Marc Mintel
5397309103
Some checks failed
Build & Deploy / 🔍 Prepare (push) Successful in 20s
Build & Deploy / 🧪 QA (push) Failing after 34s
Build & Deploy / 🏗️ Build (push) Has started running
Build & Deploy / 🚀 Deploy (push) Has been cancelled
Build & Deploy / 🧪 Smoke Test (push) Has been cancelled
Build & Deploy / ⚡ Lighthouse (push) Has been cancelled
Build & Deploy / 🔔 Notify (push) Has been cancelled
929 lines
40 KiB
Plaintext
929 lines
40 KiB
Plaintext
(function (global, factory) {
|
|
typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
|
|
typeof define === 'function' && define.amd ? define(['exports'], factory) :
|
|
(global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.graphqlHttpAudits = {}));
|
|
})(this, (function (exports) { 'use strict';
|
|
|
|
/**
|
|
*
|
|
* utils
|
|
*
|
|
*/
|
|
/** @private */
|
|
function extendedTypeof(val) {
|
|
if (val === null) {
|
|
return 'null';
|
|
}
|
|
if (Array.isArray(val)) {
|
|
return 'array';
|
|
}
|
|
return typeof val;
|
|
}
|
|
|
|
/**
|
|
*
|
|
* audit/utils
|
|
*
|
|
*/
|
|
/**
|
|
* Wrap and prepare an audit for testing.
|
|
*
|
|
* @private
|
|
*/
|
|
function audit(id, name, fn) {
|
|
return {
|
|
id,
|
|
name,
|
|
fn: async () => {
|
|
try {
|
|
await fn();
|
|
return {
|
|
id,
|
|
name,
|
|
status: 'ok',
|
|
};
|
|
}
|
|
catch (err) {
|
|
if (!(err instanceof AuditError)) {
|
|
// anything thrown that is not an assertion error is considered fatal
|
|
throw err;
|
|
}
|
|
return {
|
|
id,
|
|
name,
|
|
status: name.startsWith('MUST')
|
|
? // failing MUSTs are considered errors
|
|
'error'
|
|
: name.startsWith('SHOULD')
|
|
? // recommendations are warnings
|
|
'warn'
|
|
: // everything else is truly optional
|
|
'notice',
|
|
reason: err.reason,
|
|
response: err.response,
|
|
};
|
|
}
|
|
},
|
|
};
|
|
}
|
|
/**
|
|
* Error thrown when an assertion test fails.
|
|
*
|
|
* @private
|
|
*/
|
|
class AuditError {
|
|
constructor(response, reason) {
|
|
this.response = response;
|
|
this.reason = reason;
|
|
}
|
|
}
|
|
/**
|
|
* Will throw an AuditError if the assertion on Response fails.
|
|
*
|
|
* All fatal problems will throw an instance of an Error.
|
|
*
|
|
* The name "ressert" is a wordplay combining "response" and "assert".
