@envelop/operation-field-permissions 3.4.0-alpha-aca44e1.0 → 3.4.0-alpha-e9434aa.0

package/{index.js → cjs/index.js}

@@ -1,11 +1,9 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-const core = require('@envelop/core');
-const extendedValidation = require('@envelop/extended-validation');
-const graphql = require('graphql');
-
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useOperationFieldPermissions = void 0;
+const core_1 = require("@envelop/core");
+const extended_validation_1 = require("@envelop/extended-validation");
+const graphql_1 = require("graphql");
 const OPERATION_PERMISSIONS_SYMBOL = Symbol('OPERATION_PERMISSIONS_SYMBOL');
 /**
  * Returns a set of type names that allow access to all fields in the type.
@@ -37,38 +35,43 @@ const OperationScopeRule = (options) => (context, executionArgs) => {
         if (!permissionContext.allowAll &&
             !permissionContext.wildcardTypes.has(objectType.name) &&
             !permissionContext.schemaCoordinates.has(schemaCoordinate)) {
-            context.reportError(new graphql.GraphQLError(options.formatError(schemaCoordinate), [node]));
+            // TODO: EnvelopError was a bad idea ;)
+            // We should use GraphQLError once the object constructor lands in stable GraphQL.js
+            // and useMaskedErrors supports it.
+            const error = new core_1.EnvelopError(options.formatError(schemaCoordinate));
+            error.nodes = [node];
+            context.reportError(error);
         }
     };
     return {
         Field(node) {
             const type = context.getType();
             if (type) {
-                const namedType = graphql.getNamedType(type);
-                if (graphql.isIntrospectionType(namedType)) {
+                const namedType = (0, graphql_1.getNamedType)(type);
+                if ((0, graphql_1.isIntrospectionType)(namedType)) {
                     return false;
                 }
             }
             const parentType = context.getParentType();
             if (parentType) {
-                if (graphql.isIntrospectionType(parentType)) {
+                if ((0, graphql_1.isIntrospectionType)(parentType)) {
                     return false;
                 }
                 // We handle objects, interface and union permissions differently.
                 // When accessing an an object field, we check simply run the check.
-                if (graphql.isObjectType(parentType)) {
+                if ((0, graphql_1.isObjectType)(parentType)) {
                     handleField(node, parentType);
                 }
                 // To allow a union case, every type in the union has to be allowed/
                 // If one of the types doesn't permit access we should throw a validation error.
-                if (graphql.isUnionType(parentType)) {
+                if ((0, graphql_1.isUnionType)(parentType)) {
                     for (const objectType of parentType.getTypes()) {
                         handleField(node, objectType);
                     }
                 }
                 // Same goes for interfaces. Every implementation should allow the access of the given
                 // field to pass the validation rule.
-                if (graphql.isInterfaceType(parentType)) {
+                if ((0, graphql_1.isInterfaceType)(parentType)) {
                     for (const objectType of executionArgs.schema.getImplementations(parentType).objects) {
                         handleField(node, objectType);
                     }
@@ -83,14 +86,14 @@ const useOperationFieldPermissions = (opts) => {
     return {
         onPluginInit({ addPlugin }) {
             var _a;
-            addPlugin(extendedValidation.useExtendedValidation({
+            addPlugin((0, extended_validation_1.useExtendedValidation)({
                 rules: [
                     OperationScopeRule({
                         formatError: (_a = opts.formatError) !== null && _a !== void 0 ? _a : defaultFormatError,
                     }),
                 ],
             }));
-            addPlugin(core.useExtendContext(async (context) => {
+            addPlugin((0, core_1.useExtendContext)(async (context) => {
                 const permissions = await opts.getPermissions(context);
                 // Schema coordinates is a set of type-name field-name strings that
                 // describe the position of a field in the schema.
@@ -108,5 +111,4 @@ const useOperationFieldPermissions = (opts) => {
         },
     };
 };
-
 exports.useOperationFieldPermissions = useOperationFieldPermissions;

package/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/{index.mjs → esm/index.js}

