graphql-http 1.17.0 → 1.18.0

package/README.md

@@ -788,6 +788,7 @@ Their compliance with the [GraphQL over HTTP spec](https://graphql.github.io/gra
 | [graphql-helix](https://www.graphql-helix.com) | [✅ Compliant](/implementations/graphql-helix/README.md) |
 | [graphql-yoga](https://www.the-guild.dev/graphql/yoga-server) | [✅ Compliant](/implementations/graphql-yoga/README.md) |
 | [hotchocolate](https://chillicream.com/docs/hotchocolate) | [✅ Compliant](/implementations/hotchocolate/README.md) |
+| [lighthouse](https://lighthouse-php.com) | [✅ Compliant](/implementations/lighthouse/README.md) |
 | [pioneer](https://pioneer.dexclaimation.com) | [✅ Compliant](/implementations/pioneer/README.md) |
 | [postgraphile](https://www.graphile.org/postgraphile) | [✅ Compliant](/implementations/postgraphile/README.md) |
 <!-- prettier-ignore-end -->

package/lib/audits/common.d.mts

@@ -62,7 +62,7 @@ export interface AuditFail {
      */
     id: string;
     name: AuditName;
-    status: 'warn' | 'error';
+    status: 'notice' | 'warn' | 'error';
     reason: string;
     response: Response;
 }

package/lib/audits/common.d.ts

@@ -62,7 +62,7 @@ export interface AuditFail {
      */
     id: string;
     name: AuditName;
-    status: 'warn' | 'error';
+    status: 'notice' | 'warn' | 'error';
     reason: string;
     response: Response;
 }

package/lib/audits/index.d.mts

@@ -1,3 +1,3 @@
-export * from './common';
-export * from './server';
-export * from './render';
+export * from './common.mjs';
+export * from './server.mjs';
+export * from './render.mjs';

package/lib/audits/render.d.mts

@@ -1,4 +1,4 @@
-import { AuditResult } from './common';
+import { AuditResult } from './common.mjs';
 /**
  * Renders the provided audit results to well-formatted and valid HTML.
  *

package/lib/audits/render.js

@@ -11,6 +11,7 @@ async function renderAuditResultsToHTML(results) {
     const grouped = {
         total: 0,
         ok: [],
+        notice: [],
         warn: [],
         error: [],
     };
@@ -33,6 +34,9 @@ async function renderAuditResultsToHTML(results) {
     if (grouped.ok.length) {
         report += `<li><span style="font-family: monospace">✅</span> <b>${grouped.ok.length}</b> pass</li>\n`;
     }
+    if (grouped.notice.length) {
+        report += `<li><span style="font-family: monospace">💡</span> <b>${grouped.notice.length}</b> notices (suggestions)</li>\n`;
+    }
     if (grouped.warn.length) {
         // TODO: warning sign is rendered as "⚠️" in markdown instead of the emoji
         report += `<li><span style="font-family: monospace">⚠️</span> <b>${grouped.warn.length}</b> warnings (optional)</li>\n`;
@@ -51,6 +55,17 @@ async function renderAuditResultsToHTML(results) {
         report += '</ol>\n';
         report += '\n';
     }
+    if (grouped.notice.length) {
+        report += `<h2>Notices</h2>\n`;
+        report +=
+            'The server <i>MAY</i> support these, but are truly optional. These are suggestions following recommended conventions.\n';
+        report += '<ol>\n';
+        for (const [, result] of grouped.notice.entries()) {
+            report += await printAuditFail(result);
+        }
+        report += '</ol>\n';
+        report += '\n';
+    }
     if (grouped.warn.length) {
         report += `<h2>Warnings</h2>\n`;
         report += 'The server <i>SHOULD</i> support these, but is not required.\n';

