@smartive/graphql-magic 19.5.0 → 19.6.0

package/CHANGELOG.md

@@ -1,6 +1,6 @@
-# [19.5.0](https://github.com/smartive/graphql-magic/compare/v19.4.0...v19.5.0) (2025-07-30)
+# [19.6.0](https://github.com/smartive/graphql-magic/compare/v19.5.0...v19.6.0) (2025-08-18)
 
 
 ### Features
 
-* Union types ([#331](https://github.com/smartive/graphql-magic/issues/331)) ([da9d23c](https://github.com/smartive/graphql-magic/commit/da9d23c7b767961dd7740f4e689522d0d4231713))
+* disable introspection by default ([#335](https://github.com/smartive/graphql-magic/issues/335)) ([d3ad3b4](https://github.com/smartive/graphql-magic/commit/d3ad3b49ec4b5bd046549cb280b6a7b6324ecf2f))

package/dist/bin/gqm.cjs

@@ -30,9 +30,12 @@ var import_simple_git = require("simple-git");
 
 // src/api/execute.ts
 var import_schema = require("@graphql-tools/schema");
-var import_graphql = require("graphql");
+var import_graphql2 = require("graphql");
 var import_merge = __toESM(require("lodash/merge"), 1);
 
+// src/errors.ts
+var import_graphql = require("graphql");
+
 // src/client/mutations.ts
 var import_upperCase = __toESM(require("lodash/upperCase"), 1);
 var constantCase = (str) => (0, import_upperCase.default)(str).replace(/ /g, "_");
@@ -1273,9 +1276,6 @@ var getMigrationDate = () => {
   return `${year}${month}${day}${hours}${minutes}${seconds}`;
 };
 
-// src/errors.ts
-var import_graphql2 = require("graphql");
-
 // src/resolvers/utils.ts
 var import_graphql3 = require("graphql");
 var import_isEqual = __toESM(require("lodash/isEqual"), 1);

package/dist/cjs/index.cjs

@@ -197,11 +197,52 @@ module.exports = __toCommonJS(index_exports);
 
 // src/api/execute.ts
 var import_schema = require("@graphql-tools/schema");
-var import_graphql = require("graphql");
+var import_graphql2 = require("graphql");
 var import_merge = __toESM(require("lodash/merge"), 1);
+
+// src/errors.ts
+var import_graphql = require("graphql");
+var GraphQLError = class extends import_graphql.GraphQLError {
+  constructor(message, extensions) {
+    super(message, void 0, void 0, void 0, void 0, void 0, extensions);
+  }
+};
+var ForbiddenError = class extends GraphQLError {
+  constructor(what) {
+    super(what, { code: "FORBIDDEN" });
+  }
+};
+var NotFoundError = class extends GraphQLError {
+  constructor(what) {
+    super(what, { code: "NOT_FOUND" });
+  }
+};
+var UserInputError = class extends GraphQLError {
+  constructor(what) {
+    super(what, { code: "BAD_USER_INPUT" });
+  }
+};
+var PermissionError = class extends ForbiddenError {
+  constructor(role, action, what, why) {
+    super(`Role ${role} does not have sufficient permissions to ${action.toLowerCase()} ${what} (${why}).`);
+  }
+};
+
+// src/utils/rules.ts
+var noIntrospection = (context) => ({
+  Field(node) {
+    const name2 = node.name.value;
+    if (name2 === "__schema" || name2 === "__type") {
+      context.reportError(new ForbiddenError("GraphQL introspection is disabled"));
+    }
+  }
+});
+
+// src/api/execute.ts
 var execute = async ({
   additionalResolvers,
   body,
+  introspection = false,
   ...ctx
 }) => {
   const document2 = generate(ctx.models);
@@ -210,13 +251,22 @@ var execute = async ({
     typeDefs: document2,
     resolvers: (0, import_merge.default)(generatedResolvers, additionalResolvers)
   });
+  const parsedDocument = (0, import_graphql2.parse)(new import_graphql2.Source(body.query, "GraphQL request"));
+  const validationErrors = (0, import_graphql2.validate)(
+    schema,
+    parsedDocument,
+    introspection ? import_graphql2.specifiedRules : [...import_graphql2.specifiedRules, noIntrospection]
+  );
+  if (validationErrors.length > 0) {
+    return { errors: validationErrors };
+  }
   const contextValue = {
     document: document2,
     ...ctx
   };
-  const result = await (0, import_graphql.execute)({
+  const result = await (0, import_graphql2.execute)({
     schema,
-    document: (0, import_graphql.parse)(new import_graphql.Source(body.query, "GraphQL request")),
+    document: parsedDocument,
     contextValue,
     variableValues: body.variables,
     operationName: body.operationName,
@@ -1679,34 +1729,6 @@ var getMigrationDate = () => {
   return `${year}${month}${day}${hours}${minutes}${seconds}`;
 };
 
