@trackunit/react-graphql-tools 1.16.4-alpha-3e7014314a8.0 → 1.17.3

package/CHANGELOG.md

@@ -1,3 +1,84 @@
+## 1.17.3 (2026-08-27)
+
+### 🧱 Updated Dependencies
+
+- Updated iris-app-build-utilities to 2.4.23
+
+## 1.17.2 (2026-08-27)
+
+### 🧱 Updated Dependencies
+
+- Updated iris-app-build-utilities to 2.4.22
+
+## 1.17.1 (2026-08-27)
+
+### 🧱 Updated Dependencies
+
+- Updated iris-app-build-utilities to 2.4.21
+
+## 1.17.0 (2026-08-27)
+
+### 🚀 Features
+
+- **react-graphql-tools:** derive the authorization scopes a project requires ([7c5c1db1258](https://github.com/Trackunit/manager/commit/7c5c1db1258))
+
+### 🧱 Updated Dependencies
+
+- Updated iris-app-build-utilities to 2.4.20
+
+### ❤️ Thank You
+
+- Cursor @cursoragent
+- Mikkel Thorbjørn Andersen
+
+## 1.16.3 (2026-08-27)
+
+### 🧱 Updated Dependencies
+
+- Updated iris-app-build-utilities to 2.4.19
+
+## 1.16.2 (2026-08-25)
+
+### 🩹 Fixes
+
+- **react-graphql-tools:** repair scope collection after applied review suggestions ([3890f3a9706](https://github.com/Trackunit/manager/commit/3890f3a9706))
+
+### 🧱 Updated Dependencies
+
+- Updated iris-app-build-utilities to 2.4.18
+- Updated react-vite-test-setup to 0.0.114
+
+### ❤️ Thank You
+
+- Cursor @cursoragent
+- Mikkel Thorbjørn Andersen
+
+## 1.16.1 (2026-08-25)
+
+### 🧱 Updated Dependencies
+
+- Updated iris-app-build-utilities to 2.4.17
+- Updated react-vite-test-setup to 0.0.113
+
+## 1.16.0 (2026-08-24)
+
+### 🚀 Features
+
+- **react-graphql-tools:** document required authorization scopes in generated mocks ([8b500687a87](https://github.com/Trackunit/manager/commit/8b500687a87))
+
+### 🩹 Fixes
+
+- **react-graphql-tools:** repair scope collection after applied review suggestions ([e0fe4fad522](https://github.com/Trackunit/manager/commit/e0fe4fad522))
+
+### 🧱 Updated Dependencies
+
+- Updated iris-app-build-utilities to 2.4.16
+
+### ❤️ Thank You
+
+- Cursor @cursoragent
+- Mikkel Thorbjørn Andersen
+
 ## 1.15.17 (2026-08-20)
 
 ### 🧱 Updated Dependencies

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trackunit/react-graphql-tools",
-  "version": "1.16.4-alpha-3e7014314a8.0",
+  "version": "1.17.3",
   "main": "src/index.js",
   "executors": "./executors.json",
   "generators": "./generators.json",
@@ -18,7 +18,9 @@
     "win-ca": "^3.5.1",
     "tslib": "^2.6.2",
     "@nx/devkit": "23.1.0",
-    "@nx/js": "23.1.0"
+    "@nx/js": "23.1.0",
+    "@trackunit/iris-app-build-utilities": "2.4.23",
+    "graphql": "^16.10.0"
   },
   "migrations": "./migrations.json",
   "types": "./src/index.d.ts",

