependency-path: |
             router-tests/go.sum
+      - name: Setup Redis Cluster (for Cluster tests)
+        uses: vishnudxb/redis-cluster@1.0.9
+        with:
+          master1-port: 7000
+          master2-port: 7001
+          master3-port: 7002
+          slave1-port: 7003
+          slave2-port: 7004
+          slave3-port: 7005
+          sleep-duration: 5
       - uses: nick-fields/retry@v3
         with:
           timeout_minutes: 30

CONTRIBUTING.md

@@ -15,8 +15,8 @@ This guide assumes you have already installed the following software:
 - Node.js [LTS](https://nodejs.org/en/about/releases/). You can also pnpm to [install](https://pnpm.io/cli/env) Node.js.
 - [docker desktop](https://docs.docker.com/desktop/) (includes: engine, buildkit & compose) **or**:
 - [docker engine](https://docs.docker.com/engine/) with:
-    - [docker buildkit](https://docs.docker.com/build/buildkit/), with optionally: [docker buildx plugin](https://docs.docker.com/build/install-buildx/)
-    - [docker compose plugin](https://docs.docker.com/compose/install/#scenario-two-install-the-compose-plugin)
+  - [docker buildkit](https://docs.docker.com/build/buildkit/), with optionally: [docker buildx plugin](https://docs.docker.com/build/install-buildx/)
+  - [docker compose plugin](https://docs.docker.com/compose/install/#scenario-two-install-the-compose-plugin)
 
 ## Monorepo
 
@@ -39,7 +39,7 @@ Ready! You can now start contributing to the WunderGraph Cosmo repository. Feel
 
 ## Go workspace
 
-According to best practices, we don't commit the `go.work` or `go.sum` files. Those files are personal to each developer. As a result, we use the `go.mod` file to manage the dependencies and overwrites. You can still create `go.work` file in the root of the repository if you are feeling more comfortable with it or to improve tooling support.
+According to best practices, we don't commit the `go.work` or `go.work.sum` files. Those files are personal to each developer. As a result, we use the `go.mod` file to manage the dependencies and overwrites. You can still create `go.work` file in the root of the repository if you are feeling more comfortable with it or to improve tooling support.
 