|
|
*
|
|
* @private
|
|
*/
|
|
function ressert(res) {
|
|
return {
|
|
status: {
|
|
toBe(code) {
|
|
if (res.status !== code) {
|
|
throw new AuditError(res, `Response status code is not ${code}`);
|
|
}
|
|
},
|
|
toBeBetween: (min, max) => {
|
|
if (!(min <= res.status && res.status <= max)) {
|
|
throw new AuditError(res, `Response status is not between ${min} and ${max}`);
|
|
}
|
|
},
|
|
},
|
|
header(key) {
|
|
return {
|
|
toContain(part) {
|
|
var _a;
|
|
if (!((_a = res.headers.get(key)) === null || _a === void 0 ? void 0 : _a.includes(part))) {
|
|
throw new AuditError(res, `Response header ${key} does not contain ${part}`);
|
|
}
|
|
},
|
|
notToContain(part) {
|
|
var _a;
|
|
if ((_a = res.headers.get(key)) === null || _a === void 0 ? void 0 : _a.includes(part)) {
|
|
throw new AuditError(res, `Response header ${key} contains ${part}`);
|
|
}
|
|
},
|
|
};
|
|
},
|
|
bodyAsExecutionResult: {
|
|
data: {
|
|
async toBe(val) {
|
|
const clonedRes = res.clone(); // allow the body to be re-read
|
|
const body = await assertBodyAsExecutionResult(res);
|
|
if (body.data !== val) {
|
|
throw new AuditError(clonedRes, `Response body execution result data is not "${val}"`);
|
|
}
|
|
},
|
|
},
|
|
async toHaveProperty(key) {
|
|
const clonedRes = res.clone(); // allow the body to be re-read
|
|
const body = await assertBodyAsExecutionResult(res);
|
|
if (!(key in body)) {
|
|
throw new AuditError(clonedRes, `Response body execution result does not have a property "${key}"`);
|
|
}
|
|
},
|
|
async notToHaveProperty(key) {
|
|
const clonedRes = res.clone(); // allow the body to be re-read
|
|
const body = await assertBodyAsExecutionResult(res);
|
|
if (key in body) {
|
|
throw new AuditError(clonedRes, `Response body execution result has a property "${key}"`);
|
|
}
|
|
},
|
|
},
|
|
};
|
|
}
|
|
/** @private */
|
|
async function assertBodyAsExecutionResult(res) {
|
|
let decoded;
|
|
try {
|
|
const decoder = new TextDecoder('utf-8');
|
|
const buff = await res.arrayBuffer();
|
|
decoded = decoder.decode(buff);
|
|
}
|
|
catch (err) {
|
|
throw new AuditError(res, 'Response body is not UTF-8 encoded');
|
|
}
|
|
let body;
|
|
try {
|
|
body = JSON.parse(decoded);
|
|
}
|
|
catch (err) {
|
|
throw new AuditError(res, 'Response body is not valid JSON');
|
|
}
|
|
return body;
|
|
}
|
|
|
|
/**
|
|
*
|
|
* audit/server
|
|
*
|
|
*/
|
|
/**
|
|
* List of server audits required to check GraphQL over HTTP spec conformance.
|
|
*
|
|
* @category Audits
|
|
*/
|
|
function serverAudits(opts) {
|
|
const fetchFn = (opts.fetchFn || fetch);
|
|
return [
|
|
// Media Types
|
|
audit(
|
|
// TODO: convert to MUST after watershed
|
|
'22EB', 'SHOULD accept application/graphql-response+json and match the content-type', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({ query: '{ __typename }' }),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
ressert(res)
|
|
.header('content-type')
|
|
.toContain('application/graphql-response+json');
|
|
}),
|
|
audit('4655', 'MUST accept application/json and match the content-type', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/json',
|
|
},
|
|
body: JSON.stringify({ query: '{ __typename }' }),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
ressert(res).header('content-type').toContain('application/json');
|
|
}),
|
|
audit('47DE', 'SHOULD accept */* and use application/json for the content-type', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: '*/*',
|
|
},
|
|
body: JSON.stringify({ query: '{ __typename }' }),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
ressert(res).header('content-type').toContain('application/json');
|
|
}),
|
|
audit('80D8', 'SHOULD assume application/json content-type when accept is missing', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
},
|
|
body: JSON.stringify({ query: '{ __typename }' }),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
ressert(res).header('content-type').toContain('application/json');
|
|
}),
|
|
audit('82A3', 'MUST use utf-8 encoding when responding', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
},
|
|
body: JSON.stringify({ query: '{ __typename }' }),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
try {
|
|
const decoder = new TextDecoder('utf-8');
|
|
decoder.decode(await res.arrayBuffer());
|
|
}
|
|
catch (_a) {
|
|
throw new AuditError(res, 'Response body is not UTF-8 encoded');
|
|
}
|
|
}),
|
|
audit('BF61', 'MUST accept utf-8 encoded request', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json; charset=utf-8',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ __type(name: "Run🏃Swim🏊") { name } }',
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
audit('78D5', 'MUST assume utf-8 in request if encoding is unspecified', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
},
|
|
body: JSON.stringify({ query: '{ __typename }' }),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
// Request
|
|
audit('2C94', 'MUST accept POST requests', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({ query: '{ __typename }' }),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
