
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@graphile/global-ids
Advanced tools
Allows you to use Relay global object identifiers in more places.
Currently (v4.3.2) PostGraphile has support for Relay Global Object Identifiers:
{node:(nodeId: ...) {...}}
interface{myTable(nodeId: ...) {...}}
interfacemutation {updateMyTable(input:{nodeId: ..., ...}){...}}
interfaceHowever, you still have to use the underlying primary keys in many places:
mutation {updatePerson(input:{nodeId: ..., patch: {organizationId: 7}}){...}}
This plugin aims to let you use global IDs in more places.
APIs in this plugin will currently be changing based on feedback from the sponsor, if you use this plugin in your stack expect your GraphQL API to change shape over time until the dust settles.
Progress:
Install:
yarn add @graphile/global-ids
Load on command line:
postgraphile --append-plugins @graphile/global-ids
Load in library usage:
app.use(
postgraphile(DB, SCHEMA, {
//...
appendPlugins: [require("@graphile/global-ids").default],
})
);
Now you can choose to specify the NodeIDs through create/update mutations instead of specifying the individual columns.
Going all-out on NodeIDs is a large undertaking right now. The hybrid approach this plugin takes moves some errors to run-time instead of build-time, and I don't want to compromise the default user experience.
Imagine you have a schema like in ./schema.sql
. You could
issue a mutation such as:
mutation CreateUser(
$user: UserInput = { organizationId: 27, name: "Bobby Tables" }
) {
createUser(input: { user: $user }) {
user {
nodeId
}
}
}
The input object UserInput
defines which fields are required:
input UserInput {
organizationId: Int!
uuid: UUID
name: String!
}
If you were to omit the organizationId
then that would be a compile-time error.
However, this plugin allows you to specify either organizationId
or
organizationNodeId
; and GraphQL currently does not have a way of
representing this data requirement. So we have to handle validation of the
query at run-time, when the mutation is executed, because the new UserInput
type will look like:
input UserInput {
organizationId: Int
organizationNodeId: ID
uuid: UUI
name: String!
}
It looks like both these organization*
fields are optional, users have to
run the mutations to find out that they've missed a field that's implicitly
rather than explicitly required.
This may change depending on progress on https://github.com/facebook/graphql/pull/395
The aim of this plugin is to introduce a hybrid approach for teams that wish to use NodeID everywhere, so we can discover everywhere it's necessary, and then in a later version of PostGraphile we may add a flag to alternate between the two methodologies.
This plugin is sponsored by MRI Technologies.
FAQs
Expands PostGraphile support for global object IDs
We found that @graphile/global-ids demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.