package/lib/audits/render.mjs

@@ -8,6 +8,7 @@ export async function renderAuditResultsToHTML(results) {
     const grouped = {
         total: 0,
         ok: [],
+        notice: [],
         warn: [],
         error: [],
     };
@@ -30,6 +31,9 @@ export async function renderAuditResultsToHTML(results) {
     if (grouped.ok.length) {
         report += `<li><span style="font-family: monospace">✅</span> <b>${grouped.ok.length}</b> pass</li>\n`;
     }
+    if (grouped.notice.length) {
+        report += `<li><span style="font-family: monospace">💡</span> <b>${grouped.notice.length}</b> notices (suggestions)</li>\n`;
+    }
     if (grouped.warn.length) {
         // TODO: warning sign is rendered as "⚠️" in markdown instead of the emoji
         report += `<li><span style="font-family: monospace">⚠️</span> <b>${grouped.warn.length}</b> warnings (optional)</li>\n`;
@@ -48,6 +52,17 @@ export async function renderAuditResultsToHTML(results) {
         report += '</ol>\n';
         report += '\n';
     }
+    if (grouped.notice.length) {
+        report += `<h2>Notices</h2>\n`;
+        report +=
+            'The server <i>MAY</i> support these, but are truly optional. These are suggestions following recommended conventions.\n';
+        report += '<ol>\n';
+        for (const [, result] of grouped.notice.entries()) {
+            report += await printAuditFail(result);
+        }
+        report += '</ol>\n';
+        report += '\n';
+    }
     if (grouped.warn.length) {
         report += `<h2>Warnings</h2>\n`;
         report += 'The server <i>SHOULD</i> support these, but is not required.\n';

package/lib/audits/server.d.mts

@@ -3,7 +3,7 @@
  * audit/server
  *
  */
-import { Audit, AuditResult } from './common';
+import { Audit, AuditResult } from './common.mjs';
 /**
  * Options for server audits required to check GraphQL over HTTP spec conformance.
  *