audit('5A70', 'MAY accept application/x-www-form-urlencoded formatted GET requests', async () => {
|
|
const url = new URL(await getUrl(opts.url));
|
|
url.searchParams.set('query', '{ __typename }');
|
|
const res = await fetchFn(url.toString());
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
// Request GET
|
|
// TODO: this is a MUST if the server supports GET requests
|
|
audit('9C48', 'MAY NOT allow executing mutations on GET requests', async () => {
|
|
const url = new URL(await getUrl(opts.url));
|
|
url.searchParams.set('query', 'mutation { __typename }');
|
|
const res = await fetchFn(url.toString(), {
|
|
headers: {
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
});
|
|
ressert(res).status.toBeBetween(400, 499);
|
|
}),
|
|
// Request POST
|
|
audit('9ABE', 'MAY respond with 4xx status code if content-type is not supplied on POST requests', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
});
|
|
ressert(res).status.toBeBetween(400, 499);
|
|
}),
|
|
audit('03D4', 'MUST accept application/json POST requests', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({ query: '{ __typename }' }),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
audit('A5BF', 'MAY use 400 status code when request body is missing on POST', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
});
|
|
ressert(res).status.toBe(400);
|
|
}),
|
|
// Request Parameters
|
|
audit('423L', 'MAY use 400 status code on missing {query} parameter', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({ notquery: '{ __typename }' }),
|
|
});
|
|
ressert(res).status.toBe(400);
|
|
}),
|
|
...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => audit(`LKJ${index}`, `MAY use 400 status code on ${extendedTypeof(invalid)} {query} parameter`, async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: invalid,
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(400);
|
|
})),
|
|
audit(
|
|
// TODO: convert to MUST after watershed
|
|
'34A2', 'SHOULD allow string {query} parameter when accepting application/graphql-response+json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ __typename }',
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
audit('13EE', 'MUST allow string {query} parameter when accepting application/json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ __typename }',
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
|
|
}),
|
|
...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => audit(`6C0${index}`, `MAY use 400 status code on ${extendedTypeof(invalid)} {operationName} parameter`, async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
operationName: invalid,
|
|
query: '{ __typename }',
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(400);
|
|
})),
|
|
audit(
|
|
// TODO: convert to MUST after watershed
|
|
'8161', 'SHOULD allow string {operationName} parameter when accepting application/graphql-response+json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({
|
|
operationName: 'Query',
|
|
query: 'query Query { __typename }',
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
audit('B8B3', 'MUST allow string {operationName} parameter when accepting application/json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
operationName: 'Query',
|
|
query: 'query Query { __typename }',
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
|
|
}),
|
|
...['variables', 'operationName', 'extensions'].flatMap((parameter, index) => [
|
|
audit(`94B${index}`,
|
|
// TODO: convert to MUST after watershed
|
|
`SHOULD allow null {${parameter}} parameter when accepting application/graphql-response+json`, async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ __typename }',
|
|
[parameter]: null,
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
|
|
}),
|
|
audit(`022${index}`, `MUST allow null {${parameter}} parameter when accepting application/json`, async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ __typename }',
|
|
[parameter]: null,
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
|
|
}),
|
|
]),
|
|
...['string', 0, false, ['array']].map((invalid, index) => audit(`476${index}`, `MAY use 400 status code on ${extendedTypeof(invalid)} {variables} parameter`, async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ __typename }',
|
|
variables: invalid,
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(400);
|
|
})),
|
|
audit(
|
|
// TODO: convert to MUST after watershed
|
|
'2EA1', 'SHOULD allow map {variables} parameter when accepting application/graphql-response+json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: 'query Type($name: String!) { __type(name: $name) { name } }',
|
|
variables: { name: 'sometype' },
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
audit('28B9', 'MUST allow map {variables} parameter when accepting application/json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: 'query Type($name: String!) { __type(name: $name) { name } }',
|
|
variables: { name: 'sometype' },
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
|
|
}),
|
|