@@ -1,7 +1,9 @@
-import { useExtendContext } from '@envelop/core';
-import { useExtendedValidation } from '@envelop/extended-validation';
-import { getNamedType, isIntrospectionType, isObjectType, isUnionType, isInterfaceType, GraphQLError } from 'graphql';
-
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useOperationFieldPermissions = void 0;
+const core_1 = require("@envelop/core");
+const extended_validation_1 = require("@envelop/extended-validation");
+const graphql_1 = require("graphql");
 const OPERATION_PERMISSIONS_SYMBOL = Symbol('OPERATION_PERMISSIONS_SYMBOL');
 /**
  * Returns a set of type names that allow access to all fields in the type.
@@ -33,38 +35,43 @@ const OperationScopeRule = (options) => (context, executionArgs) => {
         if (!permissionContext.allowAll &&
             !permissionContext.wildcardTypes.has(objectType.name) &&
             !permissionContext.schemaCoordinates.has(schemaCoordinate)) {
-            context.reportError(new GraphQLError(options.formatError(schemaCoordinate), [node]));
+            // TODO: EnvelopError was a bad idea ;)
+            // We should use GraphQLError once the object constructor lands in stable GraphQL.js
+            // and useMaskedErrors supports it.
+            const error = new core_1.EnvelopError(options.formatError(schemaCoordinate));
+            error.nodes = [node];
+            context.reportError(error);
         }
     };
     return {
         Field(node) {
             const type = context.getType();
             if (type) {
-                const namedType = getNamedType(type);
-                if (isIntrospectionType(namedType)) {
+                const namedType = (0, graphql_1.getNamedType)(type);
+                if ((0, graphql_1.isIntrospectionType)(namedType)) {
                     return false;
                 }
             }
             const parentType = context.getParentType();
             if (parentType) {
-                if (isIntrospectionType(parentType)) {
+                if ((0, graphql_1.isIntrospectionType)(parentType)) {
                     return false;
                 }
                 // We handle objects, interface and union permissions differently.
                 // When accessing an an object field, we check simply run the check.
-                if (isObjectType(parentType)) {
+                if ((0, graphql_1.isObjectType)(parentType)) {
                     handleField(node, parentType);
                 }
                 // To allow a union case, every type in the union has to be allowed/
                 // If one of the types doesn't permit access we should throw a validation error.
-                if (isUnionType(parentType)) {
+                if ((0, graphql_1.isUnionType)(parentType)) {
                     for (const objectType of parentType.getTypes()) {
                         handleField(node, objectType);
                     }
                 }
                 // Same goes for interfaces. Every implementation should allow the access of the given
                 // field to pass the validation rule.
-                if (isInterfaceType(parentType)) {
+                if ((0, graphql_1.isInterfaceType)(parentType)) {
                     for (const objectType of executionArgs.schema.getImplementations(parentType).objects) {
                         handleField(node, objectType);
                     }
@@ -79,14 +86,14 @@ const useOperationFieldPermissions = (opts) => {
     return {
         onPluginInit({ addPlugin }) {
             var _a;
-            addPlugin(useExtendedValidation({
+            addPlugin((0, extended_validation_1.useExtendedValidation)({
                 rules: [
                     OperationScopeRule({
                         formatError: (_a = opts.formatError) !== null && _a !== void 0 ? _a : defaultFormatError,
                     }),
                 ],
             }));
-            addPlugin(useExtendContext(async (context) => {
+            addPlugin((0, core_1.useExtendContext)(async (context) => {
                 const permissions = await opts.getPermissions(context);
                 // Schema coordinates is a set of type-name field-name strings that
                 // describe the position of a field in the schema.
@@ -104,5 +111,4 @@ const useOperationFieldPermissions = (opts) => {
         },
     };
 };
-
-export { useOperationFieldPermissions };
+exports.useOperationFieldPermissions = useOperationFieldPermissions;

