
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
gql-generator-node
Advanced tools
Generate queries based on GraphQL schema.
npm install gql-generator-node --save-dev
Given any schema:
type Query {
user(id: Int!): User!
}
type User {
id: Int!
username: String!
email: String!
createdAt: String!
}
this library automatically creates queries like:
query user($id: Int!) {
user(id: $id){
id
username
email
createdAt
}
}
It supports all query types:
as well as all fields descriptors, including unions, interfaces and fragments.
Last but not least it addresses corner cases - like circular reference.
The most basic usage is to generate all queries at once by passing schema to generateAll function:
import {generateAll} from 'gql-generator-node';
const {queries, mutations, subscriptions} = generateAll(schema);
console.log(mutations.signup);
/*
mutation signup($username: String!, email: String!, password: String!){
signup(username: $username, email: $email, password: $password){
token
user {
id
username
email
createdAt
}
}
}
*/
import {generateQuery} from "gql-generator-node";
const query = generateQuery({
field: schema
.getQueryType()
.getFields().user
})
console.log(query);
/*
Query user($user_context_user_details_region_language: String, $user_details_region_language: String, $id: Int!){
user(id: $id){
id
username
email
createdAt
context{
user{
id
username
email
createdAt
details{
... on Guest {
region(language: $user_context_user_details_region_language)
}
... on Member {
address
}
}
}
domain
}
details{
... on Guest {
region(language: $user_details_region_language)
}
... on Member {
address
}
}
}
}
*/
By default query is generated with all nested fields (skipping only circular references), however this behavior can be customised by passing skeleton of object we are interested in. For instance:
const query = generateQuery({
field: schema
.getQueryType()
.getFields().user,
skeleton: {
'email':
true
}
})
console.log(query);
/*
Query user($id: Int!){
user(id: $id){
email
}
}
*/
As default top variables names correspond to schema while nested ones can be addressed by the path - so all of them can be addressed independently in a declarative way. Ex:
mutation signup($signup_user_context_user_details_region_language: String, $signup_user_details_region_language: String, $email: String!, $username: String!, $password: String!){
signup(email: $email, username: $username, password: $password){
token
user{
id
username
email
createdAt
context{
user{
id
username
email
createdAt
details{
... on Guest {
region(language: $signup_user_context_user_details_region_language)
}
... on Member {
address
}
}
}
domain
}
details{
... on Guest {
region(language: $signup_user_details_region_language)
}
... on Member {
address
}
}
}
}
}
Yet some applications might take advantage of custom dedupe functions to for instance to send same argument to all sub fields using same name:
gqlGenerator(schema,depth,({args})=>{
const o = {};
(args || []).forEach(arg=>{
o[arg.name] = arg;
});
return o;
})
=>
mutation signup($language: String, $email: String!, $username: String!, $password: String!){
signup(email: $email, username: $username, password: $password){
token
user{
id
username
email
createdAt
context{
user{
id
username
email
createdAt
details{
... on Guest {
region(language: $language)
}
... on Member {
address
}
}
}
domain
}
details{
... on Guest {
region(language: $language)
}
... on Member {
address
}
}
}
}
}
I personally use it to write graphql endpoints tests.
Assuming GraphQL schema:
type Mutation {
signup(
email: String!
username: String!
password: String!
): UserToken!
}
type UserToken {
token: String!
user: User!
}
type User {
id: Int!
username: String!
email: String!
createdAt: String!
}
Before this tool, one needed to write GraphQL API test like this:
test('signup', async () => {
const query = `mutation signup($username: String!, email: String!, password: String!){
signup(username: $username, email: $email, password: $password){
token
user {
id
username
email
createdAt
}
}
}`;
return graphql(query);
});
As gqlGenerator
can generate queries, above test becomes:
const {queries} = generateAll(schema.getMutationType().signup);
const variables = { username: "I", email: "best_developer@testing.org", password: '1234' };
test.each(Object.entries(queries))('%s', async ([name,query]) =>
graphql(query,{variables})
);
It not only greatly simplifies testing which might be now automated and batched but also ensures that you would never miss the field to test. Last but not least there is no code duplication between schema and test so most schema updates does not force tests update.
Code has has its origins at modelo/gql-generator, however it greatly diverged from this implementation.
Please feel free open the issues! Although the current stage satisfies my application usage, I would be happy to provide help and improvements if there will be a need for it. Also you can gratify it with star, if you find it useful.
FAQs
Generate queries as simple function of schema.
The npm package gql-generator-node receives a total of 701 weekly downloads. As such, gql-generator-node popularity was classified as not popular.
We found that gql-generator-node demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.