audit('D6D5', 'MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json', async () => {
|
|
const url = new URL(await getUrl(opts.url));
|
|
url.searchParams.set('query', 'query Type($name: String!) { __type(name: $name) { name } }');
|
|
url.searchParams.set('variables', JSON.stringify({ name: 'sometype' }));
|
|
const res = await fetchFn(url.toString(), {
|
|
method: 'GET',
|
|
headers: {
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
audit('6A70', 'MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json', async () => {
|
|
const url = new URL(await getUrl(opts.url));
|
|
url.searchParams.set('query', 'query Type($name: String!) { __type(name: $name) { name } }');
|
|
url.searchParams.set('variables', JSON.stringify({ name: 'sometype' }));
|
|
const res = await fetchFn(url.toString(), {
|
|
method: 'GET',
|
|
headers: {
|
|
accept: 'application/json',
|
|
},
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
|
|
}),
|
|
...['string', 0, false, ['array']].map((invalid, index) => audit(`58B${index}`,
|
|
// TODO: convert to MUST after watershed
|
|
`MAY use 400 status code on ${extendedTypeof(invalid)} {extensions} parameter`, async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ __typename }',
|
|
extensions: invalid,
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(400);
|
|
})),
|
|
audit(
|
|
// TODO: convert to MUST after watershed
|
|
'428F', 'SHOULD allow map {extensions} parameter when accepting application/graphql-response+json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ __typename }',
|
|
extensions: { some: 'value' },
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
audit('1B7A', 'MUST allow map {extensions} parameter when accepting application/json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ __typename }',
|
|
extensions: { some: 'value' },
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
|
|
}),
|
|
audit('B6DC', 'MAY use 4xx or 5xx status codes on JSON parsing failure', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
},
|
|
body: '{ "not a JSON',
|
|
});
|
|
ressert(res).status.toBeBetween(400, 499);
|
|
}),
|
|
audit('BCF8', 'MAY use 400 status code on JSON parsing failure', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
},
|
|
body: '{ "not a JSON',
|
|
});
|
|
ressert(res).status.toBe(400);
|
|
}),
|
|
audit('8764', 'MAY use 4xx or 5xx status codes if parameters are invalid', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
qeury /* typo */: '{ __typename }',
|
|
}),
|
|
});
|
|
ressert(res).status.toBeBetween(400, 599);
|
|
}),
|
|
audit('3E3A', 'MAY use 400 status code if parameters are invalid', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
qeury: /* typo */ '{ __typename }',
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(400);
|
|
}),
|
|
// TODO: audit('39AA', 'MUST accept a map for the {extensions} parameter'),
|
|
// Response application/json
|
|
audit('572B', 'SHOULD use 200 status code on document parsing failure when accepting application/json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/json',
|
|
},
|
|
body: JSON.stringify({ query: '{' }),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
audit('FDE2', 'SHOULD use 200 status code on document validation failure when accepting application/json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
audit('7B9B', 'SHOULD use a status code of 200 on variable coercion failure when accepting application/json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: 'query CoerceFailure($id: ID!){ __typename }',
|
|
variables: { id: null },
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(200);
|
|
}),
|
|
// Response application/graphql-response+json
|
|
audit(
|
|
// TODO: convert to MUST after watershed
|
|
'865D', 'SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{',
|
|
}),
|
|
});
|
|
ressert(res).status.toBeBetween(400, 599);
|
|
}),
|
|
audit('556A', 'SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{',
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(400);
|
|
}),
|
|
audit('D586', 'SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{',
|
|
}),
|
|
});
|
|
await ressert(res).bodyAsExecutionResult.data.toBe(undefined);
|
|
}),
|
|
audit(
|
|
// TODO: convert to MUST after watershed
|
|
'51FE', 'SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
|
|
}),
|
|
});
|
|
ressert(res).status.toBeBetween(400, 599);
|
|
}),
|
|
audit('74FF', 'SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(400);
|
|
}),
|
|
audit('5E5B', 'SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
|
|
}),
|
|
});
|
|
await ressert(res).bodyAsExecutionResult.data.toBe(undefined);
|
|
}),
|
|
audit('86EE', 'SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json', async () => {
|
|
const res = await fetchFn(await getUrl(opts.url), {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
accept: 'application/graphql-response+json',
|
|
},
|
|
body: JSON.stringify({
|
|
query: 'query CoerceFailure($id: ID!){ __typename }',
|
|
variables: { id: null },
|
|
}),
|
|
});
|
|
ressert(res).status.toBe(400);
|
|
}),
|
|
// TODO: how to fail and have the data entry?
