
Security News
Next.js Patches Critical Middleware Vulnerability (CVE-2025-29927)
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
graphql-constraint-directive
Advanced tools
Allows using @constraint as a directive to validate input data. Inspired by Constraints Directives RFC and OpenAPI
npm install graphql-constraint-directive
const { constraintDirective, constraintDirectiveTypeDefs } = require('graphql-constraint-directive')
const express = require('express')
const { ApolloServer } = require('apollo-server-express')
const { makeExecutableSchema } = require('@graphql-tools/schema')
const typeDefs = `
type Query {
books: [Book]
}
type Book {
title: String
}
type Mutation {
createBook(input: BookInput): Book
}
input BookInput {
title: String! @constraint(minLength: 5, format: "email")
}`
let schema = makeExecutableSchema({
typeDefs: [constraintDirectiveTypeDefs, typeDefs],
})
schema = constraintDirective()(schema)
const app = express()
const server = new ApolloServer({ schema })
await server.start()
server.applyMiddleware({ app })
@constraint(minLength: 5)
Restrict to a minimum length
@constraint(maxLength: 5)
Restrict to a maximum length
@constraint(startsWith: "foo")
Ensure value starts with foo
@constraint(endsWith: "foo")
Ensure value ends with foo
@constraint(contains: "foo")
Ensure value contains foo
@constraint(notContains: "foo")
Ensure value does not contain foo
@constraint(pattern: "^[0-9a-zA-Z]*$")
Ensure value matches regex, e.g. alphanumeric
@constraint(format: "email")
Ensure value is in a particular format
Supported formats:
@constraint(min: 3)
Ensure value is greater than or equal to
@constraint(max: 3)
Ensure value is less than or equal to
@constraint(exclusiveMin: 3)
Ensure value is greater than
@constraint(exclusiveMax: 3)
Ensure value is less than
@constraint(multipleOf: 10)
Ensure value is a multiple
Each validation error throws a ConstraintDirectiveError
. Combined with a formatError function, this can be used to customise error messages.
{
code: 'ERR_GRAPHQL_CONSTRAINT_VALIDATION',
fieldName: 'theFieldName',
context: [ { arg: 'argument name which failed', value: 'value of argument' } ]
}
const formatError = function (error) {
const code = error?.originalError?.originalError?.code || error?.originalError?.code || error?.code
if (code === 'ERR_GRAPHQL_CONSTRAINT_VALIDATION') {
// return a custom object
}
return error
}
app.use('/graphql', bodyParser.json(), graphqlExpress({ schema, formatError }))
@constraint(uniqueTypeName: "Unique_Type_Name")
Override the unique type name generate by the library to the one passed as an argument
FAQs
Validate GraphQL fields
The npm package graphql-constraint-directive receives a total of 36,480 weekly downloads. As such, graphql-constraint-directive popularity was classified as popular.
We found that graphql-constraint-directive demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
Security News
A survey of 500 cybersecurity pros reveals high pay isn't enough—lack of growth and flexibility is driving attrition and risking organizational security.
Product
Socket, the leader in open source security, is now available on Google Cloud Marketplace for simplified procurement and enhanced protection against supply chain attacks.