graphql-http 1.22.4 → 1.23.1

package/README.md

@@ -5,7 +5,7 @@
 
   <h6>Simple, pluggable, zero-dependency, <a href="https://graphql.github.io/graphql-over-http">GraphQL over HTTP spec</a> compliant server, client and audit suite.</h6>
 
-[![Continuous integration](https://github.com/graphql/graphql-http/workflows/Continuous%20integration/badge.svg)](https://github.com/graphql/graphql-http/actions?query=workflow%3A%22Continuous+integration%22) [![graphql-http](https://img.shields.io/npm/v/graphql-http.svg?label=graphql-http&logo=npm)](https://www.npmjs.com/package/graphql-http)
+[![CI](https://github.com/graphql/graphql-http/workflows/CI/badge.svg)](https://github.com/graphql/graphql-http/actions?query=workflow%3A%22Continuous+integration%22) [![graphql-http](https://img.shields.io/npm/v/graphql-http.svg?label=graphql-http&logo=npm)](https://www.npmjs.com/package/graphql-http)
 
 <i>Quickly check for compliance? Visit <b>[graphql-http.com](https://graphql-http.com)</b>!</i>
 

package/lib/audits/render.js

@@ -98,10 +98,10 @@ async function printAuditFail(result) {
     const headers = {};
     for (const [key, val] of res.headers.entries()) {
         // some headers change on each run, dont report it
-        if (key === 'date') {
+        if (['date', 'expires'].includes(key)) {
             headers[key] = '<timestamp>';
         }
-        else if (['cf-ray', 'server-timing', 'set-cookie'].includes(key)) {
+        else if (['cf-ray', 'server-timing', 'set-cookie', 'age'].includes(key)) {
             headers[key] = '<omitted>';
         }
         else {

package/lib/audits/render.mjs

@@ -94,10 +94,10 @@ async function printAuditFail(result) {
     const headers = {};
     for (const [key, val] of res.headers.entries()) {
         // some headers change on each run, dont report it
-        if (key === 'date') {
+        if (['date', 'expires'].includes(key)) {
             headers[key] = '<timestamp>';
         }
-        else if (['cf-ray', 'server-timing', 'set-cookie'].includes(key)) {
+        else if (['cf-ray', 'server-timing', 'set-cookie', 'age'].includes(key)) {
             headers[key] = '<omitted>';
         }
         else {

package/lib/audits/server.js

@@ -134,9 +134,10 @@ function serverAudits(opts) {
             (0, utils_1.ressert)(res).status.toBeBetween(400, 499);
         }),
         // Request POST
-        (0, utils_1.audit)('9ABE', 'MAY respond with 4xx status code if content-type is not supplied on POST requests', async () => {
+        (0, utils_1.audit)('9ABE', 'SHOULD respond with 4xx status code if content-type is not supplied on POST requests', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
+                body: JSON.stringify({ query: '{ __typename }' }),
             });
             (0, utils_1.ressert)(res).status.toBeBetween(400, 499);
         }),
@@ -341,6 +342,7 @@ function serverAudits(opts) {
                 },
             });
             (0, utils_1.ressert)(res).status.toBe(200);
+            await (0, utils_1.ressert)(res).bodyAsExecutionResult.notToHaveProperty('errors');
         }),
         (0, utils_1.audit)('6A70', 'MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json', async () => {
             const url = new URL(await getUrl(opts.url));
@@ -401,21 +403,38 @@ function serverAudits(opts) {
             (0, utils_1.ressert)(res).status.toBe(200);
             await (0, utils_1.ressert)(res).bodyAsExecutionResult.notToHaveProperty('errors');
         }),
-        (0, utils_1.audit)('B6DC', 'MAY use 4xx or 5xx status codes on JSON parsing failure', async () => {
+        (0, utils_1.audit)('B6DC', 'MAY use 2xx, 4xx, or 5xx status codes on JSON parsing failure when accepting application/json', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
+                    accept: 'application/json',
                 },
                 body: '{ "not a JSON',
             });
-            (0, utils_1.ressert)(res).status.toBeBetween(400, 499);
+            (0, utils_1.ressert)(res).status.toBeBetweenMultiple([
+                [200, 299],
+                [400, 499],
+                [500, 599],
+            ]);
         }),
-        (0, utils_1.audit)('BCF8', 'MAY use 400 status code on JSON parsing failure', async () => {
+        (0, utils_1.audit)('BCF8', 'SHOULD use 400 status code on JSON parsing failure when accepting application/json', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: '{ "not a JSON',
+            });
+            (0, utils_1.ressert)(res).status.toBe(400);
+        }),
+        (0, utils_1.audit)('B7N8', 'SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json', async () => {
+            const res = await fetchFn(await getUrl(opts.url), {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
                 },
                 body: '{ "not a JSON',
             });

