
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
fauna-up is a simple CLI to update your database's GraphQL schema, resolver functions, indexes, and database roles without going to the FaunaDB dashboard. It uses the https://graphql.fauna.com/import endpoint to update the schema from a file within your project, and the FQL driver for JavaScript to update/create functions, roles, and indexes.
WORK IN PROGRESS Based on https://www.npmjs.com/package/fauna-gql-upload
You could install locally within your project:
npm install fauna-up
or, you could install it globally
npm install fauna-up -g
When installing locally you have to run the command using a NPM script.
Package.json:
{
"name": "my-app",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"fauna": "fauna-up"
}
}
Running it:
npm run fauna
When installing globally, all you have to do is run the command:
fauna-up
For the command to work properly, you need to have certain information in your project.
.env file with a variable called FAUNADB_SECRETfauna/schema.gql relative to the working directory where the command is executed.fauna/functions. Within this directory, you should have one .js file for each of you functions. See Uploading Functions for an example of such a file.fauna/roles. Within this directory, you should have one .js file for each of your roles. See Uploading Roles for an example of such a file.fauna/indexes. Within this directory, you should have one .js file for each of your indexes. See Uploading indexes for an example of such a file.If you want to use another environment variable name, another path for the schema, or another functions directory, you could create a .fauna.json file. It takes the following properties:
{
"schemaPath": "./schema.gql",
"secretEnv": "FAUNADB_SECRET",
"fnsDir": "fauna/functions",
"rolesDir": "fauna/roles"
}
These would now take precedent over the default values.
To upload your schema, it has to be placed at fauna/schema.gql or the path specified in .fauna.json. It also needs to be valid (of course), otherwise you would get back an error. For more information on writing a GraphQL schema for FaunaDB, see the official documentation.
If you need to make schema changes that are not compatible with the previous versions of the schema, you might have to override it. This can be done by adding a --override flag when running the command.
Like so:
fauna-up --override
If you are running the command locally with npm, you need to add the flag to the npm script.
{
"name": "my-app",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"fauna": "fauna-up",
"fauna-override": "fauna-up --override",
}
}
and then run:
npm run fauna-override
Since overriding the schema removes all collections, functions, and indexes, you will be asked to confirm your intention. In certain situations though, you'd want to skip this confirmation, like in a CI/CD pipeline. Therefore, you can use the -y flag to override the prompt and go forward with the opration without questions.
It would look like this:
fauna-up --override -y
To upload functions, you need a to have a fauna/functions directory containing .js files that describe your function's name, role, and body. As mentioned earlier, it is possible to customize the functions path by adding a fnsDir property to the .fauna.json file.
For your functions to work, you need to require("faunadb") inside each of the function files, and use the functions inside fauna.query to build your function. Take a look at the following example:
const{ query } = require("faunadb");
const{ Query, Lambda, Let, Identity, Select, Get, Var } = query;
module.exports = {
name: "current_user",
body:
Query(
Lambda([], Let({ userRef: Identity() }, Select([], Get(Var("userRef")))))
)
};
This function would return the currently authenticated user.
As you can see, you need to export an object containing the name of the function, as well as the body of the function. See the Fauna documentation for a full reference on the accepted properties.
To upload roles, you need a fauna/roles directory containing a .js file for each of your roles. These files describe the role and look like the following example.
const{ query } = require("faunadb");
const { Collection } = query;
const onlyDeleteByOwner = require("../predicates/onlyDeleteByOwner");
module.exports = {
name: "user",
privileges: [
{
resource: Collection("Comment"),
actions: {
read: true,
create: true,
delete: onlyDeleteByOwner
}
}
]
}
As with the functions, you need to include certain functions from the faunadb driver.
To upload indexes, you need a fauna/indexes directory containing a .js file for each of your roles. These files describe the role and look like the following example.
const { query } = require("faunadb");
const { Collection } = query;
module.exports = {
name: "people_sort_by_age_asc",
source: Collection("People"),
values: [
{ field: ["data", "age"] },
{ field: ["ref"] }
]
}
Fauna does actually create indexes based on your schema. But in certain situations it might be necessary to create custom indexes. The index above sorts people in ascending order by their age.
Another detail that you've probably noticed is the onlyDeleteByOwner function. This is a predicate function. It lets you define your own permissions based on the user making the request and the document's fields. You would normally have to write these inline with the permissions. But in this case, we can create these in seperate files and reuse them multiple times for different resources.
The onlyDeleteByOwner.js file would like this:
const{ query } = require("faunadb");
const{ Query, Lambda, Equals, Identity, Select, Get, Var } = query;
module.exports = Query(
Lambda(
"ref",
Equals(Identity(), Select(["data", "user"], Get(Var("ref"))))
)
);
If you want to get in touch with me, feel free to reach out to me one Twitter(@chj_web).
FAQs
Upload a GraphQL schema to FaunaDB using the command line.
We found that fauna-up demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.