fixes after rebasing

Author: dotansimha

.changeset/subgraph_error_masking.md

@@ -0,0 +1,36 @@
+---
+hive-router-config: patch
+hive-router: patch
+hive-router-plan-executor: patch
+hive-router-internal: patch
+---
+
+# Subgraph Error Masking
+
+Mask subgraph errors before they reach clients, preventing internal details from leaking.
+
+Masking is **enabled by default**: subgraph error messages are replaced with `"Unexpected error"`. It runs last in the pipeline, so metrics, tracing, and logging still see the original error.
+
+Configure it under `error_masking`:
+
+```yaml
+error_masking:
+  redacted_error_message: "Unexpected error"
+  all:
+    error_message: true
+    extensions:
+      mode: allow # allow | deny
+      keys:
+        - code
+  subgraphs:
+    products:
+      error_message: false
+```
+
+- `error_message` toggles message redaction; `extensions` redacts extension keys via an `allow`/`deny` list.
+- `subgraphs.<name>` overrides `all` per subgraph, inheriting any field it doesn't set.
+- Set `DISABLE_SUBGRAPH_ERROR_MASKING=true` to disable message masking without editing the config.
+
+[Documentation](http://the-guild.dev/graphql/hive/docs/router/security/error-masking)
+
+Fixes https://github.com/graphql-hive/router/issues/1194

bin/router/src/pipeline/execution.rs

@@ -7,7 +7,6 @@ use hive_router_internal::telemetry::traces::spans::graphql::{
 };
 use hive_router_plan_executor::execution::client_request_details::ClientRequestDetails;
 use hive_router_plan_executor::execution::demand_control::DemandControlExecutionContext;
-use hive_router_plan_executor::execution::error_masking::ErrorMaskingRuntime;
 use hive_router_plan_executor::execution::jwt_forward::JwtAuthForwardingPlan;
 use hive_router_plan_executor::execution::operation_name::OperationNameFactory;
 use hive_router_plan_executor::execution::plan::{
@@ -119,10 +118,6 @@ pub async fn execute_plan<'exec>(
             None
         };
 
-        let error_masking_runtime = Arc::new(ErrorMaskingRuntime::compile_from_config(
-            &app_state.router_config.error_masking,
-        ));
-
         let operation_name = planned_request.client_request_details.operation.name;
         let result = execute_query_plan(QueryPlanExecutionOpts {
             query_plan: planned_request.query_plan_payload,
@@ -156,7 +151,7 @@ pub async fn execute_plan<'exec>(
                 operation_name,
             ),
             response_header_sink,
-            error_masking_runtime,
+            error_masking_runtime: app_state.error_masking.clone(),
         })
         .await?;
 

bin/router/src/shared_state.rs

@@ -12,6 +12,7 @@ use hive_router_internal::telemetry::metrics::subscription_metrics::Subscription
 use hive_router_internal::telemetry::metrics::Metrics;
 use hive_router_internal::telemetry::TelemetryContext;
 use hive_router_plan_executor::coprocessor::{CoprocessorError, CoprocessorRuntime};
+use hive_router_plan_executor::execution::error_masking::ErrorMaskingRuntime;
 use hive_router_plan_executor::execution::plan::FailedExecutionResult;
 use hive_router_plan_executor::extensions::{
     compile::compile_extensions_plan, plan::ExtensionsPlan,
@@ -329,6 +330,8 @@ pub struct RouterSharedState {
     pub active_subscriptions: ActiveSubscriptions,
     /// The storage manager for the router.
     pub storage_manager: Arc<StorageManager>,
+    /// The error masking configuration for the router.
+    pub error_masking: Arc<ErrorMaskingRuntime>,
 }
 
 impl RouterSharedState {
@@ -358,6 +361,9 @@ impl RouterSharedState {
                 .map_err(Box::new)
             })
             .transpose()?;
+        let error_masking = Arc::new(ErrorMaskingRuntime::compile_from_config(
+            &router_config.error_masking,
+        ));
 
