@things-factory/shell 10.1.146 → 10.1.147

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/shell",
-  "version": "10.1.146",
+  "version": "10.1.147",
   "description": "Core module for framework",
   "bin": {
     "things-factory": "bin/things-factory",
@@ -126,5 +126,5 @@
     "pg": "^8.7.3",
     "sqlite3": "^5.0.8"
   },
-  "gitHead": "7aeb3de935ec913d271866b27d931b2278259c13"
+  "gitHead": "df93dddb6ac19a27c32fad21e29ca0ce02d08eb6"
 }

package/tests/introspection-for-signed-in.test.ts

@@ -0,0 +1,48 @@
+import { ApolloServer } from '@apollo/server'
+import { buildSchema } from 'graphql'
+
+import { introspectionForSignedIn } from '../server/introspection-for-signed-in'
+
+/**
+ * Schema reading is open to a signed-in user and refused to anyone else; `__typename` is always open
+ * (ADR-0126). The server keeps Apollo's introspection on, as shell's servers do.
+ */
+const schema = buildSchema(`type Query { hello: String }`)
+
+const server = new ApolloServer({ schema, introspection: true, plugins: [introspectionForSignedIn()] })
+
+beforeAll(() => server.start())
+afterAll(() => server.stop())
+
+const ask = async (query: string, user?: object) => {
+  const response = await server.executeOperation({ query }, { contextValue: { state: { user } } })
+  return response.body.kind === 'single' ? response.body.singleResult : undefined
+}
+
+describe('reading the schema', () => {
+  it('is refused without a signed-in user', async () => {
+    const result = await ask('{ __schema { queryType { name } } }')
+    expect(result?.errors?.[0]?.extensions?.code).toBe('UNAUTHENTICATED')
+    expect(result?.data).toBeUndefined()
+  })
+
+  it('is refused for __type and inside a fragment too', async () => {
+    expect((await ask('{ __type(name: "Query") { name } }'))?.errors?.[0]?.extensions?.code).toBe('UNAUTHENTICATED')
+    expect(
+      (await ask('query { ...schema } fragment schema on Query { __schema { queryType { name } } }'))?.errors?.[0]
+        ?.extensions?.code
+    ).toBe('UNAUTHENTICATED')
+  })
+
+  it('answers a signed-in user', async () => {
+    const result = await ask('{ __schema { queryType { name } } }', { id: 'u-1' })
+    expect(result?.errors).toBeUndefined()
+    expect((result?.data as any).__schema.queryType.name).toBe('Query')
+  })
+
+  it('leaves __typename open to everyone', async () => {
+    const result = await ask('{ __typename }')
+    expect(result?.errors).toBeUndefined()
+    expect((result?.data as any).__typename).toBe('Query')
+  })
+})