package/lib/audits/server.js

@@ -57,9 +57,13 @@ function serverAudits(opts) {
             (0, utils_1.ressert)(res).header('content-type').toContain('application/json');
         }),
         (0, utils_1.audit)('80D8', 'SHOULD assume application/json content-type when accept is missing', async () => {
-            const url = new URL(await getUrl(opts.url));
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString());
+            const res = await fetchFn(await getUrl(opts.url), {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                },
+                body: JSON.stringify({ query: '{ __typename }' }),
+            });
             (0, utils_1.ressert)(res).status.toBe(200);
             (0, utils_1.ressert)(res).header('content-type').toContain('application/json');
         }),
@@ -86,7 +90,9 @@ function serverAudits(opts) {
                 headers: {
                     'content-type': 'application/json; charset=utf-8',
                 },
-                body: JSON.stringify({ query: '{ __typename }' }),
+                body: JSON.stringify({
+                    query: '{ __type(name: "Run🏃Swim🏊") { name } }',
+                }),
             });
             (0, utils_1.ressert)(res).status.toBe(200);
         }),
@@ -128,7 +134,7 @@ function serverAudits(opts) {
             (0, utils_1.ressert)(res).status.toBeBetween(400, 499);
         }),
         // Request POST
-        (0, utils_1.audit)('9ABE', 'SHOULD respond with 4xx status code if content-type is not supplied on POST requests', async () => {
+        (0, utils_1.audit)('9ABE', 'MAY respond with 4xx status code if content-type is not supplied on POST requests', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
             });
@@ -142,23 +148,15 @@ function serverAudits(opts) {
             });
             (0, utils_1.ressert)(res).status.toBe(200);
         }),
-        (0, utils_1.audit)('7267', 'MUST require a request body on POST', async () => {
-            var _a;
+        (0, utils_1.audit)('A5BF', 'MAY use 400 status code when request body is missing on POST', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: { 'content-type': 'application/json' },
             });
-            if ((_a = res.headers.get('content-type')) === null || _a === void 0 ? void 0 : _a.includes('application/json')) {
-                await (0, utils_1.ressert)(res).bodyAsExecutionResult.toHaveProperty('errors');
-            }
-            else {
-                (0, utils_1.ressert)(res).status.toBe(400);
-            }
+            (0, utils_1.ressert)(res).status.toBe(400);
         }),
         // Request Parameters
-        (0, utils_1.audit)(
-        // TODO: convert to MUST after watershed
-        '6610', 'SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json', async () => {
+        (0, utils_1.audit)('423L', 'MAY use 400 status code on missing {query} parameter', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
@@ -169,26 +167,11 @@ function serverAudits(opts) {
             });
             (0, utils_1.ressert)(res).status.toBe(400);
         }),
-        (0, utils_1.audit)('3715', 'SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json', async () => {
+        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => (0, utils_1.audit)(`LKJ${index}`, `MAY use 400 status code on ${(0, utils_1.extendedTypeof)(invalid)} {query} parameter`, async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/json',
-                },
-                body: JSON.stringify({ notquery: '{ __typename }' }),
-            });
-            (0, utils_1.ressert)(res).status.toBe(200);
-            await (0, utils_1.ressert)(res).bodyAsExecutionResult.toHaveProperty('errors');
-        }),
-        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => (0, utils_1.audit)(`4F5${index}`, 
-        // TODO: convert to MUST after watershed
-        `SHOULD use 400 status code on ${(0, utils_1.extendedTypeof)(invalid)} {query} parameter when accepting application/graphql-response+json`, async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
                 },
                 body: JSON.stringify({
                     query: invalid,
@@ -196,20 +179,6 @@ function serverAudits(opts) {
             });
             (0, utils_1.ressert)(res).status.toBe(400);
         })),
-        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => (0, utils_1.audit)(`9FE${index}`, `SHOULD use 200 status code with errors field on ${(0, utils_1.extendedTypeof)(invalid)} {query} parameter when accepting application/json`, async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/json',
-                },
-                body: JSON.stringify({
-                    query: invalid,
-                }),
-            });
-            (0, utils_1.ressert)(res).status.toBe(200);
-            await (0, utils_1.ressert)(res).bodyAsExecutionResult.toHaveProperty('errors');
-        })),
         (0, utils_1.audit)(
         // TODO: convert to MUST after watershed
         '34A2', 'SHOULD allow string {query} parameter when accepting application/graphql-response+json', async () => {
@@ -239,14 +208,11 @@ function serverAudits(opts) {
             (0, utils_1.ressert)(res).status.toBe(200);
             await (0, utils_1.ressert)(res).bodyAsExecutionResult.notToHaveProperty('errors');
         }),
-        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => (0, utils_1.audit)(`E3E${index}`, 
-        // TODO: convert to MUST after watershed
-        `SHOULD use 400 status code on ${(0, utils_1.extendedTypeof)(invalid)} {operationName} parameter when accepting application/graphql-response+json`, async () => {
+        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => (0, utils_1.audit)(`6C0${index}`, `MAY use 400 status code on ${(0, utils_1.extendedTypeof)(invalid)} {operationName} parameter`, async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
                 },