package/src/executors/createHooks/collectPermissions.d.ts

@@ -0,0 +1,25 @@
+import { GraphQLSchema } from "graphql";
+/**
+ * Loads the authorization-annotated schema, reusing codegen's own schema resolution
+ * (`resolveSchema`) so scopes are read from the exact schema operations are generated against - the
+ * internal superset (which carries every `@authorization` directive) when checked out, otherwise
+ * the public schema. Returns null when only the remote endpoint is available (nothing to read from
+ * disk) or the schema file is missing (e.g. isolated test workspaces).
+ */
+export declare const loadAuthSchema: (nxRoot: string) => GraphQLSchema | null;
+/**
+ * Builds a map of operation name -> sorted, de-duplicated authorization scopes required by that
+ * operation, from raw GraphQL operation/fragment source documents.
+ *
+ * @param schema The authorization-annotated schema to resolve field directives against.
+ * @param documents Raw `.graphql` source strings (operations and any fragments they spread).
+ */
+export declare const collectPermissionsFromDocuments: (schema: GraphQLSchema, documents: Array<string>) => Map<string, Array<string>>;
+/**
+ * Builds a map of operation name -> sorted, de-duplicated authorization scopes required by that
+ * operation, based on the `@authorization` directives of every field the operation touches.
+ *
+ * @param schema The authorization-annotated schema to resolve field directives against.
+ * @param generatedFilePath Path to the generated `graphql.ts`; its lib `src` root holds the operations.
+ */
+export declare const collectOperationPermissions: (schema: GraphQLSchema, generatedFilePath: string) => Map<string, Array<string>>;

