@meshmakers/octo-services 3.4.1480 → 3.5.0

package/package.json

@@ -1,12 +1,14 @@
 {
   "name": "@meshmakers/octo-services",
-  "version": "3.4.1480",
+  "version": "3.5.00",
   "peerDependencies": {
     "@angular/common": "^22.0.0",
     "@angular/core": "^22.0.0",
+    "@apollo/client": "^4.1.0",
     "@meshmakers/shared-auth": "*",
     "@meshmakers/shared-services": "*",
     "apollo-angular": "^14.0.0",
+    "graphql": "^16.0.0 || ^17.0.0",
     "tus-js-client": "^4.3.1"
   },
   "dependencies": {
@@ -22,6 +24,10 @@
     ".": {
       "types": "./types/meshmakers-octo-services.d.ts",
       "default": "./fesm2022/meshmakers-octo-services.mjs"
+    },
+    "./testing": {
+      "types": "./types/meshmakers-octo-services-testing.d.ts",
+      "default": "./fesm2022/meshmakers-octo-services-testing.mjs"
     }
   },
   "type": "module"

package/types/meshmakers-octo-services-testing.d.ts

@@ -0,0 +1,44 @@
+import { GraphQLSchema, DocumentNode } from 'graphql';
+
+/**
+ * SECRET-safe GraphQL document rule (AB#5542), shared by the guard specs of the libraries
+ * (`octo-services/src/lib/graphql-secret-guard.spec.ts`) and the Refinery Studio
+ * (`src/app/graphql-secret-guard.spec.ts`). Pure functions — the specs do the file scanning.
+ *
+ * A document violates the rule when
+ * 1. a generic runtime `attributes` selection (`RtEntityAttributeDtoConnection`) has no
+ *    `attributeNames` argument, binds it to a NULLABLE variable, or lists a credential-like name
+ *    (list or single string) — omitting the filter returns every attribute incl. secrets;
+ * 2. a typed selection contains a credential-like String field (`password`, `clientSecret`,
+ *    `apiKey`, `botToken`, …; Boolean/number fields such as `isSecret` or `maxTokens` are fine) —
+ *    the fallback for models whose credentials are not SECRET yet;
+ * 3. a SECRET-typed field (schema type `OctoSecretState`, AB#5528) is selected without `isSet`
+ *    (the server refuses a scalar selection anyway; the state must be read as `{ isSet … }`).
+ *
+ * A non-null variable with a default (`$attributeNames: [String!]! = []`) is accepted.
+ */
+/** One violation: `key` = `<file>#<field path>` (allow-list key), `message` = human readable. */
+interface SecretGuardViolation {
+    readonly key: string;
+    readonly message: string;
+}
+/** Schema type of a typed SECRET field (AB#5528). */
+declare const SECRET_STATE_TYPE = "OctoSecretState";
+/**
+ * The GraphQL documents of a source file: the whole text of a `.graphql` file, or the inline
+ * `gql` template literals (interpolations removed) of a `.ts` file.
+ */
+declare function extractGraphQlDocuments(path: string, source: string): string[];
+/** Violations of the SECRET rule in one parsed document, validated against `schema`. */
+declare function findSecretUnsafeSelections(schema: GraphQLSchema, doc: DocumentNode, file: string): SecretGuardViolation[];
+/**
+ * Same rule as {@link findSecretUnsafeSelections}, but from source text: the schema SDL and the
+ * document are parsed with THIS module's `graphql` instance. Hosts that consume the library as a
+ * published package must use this variant — passing a schema or document built with the host's
+ * own `graphql` copy fails with "Cannot use GraphQLObjectType from another module or realm"
+ * whenever the bundler resolves `graphql` twice (ESM/CJS or nested copies).
+ */
+declare function findSecretUnsafeSelectionsInSource(schemaSdl: string, documentText: string, file: string): SecretGuardViolation[];
+
+export { SECRET_STATE_TYPE, extractGraphQlDocuments, findSecretUnsafeSelections, findSecretUnsafeSelectionsInSource };
+export type { SecretGuardViolation };