|
|
// audit('EE52', 'MUST use 2xx status code if response contains the data entry and it is not null when accepting application/graphql-response+json'),
|
|
// TODO: how to make an unauthorized request?
|
|
// https://graphql.github.io/graphql-over-http/draft/#sel-EANNNDTAAEVBAAqqc
|
|
// audit('BC58', 'SHOULD use 401 or 403 status codes when the request is not permitted')
|
|
];
|
|
}
|
|
/**
|
|
* Performs the full list of server audits required for GraphQL over HTTP spec conformance.
|
|
*
|
|
* Please consult the `AuditResult` for more information.
|
|
*
|
|
* @category Audits
|
|
*/
|
|
async function auditServer(opts) {
|
|
const audits = serverAudits(opts);
|
|
// audit tests will throw only on fatal errors, tests are contained within the AuditResult
|
|
return await Promise.all(audits.map(({ fn }) => fn()));
|
|
}
|
|
/** @private */
|
|
async function getUrl(url) {
|
|
if (typeof url === 'function') {
|
|
return await url();
|
|
}
|
|
return url;
|
|
}
|
|
|
|
/**
|
|
* Renders the provided audit results to well-formatted and valid HTML.
|
|
*
|
|
* Do note that the rendered result is not an HTML document, it's rather
|
|
* just a component with results.
|
|
*/
|
|
async function renderAuditResultsToHTML(results) {
|
|
const grouped = {
|
|
total: 0,
|
|
ok: [],
|
|
notice: [],
|
|
warn: [],
|
|
error: [],
|
|
};
|
|
for (const result of results) {
|
|
grouped.total++;
|
|
if (result.status === 'ok') {
|
|
grouped[result.status].push(result);
|
|
}
|
|
else {
|
|
grouped[result.status].push(result);
|
|
}
|
|
}
|
|
let report = '<i>* This report was auto-generated by graphql-http</i>\n';
|
|
report += '\n';
|
|
report += '<h1>GraphQL over HTTP audit report</h1>\n';
|
|
report += '\n';
|
|
report += '<ul>\n';
|
|
report += `<li><b>${grouped.total}</b> audits in total</li>\n`;
|
|
// font-family: monospace helps render native emojis in HTML
|
|
if (grouped.ok.length) {
|
|
report += `<li><span style="font-family: monospace">✅</span> <b>${grouped.ok.length}</b> pass</li>\n`;
|
|
}
|
|
if (grouped.notice.length) {
|
|
report += `<li><span style="font-family: monospace">💡</span> <b>${grouped.notice.length}</b> notices (suggestions)</li>\n`;
|
|
}
|
|
if (grouped.warn.length) {
|
|
report += `<li><span style="font-family: monospace">❗️</span> <b>${grouped.warn.length}</b> warnings (optional)</li>\n`;
|
|
}
|
|
if (grouped.error.length) {
|
|
report += `<li><span style="font-family: monospace">❌</span> <b>${grouped.error.length}</b> errors (required)</li>\n`;
|
|
}
|
|
report += '</ul>\n';
|
|
report += '\n';
|
|
if (grouped.ok.length) {
|
|
report += '<h2>Passing</h2>\n';
|
|
report += '<ol>\n';
|
|
for (const [, result] of grouped.ok.entries()) {
|
|
report += `<li><code>${result.id}</code> ${result.name}</li>\n`;
|
|
}
|
|
report += '</ol>\n';
|
|
report += '\n';
|
|
}
|
|
if (grouped.notice.length) {
|
|
report += `<h2>Notices</h2>\n`;
|
|
report +=
|
|
'The server <i>MAY</i> support these, but are truly optional. These are suggestions following recommended conventions.\n';
