Middleware and an Upload scalar to add support for GraphQL multipart requests (file uploads via queries and mutations) to various Node.js GraphQL servers.

⚠️ Previously published as apollo-upload-server.

The following environments are known to be compatible:

• Node.js >= v8.10
• Koa
  • graphql-api-koa
  • koa-graphql
  • apollo-server-koa (inbuilt)
• Express
  • express-graphql
  • apollo-server-express (inbuilt)

See also GraphQL multipart request spec server implementations.

Setup is necessary if your environment doesn’t feature this package inbuilt (see Support).

To install graphql-upload and the graphql peer dependency from npm run:

npm install graphql-upload graphql

Use the graphqlUploadKoa or graphqlUploadExpress middleware just before GraphQL middleware. Alternatively, use processRequest to create custom middleware.

A schema built with separate SDL and resolvers (e.g. using makeExecutableSchema) requires the Upload scalar to be setup.

Clients implementing the GraphQL multipart request spec upload files as Upload scalar query or mutation variables. Their resolver values are promises that resolve file upload details for processing and storage. Files are typically streamed into cloud storage but may also be stored in the filesystem.

See the example API and client.

• The process must have both read and write access to the directory identified by os.tmpdir().
• The device requires sufficient disk space to buffer the expected number of concurrent upload requests.
• Promisify and await file upload streams in resolvers or the server will send a response to the client before uploads are complete, causing a disconnect.
• Handle file upload promise rejection and stream errors; uploads sometimes fail due to network connectivity issues or impatient users disconnecting.
• Process multiple uploads asynchronously with Promise.all or a more flexible solution where an error in one does not reject them all.
• Only use createReadStream() before the resolver returns; late calls (e.g. in an unawaited async function or callback) throw an error. Existing streams can still be used after a response is sent, although there are few valid reasons for not awaiting their completion.
• Use stream.destroy() when an incomplete stream is no longer needed, or temporary files may not get cleaned up.

The GraphQL multipart request spec allows a file to be used for multiple query or mutation variables (file deduplication), and for variables to be used in multiple places. GraphQL resolvers need to be able to manage independent file streams. As resolvers are executed asynchronously, it’s possible they will try to process files in a different order than received in the multipart request.

busboy parses multipart request streams. Once the operations and map fields have been parsed, Upload scalar values in the GraphQL operations are populated with promises, and the operations are passed down the middleware chain to GraphQL resolvers.

fs-capacitor is used to buffer file uploads to the filesystem and coordinate simultaneous reading and writing. As soon as a file upload’s contents begins streaming, its data begins buffering to the filesystem and its associated promise resolves. GraphQL resolvers can then create new streams from the buffer by calling createReadStream(). The buffer is destroyed once all streams have ended or closed and the server has responded to the request. Any remaining buffer files will be cleaned when the process exits.

• class GraphQLUpload
• function graphqlUploadExpress
• function graphqlUploadKoa
• function processRequest
• type FileUpload
• type GraphQLOperation
• type ProcessRequestFunction
• type ProcessRequestOptions

A GraphQL Upload scalar that can be used in a GraphQLSchema. It’s value in resolvers is a promise that resolves file upload details for processing and storage.

Setup for a schema built with makeExecutableSchema.

const { makeExecutableSchema } = require('graphql-tools')
const { GraphQLUpload } = require('graphql-upload')

const schema = makeExecutableSchema({
  typeDefs: /* GraphQL */ `
    scalar Upload
  `,
  resolvers: {
    Upload: GraphQLUpload
  }
})

A manually constructed schema with an image upload mutation.

const {
  GraphQLSchema,
  GraphQLObjectType,
  GraphQLBoolean
} = require('graphql')
const { GraphQLUpload } = require('graphql-upload')

const schema = new GraphQLSchema({
  mutation: new GraphQLObjectType({
    name: 'Mutation',
    fields: {
      uploadImage: {
        description: 'Uploads an image.',
        type: GraphQLBoolean,
        args: {
          image: {
            description: 'Image file.',
            type: GraphQLUpload
          }
        },
        async resolve(parent, { image }) {
          const { filename, mimetype, createReadStream } = await image
          const stream = createReadStream()
          // Promisify the stream and store the file, then…
          return true
        }
      }
    }
  })
})

Creates Express middleware that processes GraphQL multipart requests using processRequest, ignoring non-multipart requests. It sets the request body to be similar to a conventional GraphQL POST request for following GraphQL middleware to consume.

Returns: Function — Express middleware.

Basic express-graphql setup.

const express = require('express')
const graphqlHTTP = require('express-graphql')
const { graphqlUploadExpress } = require('graphql-upload')
const schema = require('./schema')

express()
  .use(
    '/graphql',
    graphqlUploadExpress({ maxFileSize: 10000000, maxFiles: 10 }),
    graphqlHTTP({ schema })
  )
  .listen(3000)

Creates Koa middleware that processes GraphQL multipart requests using processRequest, ignoring non-multipart requests. It sets the request body to be similar to a conventional GraphQL POST request for following GraphQL middleware to consume.

Returns: Function — Koa middleware.

Basic graphql-api-koa setup.

const Koa = require('koa')
const bodyParser = require('koa-bodyparser')
const { errorHandler, execute } = require('graphql-api-koa')
const { graphqlUploadKoa } = require('graphql-upload')
const schema = require('./schema')

new Koa()
  .use(errorHandler())
  .use(bodyParser())
  .use(graphqlUploadKoa({ maxFileSize: 10000000, maxFiles: 10 }))
  .use(execute({ schema }))
  .listen(3000)

Processes a GraphQL multipart request. Errors are created with http-errors to assist in sending responses with appropriate HTTP status codes. Used in graphqlUploadExpress and graphqlUploadKoa and can be used to create custom middleware.

Type: ProcessRequestFunction

How to import.

const { processRequest } = require('graphql-upload')

File upload details, resolved from an Upload scalar promise.

Type: object

A GraphQL operation object in a shape that can be consumed and executed by most GraphQL servers.

Type: object

• GraphQL over HTTP spec.
• Apollo Server POST requests.

Processes a GraphQL multipart request.

Type: Function

Returns: Promise<GraphQLOperation | Array<GraphQLOperation>> — GraphQL operation or batch of operations for a GraphQL server to consume (usually as the request body).

Options for processing a GraphQL multipart request; mostly relating to security, performance and limits.

Type: object