Repository: strapi/strapi
File: packages/plugins/graphql/server/src/bootstrap.ts (TypeScript)

Code before:
  // add the Strapi auth middleware
  handler.push((ctx, next) => {
    ctx.state.route = {
      info: {
        // Indicate it's a content API route
        type: 'content-api',
      },
    };

    const isPlaygroundRequest =
      ctx.request.method === 'GET' &&
      ctx.request.url === path && // Matches the GraphQL endpoint
      strapi.plugin('graphql').service('utils').playground.isEnabled() && // Only allow if the Playground is enabled
      ctx.request.header.accept?.includes('text/html'); // Specific to Playground UI loading

    // Skip authentication for the GraphQL Playground UI
    if (isPlaygroundRequest) {
      return next();
    }

    return strapi.auth.authenticate(ctx, next);
  });

  // add the graphql server for koa
  handler.push(
    koaMiddleware<DefaultStateExtends, DefaultContextExtends>(server, {
      // Initialize loaders for this request.
      context: async ({ ctx }) => ({
        state: ctx.state,
        koaContext: ctx,
      }),
    })
  );

  // now that handlers are set up, add the graphql route to our apollo server
  strapi.server.routes([
    {
      method: 'ALL',
      path,
      handler,
      config: {
        auth: false,
      },
    },
  ]);

  // Register destroy behavior
  // We're doing it here instead of exposing a destroy method to the strapi-server.js
  // file since we need to have access to the ApolloServer instance
  strapi.plugin('graphql').destroy = async () => {
    await server.stop();

Review comment (bug):
I don't think we listed this as a breaking change from Strapi 4-> Strapi 5, we just... accidentally removed it completely 🤦

So in order to keep this working as expected for someone upgrading from Strapi 4 (which would have worked if not for this bug), can we keep the support for booleans?

It would be something like this:

```
  if (serverConfig.cors === false) {
    // Explicitly disabled - don't add middleware
  } else if (serverConfig.cors === undefined || serverConfig.cors === true) {
    // enable with defaults (backwards compatible)
    handler.push(cors());
  else {
    handler.push(serverConfig.cors);
  }
```

Code after:
  // Create a new Apollo server
  const server = new ApolloServer(serverConfig);

  try {
    // server.start() must be called before using server.applyMiddleware()
    await server.start();
  } catch (error) {
    if (error instanceof Error) {
      strapi.log.error('Failed to start the Apollo server', error.message);
    }

    throw error;
  }

  // Create the route handlers for Strapi
  const handler: Core.MiddlewareHandler[] = [];

  // add cors middleware
  if (serverConfig.cors === false) {
    // Explicitly disabled - don't add middleware
  } else if (serverConfig.cors === undefined || serverConfig.cors === true) {
    // enable with defaults (backwards compatible)
    handler.push(cors());
  } else {
    // Custom options object
    handler.push(cors(serverConfig.cors));
  }

  // add koa bodyparser middleware
  if (isObject(serverConfig.bodyParserConfig)) {
    handler.push(bodyParser(serverConfig.bodyParserConfig));
  } else if (serverConfig.bodyParserConfig) {
    handler.push(bodyParser());
  } else {
    strapi.log.debug('Body parser has been disabled for Apollo server');
  }

  // add the Strapi auth middleware
  handler.push((ctx, next) => {
    ctx.state.route = {
      info: {
        // Indicate it's a content API route
        type: 'content-api',
      },
    };

    const isPlaygroundRequest =
      ctx.request.method === 'GET' &&
      ctx.request.url === path && // Matches the GraphQL endpoint
      strapi.plugin('graphql').service('utils').playground.isEnabled() && // Only allow if the Playground is enabled
      ctx.request.header.accept?.includes('text/html'); // Specific to Playground UI loading