-// src/errors.ts
-var import_graphql2 = require("graphql");
-var GraphQLError = class extends import_graphql2.GraphQLError {
-  constructor(message, extensions) {
-    super(message, void 0, void 0, void 0, void 0, void 0, extensions);
-  }
-};
-var ForbiddenError = class extends GraphQLError {
-  constructor(what) {
-    super(what, { code: "FORBIDDEN" });
-  }
-};
-var NotFoundError = class extends GraphQLError {
-  constructor(what) {
-    super(what, { code: "NOT_FOUND" });
-  }
-};
-var UserInputError = class extends GraphQLError {
-  constructor(what) {
-    super(what, { code: "BAD_USER_INPUT" });
-  }
-};
-var PermissionError = class extends ForbiddenError {
-  constructor(role, action, what, why) {
-    super(`Role ${role} does not have sufficient permissions to ${action.toLowerCase()} ${what} (${why}).`);
-  }
-};
-
 // src/resolvers/utils.ts
 var import_crypto = require("crypto");
 var import_graphql3 = require("graphql");

package/dist/esm/api/execute.d.ts

@@ -1,6 +1,7 @@
 import { IResolvers } from '@graphql-tools/utils';
 import { Context } from '..';
-export declare const execute: ({ additionalResolvers, body, ...ctx }: {
+export declare const execute: ({ additionalResolvers, body, introspection, ...ctx }: {
     additionalResolvers?: IResolvers<any, any>;
+    introspection?: boolean;
     body: any;
 } & Omit<Context, "document">) => Promise<import("graphql").ExecutionResult<import("graphql/jsutils/ObjMap").ObjMap<unknown>, import("graphql/jsutils/ObjMap").ObjMap<unknown>>>;

package/dist/esm/api/execute.js

@@ -1,21 +1,27 @@
 import { makeExecutableSchema } from '@graphql-tools/schema';
-import { Source, execute as graphqlExecute, parse } from 'graphql';
+import { Source, execute as graphqlExecute, parse, specifiedRules, validate } from 'graphql';
 import merge from 'lodash/merge';
 import { generate, get, getResolvers } from '..';
-export const execute = async ({ additionalResolvers, body, ...ctx }) => {
+import { noIntrospection } from '../utils/rules';
+export const execute = async ({ additionalResolvers, body, introspection = false, ...ctx }) => {
     const document = generate(ctx.models);
     const generatedResolvers = getResolvers(ctx.models);
     const schema = makeExecutableSchema({
         typeDefs: document,
         resolvers: merge(generatedResolvers, additionalResolvers),
     });
+    const parsedDocument = parse(new Source(body.query, 'GraphQL request'));
+    const validationErrors = validate(schema, parsedDocument, introspection ? specifiedRules : [...specifiedRules, noIntrospection]);
+    if (validationErrors.length > 0) {
+        return { errors: validationErrors };
+    }
     const contextValue = {
         document,
         ...ctx,
     };
     const result = await graphqlExecute({
         schema,
-        document: parse(new Source(body.query, 'GraphQL request')),
+        document: parsedDocument,
         contextValue,
         variableValues: body.variables,
         operationName: body.operationName,

package/dist/esm/api/execute.js.map

@@ -1 +1 @@
-{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../../src/api/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAsB,MAAM,EAAE,OAAO,IAAI,cAAc,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,KAAK,MAAM,cAAc,CAAC;AACjC,OAAO,EAAW,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAE1D,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAAE,EAC5B,mBAAmB,EACnB,IAAI,EACJ,GAAG,GAAG,EAIqB,EAAE,EAAE;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,kBAAkB,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,oBAAoB,CAAC;QAClC,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,KAAK,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;KAC1D,CAAC,CAAC;IAEH,MAAM,YAAY,GAAY;QAC5B,QAAQ;QACR,GAAG,GAAG;KACP,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC1D,YAAY;QACZ,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAwB,EAAE,EAAE;YAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YAEzB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}
+{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../../src/api/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAsB,MAAM,EAAE,OAAO,IAAI,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjH,OAAO,KAAK,MAAM,cAAc,CAAC;AACjC,OAAO,EAAW,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAAE,EAC5B,mBAAmB,EACnB,IAAI,EACJ,aAAa,GAAG,KAAK,EACrB,GAAG,GAAG,EAKqB,EAAE,EAAE;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,kBAAkB,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,oBAAoB,CAAC;QAClC,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,KAAK,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;KAC1D,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAExE,MAAM,gBAAgB,GAAG,QAAQ,CAC/B,MAAM,EACN,cAAc,EACd,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,EAAE,eAAe,CAAC,CACtE,CAAC;IAEF,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,YAAY,GAAY;QAC5B,QAAQ;QACR,GAAG,GAAG;KACP,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,MAAM;QACN,QAAQ,EAAE,cAAc;QACxB,YAAY;QACZ,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAwB,EAAE,EAAE;YAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YAEzB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/esm/utils/rules.d.ts