                 body: JSON.stringify({
                     operationName: invalid,
@@ -255,21 +221,6 @@ function serverAudits(opts) {
             });
             (0, utils_1.ressert)(res).status.toBe(400);
         })),
-        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid, index) => (0, utils_1.audit)(`FB9${index}`, `SHOULD use 200 status code with errors field on ${(0, utils_1.extendedTypeof)(invalid)} {operationName} parameter when accepting application/json`, async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/json',
-                },
-                body: JSON.stringify({
-                    operationName: invalid,
-                    query: '{ __typename }',
-                }),
-            });
-            (0, utils_1.ressert)(res).status.toBe(200);
-            await (0, utils_1.ressert)(res).bodyAsExecutionResult.toHaveProperty('errors');
-        })),
         (0, utils_1.audit)(
         // TODO: convert to MUST after watershed
         '8161', 'SHOULD allow string {operationName} parameter when accepting application/graphql-response+json', async () => {
@@ -335,14 +286,11 @@ function serverAudits(opts) {
                 await (0, utils_1.ressert)(res).bodyAsExecutionResult.notToHaveProperty('errors');
             }),
         ]),
-        ...['string', 0, false, ['array']].map((invalid, index) => (0, utils_1.audit)(`69B${index}`, 
-        // TODO: convert to MUST after watershed
-        `SHOULD use 400 status code on ${(0, utils_1.extendedTypeof)(invalid)} {variables} parameter when accepting application/graphql-response+json`, async () => {
+        ...['string', 0, false, ['array']].map((invalid, index) => (0, utils_1.audit)(`476${index}`, `MAY use 400 status code on ${(0, utils_1.extendedTypeof)(invalid)} {variables} parameter`, async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
                 },
                 body: JSON.stringify({
                     query: '{ __typename }',
@@ -351,21 +299,6 @@ function serverAudits(opts) {
             });
             (0, utils_1.ressert)(res).status.toBe(400);
         })),
-        ...['string', 0, false, ['array']].map((invalid, index) => (0, utils_1.audit)(`F05${index}`, `SHOULD use 200 status code with errors field on ${(0, utils_1.extendedTypeof)(invalid)} {variables} parameter when accepting application/json`, async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/json',
-                },
-                body: JSON.stringify({
-                    query: '{ __typename }',
-                    variables: invalid,
-                }),
-            });
-            (0, utils_1.ressert)(res).status.toBe(200);
-            await (0, utils_1.ressert)(res).bodyAsExecutionResult.toHaveProperty('errors');
-        })),
         (0, utils_1.audit)(
         // TODO: convert to MUST after watershed
         '2EA1', 'SHOULD allow map {variables} parameter when accepting application/graphql-response+json', async () => {
@@ -422,14 +355,13 @@ function serverAudits(opts) {
             (0, utils_1.ressert)(res).status.toBe(200);
             await (0, utils_1.ressert)(res).bodyAsExecutionResult.notToHaveProperty('errors');
         }),
-        ...['string', 0, false, ['array']].map((invalid, index) => (0, utils_1.audit)(`904${index}`, 
+        ...['string', 0, false, ['array']].map((invalid, index) => (0, utils_1.audit)(`58B${index}`, 
         // TODO: convert to MUST after watershed
-        `SHOULD use 400 status code on ${(0, utils_1.extendedTypeof)(invalid)} {extensions} parameter when accepting application/graphql-response+json`, async () => {
+        `MAY use 400 status code on ${(0, utils_1.extendedTypeof)(invalid)} {extensions} parameter`, async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
                 },
                 body: JSON.stringify({
                     query: '{ __typename }',
@@ -438,21 +370,6 @@ function serverAudits(opts) {
             });
             (0, utils_1.ressert)(res).status.toBe(400);
         })),
-        ...['string', 0, false, ['array']].map((invalid, index) => (0, utils_1.audit)(`368${index}`, `SHOULD use 200 status code with errors field on ${(0, utils_1.extendedTypeof)(invalid)} {extensions} parameter when accepting application/json`, async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/json',
-                },
-                body: JSON.stringify({
-                    query: '{ __typename }',
-                    extensions: invalid,
-                }),
-            });
-            (0, utils_1.ressert)(res).status.toBe(200);
-            await (0, utils_1.ressert)(res).bodyAsExecutionResult.toHaveProperty('errors');
-        })),
         (0, utils_1.audit)(
         // TODO: convert to MUST after watershed
         '428F', 'SHOULD allow map {extensions} parameter when accepting application/graphql-response+json', async () => {
@@ -484,122 +401,91 @@ function serverAudits(opts) {
             (0, utils_1.ressert)(res).status.toBe(200);
             await (0, utils_1.ressert)(res).bodyAsExecutionResult.notToHaveProperty('errors');
         }),
-        // TODO: audit('39AA', 'MUST accept a map for the {extensions} parameter'),
-        // Response application/json
-        (0, utils_1.audit)('D477', 'SHOULD use 200 status code on JSON parsing failure when accepting application/json', async () => {
+        (0, utils_1.audit)('B6DC', 'MAY use 4xx or 5xx status codes on JSON parsing failure', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/json',
                 },
                 body: '{ "not a JSON',
             });
-            (0, utils_1.ressert)(res).status.toBe(200);
-        }),
-        (0, utils_1.audit)('F5AF', 'SHOULD use 200 status code if parameters are invalid when accepting application/json', async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/json',
-                },
-                body: JSON.stringify({
-                    qeury: /* typo */ '{ __typename }',
