Reaction: Apollo GraphQL Endpoint responds with Status 400

[janus-reith]

Prerequisites

• [x] Are you running the latest version?
• [x] Are you able to consistently reproduce the issue?
• [x] Did you search the issue queue for existing issue? Search issues

Issue Description

While still accepting and responding to Queries and Mutations, Apollo Server throws Status 400 in the latest RC.

e.g: https://reaction-core.staging.reactioncommerce.com/graphql-alpha
When using a separate instance of GraphQL Playground, the response is

{
  "error": "Response not successful: Received status code 400"
}

and the client is unable to fetch the schema.
Querieing for example primaryShopId still works, although there is no autocomplete due to the missing schema.

Steps to Reproduce

1. Connect to GrapQL Endpoint
2. Recieve status 400
3. Do the same using an external GraphQL Client, observe the same status as return.

[aldeed]

@janus-reith Is there a body in the response with more information?

[janus-reith]

A simple curl https://reaction-core.staging.reactioncommerce.com/graphql-alpha
returns a proper answer,
GET query missing.%

Using chrome to navigate to https://reaction-core.staging.reactioncommerce.com/graphql-alpha I simply get an Status 400. I inspected the call in chrome Network Tools, there seems to be no response body.

I tried the same with GraphQL Playground and used the Electron DevTools there.
The difference here is that it is shown as type fetch with POST (chrome was document/GET, makes sense) and that there is a response body, while Status in the Header still is 400:

{"errors":[{"message":"GraphQL introspection is not allowed by Apollo Server, but the query contained __schema or __type. To enable introspection, pass introspection: true to ApolloServer in production","locations":[{"line":2,"column":3}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"},"errorId":"cjsyhj530000s01o6xstrl5kc","type":"unknown"}]}

But GraphQL Playground won't show this outside of the devtools, and instead just displays as response:

{
  "error": "Response not successful: Received status code 400"
}

Well, now it makes sense to me, never noticed that "hidden" body before,
Is this done on purpose on production deployments?

[aldeed]

Oh I see. Yep, this is default behavior for production. See https://www.apollographql.com/docs/apollo-server/features/graphql-playground.html

In development, Apollo Server enables GraphQL Playground on the same URL as the GraphQL server itself (e.g. http://localhost:4000/graphql) and automatically serves the GUI to web browsers. When NODE_ENV is set to production, GraphQL Playground (as well as introspection) is disabled as a production best-practice.

It can be enabled for production as seen on that docs page I linked to, but Reaction needs to be updated to allow setting those options from ENV variables.

[aldeed]

Created https://github.com/reactioncommerce/reaction/issues/5025 for the ENV work