package/package.json

@@ -1,36 +1,57 @@
 {
   "name": "@envelop/operation-field-permissions",
-  "version": "3.4.0-alpha-aca44e1.0",
+  "version": "3.4.0-alpha-e9434aa.0",
   "sideEffects": false,
   "peerDependencies": {
-    "@envelop/core": "2.4.0-alpha-aca44e1.0",
+    "@envelop/core": "2.4.0-alpha-e9434aa.0",
     "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0"
   },
   "dependencies": {
-    "@envelop/extended-validation": "1.7.0-alpha-aca44e1.0"
+    "@envelop/extended-validation": "1.7.0-alpha-e9434aa.0"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/dotansimha/envelop.git",
+    "url": "https://github.com/n1ru4l/envelop.git",
     "directory": "packages/plugins/operation-field-permissions"
   },
   "author": "Laurin Quast <laurinquast@googlemail.com.com>",
   "license": "MIT",
-  "main": "index.js",
-  "module": "index.mjs",
-  "typings": "index.d.ts",
+  "main": "cjs/index.js",
+  "module": "esm/index.js",
+  "typings": "typings/index.d.ts",
   "typescript": {
-    "definition": "index.d.ts"
+    "definition": "typings/index.d.ts"
   },
+  "type": "module",
   "exports": {
     ".": {
-      "require": "./index.js",
-      "import": "./index.mjs"
+      "require": {
+        "types": "./typings/index.d.ts",
+        "default": "./cjs/index.js"
+      },
+      "import": {
+        "types": "./typings/index.d.ts",
+        "default": "./esm/index.js"
+      },
+      "default": {
+        "types": "./typings/index.d.ts",
+        "default": "./esm/index.js"
+      }
     },
     "./*": {
-      "require": "./*.js",
-      "import": "./*.mjs"
+      "require": {
+        "types": "./typings/*.d.ts",
+        "default": "./cjs/*.js"
+      },
+      "import": {
+        "types": "./typings/*.d.ts",
+        "default": "./esm/*.js"
+      },
+      "default": {
+        "types": "./typings/*.d.ts",
+        "default": "./esm/*.js"
+      }
     },
     "./package.json": "./package.json"
   }
-}
+}

package/README.md

@@ -1,65 +0,0 @@
-## `@envelop/operation-field-permissions`
-
-Disallow executing operations that select certain fields. Useful if you want to restrict the scope of certain public API users to a subset of the public GraphQL schema, without triggering execution (e.g. how [graphql-shield](https://github.com/maticzav/graphql-shield) works).
-
-**Note:** This plugin and authorization on a resolver level (or via middleware) are complementary. You should still verify whether a viewer is allowed to access certain data within your resolvers.
-
-## Installation
-
-```bash
-yarn add @envelop/operation-field-permissions
-```
-
-## Usage Example
-
-```ts
-import { envelop, useSchema } from '@envelop/core';
-import { useOperationFieldPermissions } from 'envelop/operation-field-permissions';
-
-const getEnveloped = envelop({
-  plugins: [
-    useSchema(schema),
-    useOperationFieldPermissions({
-      // we can access graphql context here
-      getPermissions: async context => new Set(['Query.greetings', ...context.viewer.permissions]),
-    }),
-    /* ... other envelops */
-  ],
-});
-```
-
-**Schema**
-
-```graphql
-type Query {
-  greetings: [String!]!
-  foo: String
-}
-```
-
-**Operation**
-
-```graphql
-query {
-  foo
-}
-```
-
-**Response**
-
-```json
-{
-  "data": null,
-  "errors": [
-    {
-      "message": "Insufficient permissions for selecting 'Query.foo'.",
-      "locations": [
-        {
-          "line": 2,
-          "column": 2
-        }
-      ]
-    }
-  ]
-}
-```