package/lib/audits/server.mjs

@@ -131,9 +131,10 @@ export function serverAudits(opts) {
             ressert(res).status.toBeBetween(400, 499);
         }),
         // Request POST
-        audit('9ABE', 'MAY respond with 4xx status code if content-type is not supplied on POST requests', async () => {
+        audit('9ABE', 'SHOULD respond with 4xx status code if content-type is not supplied on POST requests', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
+                body: JSON.stringify({ query: '{ __typename }' }),
             });
             ressert(res).status.toBeBetween(400, 499);
         }),
@@ -338,6 +339,7 @@ export function serverAudits(opts) {
                 },
             });
             ressert(res).status.toBe(200);
+            await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
         }),
         audit('6A70', 'MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json', async () => {
             const url = new URL(await getUrl(opts.url));
@@ -398,21 +400,38 @@ export function serverAudits(opts) {
             ressert(res).status.toBe(200);
             await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
         }),
-        audit('B6DC', 'MAY use 4xx or 5xx status codes on JSON parsing failure', async () => {
+        audit('B6DC', 'MAY use 2xx, 4xx, or 5xx status codes on JSON parsing failure when accepting application/json', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
+                    accept: 'application/json',
                 },
                 body: '{ "not a JSON',
             });
-            ressert(res).status.toBeBetween(400, 499);
+            ressert(res).status.toBeBetweenMultiple([
+                [200, 299],
+                [400, 499],
+                [500, 599],
+            ]);
         }),
-        audit('BCF8', 'MAY use 400 status code on JSON parsing failure', async () => {
+        audit('BCF8', 'SHOULD use 400 status code on JSON parsing failure when accepting application/json', async () => {
             const res = await fetchFn(await getUrl(opts.url), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: '{ "not a JSON',
+            });
+            ressert(res).status.toBe(400);
+        }),
+        audit('B7N8', 'SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json', async () => {
+            const res = await fetchFn(await getUrl(opts.url), {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
                 },
                 body: '{ "not a JSON',
             });

package/lib/audits/utils.d.mts

@@ -41,6 +41,7 @@ export declare function ressert(res: Response): {
     status: {
         toBe(code: number): void;
         toBeBetween: (min: number, max: number) => void;
+        toBeBetweenMultiple: (ranges: Array<[number, number]>) => void;
     };
     header(key: 'content-type'): {
         toContain(part: string): void;

package/lib/audits/utils.d.ts

@@ -41,6 +41,7 @@ export declare function ressert(res: Response): {
     status: {
         toBe(code: number): void;
         toBeBetween: (min: number, max: number) => void;
+        toBeBetweenMultiple: (ranges: Array<[number, number]>) => void;
     };
     header(key: 'content-type'): {
         toContain(part: string): void;

package/lib/audits/utils.js

@@ -97,6 +97,14 @@ function ressert(res) {
                     throw new AuditError(res, `Response status is not between ${min} and ${max}`);
                 }
             },
+            toBeBetweenMultiple: (ranges) => {
+                const isInRange = ranges.some(([min, max]) => min <= res.status && res.status <= max);
+                if (!isInRange) {
+                    throw new AuditError(res, `Response status is not between any of the provided ranges: ${ranges
+                        .map(([min, max]) => `[${min}, ${max}]`)
+                        .join(', ')}`);
+                }
+            },
         },
         header(key) {
             return {

package/lib/audits/utils.mjs

@@ -78,6 +78,14 @@ export function ressert(res) {
                     throw new AuditError(res, `Response status is not between ${min} and ${max}`);
                 }
             },
+            toBeBetweenMultiple: (ranges) => {
+                const isInRange = ranges.some(([min, max]) => min <= res.status && res.status <= max);
+                if (!isInRange) {
+                    throw new AuditError(res, `Response status is not between any of the provided ranges: ${ranges
+                        .map(([min, max]) => `[${min}, ${max}]`)
+                        .join(', ')}`);
+                }
+            },
         },
         header(key) {
             return {

package/lib/handler.d.mts

@@ -201,7 +201,7 @@ export interface HandlerOptions<RequestRaw = unknown, RequestContext = unknown,
     getOperationAST?: typeof graphqlGetOperationAST;
     /**
      * The GraphQL root value or resolvers to go alongside the execution.
-     * Learn more about them here: https://graphql.org/learn/execution/#root-fields-resolvers.
+     * Learn more about them here: https://graphql.org/learn/execution/#root-fields-and-resolvers.
      *
      * If you return from `onSubscribe`, and the returned value is
      * missing the `rootValue` field, the relevant operation root

package/lib/handler.d.ts

@@ -201,7 +201,7 @@ export interface HandlerOptions<RequestRaw = unknown, RequestContext = unknown,
     getOperationAST?: typeof graphqlGetOperationAST;
     /**
      * The GraphQL root value or resolvers to go alongside the execution.
-     * Learn more about them here: https://graphql.org/learn/execution/#root-fields-resolvers.
+     * Learn more about them here: https://graphql.org/learn/execution/#root-fields-and-resolvers.
      *
      * If you return from `onSubscribe`, and the returned value is
      * missing the `rootValue` field, the relevant operation root

