1.0.0

Author: multipliedtwice

.eslintrc.js

@@ -0,0 +1,13 @@
+module.exports = {
+    parser: '@typescript-eslint/parser',
+    env: {
+      es2021: true,
+      'jest/globals': true,
+    },
+    extends: ['plugin:@typescript-eslint/recommended'],
+    parserOptions: {
+      ecmaVersion: 2019,
+      sourceType: 'module',
+    },
+    rules: {},
+  };

.gitignore

@@ -0,0 +1,9 @@
+.yarn/*
+!.yarn/releases
+!.yarn/plugins
+!.yarn/versions
+.pnp.*
+node_modules
+.npmrc
+coverage
+merge-2.spec.ts

.prettierrc

@@ -0,0 +1,9 @@
+{
+    "semi": true,
+    "singleQuote": true,
+    "printWidth": 80,
+    "tabWidth": 2,
+    "useTabs": false,
+    "trailingComma": "es5",
+    "bracketSpacing": true
+  }

.yarn/releases/yarn-3.6.4.cjs

@@ -0,0 +1,3 @@
+nodeLinker: node-modules
+
+yarnPath: .yarn/releases/yarn-3.6.4.cjs

.yarnrc.yml

@@ -0,0 +1 @@
+export {};

dist/__tests__/merge-2.spec.d.ts

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const merge_1 = require("../merge");
+describe('mergeQueries', () => {
+    test('should handle complex typegraphql-prisma queries', () => {
+        const requestQuery = `query FindAdminTalentProfile($where: TalentProfileWhereUniqueInput!) {
+  data: findAdminTalentProfile(where: $where) {
+    id
+    profileName
+    description
+    education
+    email
+    user {
+      email
+      phoneNumber
+      lastVisit
+      __typename
+    }
+    __typename
+  }
+}`;
+        const allowedQueries = [
+            `query FindAdminTalentProfile($where: TalentProfileWhereUniqueInput!) {
+  data: findAdminTalentProfile(where: $where) {
+    id
+    profileName
+    description
+    education
+    email
+    user {
+      email
+      phoneNumber
+      lastVisit
+      __typename
+    }
+    __typename
+  }
+}`,
+            `query groupByLocationsTalentProfiles($by: [TalentProfileScalarFieldEnum!]!, $orderBy: [TalentProfileOrderByWithAggregationInput!]) {
+  data: groupByTalentProfiles(by: $by, orderBy: $orderBy) {
+    location
+    _count {
+      location
+      __typename
+    }
+    __typename
+  }
+}`,
+            `query FindUser($where: CompanyOnUserWhereInput) {
+  data: findMe {
+    redirect
+    companies(where: $where) {
+      company {
+        id
+        deletedAt
+        address
+        logo
+        name
+        verificationStatus
+        __typename
+      }
+      __typename
+    }
+    profile {
+      id
+      userId
+      jobTitle
+      profileName
+      profilePicture
+      isAvailableForHire
+      isInterestedInRelocation
+      languages
+      location
+      rateCurrency
+      skills
+      totalExperience
+      description
+      experience
+      education
+      monthlyRate
+      hourlyRate
+      __typename
+    }
+    __typename
+  }
+}`,
+        ];
+        const expected = `query FindAdminTalentProfile($where: TalentProfileWhereUniqueInput!) {
+  data: findAdminTalentProfile(where: $where) {
+    id
+    profileName
+    description
+    education
+    email
+    user {
+      email
+      phoneNumber
+      lastVisit
+      __typename
+    }
+    __typename
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should handle request trying to query much more than allowed', () => {
+        const requestQuery = `query {
+  user {
+    id
+    name
+    email
+    profile {
+      bio
+      address
+      phoneNumber
+      website
+      skills
+      experiences {
+        title
+        company
+        startDate
+        endDate
+      }
+    }
+  }
+}`;
+        const allowedQueries = [
+            `{
+      user {
+        id
+        name
+      }
+    }`,
+        ];
+        const expected = `{
+  user {
+    id
+    name
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+});

dist/__tests__/merge-2.spec.js

@@ -0,0 +1 @@
+export {};