 ### Example
 
@@ -183,4 +183,4 @@ Grafana is available at [http://localhost:9300](http://localhost:9300) with the
 ```
 Username: admin
 Password: admin
-```
+```

admission-server/Dockerfile

@@ -23,7 +23,7 @@ FROM --platform=${BUILDPLATFORM} node:lts-slim
 
 WORKDIR /app
 
-ENV NODE_ENV production
+ENV NODE_ENV=production
 
 # Fetch built artifacts
 COPY --from=builder /app/pruned .

aws-lambda-router/config.test.yaml

@@ -3,11 +3,10 @@
 version: '1'
 
 authentication:
-  providers:
-    - name: Test Auth Service
-      jwks:
+  jwt:
+    jwks:
+      - url: https://www.googleapis.com/oauth2/v3/certs
         # Example JWKS - Google OIDC
-        url: https://www.googleapis.com/oauth2/v3/certs
         refresh_interval: 5m
 headers:
   all:

aws-lambda-router/go.mod

@@ -7,7 +7,7 @@ toolchain go1.23.4
 require (
 	github.com/akrylysov/algnhsa v1.1.0
 	github.com/aws/aws-lambda-go v1.43.0
-	github.com/stretchr/testify v1.9.0
+	github.com/stretchr/testify v1.10.0
 	github.com/wundergraph/cosmo/router v0.0.0-20241115174502-7156536a93bf
 	go.uber.org/zap v1.27.0
 )
@@ -26,7 +26,7 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudflare/backoff v0.0.0-20161212185259-647f3cdfc87a // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/dgraph-io/ristretto v0.1.2-0.20240723054643-f5997484152c // indirect
+	github.com/dgraph-io/ristretto/v2 v2.1.0 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/expr-lang/expr v1.16.9 // indirect
@@ -97,7 +97,7 @@ require (
 	github.com/twmb/franz-go v1.16.1 // indirect
 	github.com/twmb/franz-go/pkg/kmsg v1.7.0 // indirect
 	github.com/wundergraph/astjson v0.0.0-20250106123708-be463c97e083 // indirect
-	github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.138.0.20250106145350-20e4f82cea6b // indirect
+	github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.145 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect
 	go.opentelemetry.io/contrib/propagators/b3 v1.23.0 // indirect

aws-lambda-router/go.sum

@@ -11,6 +11,10 @@ github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRB
 github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
 github.com/akrylysov/algnhsa v1.1.0 h1:G0SoP16tMRyiism7VNc3JFA0wq/cVgEkp/ExMVnc6PQ=
 github.com/akrylysov/algnhsa v1.1.0/go.mod h1:+bOweRs/WBu5awl+ifCoSYAuKVPAmoTk8XOMrZ1xwiw=
+github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302 h1:uvdUDbHQHO85qeSydJtItA4T55Pw6BtAejd0APRJOCE=
+github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
+github.com/alicebob/miniredis/v2 v2.34.0 h1:mBFWMaJSNL9RwdGRyEDoAAv8OQc5UlEhLDQggTglU/0=
+github.com/alicebob/miniredis/v2 v2.34.0/go.mod h1:kWShP4b58T1CW0Y5dViCd5ztzrDqRWqM3nksiyXk5s8=
 github.com/andybalholm/brotli v1.1.0 h1:eLKJA0d02Lf0mVpIDgYnqXcUn0GqVmEFny3VuID1U3M=
 github.com/andybalholm/brotli v1.1.0/go.mod h1:sms7XGricyQI9K10gOSf56VKKWS4oLer58Q+mhRPtnY=
 github.com/aws/aws-lambda-go v1.43.0 h1:Tdu7SnMB5bD+CbdnSq1Dg4sM68vEuGIDcQFZ+IjUfx0=
@@ -40,8 +44,8 @@ github.com/coder/websocket v1.8.12/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3C
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgraph-io/ristretto v0.1.2-0.20240723054643-f5997484152c h1:V2+MhiAoTwUNENo9PFoz2NSr0VDJEzIARLuzb30YyqA=
-github.com/dgraph-io/ristretto v0.1.2-0.20240723054643-f5997484152c/go.mod h1:swkazRqnUf1N62d0Nutz7KIj2UKqsm/H8tD0nBJAXqM=
+github.com/dgraph-io/ristretto/v2 v2.1.0 h1:59LjpOJLNDULHh8MC4UaegN52lC4JnO2dITsie/Pa8I=
+github.com/dgraph-io/ristretto/v2 v2.1.0/go.mod h1:uejeqfYXpUomfse0+lO+13ATz4TypQYLJZzBSAemuB4=
 github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 h1:fAjc9m62+UWV/WAFKLNi6ZS0675eEUC9y3AlwSbQu1Y=
 github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
@@ -230,8 +234,9 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
 github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
@@ -256,8 +261,10 @@ github.com/vektah/gqlparser/v2 v2.5.16 h1:1gcmLTvs3JLKXckwCwlUagVn/IlV2bwqle0vJ0
 github.com/vektah/gqlparser/v2 v2.5.16/go.mod h1:1lz1OeCqgQbQepsGxPVywrjdBHW2T08PUS3pJqepRww=
 github.com/wundergraph/astjson v0.0.0-20250106123708-be463c97e083 h1:8/D7f8gKxTBjW+SZK4mhxTTBVpxcqeBgWF1Rfmltbfk=
 github.com/wundergraph/astjson v0.0.0-20250106123708-be463c97e083/go.mod h1:eOTL6acwctsN4F3b7YE+eE2t8zcJ/doLm9sZzsxxxrE=
-github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.138.0.20250106145350-20e4f82cea6b h1:DnIV7YVjrPcrJj2awt8M1F++ql6EfC0hB0Or0m4OXx4=
-github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.138.0.20250106145350-20e4f82cea6b/go.mod h1:B7eV0Qh8Lop9QzIOQcsvKp3S0ejfC6mgyWoJnI917yQ=