package/lib/handler.js

@@ -308,7 +308,7 @@ function createHandler(options) {
             return makeResponse(new graphql_1.GraphQLError('Subscriptions are not supported'), acceptedMediaType, formatError);
         }
         // mutations cannot happen over GETs
-        // https://graphql.github.io/graphql-over-http/draft/#sel-CALFJRPAAELBAAxwP
+        // https://graphql.github.io/graphql-over-http/draft/#sel-GALJTPABABgCzsd
         if (operation === 'mutation' && req.method === 'GET') {
             return [
                 JSON.stringify({

package/lib/handler.mjs

@@ -304,7 +304,7 @@ export function createHandler(options) {
             return makeResponse(new GraphQLError('Subscriptions are not supported'), acceptedMediaType, formatError);
         }
         // mutations cannot happen over GETs
-        // https://graphql.github.io/graphql-over-http/draft/#sel-CALFJRPAAELBAAxwP
+        // https://graphql.github.io/graphql-over-http/draft/#sel-GALJTPABABgCzsd
         if (operation === 'mutation' && req.method === 'GET') {
             return [
                 JSON.stringify({

package/lib/use/express.d.mts

@@ -7,6 +7,12 @@ import { RequestParams } from '../common.mjs';
  * @category Server/express
  */
 export interface RequestContext {
+    /**
+     * The Express response object for the current request.
+     *
+     * This can be used to manipulate the HTTP response, for example to set
+     * response headers or cookies.
+     */
     res: Response;
 }
 /**
@@ -59,16 +65,40 @@ export type HandlerOptions<Context extends OperationContext = undefined> = RawHa
  * Create a GraphQL over HTTP spec compliant request handler for
  * the express framework.
  *
+ * The Express response is available through `req.context.res`. To expose it
+ * to GraphQL resolvers, return it from the `context` option. This can be used
+ * to manipulate the HTTP response, for example to set response headers or
+ * cookies.
+ *
  * ```js
  * import express from 'express'; // yarn add express
  * import { createHandler } from 'graphql-http/lib/use/express';
  * import { schema } from './my-graphql-schema/index.mjs';
  *
  * const app = express();
- * app.all('/graphql', createHandler({ schema }));
+ *
+ * app.all(
+ *   '/graphql',
+ *   createHandler({
+ *     schema,
+ *     context(req) {
+ *       return {
+ *         res: req.context.res,
+ *       };
+ *     },
+ *   }),
+ * );
  *
  * app.listen({ port: 4000 });
- * console.log('Listening to port 4000');
+ * ```
+ *
+ * A resolver can then manipulate the response:
+ *
+ * ```js
+ * resolve(_, __, { res }) {
+ *   res.setHeader('set-cookie', 'session=; Max-Age=0; Path=/');
+ *   return true;
+ * }
  * ```
  *
  * @category Server/express

package/lib/use/express.d.ts

@@ -7,6 +7,12 @@ import { RequestParams } from '../common';
  * @category Server/express
  */
 export interface RequestContext {
+    /**
+     * The Express response object for the current request.
+     *
+     * This can be used to manipulate the HTTP response, for example to set
+     * response headers or cookies.
+     */
     res: Response;
 }
 /**
@@ -59,16 +65,40 @@ export type HandlerOptions<Context extends OperationContext = undefined> = RawHa
  * Create a GraphQL over HTTP spec compliant request handler for
  * the express framework.
  *
+ * The Express response is available through `req.context.res`. To expose it
+ * to GraphQL resolvers, return it from the `context` option. This can be used
+ * to manipulate the HTTP response, for example to set response headers or
+ * cookies.
+ *
  * ```js
  * import express from 'express'; // yarn add express
  * import { createHandler } from 'graphql-http/lib/use/express';
  * import { schema } from './my-graphql-schema';
  *
  * const app = express();
- * app.all('/graphql', createHandler({ schema }));
+ *
+ * app.all(
+ *   '/graphql',
+ *   createHandler({
+ *     schema,
+ *     context(req) {
+ *       return {
+ *         res: req.context.res,
+ *       };
+ *     },
+ *   }),
+ * );
  *
  * app.listen({ port: 4000 });
- * console.log('Listening to port 4000');
+ * ```
+ *
+ * A resolver can then manipulate the response:
+ *
+ * ```js
+ * resolve(_, __, { res }) {
+ *   res.setHeader('set-cookie', 'session=; Max-Age=0; Path=/');
+ *   return true;
+ * }
  * ```
  *
  * @category Server/express