dist/__tests__/merge.spec.d.ts

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const merge_1 = require("../merge");
+describe('mergeQueries', () => {
+    test('should allow fields present in allowed queries', () => {
+        const requestQuery = `{ user { id, name, email } }`;
+        const allowedQueries = [`{ user { id, name } }`];
+        const expected = `{
+  user {
+    id
+    name
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should exclude fields not present in allowed queries', () => {
+        const requestQuery = `{ user { id, name, email } }`;
+        const allowedQueries = [`{ user { id } }`];
+        const expected = `{
+  user {
+    id
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should handle nested queries', () => {
+        const requestQuery = `{ user { id, profile { name, age } } }`;
+        const allowedQueries = [`{ user { profile { name } } }`];
+        const expected = `{
+  user {
+    profile {
+      name
+    }
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should handle queries with arguments', () => {
+        const requestQuery = `{ users(age: 30) { id, name } }`;
+        const allowedQueries = [`{ users { name } }`];
+        const expected = `{
+  users(age: 30) {
+    name
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should strictly follow allowed queries with aliases', () => {
+        const requestQuery = `{ user: users { id, name } }`;
+        const allowedQueries = [`{ user: users { name } }`];
+        const expected = `{
+  user: users {
+    name
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should strictly follow allowed queries without aliases', () => {
+        const requestQuery = `{ users { id, name } }`;
+        const allowedQueries = [`{ users { name } }`];
+        const expected = `{
+  users {
+    name
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should handle mutations', () => {
+        const requestQuery = `mutation { updateUser(id: 1, data: { name: "New Name" }) { id, name } }`;
+        const allowedQueries = [
+            `mutation { updateUser(id: 1, data: { name: "New Name" }) { name } }`,
+        ];
+        const expected = `mutation {
+  updateUser(id: 1, data: {name: "New Name"}) {
+    name
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should handle multiple allowed queries', () => {
+        const requestQuery = `{ user { id, name, email } }`;
+        const allowedQueries = [`{ user { id } }`, `{ user { name } }`];
+        const expected = `{
+  user {
+    id
+    name
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should handle empty requestQuery', () => {
+        const requestQuery = '';
+        const allowedQueries = [`{ user { id, name } }`];
+        const expected = '';
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should handle empty allowedQueries', () => {
+        const requestQuery = `{ user { id, name, email } }`;
+        const allowedQueries = [];
+        const expected = '';
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should handle mutations', () => {
+        const requestQuery = `mutation { updateUser(id: 1, data: { name: "New Name" }) { id, name } }`;
+        const allowedQueries = [
+            `mutation { updateUser(id: 1, data: { name: "New Name" }) { name } }`,
+        ];
+        const expected = `mutation {
+  updateUser(id: 1, data: {name: "New Name"}) {
+    name
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should handle deeply nested queries', () => {
+        const requestQuery = `{ user { id, profile { name, address { street, city } } } }`;
+        const allowedQueries = [`{ user { profile { address { street } } } }`];
+        const expected = `{
+  user {
+    profile {
+      address {
+        street
+      }
+    }
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+    test('should handle nested mutations', () => {
+        const requestQuery = `mutation { updateUser(id: 1, data: { profile: { name: "New Name" } }) { id } }`;
+        const allowedQueries = [
+            `mutation { updateUser(id: 1, data: { profile: { name: "New Name" } }) { id } }`,
+        ];
+        const expected = `mutation {
+  updateUser(id: 1, data: {profile: {name: "New Name"}}) {
+    id
+  }
+}`;
+        expect((0, merge_1.mergeQueries)(requestQuery, allowedQueries)).toBe(expected);
+    });
+});

dist/__tests__/merge.spec.js

@@ -0,0 +1,8 @@
+import { NextFunction, Request, Response } from 'express';
+export declare class GraphQLQueryPurifier {
+    private gqlPath;
+    private queryMap;
+    constructor(gqlPath: string);
+    private loadQueries;
+    customGraphQLMiddleware: (req: Request, res: Response, next: NextFunction) => void;
+}