+github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.145 h1:3JuBmRux6YB/UZgh6COvgLXzQhMIsdHV7A02NsYdAVE=
+github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.145/go.mod h1:B7eV0Qh8Lop9QzIOQcsvKp3S0ejfC6mgyWoJnI917yQ=
+github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
+github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 h1:aFJWCqJMNjENlcleuuOkGAPH82y0yULBScfXcIEdS24=

aws-lambda-router/internal/router.go

@@ -199,47 +199,9 @@ func NewRouter(opts ...Option) (*core.Router, error) {
 			routerOpts = append(routerOpts, core.WithAccessLogs(c))
 		}
 
-		var authenticators []authentication.Authenticator
-		for i, auth := range cfg.Authentication.Providers {
-			if auth.JWKS != nil {
-				name := auth.Name
-				if name == "" {
-					name = fmt.Sprintf("jwks-#%d", i)
-				}
-				providerLogger := logger.With(zap.String("provider_name", name))
-				tokenDecoder, err := authentication.NewJwksTokenDecoder(ctx, providerLogger, auth.JWKS.URL, auth.JWKS.RefreshInterval)
-				if err != nil {
-					providerLogger.Error("Could not create JWKS token decoder", zap.Error(err))
-					return nil, err
-				}
-				opts := authentication.HttpHeaderAuthenticatorOptions{
-					Name:                name,
-					URL:                 auth.JWKS.URL,
-					HeaderNames:         auth.JWKS.HeaderNames,
-					HeaderValuePrefixes: auth.JWKS.HeaderValuePrefixes,
-					TokenDecoder:        tokenDecoder,
-				}
-				authenticator, err := authentication.NewHttpHeaderAuthenticator(opts)
-				if err != nil {
-					providerLogger.Error("Could not create HttpHeader authenticator", zap.Error(err))
-					return nil, err
-				}
-				authenticators = append(authenticators, authenticator)
-
-				if cfg.WebSocket.Authentication.FromInitialPayload.Enabled {
-					opts := authentication.WebsocketInitialPayloadAuthenticatorOptions{
-						TokenDecoder:        tokenDecoder,
-						Key:                 cfg.WebSocket.Authentication.FromInitialPayload.Key,
-						HeaderValuePrefixes: auth.JWKS.HeaderValuePrefixes,
-					}
-					authenticator, err = authentication.NewWebsocketInitialPayloadAuthenticator(opts)
-					if err != nil {
-						providerLogger.Error("Could not create WebsocketInitialPayload authenticator", zap.Error(err))
-						return nil, err
-					}
-					authenticators = append(authenticators, authenticator)
-				}
-			}
+		authenticators, err := setupAuthenticators(ctx, logger, cfg)
+		if err != nil {
+			return nil, fmt.Errorf("could not setup authenticators: %w", err)
 		}
 
 		if len(authenticators) > 0 {
@@ -352,3 +314,82 @@ func WithLogger(logger *zap.Logger) Option {
 		r.Logger = logger
 	}
 }
+
+func setupAuthenticators(ctx context.Context, logger *zap.Logger, cfg *config.Config) ([]authentication.Authenticator, error) {
+	jwtConf := cfg.Authentication.JWT
+	if len(jwtConf.JWKS) == 0 {
+		// No JWT authenticators configured
+		return nil, nil
+	}
+
+	var authenticators []authentication.Authenticator
+	configs := make([]authentication.JWKSConfig, 0, len(jwtConf.JWKS))
+
+	for _, jwks := range cfg.Authentication.JWT.JWKS {
+		configs = append(configs, authentication.JWKSConfig{
+			URL:               jwks.URL,
+			RefreshInterval:   jwks.RefreshInterval,
+			AllowedAlgorithms: jwks.Algorithms,
+		})
+	}
+
+	tokenDecoder, err := authentication.NewJwksTokenDecoder(ctx, logger, configs)
+	if err != nil {
+		return nil, err
+	}
+
+	// create a map for the `httpHeaderAuthenticator`
+	headerSourceMap := map[string][]string{
+		jwtConf.HeaderName: {jwtConf.HeaderValuePrefix},
+	}
+
+	// The `websocketInitialPayloadAuthenticator` has one key and uses a flat list of prefixes
+	prefixSet := make(map[string]struct{})
+
+	for _, s := range jwtConf.HeaderSources {
+		if s.Type != "header" {
+			continue
+		}
+
+		for _, prefix := range s.ValuePrefixes {
+			headerSourceMap[s.Name] = append(headerSourceMap[s.Name], prefix)
+			prefixSet[prefix] = struct{}{}
+		}
+
+	}
+
+	opts := authentication.HttpHeaderAuthenticatorOptions{
+		Name:                 "jwks",
+		HeaderSourcePrefixes: headerSourceMap,
+		TokenDecoder:         tokenDecoder,
+	}
+
+	authenticator, err := authentication.NewHttpHeaderAuthenticator(opts)
+	if err != nil {
+		logger.Error("Could not create HttpHeader authenticator", zap.Error(err))
+		return nil, err
+	}
+
+	authenticators = append(authenticators, authenticator)
+
+	if cfg.WebSocket.Authentication.FromInitialPayload.Enabled {
+		headerPrefixes := make([]string, 0, len(prefixSet))
+		for prefix := range prefixSet {
+			headerPrefixes = append(headerPrefixes, prefix)
+		}
+
+		opts := authentication.WebsocketInitialPayloadAuthenticatorOptions{
