
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@graasp/apps-query-client
Advanced tools
This repository implements the react-query hooks and mutations for apps to consume the Graasp Apps API. It also provides a mock API server based on MirageJS for local development.
This apps-query-client package provides a mock API to mock any call an app might use to consume the Graasp API. It is based on MirageJS, which simulates the network requests themselves, and can thus remember remote state in memory. So the database is preserved as long as the app is not refreshed. This mock API is also particularly useful for continuous integration tests.
The following steps are designed to take into account Cypress, our test framework. So the mock database can also receive data from the tests and apply them.
!WARNING: The mock API cannot fake uploading and downloading files!
env-cmd dependency. Create a new script start:local in package.json:"start:local": "env-cmd -f ./.env.development react-scripts start"
.env.development which will contain the variables below. The app id you will choose doesn't have to be valid, but needs to exist.REACT_APP_GRAASP_APP_ID=<your app id>
REACT_APP_GRAASP_APP_KEY=<your app key>
REACT_APP_ENABLE_MOCK_API=true
src/config/queryClient.js with the following code.import {
configureQueryClient,
buildMockLocalContext,
buildMockParentWindow,
} from '@graasp/apps-query-client';
const values = configureQueryClient({
GRAASP_APP_KEY: process.env.REACT_APP_GRAASP_APP_KEY,
isStandalone: MOCK_API,
});
export values;
src/index.js. mockApi can take a defined context and/or database if necessary (see the Cypress section)import { mockApi } from '@graasp/apps-query-client';
if (process.env.REACT_APP_ENABLE_MOCK_API === 'true') {
mockApi();
}
withContext and the withToken files in your app. It will handle the authentication and fetching the local context automatically for you. For example:const AppWithContext = withToken(App, {
LoadingComponent: <Loader />,
useAuthToken: hooks.useAuthToken,
onError: () => {
showErrorToast('An error occured while requesting the token.');
},
});
const AppWithContextAndToken = withContext(AppWithContext, {
LoadingComponent: <Loader />,
useGetLocalContext: hooks.useGetLocalContext,
useAutoResize: hooks.useAutoResize,
onError: () => {
showErrorToast('An error occured while fetching the context.');
},
});
You can now start your app with the mock API installed. Don't forget to disable it when you build your app (set REACT_APP_ENABLE_MOCK_API to false).
The next steps will help you set up Cypress to work with MirageJS. There is an official tutorial from MirageJS. But in our case, we followed a different strategy.
src/index.js to include some config defined from Cypress in the mock server:if (process.env.REACT_APP_ENABLE_MOCK_API === 'true') {
mockApi({
appContext: window.Cypress ? window.appContext : undefined,
database: window.Cypress ? window.database : undefined,
});
}
cypress/support/commands.js. You will need to define MEMBERS and CURRENT_MEMBER to reuse them in your tests as well.import { buildDatabase } from '@graasp/apps-query-client';
Cypress.Commands.add('setUpApi', ({ currentMember = CURRENT_MEMBER, database = {}, appContext } = {}) => {
// mock api and database
Cypress.on('window:before:load', (win) => {
win.database = buildDatabase({
members: Object.values(MEMBERS),
...database,
});
win.appContext = appContext;
});
});
// start with an empty database
cy.setUpApi();
// start with one app data pre-saved in builder for an admin
cy.setUpApi({
database: { appData: [MOCK_APP_DATA] },
appContext: {
permission: 'admin',
context: 'builder',
},
});
If you need to have files in the mocked server, you can use the uploadedFiles array of the setupApi. The following are steps to follow if you want to upload and retrieve a file for an app.
AppSetting and add it in the appSettings array of the setupApi (in the Cypress test of the frontend).// MOCK_FILE_APP_SETTING
{
id: mockFileSettingId,
name: 'file', // should be named `file`! Do not change it!
data: {
path: `apps/app-setting/${item.id}/${mockFileSettingId}`, // This path should be mocked in the MSW! If you want to use another path, you just have to mock it.
},
item,
creator,
createdAt,
updatedAt,
};
File type. With Cypress, have a look to cy.fixtures (put the setupApi in the then callback).uploadedFiles: [
{
id: MOCK_FILE_APP_SETTING.id,
file,
},
],
GET /app-items/app-settings/:appSettingId/download (or your mocked route) to retrieve the path of the file.GET /download-app-setting-url/:appSettingId.Another solution could be to upload your file from the Cypress test, by using the route /app-items/app-settings-/upload?id=:itemId for example.
FAQs
Query client repository for Graasp apps
The npm package @graasp/apps-query-client receives a total of 124 weekly downloads. As such, @graasp/apps-query-client popularity was classified as not popular.
We found that @graasp/apps-query-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.