Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@deboxsoft/users-graphql-api
Advanced tools
Schema, Resolvers and Utils for GraphQL server with JSAccounts
This package does not requires any network interface / express in order to combine with your GraphQL - it's just a collection of GraphQL schema, resolvers and utils!
This package exports GraphQL schema and GraphQL resolvers, which you can extend with your existing GraphQL schema server.
Start by installing it from NPM / Yarn:
yarn add @deboxsoft/users-server @deboxsoft/users-graphql-api
This package does not create a transport or anything else, only schema and string and resolvers as object.
Start by configuring your AccountsServer
as you wish. For example, using MongoDB:
import mongoose from "mongoose";
import AccountsServer from "@deboxsoft/users-server";
import AccountsPassword from "@deboxsoft/users-password";
import MongoDBInterface from "@deboxsoft/users-mongo";
const db = mongoose.connection;
const password = new AccountsPassword();
const accountsServer = new AccountsServer(
{
db: new MongoDBInterface(db),
tokenSecret: "SECRET"
},
{
password
}
);
Next, import AccountsModule
from this package, and run it with your AccountsServer
:
import { AccountsModule } from "@deboxsoft/users-graphql-api";
const accountsGraphQL = AccountsModule.forRoot({
accountsServer
});
Now, add accountsGraphQL.typeDefs
to your schema definition (just before using it with makeExecutableSchema
), and merge your resolvers object with accountsGraphQL.resolvers
by using @graphql-tools/epoxy
, for example:
import { makeExecutableSchema } from "@graphql-tools/schema";
import { mergeGraphQLSchemas, mergeResolvers } from "@graphql-tools/epoxy";
const typeDefs = [
`
type Query {
myQuery: String
}
type Mutation {
myMutation: String
}
schema {
query: Query,
mutation: Mutation
}
`,
accountsGraphQL.typeDefs
];
let myResolvers = {
Query: {
myQuery: () => "Hello"
},
Mutation: {
myMutation: () => "Hello"
}
};
const schema = makeExecutableSchema({
resolvers: mergeResolvers([accountsGraphQL.resolvers, myResolvers]),
typeDefs: mergeGraphQLSchemas([typeDefs])
});
The last step is to extend your graphqlExpress
with a context middleware, that extracts the authentication token from the HTTP request, so AccountsServer will automatically validate it:
app.use(
GRAPHQL_ROUTE,
bodyParser.json(),
graphqlExpress((request) => {
return {
context: {
...accountsGraphQL(request)
// your context
},
schema
};
})
);
You can authenticate your own resolvers with JSAccounts
authentication flow, by using authenticated
method from this package.
This method composer also extends context
with the current authenticated user!
This is an example for a protected mutation:
import AccountsServer from "@users/deboxsoft-server";
import { authenticated } from "@users/deboxsoft-graphql-api";
export const resolver = {
Mutation: {
updateUserProfile: authenticated((rootValue, args, context) => {
// Write your resolver here
// context.user - the current authenticated user!
})
}
};
This package allow you to customize the GraphQL schema and it's resolvers.
For example, some application main query called MyQuery
or RootQuery
instead of query, so you can customize the name, without modifying you application's schema.
These are the available customizations:
rootQueryName
(string) - The name of the root query, default: Query
.rootMutationName
(string) - The name of the root mutation, default: Mutation
.extend
(boolean) - whether to add extend
before the root type declaration, default: true
.withSchemaDefinition
(boolean): whether to add schema { ... }
declaration to the generation schema, default: false
.Pass a second object to createAccountsGraphQL
, for example:
Another possible customization is to modify the name of the authentication header, use it with accountsContext
(the default is Authorization
):
const myCustomGraphQLAccounts = AccountsModule.forRoot({
accountsServer,
rootQueryName: "RootQuery",
rootMutationName: "RootMutation",
headerName: "MyCustomHeader"
});
User
To extend User
object with custom fields and logic, add your own GraphQL type definition of User
with the prefix of extend
, and add your fields:
extend type User {
firstName: String
lastName: String
}
And also implement a regular resolver, for the fields you added:
const UserResolver = {
firstName: () => "Dotan",
lastName: () => "Simha"
};
User
during password creationTo extend the user object during the user creation you need to extend the CreateUserInput
type and add your fields:
extend input CreateUserInput {
profile: CreateUserProfileInput!
}
input CreateUserProfileInput {
firstName: String!
lastName: String!
}
The user will be saved in the db with the profile key set.
FAQs
Server side GraphQL transport for users
The npm package @deboxsoft/users-graphql-api receives a total of 3 weekly downloads. As such, @deboxsoft/users-graphql-api popularity was classified as not popular.
We found that @deboxsoft/users-graphql-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.