package/src/executors/createHooks/collectPermissions.js

@@ -0,0 +1,200 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectOperationPermissions = exports.collectPermissionsFromDocuments = exports.loadAuthSchema = void 0;
+const iris_app_build_utilities_1 = require("@trackunit/iris-app-build-utilities");
+const fs_1 = require("fs");
+const graphql_1 = require("graphql");
+const path_1 = require("path");
+const AUTH_DIRECTIVE = "authorization";
+const ALLOW_ARGUMENT = "allow";
+/**
+ * Schemas are large (tens of thousands of lines) and every generated lib triggers a scrub, so cache
+ * the built schema per absolute path for the lifetime of the process.
+ */
+const schemaCache = new Map();
+/**
+ * Loads the authorization-annotated schema, reusing codegen's own schema resolution
+ * (`resolveSchema`) so scopes are read from the exact schema operations are generated against - the
+ * internal superset (which carries every `@authorization` directive) when checked out, otherwise
+ * the public schema. Returns null when only the remote endpoint is available (nothing to read from
+ * disk) or the schema file is missing (e.g. isolated test workspaces).
+ */
+const loadAuthSchema = (nxRoot) => {
+    const schemaPointer = (0, iris_app_build_utilities_1.resolveSchema)("auto");
+    // `resolveSchema` returns the public endpoint URL when no schema file is checked out; we can only
+    // inspect directives from a schema we can read off disk, so skip in that case.
+    if (/^https?:\/\//.test(schemaPointer))
+        return null;
+    const schemaPath = (0, path_1.isAbsolute)(schemaPointer) ? schemaPointer : (0, path_1.join)(nxRoot, schemaPointer);
+    if (!(0, fs_1.existsSync)(schemaPath))
+        return null;
+    const cached = schemaCache.get(schemaPath);
+    if (cached !== undefined)
+        return cached;
+    try {
+        const schema = (0, graphql_1.buildSchema)((0, fs_1.readFileSync)(schemaPath, { encoding: "utf-8" }), { assumeValidSDL: true });
+        schemaCache.set(schemaPath, schema);
+        return schema;
+    }
+    catch {
+        schemaCache.set(schemaPath, null);
+        return null;
+    }
+};
+exports.loadAuthSchema = loadAuthSchema;
+/**
+ * Flattens a GraphQL value node into the string scopes it contains.
+ * `allow` accepts both a single string (`allow: "asset.view"`) and a list (`allow: ["asset.view"]`).
+ */
+const valueToScopes = (value) => {
+    if (value.kind === "StringValue")
+        return [value.value];
+    if (value.kind === "ListValue")
+        return value.values.flatMap(valueToScopes);
+    return [];
+};
+/**
+ * Reads the scopes declared by any `@authorization(allow: ...)` directive in the given list.
+ */
+const scopesFromDirectives = (directives) => {
+    if (!directives)
+        return [];
+    return directives
+        .filter(directive => directive.name.value === AUTH_DIRECTIVE)
+        .flatMap(directive => {
+        const allowArgument = directive.arguments?.find(argument => argument.name.value === ALLOW_ARGUMENT);
+        return allowArgument ? valueToScopes(allowArgument.value) : [];
+    });
+};
+/**
+ * Collects the object-level `@authorization` scopes declared directly on a type definition
+ * (the directive is valid on both FIELD_DEFINITION and OBJECT).
+ */
+const scopesFromType = (type) => {
+    const definitionDirectives = scopesFromDirectives(type.astNode?.directives);
+    const extensionDirectives = type.extensionASTNodes.flatMap(extension => scopesFromDirectives(extension.directives));
+    return [...definitionDirectives, ...extensionDirectives];
+};
+/**
+ * Walks a selection set against the schema, following inline fragments and fragment spreads, and
+ * accumulates every authorization scope referenced by the accessed fields and their return types.
+ */
+const collectSelectionScopes = (schema, parentType, selectionSet, fragments, scopes, visitedFragments) => {
+    if (!parentType)
+        return;
+    for (const selection of selectionSet.selections) {
+        if (selection.kind === "Field") {
+            if (selection.name.value === "__typename")
+                continue;
+            if (!(0, graphql_1.isObjectType)(parentType) && !(0, graphql_1.isInterfaceType)(parentType))
+                continue;
+            const fieldDefinition = parentType.getFields()[selection.name.value];
+            if (!fieldDefinition)
+                continue;
+            scopesFromDirectives(fieldDefinition.astNode?.directives).forEach(scope => scopes.add(scope));
+            const fieldType = (0, graphql_1.getNamedType)(fieldDefinition.type);
+            scopesFromType(fieldType).forEach(scope => scopes.add(scope));
+            if (selection.selectionSet) {
+                collectSelectionScopes(schema, fieldType, selection.selectionSet, fragments, scopes, visitedFragments);
+            }
+        }
+        else if (selection.kind === "InlineFragment") {
+            const targetType = selection.typeCondition ? schema.getType(selection.typeCondition.name.value) : parentType;
+            if (targetType)
+                scopesFromType(targetType).forEach(scope => scopes.add(scope));
+            collectSelectionScopes(schema, targetType ?? undefined, selection.selectionSet, fragments, scopes, visitedFragments);
+        }
+        else {
+            const fragmentName = selection.name.value;
+            if (visitedFragments.has(fragmentName))
+                continue;
+            visitedFragments.add(fragmentName);
+            const fragment = fragments.get(fragmentName);
+            if (!fragment)
+                continue;
+            const targetType = schema.getType(fragment.typeCondition.name.value);
+            if (targetType)
+                scopesFromType(targetType).forEach(scope => scopes.add(scope));
+            collectSelectionScopes(schema, targetType ?? undefined, fragment.selectionSet, fragments, scopes, visitedFragments);
+        }
+    }
+};
+/**
+ * Recursively reads every `.graphql` source document under a directory, skipping generated output.
+ * `*-manager.graphql` is excluded to match codegen's default document globs, so an operation that was
+ * never generated can't shadow a generated one of the same name.
+ */
+const readGraphqlDocuments = (directory) => {
+    if (!(0, fs_1.existsSync)(directory))
+        return [];
+    const documents = [];
+    for (const entry of (0, fs_1.readdirSync)(directory, { withFileTypes: true })) {
+        const fullPath = (0, path_1.join)(directory, entry.name);
+        if (entry.isDirectory()) {
+            if (entry.name === "generated" || entry.name === "node_modules")
+                continue;
+            documents.push(...readGraphqlDocuments(fullPath));
+        }
+        else if (entry.name.endsWith(".graphql") && !entry.name.endsWith("-manager.graphql")) {
+            documents.push((0, fs_1.readFileSync)(fullPath, { encoding: "utf-8" }));
+        }
+    }
+    return documents;
+};
+/**
+ * Builds a map of operation name -> sorted, de-duplicated authorization scopes required by that
+ * operation, from raw GraphQL operation/fragment source documents.
+ *
+ * @param schema The authorization-annotated schema to resolve field directives against.
+ * @param documents Raw `.graphql` source strings (operations and any fragments they spread).
+ */
+const collectPermissionsFromDocuments = (schema, documents) => {
+    const result = new Map();
+    if (documents.length === 0)
+        return result;
+    const definitions = [];
+    for (const document of documents) {
+        try {
+            definitions.push(...(0, graphql_1.parse)(document).definitions);
+        }
+        catch (error) {
+            // A single unparseable document must not silently strip scope docs from every other operation.
+            // eslint-disable-next-line no-console
+            console.warn(`[graphql-mock] Skipping unparseable GraphQL document: ${error.message}`);
+        }
+    }
+    const fragments = new Map();
+    for (const definition of definitions) {
+        if (definition.kind === "FragmentDefinition") {
+            fragments.set(definition.name.value, definition);
+        }
+    }
+    for (const definition of definitions) {
+        if (definition.kind !== "OperationDefinition" || !definition.name)
+            continue;
+        const rootType = definition.operation === "query"
+            ? schema.getQueryType()
+            : definition.operation === "mutation"
+                ? schema.getMutationType()
+                : schema.getSubscriptionType();
+        const scopes = new Set();
+        collectSelectionScopes(schema, rootType ?? undefined, definition.selectionSet, fragments, scopes, new Set());
+        result.set(definition.name.value, [...scopes].sort());
+    }
+    return result;
+};
+exports.collectPermissionsFromDocuments = collectPermissionsFromDocuments;
+/**
+ * Builds a map of operation name -> sorted, de-duplicated authorization scopes required by that
+ * operation, based on the `@authorization` directives of every field the operation touches.
+ *
+ * @param schema The authorization-annotated schema to resolve field directives against.
+ * @param generatedFilePath Path to the generated `graphql.ts`; its lib `src` root holds the operations.
+ */
+const collectOperationPermissions = (schema, generatedFilePath) => {
+    // <lib>/src/generated/graphql-api/graphql.ts -> <lib>/src
+    const documentsDirectory = (0, path_1.join)((0, path_1.dirname)(generatedFilePath), "..", "..");
+    return (0, exports.collectPermissionsFromDocuments)(schema, readGraphqlDocuments(documentsDirectory));
+};
+exports.collectOperationPermissions = collectOperationPermissions;
+//# sourceMappingURL=collectPermissions.js.map

