@platformatic/graphql-composer - npm Package Compare versions

Comparing version 0.7.2 to 0.7.3

lib/network.js

@@ -63,4 +63,10 @@ 'use strict'
 
-  const { data, errors } = await gqlResponse.body.json()
+  const res = await gqlResponse.body.json()
+  // check if exception was thrown by the subgraph
+  if (res.error) {
+    const msg = res.message ?? res.error ?? 'Unknown subgraph request error'
+    throw new Error(msg, { cause: res })
+  }
 
+  const { data, errors } = res
   if (errors) {
@@ -67,0 +73,0 @@ const msg = errors?.[0]?.message ?? 'Unknown subgraph request error'

package.json

 {
   "name": "@platformatic/graphql-composer",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "GraphQL API Composer",
@@ -5,0 +5,0 @@ "license": "Apache-2.0",

test/network.test.js

@@ -9,2 +9,3 @@ 'use strict'
 const { createGraphqlServices } = require('./helper')
+const { makeGraphqlRequest } = require('../lib/network')
 
@@ -111,1 +112,113 @@ const gql = {
 })
+
+test('makeGraphqlRequest should return data for a valid query', async (t) => {
+  const [service] = await createGraphqlServices(t,
+    [{
+      mercurius: { ...gql },
+      exposeIntrospection: false,
+      listen: true
+    }]
+  )
+
+  const query = '{ add(x: 1, y: 2) }'
+  const data = await makeGraphqlRequest({
+    server: { host: service.host, graphqlEndpoint: '/graphql' },
+    headers: {},
+    query
+  })
+
+  assert.deepStrictEqual(data, { add: 3 })
+})
+
+test('makeGraphqlRequest should throw an error for a query with errors', async (t) => {
+  const [service] = await createGraphqlServices(t,
+    [{
+      mercurius: { ...gql },
+      exposeIntrospection: false,
+      listen: true
+    }]
+  )
+
+  const query = '{ subtract(x: 1, y: 2) }' // Invalid query
+  await assert.rejects(
+    makeGraphqlRequest({
+      server: { host: service.host, graphqlEndpoint: '/graphql' },
+      headers: {},
+      query
+    }),
+    {
+      message: 'Cannot query field "subtract" on type "Query".'
+    }
+  )
+})
+
+test('makeGraphqlRequest should throw an error if the subgraph returns an error', async (t) => {
+  const [service] = await createGraphqlServices(t,
+    [{
+      mercurius: { ...gql, validationRules: [NoSchemaIntrospectionCustomRule] },
+      exposeIntrospection: false,
+      listen: true
+    }]
+  )
+
+  const query = '{ __schema { queryType { name } } }'
+  await assert.rejects(
+    makeGraphqlRequest({
+      server: { host: service.host, graphqlEndpoint: '/graphql' },
+      headers: {},
+      query
+    }),
+    {
+      message: 'GraphQL introspection has been disabled, but the requested query contained the field "__schema".'
+    }
+  )
+})
+
+test('makeGraphqlRequest should throw an error if the subgraph context returns an error', async (t) => {
+  const [service] = await createGraphqlServices(t,
+    [{
+      mercurius: {
+        ...gql,
+        context: () => {
+          throw new Error('Error in context')
+        }
+      },
+      exposeIntrospection: false,
+      listen: true
+    }]
+  )
+
+  const query = '{ add(x: 1, y: 2) }'
+  await assert.rejects(
+    makeGraphqlRequest({
+      server: { host: service.host, graphqlEndpoint: '/graphql' },
+      headers: {},
+      query
+    }),
+    {
+      message: 'Error in context'
+    }
+  )
+})
+
+test('makeGraphqlRequest should throw an error if the response contains an error', async (t) => {
+  const [service] = await createGraphqlServices(t,
+    [{
+      mercurius: { ...gql },
+      exposeIntrospection: false,
+      listen: true
+    }]
+  )
+
+  const query = '{ add(x: 1, y: "two") }' // Invalid argument type
+  await assert.rejects(
+    makeGraphqlRequest({
+      server: { host: service.host, graphqlEndpoint: '/graphql' },
+      headers: {},
+      query
+    }),
+    {
+      message: 'Int cannot represent non-integer value: "two"'
+    }
+  )
+})

New alerts

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

211439

1.47%

Lines of code

6394

1.72%

No dependency changes