package/lib/use/express.js

@@ -56,16 +56,40 @@ exports.parseRequestParams = parseRequestParams;
  * Create a GraphQL over HTTP spec compliant request handler for
  * the express framework.
  *
+ * The Express response is available through `req.context.res`. To expose it
+ * to GraphQL resolvers, return it from the `context` option. This can be used
+ * to manipulate the HTTP response, for example to set response headers or
+ * cookies.
+ *
  * ```js
  * import express from 'express'; // yarn add express
  * import { createHandler } from 'graphql-http/lib/use/express';
  * import { schema } from './my-graphql-schema';
  *
  * const app = express();
- * app.all('/graphql', createHandler({ schema }));
+ *
+ * app.all(
+ *   '/graphql',
+ *   createHandler({
+ *     schema,
+ *     context(req) {
+ *       return {
+ *         res: req.context.res,
+ *       };
+ *     },
+ *   }),
+ * );
  *
  * app.listen({ port: 4000 });
- * console.log('Listening to port 4000');
+ * ```
+ *
+ * A resolver can then manipulate the response:
+ *
+ * ```js
+ * resolve(_, __, { res }) {
+ *   res.setHeader('set-cookie', 'session=; Max-Age=0; Path=/');
+ *   return true;
+ * }
  * ```
  *
  * @category Server/express

package/lib/use/express.mjs

@@ -52,16 +52,40 @@ export async function parseRequestParams(req, res) {
  * Create a GraphQL over HTTP spec compliant request handler for
  * the express framework.
  *
+ * The Express response is available through `req.context.res`. To expose it
+ * to GraphQL resolvers, return it from the `context` option. This can be used
+ * to manipulate the HTTP response, for example to set response headers or
+ * cookies.
+ *
  * ```js
  * import express from 'express'; // yarn add express
  * import { createHandler } from 'graphql-http/lib/use/express';
  * import { schema } from './my-graphql-schema/index.mjs';
  *
  * const app = express();
- * app.all('/graphql', createHandler({ schema }));
+ *
+ * app.all(
+ *   '/graphql',
+ *   createHandler({
+ *     schema,
+ *     context(req) {
+ *       return {
+ *         res: req.context.res,
+ *       };
+ *     },
+ *   }),
+ * );
  *
  * app.listen({ port: 4000 });
- * console.log('Listening to port 4000');
+ * ```
+ *
+ * A resolver can then manipulate the response:
+ *
+ * ```js
+ * resolve(_, __, { res }) {
+ *   res.setHeader('set-cookie', 'session=; Max-Age=0; Path=/');
+ *   return true;
+ * }
  * ```
  *
  * @category Server/express

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphql-http",
-  "version": "1.22.4",
+  "version": "1.23.1",
   "description": "Simple, pluggable, zero-dependency, GraphQL over HTTP spec compliant server, client and audit suite.",
   "keywords": [
     "graphql",
@@ -113,7 +113,7 @@
     "implementations/**/*"
   ],
   "peerDependencies": {
-    "graphql": ">=0.11 <=16"
+    "graphql": ">=0.11 <=17"
   },
   "devDependencies": {
     "@cspell/cspell-types": "^8.1.2",
@@ -126,7 +126,6 @@
     "@types/express": "^4.17.21",
     "@types/glob": "^8.1.0",
     "@types/html-validator": "^5.0.6",
-    "@types/k6": "^0.47.3",
     "@types/koa": "^2.15.0",
     "@types/koa-mount": "^4.0.5",
     "@typescript-eslint/eslint-plugin": "^6.13.2",
@@ -138,7 +137,7 @@
     "express": "^4.18.2",
     "fastify": "^4.24.3",
     "glob": "^10.3.10",
-    "graphql": "^16.8.1",
+    "graphql": "^17.0.0",
     "html-validator": "^6.0.1",
     "koa": "^2.15.3",
     "koa-mount": "^4.0.0",
@@ -152,7 +151,7 @@
     "typedoc": "^0.25.4",
     "typedoc-plugin-markdown": "^3.17.1",
     "typescript": "^5.3.2",
-    "uWebSockets.js": "uNetworking/uWebSockets.js#v20.34.0",
+    "uWebSockets.js": "uNetworking/uWebSockets.js#v20.69.0",
     "vitest": "^1.0.1"
   }
 }