+			TokenDecoder:        tokenDecoder,
+			Key:                 cfg.WebSocket.Authentication.FromInitialPayload.Key,
+			HeaderValuePrefixes: headerPrefixes,
+		}
+		authenticator, err = authentication.NewWebsocketInitialPayloadAuthenticator(opts)
+		if err != nil {
+			logger.Error("Could not create WebsocketInitialPayload authenticator", zap.Error(err))
+			return nil, err
+		}
+		authenticators = append(authenticators, authenticator)
+	}
+
+	return authenticators, nil
+}

aws-lambda-router/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-lambda-router",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "private": true,
   "description": "Placeholder package to simplify versioning and releasing with lerna.",
   "keywords": [

cdn-server/CHANGELOG.md

@@ -4,6 +4,18 @@ Binaries are attached to the github release otherwise all images can be found [h
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [0.13.0](https://github.com/wundergraph/cosmo/compare/cdn@0.12.0...cdn@0.13.0) (2025-01-17)
+
+### Features
+
+* cache warmer ([#1501](https://github.com/wundergraph/cosmo/issues/1501)) ([948edd2](https://github.com/wundergraph/cosmo/commit/948edd23e6d0ee968c91edd1a9e9943c3405ac2d)) (@JivusAyrus)
+
+# [0.12.0](https://github.com/wundergraph/cosmo/compare/cdn@0.11.2...cdn@0.12.0) (2025-01-08)
+
+### Features
+
+* expose type data and record subgraphs for enums ([#1495](https://github.com/wundergraph/cosmo/issues/1495)) ([9e13f28](https://github.com/wundergraph/cosmo/commit/9e13f28c0a90b0d2f335c9b31f35e728c4a1799c)) (@thisisnithin)
+
 ## [0.11.2](https://github.com/wundergraph/cosmo/compare/cdn@0.11.1...cdn@0.11.2) (2024-12-06)
 
 ### Bug Fixes

cdn-server/Dockerfile

@@ -24,7 +24,7 @@ FROM --platform=${BUILDPLATFORM} node:lts-slim
 
 WORKDIR /app
 
-ENV NODE_ENV production
+ENV NODE_ENV=production
 
 # Fetch built artifacts
 COPY --from=builder /app/pruned .

cdn-server/cdn/CHANGELOG.md

@@ -4,6 +4,12 @@ Binaries are attached to the github release otherwise all images can be found [h
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [0.8.0](https://github.com/wundergraph/cosmo/compare/@wundergraph/cosmo-cdn@0.7.1...@wundergraph/cosmo-cdn@0.8.0) (2025-01-17)
+
+### Features
+
+* cache warmer ([#1501](https://github.com/wundergraph/cosmo/issues/1501)) ([948edd2](https://github.com/wundergraph/cosmo/commit/948edd23e6d0ee968c91edd1a9e9943c3405ac2d)) (@JivusAyrus)
+
 ## [0.7.1](https://github.com/wundergraph/cosmo/compare/@wundergraph/cosmo-cdn@0.7.0...@wundergraph/cosmo-cdn@0.7.1) (2024-12-06)
 
 ### Bug Fixes

cdn-server/cdn/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wundergraph/cosmo-cdn",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "author": {
     "name": "WunderGraph Maintainers",
     "email": "info@wundergraph.com"

cdn-server/cdn/src/index.ts

@@ -218,6 +218,36 @@ const draftRouterConfig = (storage: BlobStorage) => {
   };
 };
 
+const cacheOperations = (storage: BlobStorage) => {
+  return async (c: Context) => {
+    const organizationId = c.get('authenticatedOrganizationId');
+    const federatedGraphId = c.get('authenticatedFederatedGraphId');
+
+    if (organizationId !== c.req.param('organization_id') || federatedGraphId !== c.req.param('federated_graph_id')) {
+      return c.text('Bad Request', 400);
+    }
+
+    const key = `${organizationId}/${federatedGraphId}/cache_warmup/operations.json`;
+    let blobObject: BlobObject;
+
+    try {
+      blobObject = await storage.getObject({ context: c, key, cacheControl: 'no-cache' });
+    } catch (e: any) {
+      if (e instanceof BlobNotFoundError) {
+        return c.notFound();
+      }
+      throw e;
+    }
+
+    c.header('Content-Type', 'application/json; charset=UTF-8');
+    c.header('Cache-Control', 'no-cache, no-store, must-revalidate');
+
+    return stream(c, async (stream) => {
+      await stream.pipe(blobObject.stream);
+    });
+  };
+};
+
 // eslint-disable-next-line @typescript-eslint/ban-types
 export const cdn = <E extends Env, S extends Schema = {}, BasePath extends string = '/'>(
   hono: Hono<E, S, BasePath>,
@@ -235,4 +265,9 @@ export const cdn = <E extends Env, S extends Schema = {}, BasePath extends strin
   hono
     .use(draftRouterConfigs, jwtMiddleware(opts.authAdmissionJwtSecret))
     .get(draftRouterConfigs, draftRouterConfig(opts.blobStorage));
+
+  const cacheOperationsPath = '/:organization_id/:federated_graph_id/cache_warmup/operations.json';
+  hono
+    .use(cacheOperationsPath, jwtMiddleware(opts.authJwtSecret))
+    .get(cacheOperationsPath, cacheOperations(opts.blobStorage));
 };