package/src/executors/createHooks/scrubFile.js

@@ -93,7 +93,7 @@ const scrubFile = async (file, nxRoot, isVerbose, generateMocks = true) => {
     // mutates the shared source file via insertStatements().
     const scrubbedFileContent = await (0, exports.scrubFileContent)(fileContent, nxRoot, isVerbose, sharedSourceFile);
     const scrubbedMockFileContent = generateMocks
-        ? await (0, scrubMockFile_1.scrubMockFileContent)(fileContent, nxRoot, isVerbose, sharedSourceFile)
+        ? await (0, scrubMockFile_1.scrubMockFileContent)(fileContent, nxRoot, isVerbose, sharedSourceFile, file)
         : undefined;
     const prettierOptions = await getPrettierOptions(nxRoot);
     let prettySrc = scrubbedFileContent;

package/src/executors/createHooks/scrubMockFile.d.ts

@@ -2,4 +2,4 @@ import { SourceFile } from "ts-morph";
 /**
  *  Generates React hooks from your graphql files.
  */
-export declare const scrubMockFileContent: (fileContent: string, _nxRoot: string, isVerbose?: boolean, providedSourceFile?: SourceFile) => Promise<string>;
+export declare const scrubMockFileContent: (fileContent: string, nxRoot: string, isVerbose?: boolean, providedSourceFile?: SourceFile, generatedFilePath?: string) => Promise<string>;