package/umd/graphql-http-audits.js

@@ -99,6 +99,14 @@
                         throw new AuditError(res, `Response status is not between ${min} and ${max}`);
                     }
                 },
+                toBeBetweenMultiple: (ranges) => {
+                    const isInRange = ranges.some(([min, max]) => min <= res.status && res.status <= max);
+                    if (!isInRange) {
+                        throw new AuditError(res, `Response status is not between any of the provided ranges: ${ranges
+                        .map(([min, max]) => `[${min}, ${max}]`)
+                        .join(', ')}`);
+                    }
+                },
             },
             header(key) {
                 return {
@@ -296,9 +304,10 @@
                 ressert(res).status.toBeBetween(400, 499);
             }),
             // Request POST
-            audit('9ABE', 'MAY respond with 4xx status code if content-type is not supplied on POST requests', async () => {
+            audit('9ABE', 'SHOULD respond with 4xx status code if content-type is not supplied on POST requests', async () => {
                 const res = await fetchFn(await getUrl(opts.url), {
                     method: 'POST',
+                    body: JSON.stringify({ query: '{ __typename }' }),
                 });
                 ressert(res).status.toBeBetween(400, 499);
             }),
@@ -503,6 +512,7 @@
                     },
                 });
                 ressert(res).status.toBe(200);
+                await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
             }),
             audit('6A70', 'MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json', async () => {
                 const url = new URL(await getUrl(opts.url));
@@ -563,21 +573,38 @@
                 ressert(res).status.toBe(200);
                 await ressert(res).bodyAsExecutionResult.notToHaveProperty('errors');
             }),
-            audit('B6DC', 'MAY use 4xx or 5xx status codes on JSON parsing failure', async () => {
+            audit('B6DC', 'MAY use 2xx, 4xx, or 5xx status codes on JSON parsing failure when accepting application/json', async () => {
                 const res = await fetchFn(await getUrl(opts.url), {
                     method: 'POST',
                     headers: {
                         'content-type': 'application/json',
+                        accept: 'application/json',
                     },
                     body: '{ "not a JSON',
                 });
-                ressert(res).status.toBeBetween(400, 499);
+                ressert(res).status.toBeBetweenMultiple([
+                    [200, 299],
+                    [400, 499],
+                    [500, 599],
+                ]);
             }),
-            audit('BCF8', 'MAY use 400 status code on JSON parsing failure', async () => {
+            audit('BCF8', 'SHOULD use 400 status code on JSON parsing failure when accepting application/json', async () => {
                 const res = await fetchFn(await getUrl(opts.url), {
                     method: 'POST',
                     headers: {
                         'content-type': 'application/json',
+                        accept: 'application/json',
+                    },
+                    body: '{ "not a JSON',
+                });
+                ressert(res).status.toBe(400);
+            }),
+            audit('B7N8', 'SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json', async () => {
+                const res = await fetchFn(await getUrl(opts.url), {
+                    method: 'POST',
+                    headers: {
+                        'content-type': 'application/json',
+                        accept: 'application/graphql-response+json',
                     },
                     body: '{ "not a JSON',
                 });
@@ -867,10 +894,10 @@
         const headers = {};
         for (const [key, val] of res.headers.entries()) {
             // some headers change on each run, dont report it
-            if (key === 'date') {
+            if (['date', 'expires'].includes(key)) {
                 headers[key] = '<timestamp>';
             }
-            else if (['cf-ray', 'server-timing', 'set-cookie'].includes(key)) {
+            else if (['cf-ray', 'server-timing', 'set-cookie', 'age'].includes(key)) {
                 headers[key] = '<omitted>';
             }
             else {