         Ok(Self {
             validation_plan: Arc::new(validation_plan),
@@ -394,6 +400,7 @@ impl RouterSharedState {
             long_lived_client_count: Arc::new(AtomicUsize::new(0)),
             active_subscriptions,
             storage_manager,
+            error_masking,
         })
     }
 }

docs/README.md

@@ -9,7 +9,7 @@
 |[**cors**](#cors)|`object`|Configuration for CORS (Cross-Origin Resource Sharing).<br/>Default: `{"allow_any_origin":false,"allow_credentials":false,"enabled":false,"policies":[]}`<br/>|yes|
 |[**csrf**](#csrf)|`object`|Configuration for CSRF prevention.<br/>Default: `{"enabled":false,"required_headers":[]}`<br/>||
 |[**demand\_control**](#demand_control)|`object`, `null`||yes|
-|[**error\_masking**](#error_masking)|`object`|Configuration for error masking.<br/>Default: `{"all":{"error_message":true,"extensions":null},"redacted_error_message":"Unexpected error"}`<br/>||
+|[**error\_masking**](#error_masking)|`object`|Configuration for error masking.<br/>Default: `{"all":{"error_message":true},"redacted_error_message":"Unexpected error"}`<br/>||
 |[**headers**](#headers)|`object`|Configuration for the headers.<br/>Default: `{}`<br/>||
 |[**http**](#http)|`object`|Configuration for the HTTP server/listener.<br/>Default: `{"graphql_endpoint":"/graphql","host":"0.0.0.0","port":4000}`<br/>||
 |**introspection**||Configuration to enable or disable introspection queries.<br/>||
@@ -61,7 +61,6 @@ csrf:
 error_masking:
   all:
     error_message: true
-    extensions: null
   redacted_error_message: Unexpected error
 headers:
   all:
@@ -1011,42 +1010,48 @@ Configuration for error masking.
 
 |Name|Type|Description|Required|
 |----|----|-----------|--------|
-|[**all**](#error_maskingall)|`object`|Default: `{"error_message":true,"extensions":null}`<br/>||
-|**redacted\_error\_message**|`string`|Default: `"Unexpected error"`<br/>||
-|[**subgraphs**](#error_maskingsubgraphs)|`object`, `null`|||
+|[**all**](#error_maskingall)|`object`|The default error masking configuration for all subgraphs.<br/>Default: `{"error_message":true}`<br/>||
+|**redacted\_error\_message**|`string`|The error message to redact in subgraph errors. The default is "Unexpected error".<br/>Default: `"Unexpected error"`<br/>||
+|[**subgraphs**](#error_maskingsubgraphs)|`object`, `null`|The error masking configuration for individual subgraphs.<br/>||
 
 **Additional Properties:** not allowed  
 **Example**
 
 ```yaml
 all:
   error_message: true
-  extensions: null
 redacted_error_message: Unexpected error
 
 ```
 
 <a name="error_maskingall"></a>
 ### error\_masking\.all: object
 
+The default error masking configuration for all subgraphs.
+
+
 **Properties**
 
 |Name|Type|Description|Required|
 |----|----|-----------|--------|
-|**error\_message**|`boolean`, `null`|||
-|**extensions**||||
+|**error\_message**|`boolean`|Whether to redact the error message in subgraph errors. The default is `true`.<br/><br/>This field can be set to `false`, in order to disable error masking, by setting the `DISABLE_SUBGRAPH_ERROR_MASKING=true` environment variable.<br/>Default: `true`<br/>||
+|**extensions**||Whether to redact the `extensions` in errors.<br/><br/>You may pick the execution mode by setting `mode: allow` or `mode: deny`.<br/>Note: only root-level fields are supported.<br/>||
 
+**Additional Properties:** not allowed  
 **Example**
 
 ```yaml
 error_message: true
-extensions: null
 
 ```
 
 <a name="error_maskingsubgraphs"></a>
 ### error\_masking\.subgraphs: object,null
 
+The error masking configuration for individual subgraphs.
+Any configuration field that will be specified here, will override the configuration in `all`.
+
+
 **Additional Properties**
 
 |Name|Type|Description|Required|
@@ -1060,9 +1065,10 @@ extensions: null
 
 |Name|Type|Description|Required|
 |----|----|-----------|--------|
-|**error\_message**|`boolean`, `null`|||
-|**extensions**||||
+|**error\_message**|`boolean`, `null`|Whether to redact the `error_message` in errors, for that specific subgraph.<br/><br/>Configuring this will override the global `all.error_message` setting.<br/>||
+|**extensions**||Whether to redact the `extensions` in errors, for that specific subgraph.<br/>Configuring this will override the global `all.extensions` setting.<br/><br/>You may pick the execution mode by setting `mode: allow` or `mode: deny`.<br/>Note: only root-level fields are supported.<br/>||
 