package/src/executors/createHooks/scrubMockFile.js

@@ -4,6 +4,7 @@ exports.scrubMockFileContent = void 0;
 /* eslint-disable no-console */
 const faker_1 = require("@faker-js/faker");
 const ts_morph_1 = require("ts-morph");
+const collectPermissions_1 = require("./collectPermissions");
 const UNDEFINED_SENTINEL = "__UNDEFINED__";
 /**
  * Strips surrounding double-quotes from a ts-morph property name.
@@ -281,7 +282,7 @@ const generateMockFromType = (type, text) => {
 /**
  *  Generates React hooks from your graphql files.
  */
-const scrubMockFileContent = async (fileContent, _nxRoot, isVerbose, providedSourceFile) => {
+const scrubMockFileContent = async (fileContent, nxRoot, isVerbose, providedSourceFile, generatedFilePath) => {
     const start = new Date().getTime();
     const generatedFile = providedSourceFile ??
         new ts_morph_1.Project({
@@ -307,6 +308,10 @@ const scrubMockFileContent = async (fileContent, _nxRoot, isVerbose, providedSou
         const time = end - start;
         console.log(`Mock Execution time: ${time}`);
     }
+    // Resolve which authorization scopes each mocked operation requires. `@authorization(allow: [...])`
+    // directives only live in the schema, so we walk each operation's selection set against it.
+    const schema = generatedFilePath ? (0, collectPermissions_1.loadAuthSchema)(nxRoot) : null;
+    const permissionsByOperation = schema && generatedFilePath ? (0, collectPermissions_1.collectOperationPermissions)(schema, generatedFilePath) : new Map();
     const mock = mockThese.map(mocker => {
         const postFix = (mocker.getName().includes("Query") ? "Query" : "Mutation").length;
         const variablesTypeName = `${mocker.getName()}Variables`;
@@ -346,7 +351,15 @@ const scrubMockFileContent = async (fileContent, _nxRoot, isVerbose, providedSou
             : `
     const default${mocker.getName()}Variables: gql.${variablesTypeName} = ${defaultVarsSource};
 `;
-        return `${constBlock}
+        const permissions = permissionsByOperation.get(docName) ?? [];
+        const permissionsComment = permissions.length > 0
+            ? `
+    /**
+     * Required authorization scopes (the token needs at least one allowed scope per accessed field):
+${permissions.map(scope => `     * - ${scope}`).join("\n")}
+     */`
+            : "";
+        return `${constBlock}${permissionsComment}
     export const mockFor${mocker.getName()} = (${variablesParam}, data?: DeepPartialNullable<gql.${mocker.getName()}> ) => {
       return queryFor(gql.${docName}Document, mergeDeepVars(${defaultVarsRef}, variables),
         mergeDeep(
@@ -355,6 +368,11 @@ const scrubMockFileContent = async (fileContent, _nxRoot, isVerbose, providedSou
       );
     }`;
     });
+    const mockedOperationNames = mockThese.map(mocker => {
+        const postFix = (mocker.getName().includes("Query") ? "Query" : "Mutation").length;
+        return mocker.getName().substring(0, mocker.getName().length - postFix);
+    });
+    logRequiredPermissions(mockedOperationNames, permissionsByOperation, generatedFilePath, isVerbose);
     return `
   import { mergeDeep } from "@apollo/client/utilities";
   import { mergeDeepVars, queryFor, DeepPartialNullable, PickDeepPartialNullable } from "@trackunit/react-core-contexts-test";
@@ -364,4 +382,21 @@ const scrubMockFileContent = async (fileContent, _nxRoot, isVerbose, providedSou
   `;
 };
 exports.scrubMockFileContent = scrubMockFileContent;
+/**
+ * Prints a summary of the authorization scopes required by the mocked operations, plus the full
+ * de-duplicated list of scopes a token must be granted to satisfy every mock in the file.
+ */
+const logRequiredPermissions = (operationNames, permissionsByOperation, generatedFilePath, isVerbose) => {
+    if (!isVerbose || permissionsByOperation.size === 0)
+        return;
+    const allScopes = new Set();
+    console.log(`[graphql-mock] Required authorization scopes${generatedFilePath ? ` for ${generatedFilePath}` : ""}:`);
+    operationNames.forEach(operationName => {
+        const scopes = permissionsByOperation.get(operationName) ?? [];
+        scopes.forEach(scope => allScopes.add(scope));
+        console.log(`  ${operationName}: ${scopes.length > 0 ? scopes.join(", ") : "(none)"}`);
+    });
+    const sortedScopes = [...allScopes].sort();
+    console.log(`[graphql-mock] All scopes referenced (${sortedScopes.length}): ${sortedScopes.length > 0 ? sortedScopes.join(", ") : "(none)"}`);
+};
 //# sourceMappingURL=scrubMockFile.js.map