Correctly handle multipart/form-data requests

Author: rshk

flask_graphql/fields.py

@@ -0,0 +1,45 @@
+"""Provide field definitions for file uploads
+
+TODO: this should be supported upstream, in graphql-core
+and graphene. Shall we just remove it from here and only
+provide a reference definition instead?
+"""
+
+try:
+    from graphql.type.definition import GraphQLScalarType
+
+except ImportError:
+    pass
+
+else:
+
+    GraphQLFileUpload = GraphQLScalarType(
+        name='FileUpload',
+        description='File upload',
+        serialize=lambda x: None,
+        parse_value=lambda value: value,
+        parse_literal=lambda node: None,
+    )
+
+
+try:
+    import graphene
+
+except ImportError:
+    pass
+
+else:
+
+    class FileUpload(graphene.Scalar):
+
+        @staticmethod
+        def serialize(value):
+            return None
+
+        @staticmethod
+        def parse_literal(node):
+            return None
+
+        @staticmethod
+        def parse_value(value):
+            return value  # IMPORTANT

flask_graphql/graphqlview.py

@@ -135,9 +135,22 @@ def parse_body(self):
         elif content_type == 'application/json':
             return load_json_body(request.data.decode('utf8'))
 
-        elif content_type in ('application/x-www-form-urlencoded', 'multipart/form-data'):
+        elif content_type in 'application/x-www-form-urlencoded':
             return request.form
 
+        elif content_type == 'multipart/form-data':
+            # --------------------------------------------------------
+            # See spec: https://github.com/jaydenseric/graphql-multipart-request-spec
+            #
+            # When processing multipart/form-data, we need to take
+            # files (from "parts") and place them in the "operations"
+            # data structure (list or dict) according to the "map".
+            # --------------------------------------------------------
+            operations = load_json_body(request.form['operations'])
+            files_map = load_json_body(request.form['map'])
+            return place_files_in_operations(
+                operations, files_map, request.files)
+
         return {}
 
     def should_display_graphiql(self):
@@ -152,3 +165,80 @@ def request_wants_html(self):
         return best == 'text/html' and \
             request.accept_mimetypes[best] > \
             request.accept_mimetypes['application/json']
+
+
+def place_files_in_operations(operations, files_map, files):
+    """Place files from multipart reuqests inside operations.
+
+    Args:
+
+        operations:
+            Either a dict or a list of dicts, containing GraphQL
+            operations to be run.
+
+        files_map:
+            A dictionary defining the mapping of files into "paths"
+            inside the operations data structure.
+
+            Keys are file names from the "files" dict, values are
+            lists of dotted paths describing where files should be
+            placed.
+
+        files:
+            A dictionary mapping file names to FileStorage instances.
+
+    Returns:
+
+        A structure similar to operations, but with FileStorage
+        instances placed appropriately.
+    """
+
+    # operations: dict or list
+    # files_map: {filename: [path, path, ...]}
+    # files: {filename: FileStorage}
+
+    fmap = []
+    for key, values in files_map.items():
+        for val in values:
+            path = val.split('.')
+            fmap.append((path, key))
+
+    return _place_files_in_operations(operations, fmap, files)
+
+
+def _place_files_in_operations(ops, fmap, fobjs):
+    for path, fkey in fmap:
+        ops = _place_file_in_operations(ops, path, fobjs[fkey])
+    return ops
+
+
+def _place_file_in_operations(ops, path, obj):
+
+    if len(path) == 0:
+        return obj
+
+    if isinstance(ops, list):
+        key = int(path[0])
+        sub = _place_file_in_operations(ops[key], path[1:], obj)
+        return _insert_in_list(ops, key, sub)
+
+    if isinstance(ops, dict):
+        key = path[0]
+        sub = _place_file_in_operations(ops[key], path[1:], obj)
+        return _insert_in_dict(ops, key, sub)
+
+    raise TypeError('Expected ops to be list or dict')
+
+
+def _insert_in_dict(dct, key, val):
+    new_dict = dct.copy()
+    new_dict[key] = val
+    return new_dict
+
+
+def _insert_in_list(lst, key, val):
+    new_list = []
+    new_list.extend(lst[:key])
+    new_list.append(val)
+    new_list.extend(lst[key + 1:])
+    return new_list