package/umd/graphql-http-audits.min.js

@@ -1 +1 @@
-!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).graphqlHttpAudits={})}(this,(function(e){"use strict";function t(e){return null===e?"null":Array.isArray(e)?"array":typeof e}function a(e,t,a){return{id:e,name:t,fn:async()=>{try{return await a(),{id:e,name:t,status:"ok"}}catch(a){if(!(a instanceof n))throw a;return{id:e,name:t,status:t.startsWith("MUST")?"error":t.startsWith("SHOULD")?"warn":"notice",reason:a.reason,response:a.response}}}}}class n{constructor(e,t){this.response=e,this.reason=t}}function o(e){return{status:{toBe(t){if(e.status!==t)throw new n(e,`Response status code is not ${t}`)},toBeBetween:(t,a)=>{if(!(t<=e.status&&e.status<=a))throw new n(e,`Response status is not between ${t} and ${a}`)}},header:t=>({toContain(a){var o;if(!(null===(o=e.headers.get(t))||void 0===o?void 0:o.includes(a)))throw new n(e,`Response header ${t} does not contain ${a}`)},notToContain(a){var o;if(null===(o=e.headers.get(t))||void 0===o?void 0:o.includes(a))throw new n(e,`Response header ${t} contains ${a}`)}}),bodyAsExecutionResult:{data:{async toBe(t){const a=e.clone();if((await s(e)).data!==t)throw new n(a,`Response body execution result data is not "${t}"`)}},async toHaveProperty(t){const a=e.clone();if(!(t in await s(e)))throw new n(a,`Response body execution result does not have a property "${t}"`)},async notToHaveProperty(t){const a=e.clone();if(t in await s(e))throw new n(a,`Response body execution result has a property "${t}"`)}}}}async function s(e){let t,a;try{const a=new TextDecoder("utf-8"),n=await e.arrayBuffer();t=a.decode(n)}catch(t){throw new n(e,"Response body is not UTF-8 encoded")}try{a=JSON.parse(t)}catch(t){throw new n(e,"Response body is not valid JSON")}return a}function i(e){const s=e.fetchFn||fetch;return[a("22EB","SHOULD accept application/graphql-response+json and match the content-type",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ __typename }"})});o(t).status.toBe(200),o(t).header("content-type").toContain("application/graphql-response+json")})),a("4655","MUST accept application/json and match the content-type",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"{ __typename }"})});o(t).status.toBe(200),o(t).header("content-type").toContain("application/json")})),a("47DE","SHOULD accept */* and use application/json for the content-type",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"*/*"},body:JSON.stringify({query:"{ __typename }"})});o(t).status.toBe(200),o(t).header("content-type").toContain("application/json")})),a("80D8","SHOULD assume application/json content-type when accept is missing",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }"})});o(t).status.toBe(200),o(t).header("content-type").toContain("application/json")})),a("82A3","MUST use utf-8 encoding when responding",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }"})});o(t).status.toBe(200);try{new TextDecoder("utf-8").decode(await t.arrayBuffer())}catch(e){throw new n(t,"Response body is not UTF-8 encoded")}})),a("BF61","MUST accept utf-8 encoded request",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json; charset=utf-8"},body:JSON.stringify({query:'{ __type(name: "Run🏃Swim🏊") { name } }'})})).status.toBe(200)})),a("78D5","MUST assume utf-8 in request if encoding is unspecified",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }"})})).status.toBe(200)})),a("2C94","MUST accept POST requests",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }"})})).status.toBe(200)})),a("5A70","MAY accept application/x-www-form-urlencoded formatted GET requests",(async()=>{const t=new URL(await r(e.url));t.searchParams.set("query","{ __typename }");o(await s(t.toString())).status.toBe(200)})),a("9C48","MAY NOT allow executing mutations on GET requests",(async()=>{const t=new URL(await r(e.url));t.searchParams.set("query","mutation { __typename }");o(await s(t.toString(),{headers:{accept:"application/graphql-response+json"}})).status.toBeBetween(400,499)})),a("9ABE","MAY respond with 4xx status code if content-type is not supplied on POST requests",(async()=>{o(await s(await r(e.url),{method:"POST"})).status.toBeBetween(400,499)})),a("03D4","MUST accept application/json POST requests",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }"})})).status.toBe(200)})),a("A5BF","MAY use 400 status code when request body is missing on POST",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"}})).status.toBe(400)})),a("423L","MAY use 400 status code on missing {query} parameter",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({notquery:"{ __typename }"})})).status.toBe(400)})),...[{obj:"ect"},0,!1,["array"]].map(((n,i)=>a(`LKJ${i}`,`MAY use 400 status code on ${t(n)} {query} parameter`,(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:n})})).status.toBe(400)})))),a("34A2","SHOULD allow string {query} parameter when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ __typename }"})})).status.toBe(200)})),a("13EE","MUST allow string {query} parameter when accepting application/json",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"{ __typename }"})});o(t).status.toBe(200),await o(t).bodyAsExecutionResult.notToHaveProperty("errors")})),...[{obj:"ect"},0,!1,["array"]].map(((n,i)=>a(`6C0${i}`,`MAY use 400 status code on ${t(n)} {operationName} parameter`,(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({operationName:n,query:"{ __typename }"})})).status.toBe(400)})))),a("8161","SHOULD allow string {operationName} parameter when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({operationName:"Query",query:"query Query { __typename }"})})).status.toBe(200)})),a("B8B3","MUST allow string {operationName} parameter when accepting application/json",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({operationName:"Query",query:"query Query { __typename }"})});o(t).status.toBe(200),await o(t).bodyAsExecutionResult.notToHaveProperty("errors")})),...