+**Additional Properties:** not allowed  
 **Example**
 
 ```yaml

e2e/configs/env_vars.router.yaml

@@ -13,3 +13,6 @@ headers:
       - insert:
           name: "x-router-env"
           expression: env("ROUTER_ENV_HEADER", "default")
+error_masking:
+  all:
+    error_message: false

e2e/configs/timeout_per_subgraph_dynamic.router.yaml

@@ -16,3 +16,6 @@ traffic_shaping:
           } else {
             .default
           }
+error_masking:
+  all:
+    error_message: false

e2e/src/circuit_breaker.rs

@@ -86,6 +86,9 @@ mod circuit_breaker_e2e_tests {
         supergraph:
           source: file
           path: supergraph.graphql
+        error_masking:
+          all:
+            error_message: false
         traffic_shaping:
           all:
             request_timeout: 200ms
@@ -246,6 +249,9 @@ mod circuit_breaker_e2e_tests {
                 supergraph:
                     source: file
                     path: supergraph.graphql
+                error_masking:
+                  all:
+                    error_message: false
                 traffic_shaping:
                     all:
                         circuit_breaker:
@@ -336,6 +342,9 @@ mod circuit_breaker_e2e_tests {
                 supergraph:
                     source: file
                     path: supergraph.graphql
+                error_masking:
+                  all:
+                    error_message: false
                 traffic_shaping:
                     all:
                         circuit_breaker:
@@ -443,6 +452,9 @@ mod circuit_breaker_e2e_tests {
                 supergraph:
                     source: file
                     path: supergraph.graphql
+                error_masking:
+                  all:
+                    error_message: false
                 traffic_shaping:
                     all:
                         circuit_breaker:
@@ -540,6 +552,9 @@ mod circuit_breaker_e2e_tests {
                 supergraph:
                     source: file
                     path: supergraph.graphql
+                error_masking:
+                  all:
+                    error_message: false
                 traffic_shaping:
                     all:
                         circuit_breaker:
@@ -608,6 +623,9 @@ mod circuit_breaker_e2e_tests {
                 supergraph:
                     source: file
                     path: supergraph.graphql
+                error_masking:
+                  all:
+                    error_message: false
                 traffic_shaping:
                     all:
                         circuit_breaker:
@@ -671,6 +689,9 @@ mod circuit_breaker_e2e_tests {
                 supergraph:
                     source: file
                     path: supergraph.graphql
+                error_masking:
+                  all:
+                    error_message: false
                 traffic_shaping:
                     all:
                         circuit_breaker:
@@ -740,6 +761,9 @@ mod circuit_breaker_e2e_tests {
                 supergraph:
                     source: file
                     path: supergraph.graphql
+                error_masking:
+                  all:
+                    error_message: false
                 traffic_shaping:
                     all:
                         request_timeout: 500ms
@@ -1332,6 +1356,9 @@ mod circuit_breaker_e2e_tests {
                 supergraph:
                     source: file
                     path: supergraph.graphql
+                error_masking:
+                  all:
+                    error_message: false
                 traffic_shaping:
                     all:
                         circuit_breaker:
@@ -1408,6 +1435,9 @@ mod circuit_breaker_e2e_tests {
                 supergraph:
                     source: file
                     path: supergraph.graphql
+                error_masking:
+                  all:
+                    error_message: false
                 traffic_shaping:
                     all:
                         circuit_breaker:
@@ -1490,6 +1520,9 @@ mod circuit_breaker_e2e_tests {
                 supergraph:
                     source: file
                     path: supergraph.graphql
+                error_masking:
+                  all:
+                    error_message: false
                 traffic_shaping:
                     all:
                         circuit_breaker:
@@ -1579,6 +1612,9 @@ mod circuit_breaker_e2e_tests {
                 supergraph:
                     source: file
                     path: supergraph.graphql
+                error_masking:
+                  all:
+                    error_message: false
                 traffic_shaping:
                     all:
                         circuit_breaker:
@@ -1755,6 +1791,9 @@ mod circuit_breaker_e2e_tests {
                 supergraph:
                     source: file
                     path: supergraph.graphql
+                error_masking:
+                  all:
+                    error_message: false
                 traffic_shaping:
                     all:
                         circuit_breaker:

e2e/src/demand_control/subgraph_budgets.rs

@@ -12,6 +12,9 @@ mod subgraph_budgets_tests {
         supergraph:
             source: file
             path: supergraph.graphql
+        error_masking:
+          all:
+            error_message: false
         demand_control:
             enabled: true
             operation_cost: