Security News
Input Validation Vulnerabilities Dominate MITRE's 2024 CWE Top 25 List
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
@jortizsao/graphql-persisted-document-loader
Advanced tools
Webpack loader that adds a documentId to a compiled graphql document, which can be used when persisting/retrieving documents
Webpack loader that assigns a documentId to a compiled GraphQL document's AST.
When dealing with persisted documents in GraphQL, tools like PersistGraphQL generate a map from query to id that helps you determine the id for a given document and send that to the server instead of the full query string. This is useful to optimize the payload sent to the server, and also to allow the server to not parse and validate those queries, and also to optimize them particularly since the server now knows which queries the client will send.
However, on the client we still need to load up this map of queries to ids, which may become too big to load in one shot if your app has quite some queries. Moreover, if you are using code splitting, you'll be loading a file that includes queries for sections of your app that may never be executed or loaded.
To solve this problem, this loader works after the graphql-tag loader by injecting the document id as a property to the compiled AST, so you can access it directly when importing/requiring the document. This effectively co-locates the id with the query, and you no longer need a big lookup map to get the id for a particular query document.
You need to have the graphql-tag (>= v2.8.0) package installed.
First install this package
npm install --save-dev graphql-persisted-document-loader
Then in the webpack configuration, add the loader BEFORE the graphql-tag/loader
:
Note: This loader currently only works for .graphql files. It does not work for
gql
calls within JS files.
module.exports = {
// ...,
module: {
rules: [
{
test: /\.graphql$/, use: [
{ loader: 'graphql-persisted-document-loader' }, // <= Before graphql-tag/loader!
{ loader: 'graphql-tag/loader' }
]
}
]
}
};
When importing or requiring .graphql
files, you'll have the documentId
property accessible from the imported object:
import query from 'query.graphql';
// OR
const query = require('query.graphql');
console.log(query.documentId); // => 5eef6cd6a52ee0d67bfbb0fdc72bbbde4d70331834eeec95787fe71b45f0a491
generateId
: function (querySource: string) => string
Function that allows to generate a custom documentId from the query source. This source contains all the dependencies sources concatenated, so it's suitable for hashing. By default it generates the sha256 hash in hexadecimal format. The source is concatenated in the same way as you'd get it from the persistgraphql
tool, so hashing the queries from the output of that tool should get you the same hash value.addTypename
: boolean
Apply a query transformation to the query documents, adding the __typename field at every level of the query. You must pass this option if your client code uses this query transformation.FAQs
Webpack loader that adds a documentId to a compiled graphql document, which can be used when persisting/retrieving documents
We found that @jortizsao/graphql-persisted-document-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.