["variables","operationName","extensions"].flatMap(((t,n)=>[a(`94B${n}`,`SHOULD allow null {${t}} parameter when accepting application/graphql-response+json`,(async()=>{const a=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ __typename }",[t]:null})});o(a).status.toBe(200),await o(a).bodyAsExecutionResult.notToHaveProperty("errors")})),a(`022${n}`,`MUST allow null {${t}} parameter when accepting application/json`,(async()=>{const a=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"{ __typename }",[t]:null})});o(a).status.toBe(200),await o(a).bodyAsExecutionResult.notToHaveProperty("errors")}))])),...["string",0,!1,["array"]].map(((n,i)=>a(`476${i}`,`MAY use 400 status code on ${t(n)} {variables} parameter`,(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }",variables:n})})).status.toBe(400)})))),a("2EA1","SHOULD allow map {variables} parameter when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"query Type($name: String!) { __type(name: $name) { name } }",variables:{name:"sometype"}})})).status.toBe(200)})),a("28B9","MUST allow map {variables} parameter when accepting application/json",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"query Type($name: String!) { __type(name: $name) { name } }",variables:{name:"sometype"}})});o(t).status.toBe(200),await o(t).bodyAsExecutionResult.notToHaveProperty("errors")})),a("D6D5","MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json",(async()=>{const t=new URL(await r(e.url));t.searchParams.set("query","query Type($name: String!) { __type(name: $name) { name } }"),t.searchParams.set("variables",JSON.stringify({name:"sometype"}));o(await s(t.toString(),{method:"GET",headers:{accept:"application/graphql-response+json"}})).status.toBe(200)})),a("6A70","MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json",(async()=>{const t=new URL(await r(e.url));t.searchParams.set("query","query Type($name: String!) { __type(name: $name) { name } }"),t.searchParams.set("variables",JSON.stringify({name:"sometype"}));const a=await s(t.toString(),{method:"GET",headers:{accept:"application/json"}});o(a).status.toBe(200),await o(a).bodyAsExecutionResult.notToHaveProperty("errors")})),...["string",0,!1,["array"]].map(((n,i)=>a(`58B${i}`,`MAY use 400 status code on ${t(n)} {extensions} parameter`,(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }",extensions:n})})).status.toBe(400)})))),a("428F","SHOULD allow map {extensions} parameter when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ __typename }",extensions:{some:"value"}})})).status.toBe(200)})),a("1B7A","MUST allow map {extensions} parameter when accepting application/json",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"{ __typename }",extensions:{some:"value"}})});o(t).status.toBe(200),await o(t).bodyAsExecutionResult.notToHaveProperty("errors")})),a("B6DC","MAY use 4xx or 5xx status codes on JSON parsing failure",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:'{ "not a JSON'})).status.toBeBetween(400,499)})),a("BCF8","MAY use 400 status code on JSON parsing failure",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:'{ "not a JSON'})).status.toBe(400)})),a("8764","MAY use 4xx or 5xx status codes if parameters are invalid",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({qeury:"{ __typename }"})})).status.toBeBetween(400,599)})),a("3E3A","MAY use 400 status code if parameters are invalid",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({qeury:"{ __typename }"})})).status.toBe(400)})),a("572B","SHOULD use 200 status code on document parsing failure when accepting application/json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"{"})})).status.toBe(200)})),a("FDE2","SHOULD use 200 status code on document validation failure when accepting application/json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"{ 8f31403dfe404bccbb0e835f2629c6a7 }"})})).status.toBe(200)})),a("7B9B","SHOULD use a status code of 200 on variable coercion failure when accepting application/json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"query CoerceFailure($id: ID!){ __typename }",variables:{id:null}})})).status.toBe(200)})),a("865D","SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{"})})).status.toBeBetween(400,599)})),a("556A","SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{"})})).status.toBe(400)})),a("D586","SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{"})});await o(t).bodyAsExecutionResult.data.toBe(void 0)})),a("51FE","SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ 8f31403dfe404bccbb0e835f2629c6a7 }"})})).status.toBeBetween(400,599)})),a("74FF","SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ 8f31403dfe404bccbb0e835f2629c6a7 }"})})).status.toBe(400)})),a("5E5B","SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ 8f31403dfe404bccbb0e835f2629c6a7 }"})});await o(t).bodyAsExecutionResult.data.toBe(void 0)})),a("86EE","SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"query CoerceFailure($id: ID!){ __typename }",variables:{id:null}})})).status.toBe(400)}))]}async function r(e){return"function"==typeof e?await e():e}async function p(e){var t;let a="";a+=`<li><code>${e.id}</code> ${e.name}\n`,a+="<details>\n",a+=`<summary>${function(e,t=1024){if(e.length>t)return e.substring(0,t)+"...";return e}(e.reason)}</summary>\n`,a+='<pre><code class="lang-json">';const n=e.response,o={};for(const[e,t]of n.headers.entries())"date"===e?o[e]="<timestamp>":["cf-ray","server-timing","set-cookie"].includes(e)?o[e]="<omitted>":o[e]=t;let s,i="";try{i=await n.text(),s=JSON.parse(i)}catch(e){(null===(t=n.headers.get("content-type"))||void 0===t?void 0:t.includes("text/html"))&&(i="<html omitted>")}return a+=JSON.stringify({status:n.status,statusText:n.statusText,headers:o,body:s||((null==i?void 0:i.length)>5120?"