|
|
report += '<ol>\n';
|
|
for (const [, result] of grouped.notice.entries()) {
|
|
report += await printAuditFail(result);
|
|
}
|
|
report += '</ol>\n';
|
|
report += '\n';
|
|
}
|
|
if (grouped.warn.length) {
|
|
report += `<h2>Warnings</h2>\n`;
|
|
report += 'The server <i>SHOULD</i> support these, but is not required.\n';
|
|
report += '<ol>\n';
|
|
for (const [, result] of grouped.warn.entries()) {
|
|
report += await printAuditFail(result);
|
|
}
|
|
report += '</ol>\n';
|
|
report += '\n';
|
|
}
|
|
if (grouped.error.length) {
|
|
report += `<h2>Errors</h2>\n`;
|
|
report += 'The server <b>MUST</b> support these.\n';
|
|
report += '<ol>\n';
|
|
for (const [, result] of grouped.error.entries()) {
|
|
report += await printAuditFail(result);
|
|
}
|
|
report += '</ol>\n';
|
|
}
|
|
return report;
|
|
}
|
|
async function printAuditFail(result) {
|
|
var _a;
|
|
let report = '';
|
|
report += `<li><code>${result.id}</code> ${result.name}\n`;
|
|
report += '<details>\n';
|
|
report += `<summary>${truncate(result.reason)}</summary>\n`;
|
|
report += '<pre><code class="lang-json">'; // no "\n" because they count in HTML pre tags
|
|
const res = result.response;
|
|
const headers = {};
|
|
for (const [key, val] of res.headers.entries()) {
|
|
// some headers change on each run, dont report it
|
|
if (key === 'date') {
|
|
headers[key] = '<timestamp>';
|
|
}
|
|
else if (['cf-ray', 'server-timing', 'set-cookie'].includes(key)) {
|
|
headers[key] = '<omitted>';
|
|
}
|
|
else {
|
|
headers[key] = val;
|
|
}
|
|
}
|
|
let text = '', json;
|
|
try {
|
|
text = await res.text();
|
|
json = JSON.parse(text);
|
|
// is json, there shouldnt be nothing to sanitize (hopefully)
|
|
}
|
|
catch (_b) {
|
|
// is not json, avoid rendering html (rest is allowed)
|
|
if ((_a = res.headers.get('content-type')) === null || _a === void 0 ? void 0 : _a.includes('text/html')) {
|
|
text = '<html omitted>';
|
|
}
|
|
}
|
|
const stringified = JSON.stringify({
|
|
status: res.status,
|
|
statusText: res.statusText,
|
|
headers,
|
|
body: json || ((text === null || text === void 0 ? void 0 : text.length) > 5120 ? '<body is too long>' : text) || null,
|
|
}, (_k, v) => {
|
|
if (v != null && typeof v === 'object' && !Array.isArray(v)) {
|
|
// sort object fields for stable stringify
|
|
const acc = {};
|
|
return Object.keys(v)
|
|
.sort()
|
|
.reverse() // body on bottom
|
|
.reduce((acc, k) => {
|
|
acc[k] = v[k];
|
|
return acc;
|
|
}, acc);
|
|
}
|
|
return v;
|
|
}, 2);
|
|
report += stringified + '\n';
|
|
report += '</code></pre>\n';
|
|
report += '</details>\n';
|
|
report += '</li>\n';
|
|
return report;
|
|
}
|
|
function truncate(str, len = 1024) {
|
|
if (str.length > len) {
|
|
return str.substring(0, len) + '...';
|
|
}
|
|
return str;
|
|
}
|
|
|
|
exports.auditServer = auditServer;
|
|
exports.renderAuditResultsToHTML = renderAuditResultsToHTML;
|
|
exports.serverAudits = serverAudits;
|
|
|
|
}));
|