`isPresent()` returns false, even when an explicit `null` value is
supplied. By checking `isOmitted()` instead, we can correctly use
validation annotations like `@NotBlank`.
Closes gh-842
1. Offset to be advanced back by 1 more than the count in order to
exclude the item at the specified offset.
2. Count to be adjusted down if offset is too low.
3. Count to be set to 0 if offset is 0.
See gh-840
Prior to this commit, the embedded reachability metadata for GraalVM
would declare a reflection hint for `GraphQlWebSocketMessage` when the
RSocket or WebSocket clients are reachable.
The `CodecDelegate` relies on this message class to test codecs and
detect a JSON-capable instance. This is true for all supported
GraphQlClient implementations.
This commit revisits the embedded reachability metadata to:
* allow reflection on `GraphQlWebSocketMessage` if any client extending
`AbstractGraphQlClientBuilder` is available
* allow reflection on `GraphQlWebSocketMessage` if a
`GraphQlWebSocketHandler` is reachable
Fixes gh-825
Prior to this commit, the `AnnotatedControllerExceptionResolver` would
scan the application context for `@ControllerAdvice` beans and cache the
results in an unordered Map. It's later iterating over the entries to
resolve an exception handler at runtime.
This commit ensures that such entries are now stored in an ordered map,
using the `OrderComparator.INSTANCE` comparator. `ControllerAdvice`
beans will be iterated over the order specified by the `Ordered`
contract or the `@Order` annotation.
Fixes gh-830
Rudimentary implementation to support returning a `CompletableFuture`
from a suspend function.
`CoroutinesUtils.invokeSuspendingFunction` wraps the return value of
the function in a `Mono` (or `Flux`). But it also does this when a
`CompletableFuture` is returned, and thus results in a
`Mono<CompletableFuture<?>>`, which isn't captured by graphql-java,
and thus the dataloader is never dispatched.
By unwrapping the future, and _converting_ it to a mono (as opposed
to wrapping), the dataloader is dispatched correctly.
See gh-653
This commit ensures that, when an instrumented DataFetcher returns a
`CompletionException`, we do not re-wrap it with the same exception
type. This aligns with the behavior enforced in the JDK
`CompletableFuture`.
Fixes gh-780
Prior to this commit, secured applications with CSRF protection could
not easily use the GraphiQL integration shipped with Spring for GraphQL,
as the JavaScript code would not work with any CSRF protection strategy
for single page apps.
This commit checks whether the main HTTP response contains a
`XSRF-TOKEN` Cookie value, and uses it as a `X-XSRF-TOKEN` request
header for the next AJAX request to the `/graphql` endpoint.
Note that a specific configuration must be set in Spring Security to
achieve that:
* the CSRF token must be sent as a response Cookie for the initial
authenticated request
* if the application is protected against BREACH, all new token values
must be sent as response cookies as well and a request handler must be
configured
Closes gh-758