@@ -0,0 +1,4 @@
+import { ValidationContext } from 'graphql';
+export declare const noIntrospection: (context: ValidationContext) => {
+    Field(node: any): void;
+};

package/dist/esm/utils/rules.js

@@ -0,0 +1,10 @@
+import { ForbiddenError } from '../errors';
+export const noIntrospection = (context) => ({
+    Field(node) {
+        const name = node.name.value;
+        if (name === '__schema' || name === '__type') {
+            context.reportError(new ForbiddenError('GraphQL introspection is disabled'));
+        }
+    },
+});
+//# sourceMappingURL=rules.js.map

package/dist/esm/utils/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../src/utils/rules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAA0B,EAAE,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7B,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7C,OAAO,CAAC,WAAW,CAAC,IAAI,cAAc,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/docs/package-lock.json

@@ -20,7 +20,7 @@
         "@docusaurus/module-type-aliases": "3.8.1",
         "@docusaurus/tsconfig": "3.8.1",
         "@docusaurus/types": "3.8.1",
-        "typescript": "5.8.3"
+        "typescript": "5.9.2"
       },
       "engines": {
         "node": ">=22.0"
@@ -16012,9 +16012,9 @@
       }
     },
     "node_modules/typescript": {
-      "version": "5.8.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.8.3.tgz",
-      "integrity": "sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ==",
+      "version": "5.9.2",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.2.tgz",
+      "integrity": "sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==",
       "devOptional": true,
       "license": "Apache-2.0",
       "bin": {

package/docs/package.json

@@ -27,7 +27,7 @@
     "@docusaurus/module-type-aliases": "3.8.1",
     "@docusaurus/tsconfig": "3.8.1",
     "@docusaurus/types": "3.8.1",
-    "typescript": "5.8.3"
+    "typescript": "5.9.2"
   },
   "browserslist": {
     "production": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartive/graphql-magic",
-  "version": "19.5.0",
+  "version": "19.6.0",
   "description": "",
   "source": "src/index.ts",
   "type": "module",
@@ -74,13 +74,13 @@
     "@types/uuid": "10.0.0",
     "create-ts-index": "1.14.0",
     "del-cli": "6.0.0",
-    "esbuild": "0.25.8",
-    "eslint": "9.32.0",
+    "esbuild": "0.25.9",
+    "eslint": "9.33.0",
     "jest": "29.7.0",
     "mock-knex": "0.4.13",
     "prettier": "3.6.2",
-    "ts-jest": "29.4.0",
+    "ts-jest": "29.4.1",
     "ts-node": "10.9.2",
-    "typescript": "5.8.3"
+    "typescript": "5.9.2"
   }
 }

package/src/api/execute.ts

@@ -1,15 +1,18 @@
 import { makeExecutableSchema } from '@graphql-tools/schema';
 import { IResolvers } from '@graphql-tools/utils';
-import { GraphQLResolveInfo, Source, execute as graphqlExecute, parse } from 'graphql';
+import { GraphQLResolveInfo, Source, execute as graphqlExecute, parse, specifiedRules, validate } from 'graphql';
 import merge from 'lodash/merge';
 import { Context, generate, get, getResolvers } from '..';
+import { noIntrospection } from '../utils/rules';
 
 export const execute = async ({
   additionalResolvers,
   body,
+  introspection = false,
   ...ctx
 }: {
   additionalResolvers?: IResolvers<any, any>;
+  introspection?: boolean;
   body: any;
 } & Omit<Context, 'document'>) => {
   const document = generate(ctx.models);
@@ -21,6 +24,18 @@ export const execute = async ({
     resolvers: merge(generatedResolvers, additionalResolvers),
   });
 
+  const parsedDocument = parse(new Source(body.query, 'GraphQL request'));
+
+  const validationErrors = validate(
+    schema,
+    parsedDocument,
+    introspection ? specifiedRules : [...specifiedRules, noIntrospection],
+  );
+
+  if (validationErrors.length > 0) {
+    return { errors: validationErrors };
+  }
+
   const contextValue: Context = {
     document,
     ...ctx,
@@ -28,7 +43,7 @@ export const execute = async ({
 
   const result = await graphqlExecute({
     schema,
-    document: parse(new Source(body.query, 'GraphQL request')),
+    document: parsedDocument,
     contextValue,
     variableValues: body.variables,
     operationName: body.operationName,

package/src/utils/rules.ts

@@ -0,0 +1,11 @@
+import { ValidationContext } from 'graphql';
+import { ForbiddenError } from '../errors';
+
+export const noIntrospection = (context: ValidationContext) => ({
+  Field(node) {
+    const name = node.name.value;
+    if (name === '__schema' || name === '__type') {
+      context.reportError(new ForbiddenError('GraphQL introspection is disabled'));
+    }
+  },
+});