-                }),
-            });
-            (0, utils_1.ressert)(res).status.toBe(200);
+            (0, utils_1.ressert)(res).status.toBeBetween(400, 499);
         }),
-        (0, utils_1.audit)('572B', 'SHOULD use 200 status code on document parsing failure when accepting application/json', async () => {
+        (0, utils_1.audit)('BCF8', 'MAY use 400 status code on JSON parsing failure', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/json',
                 },
-                body: JSON.stringify({ query: '{' }),
+                body: '{ "not a JSON',
             });
-            (0, utils_1.ressert)(res).status.toBe(200);
+            (0, utils_1.ressert)(res).status.toBe(400);
         }),
-        (0, utils_1.audit)('FDE2', 'SHOULD use 200 status code on document validation failure when accepting application/json', async () => {
+        (0, utils_1.audit)('8764', 'MAY use 4xx or 5xx status codes if parameters are invalid', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/json',
                 },
                 body: JSON.stringify({
-                    query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
+                    qeury /* typo */: '{ __typename }',
                 }),
             });
-            (0, utils_1.ressert)(res).status.toBe(200);
+            (0, utils_1.ressert)(res).status.toBeBetween(400, 599);
         }),
-        // Response application/graphql-response+json
-        (0, utils_1.audit)(
-        // TODO: convert to MUST after watershed
-        '60AA', 'SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json', async () => {
+        (0, utils_1.audit)('3E3A', 'MAY use 400 status code if parameters are invalid', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
                 },
-                body: '{ "not a JSON',
-            });
-            (0, utils_1.ressert)(res).status.toBeBetween(400, 499);
-        }),
-        (0, utils_1.audit)('2163', 'SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json', async () => {
-            const res = await fetchFn(await getUrl(opts.url), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
-                },
-                body: '{ "not a JSON',
+                body: JSON.stringify({
+                    qeury: /* typo */ '{ __typename }',
+                }),
             });
             (0, utils_1.ressert)(res).status.toBe(400);
         }),
-        (0, utils_1.audit)(
-        // TODO: convert to MUST after watershed
-        '3E36', 'SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json', async () => {
+        // TODO: audit('39AA', 'MUST accept a map for the {extensions} parameter'),
+        // Response application/json
+        (0, utils_1.audit)('572B', 'SHOULD use 200 status code on document parsing failure when accepting application/json', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
+                    accept: 'application/json',
                 },
-                body: JSON.stringify({
-                    qeury /* typo */: '{ __typename }',
-                }),
+                body: JSON.stringify({ query: '{' }),
             });
-            (0, utils_1.ressert)(res).status.toBeBetween(400, 599);
+            (0, utils_1.ressert)(res).status.toBe(200);
         }),
-        (0, utils_1.audit)('17C5', 'SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json', async () => {
+        (0, utils_1.audit)('FDE2', 'SHOULD use 200 status code on document validation failure when accepting application/json', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
+                    accept: 'application/json',
                 },
                 body: JSON.stringify({
-                    qeury: /* typo */ '{ __typename }',
+                    query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
                 }),
             });
-            (0, utils_1.ressert)(res).status.toBe(400);
+            (0, utils_1.ressert)(res).status.toBe(200);
         }),
-        (0, utils_1.audit)('34D6', 'SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json', async () => {
+        (0, utils_1.audit)('7B9B', 'SHOULD use a status code of 200 on variable coercion failure when accepting application/json', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
-                    accept: 'application/graphql-response+json',
+                    accept: 'application/json',
                 },
                 body: JSON.stringify({
-                    qeury: /* typo */ '{ __typename }',
+                    query: 'query CoerceFailure($id: ID!){ __typename }',
+                    variables: { id: null },
                 }),
             });
-            await (0, utils_1.ressert)(res).bodyAsExecutionResult.data.toBe(undefined);
+            (0, utils_1.ressert)(res).status.toBe(200);
         }),
+        // Response application/graphql-response+json
         (0, utils_1.audit)(
         // TODO: convert to MUST after watershed
         '865D', 'SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json', async () => {
@@ -682,6 +568,20 @@ function serverAudits(opts) {
             });
             await (0, utils_1.ressert)(res).bodyAsExecutionResult.data.toBe(undefined);
         }),
+        (0, utils_1.audit)('86EE', 'SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json', async () => {
+            const res = await fetchFn(await getUrl(opts.url), {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: 'query CoerceFailure($id: ID!){ __typename }',
+                    variables: { id: null },
+                }),
+            });
+            (0, utils_1.ressert)(res).status.toBe(400);
+        }),
         // TODO: how to fail and have the data entry?
         // audit('EE52', 'MUST use 2xx status code if response contains the data entry and it is not null when accepting application/graphql-response+json'),
         // TODO: how to make an unauthorized request?