config 0.0.12 (2025-11-21)

Features

Breaking

Removed pool_idle_timeout_seconds from traffic_shaping, instead use pool_idle_timeout with duration format.

traffic_shaping:
-  pool_idle_timeout_seconds: 30
+  pool_idle_timeout: 30s

#540 by @ardatan

executor 6.1.0 (2025-11-21)

Features

Directive-Based Authorization

Introducing directive-based authorization. This allows you to enforce fine-grained access control directly from your subgraph schemas using the @authenticated and @requiresScopes directives.

This new authorization layer runs before the query planner, ensuring that unauthorized requests are handled efficiently without reaching your subgraphs.

Configuration

You can configure how the router handles unauthorized requests with two modes:

• filter (default): Silently removes any fields the user is not authorized to see from the query. The response will contain null for the removed fields and an error in the errors array.
• reject: Rejects the entire GraphQL operation if it requests any field the user is not authorized to access.

To configure this, add the following to your router.yaml configuration file:

authentication:
  directives:
    unauthorized:
      # "filter" (default): Removes unauthorized fields from the query and returns errors.
      # "reject": Rejects the entire request if any unauthorized field is requested.
      mode: reject

If this section is omitted, the router will use filter mode by default.

JWT Scope Requirements

When using the @requiresScopes directive, the router expects the user's granted scopes to be present in the JWT payload. The scopes should be in an array of strings or a string (scopes separated by space), within a claim named scope.

Here is an example of a JWT payload with the correct format:

{
  "sub": "user-123",
  "scope": [
    "read:products",
    "write:reviews"
  ],
  "iat": 1516239022
}

Breaking

Removed pool_idle_timeout_seconds from traffic_shaping, instead use pool_idle_timeout with duration format.

traffic_shaping:
-  pool_idle_timeout_seconds: 30
+  pool_idle_timeout: 30s

#540 by @ardatan

router 0.0.20 (2025-11-21)

Features

• support authenticated and requiresScopes directives (feat(router): support authenticated and requiresScopes directives #538)

Directive-Based Authorization

Introducing directive-based authorization. This allows you to enforce fine-grained access control directly from your subgraph schemas using the @authenticated and @requiresScopes directives.

This new authorization layer runs before the query planner, ensuring that unauthorized requests are handled efficiently without reaching your subgraphs.

Configuration

You can configure how the router handles unauthorized requests with two modes:

• filter (default): Silently removes any fields the user is not authorized to see from the query. The response will contain null for the removed fields and an error in the errors array.
• reject: Rejects the entire GraphQL operation if it requests any field the user is not authorized to access.

To configure this, add the following to your router.yaml configuration file:

authentication:
  directives:
    unauthorized:
      # "filter" (default): Removes unauthorized fields from the query and returns errors.
      # "reject": Rejects the entire request if any unauthorized field is requested.
      mode: reject

If this section is omitted, the router will use filter mode by default.

JWT Scope Requirements

When using the @requiresScopes directive, the router expects the user's granted scopes to be present in the JWT payload. The scopes should be in an array of strings or a string (scopes separated by space), within a claim named scope.

Here is an example of a JWT payload with the correct format:

{
  "sub": "user-123",
  "scope": [
    "read:products",
    "write:reviews"
  ],
  "iat": 1516239022
}

Breaking

Removed pool_idle_timeout_seconds from traffic_shaping, instead use pool_idle_timeout with duration format.

traffic_shaping:
-  pool_idle_timeout_seconds: 30
+  pool_idle_timeout: 30s

#540 by @ardatan

query-planner 2.1.0 (2025-11-21)

Features

Directive-Based Authorization

Introducing directive-based authorization. This allows you to enforce fine-grained access control directly from your subgraph schemas using the @authenticated and @requiresScopes directives.

This new authorization layer runs before the query planner, ensuring that unauthorized requests are handled efficiently without reaching your subgraphs.

Configuration

You can configure how the router handles unauthorized requests with two modes:

• filter (default): Silently removes any fields the user is not authorized to see from the query. The response will contain null for the removed fields and an error in the errors array.
• reject: Rejects the entire GraphQL operation if it requests any field the user is not authorized to access.

To configure this, add the following to your router.yaml configuration file:

authentication:
  directives:
    unauthorized:
      # "filter" (default): Removes unauthorized fields from the query and returns errors.
      # "reject": Rejects the entire request if any unauthorized field is requested.
      mode: reject

If this section is omitted, the router will use filter mode by default.

JWT Scope Requirements

When using the @requiresScopes directive, the router expects the user's granted scopes to be present in the JWT payload. The scopes should be in an array of strings or a string (scopes separated by space), within a claim named scope.

Here is an example of a JWT payload with the correct format:

{
  "sub": "user-123",
  "scope": [
    "read:products",
    "write:reviews"
  ],
  "iat": 1516239022
}