
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@aerogear/graphql-query-mapper
Advanced tools
GraphQL Query Mapper will help you to build GraphQL API
without overfetching data on the server.
GraphQL Query Mapper transform resolvers info argument into structure that can be
used to filter data based on fields queried by client.
When building public GraphQL API external developers can often missuse the queries.
For example getProfile query that does expensive fetch from different servers can be used
only to fetch username for home page. To prevent from overfetching we can extract
information about required fields from the info object and avoid expensive queries.
Query mapping will prevent from server side database overfetching data by providing list of the fields that were requested in the client side query. Developers can use them to perform targeted queries against their database and rest endpoints.
Library exposes following methods:
getQueryObject: provides list of fields that user queried with additional helpers for database access
Example:
import { getQueryObject} from '@aerogear/graphql-query-mapper'
const resolvers = {
Query: {
models (_, params, context, info) {
const queryData = getQueryObject(info)
console.log(`${queryData.getRootFields()}`)
}
}
}
getQueryObject returns following type
/**
* Query fields specified in client side query
*/
fields: string[];
/**
* All relations that are part of the query
*/
relations: {
[relationName: string]: any;
};
/**
* Check if object has relations
*/
hasRelations(): boolean;
/**
* Checks if object has specified relation
*/
hasRelation(name: string): boolean;
/**
* Returns root fields in format acceptable for most of the sql queries
* @param separator - separates variables (default ,)
*/
getRootFields(separator?: string): string;
/**
* Returns relation fields in format acceptable for most of the sql queries.
* Method works with PostgresDB, MySQL and any other database that supports
* this syntax.
*
* @param mapper - argument that maps composite field to single one.
* By default `as` for PostgreSQL. Use `on`for mysql.
* @param separator - separates variables (default ,)
*/
getRelationFields(relation: string, mapper?: string, separator?: string): any;
/**
* Expands single key structure returned from database to graph that can
* be returned by resolver. Method picks all fields that starts with relation name.
* For example 'relation__field' and puts them into nested relation structure.
*/
expandToGraph(data: any): any;
Derived fields will still require additional checks in the resolver.
For example fullname that consist of the firstName+secondName from database:
if(fields.fullname){
fields.push("firstName")
fields.push("secondName")
}
When using query mapper we can opt out from default GraphQL query execution logic and only use only top level (root) query resolvers. Root resolvers can fetch all data required from relationships and deliver it much faster than in classical execution plan that needs to traverse thru entire graph.
Additionally developers can use graphql compiler to provide V8 optimializations for Node.js queries. See https://github.com/zalando-incubator/graphql-jit for more information.
Applying this patterns will help to archieve up to ~15 times better performance comparimng to using graphql reference implementation. This aproach will not require Facebook Data Loader cache layer sice all queries and data will be controlled from the root.
Apache-2.0
Project maintained by AeroGear GraphQL Team: https://github.com/aerogear/graphql-home
FAQs
Query specific fields in resolvers
The npm package @aerogear/graphql-query-mapper receives a total of 1 weekly downloads. As such, @aerogear/graphql-query-mapper popularity was classified as not popular.
We found that @aerogear/graphql-query-mapper demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.