Update package for dgraph-js-http

[gotjoshua]

I am trying to setup @auth directives and it seems that master is updated at:

dgraph-io/dgraph-js-http

but even when i do:
yarn add https://github.com/dgraph-io/dgraph-js-http
I still get errors when trying to run the suggested command to register the auth token:
dgraphClient.setAlphaAuthToken("My secret token value");

The version in my yarn.lock is

"[email protected]://github.com/dgraph-io/dgraph-js-http":
  version "20.7.1-rc1"

which is not in the list of tags nor releases

Is master usable?

Why does the version tag format keep changing? (eg: 20.07.0 → 20.7.1-rc1)

[chewxy]

I’ve just merged the latest dependencies (thanks to @catherineluse for the PR) Can you check if it works?

[gotjoshua]

i updated the package and i was able to call that function and successfully do an alter operation on an alpha that is set up for securing alter operations !

That much is great! Will you correct the tag and make an official release soon?

However i was only able to succeed from node.js as the browser fails due to cors errors, reported here:

@auth, cors, securing alter operations, and request headers

Expected behaviour and actual result. I expect the server to return all allow-headers needed for the various types of auth and auth tokens that are supported. The current list does not include X-Dgraph-AuthToken which is referenced here in the securing alter operations section. this is what Chrome shows in the network pane: access-control-allow-headers: X-Dgraph-AccessToken, Content-Type, Content-Length, Accept-Encoding, Cache-Control, X-CSRF-Token, X-Auth-Token, X-Requested-With This mean…

[chewxy]

@Paras wondering if this is something you could look at? (re: release and auth)

[Paras (Paras Shah)]

@paulftw owns this client. tagged him.

[gotjoshua]

Guys, I think the auth part is fine from the client side (except maybe documentation), the main repo needs to add the allowed header…

Perhaps you could use an additional function for setting for X-CSRF-Token in the client (as this is already allowed by the backend) - but all this can also be done without specialized functions just by setting the headers when creating the clientStub:

const headers = {
    ['X-CSRF-Token']:X_USER_AUTH_TOKEN,
    // ['X-Dgraph-AuthToken']:X_DGRAPH_AUTH_TOKEN, // this is not permitted by alpha cors - and does exactly the same as setAlphaAuthToken()
    ['X-Auth-Token']:X_USER_AUTH_TOKEN // this is allowed but doesn't do anything related to alter restriction - but can be used with GraphQL @auth rules
  }
  const newStub = await new DgraphClientStub(DGRAPH_URL,undefined,{headers})

[paulftw (Paul Korzhyk)]

@gotjoshua I’ve published the latest version to npm, you should be able to yarn add dgraph-js-http and get a working version of the library.

Let me know if you see any other issues

[gotjoshua]

thanks @paulftw! Looks good so far…