<body is too long>":i)||null},((e,t)=>{if(null!=t&&"object"==typeof t&&!Array.isArray(t)){const e={};return Object.keys(t).sort().reverse().reduce(((e,a)=>(e[a]=t[a],e)),e)}return t}),2)+"\n",a+="</code></pre>\n",a+="</details>\n",a+="</li>\n",a}e.auditServer=async function(e){const t=i(e);return await Promise.all(t.map((({fn:e})=>e())))},e.renderAuditResultsToHTML=async function(e){const t={total:0,ok:[],notice:[],warn:[],error:[]};for(const a of e)t.total++,a.status,t[a.status].push(a);let a="<i>* This report was auto-generated by graphql-http</i>\n";if(a+="\n",a+="<h1>GraphQL over HTTP audit report</h1>\n",a+="\n",a+="<ul>\n",a+=`<li><b>${t.total}</b> audits in total</li>\n`,t.ok.length&&(a+=`<li><span style="font-family: monospace">✅</span> <b>${t.ok.length}</b> pass</li>\n`),t.notice.length&&(a+=`<li><span style="font-family: monospace">💡</span> <b>${t.notice.length}</b> notices (suggestions)</li>\n`),t.warn.length&&(a+=`<li><span style="font-family: monospace">❗️</span> <b>${t.warn.length}</b> warnings (optional)</li>\n`),t.error.length&&(a+=`<li><span style="font-family: monospace">❌</span> <b>${t.error.length}</b> errors (required)</li>\n`),a+="</ul>\n",a+="\n",t.ok.length){a+="<h2>Passing</h2>\n",a+="<ol>\n";for(const[,e]of t.ok.entries())a+=`<li><code>${e.id}</code> ${e.name}</li>\n`;a+="</ol>\n",a+="\n"}if(t.notice.length){a+="<h2>Notices</h2>\n",a+="The server <i>MAY</i> support these, but are truly optional. These are suggestions following recommended conventions.\n",a+="<ol>\n";for(const[,e]of t.notice.entries())a+=await p(e);a+="</ol>\n",a+="\n"}if(t.warn.length){a+="<h2>Warnings</h2>\n",a+="The server <i>SHOULD</i> support these, but is not required.\n",a+="<ol>\n";for(const[,e]of t.warn.entries())a+=await p(e);a+="</ol>\n",a+="\n"}if(t.error.length){a+="<h2>Errors</h2>\n",a+="The server <b>MUST</b> support these.\n",a+="<ol>\n";for(const[,e]of t.error.entries())a+=await p(e);a+="</ol>\n"}return a},e.serverAudits=i}));
+!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).graphqlHttpAudits={})}(this,(function(e){"use strict";function t(e){return null===e?"null":Array.isArray(e)?"array":typeof e}function a(e,t,a){return{id:e,name:t,fn:async()=>{try{return await a(),{id:e,name:t,status:"ok"}}catch(a){if(!(a instanceof n))throw a;return{id:e,name:t,status:t.startsWith("MUST")?"error":t.startsWith("SHOULD")?"warn":"notice",reason:a.reason,response:a.response}}}}}class n{constructor(e,t){this.response=e,this.reason=t}}function o(e){return{status:{toBe(t){if(e.status!==t)throw new n(e,`Response status code is not ${t}`)},toBeBetween:(t,a)=>{if(!(t<=e.status&&e.status<=a))throw new n(e,`Response status is not between ${t} and ${a}`)},toBeBetweenMultiple:t=>{if(!t.some((([t,a])=>t<=e.status&&e.status<=a)))throw new n(e,`Response status is not between any of the provided ranges: ${t.map((([e,t])=>`[${e}, ${t}]`)).join(", ")}`)}},header:t=>({toContain(a){var o;if(!(null===(o=e.headers.get(t))||void 0===o?void 0:o.includes(a)))throw new n(e,`Response header ${t} does not contain ${a}`)},notToContain(a){var o;if(null===(o=e.headers.get(t))||void 0===o?void 0:o.includes(a))throw new n(e,`Response header ${t} contains ${a}`)}}),bodyAsExecutionResult:{data:{async toBe(t){const a=e.clone();if((await s(e)).data!==t)throw new n(a,`Response body execution result data is not "${t}"`)}},async toHaveProperty(t){const a=e.clone();if(!(t in await s(e)))throw new n(a,`Response body execution result does not have a property "${t}"`)},async notToHaveProperty(t){const a=e.clone();if(t in await s(e))throw new n(a,`Response body execution result has a property "${t}"`)}}}}async function s(e){let t,a;try{const a=new TextDecoder("utf-8"),n=await e.arrayBuffer();t=a.decode(n)}catch(t){throw new n(e,"Response body is not UTF-8 encoded")}try{a=JSON.parse(t)}catch(t){throw new n(e,"Response body is not valid JSON")}return a}function i(e){const s=e.fetchFn||fetch;return[a("22EB","SHOULD accept application/graphql-response+json and match the content-type",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ __typename }"})});o(t).status.toBe(200),o(t).header("content-type").toContain("application/graphql-response+json")})),a("4655","MUST accept application/json and match the content-type",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"{ __typename }"})});o(t).status.toBe(200),o(t).header("content-type").toContain("application/json")})),a("47DE","SHOULD accept */* and use application/json for the content-type",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"*/*"},body:JSON.stringify({query:"{ __typename }"})});o(t).status.toBe(200),o(t).header("content-type").toContain("application/json")})),a("80D8","SHOULD assume application/json content-type when accept is missing",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }"})});o(t).status.toBe(200),o(t).header("content-type").toContain("application/json")})),a("82A3","MUST use utf-8 encoding when responding",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }"})});o(t).status.toBe(200);try{new TextDecoder("utf-8").decode(await t.arrayBuffer())}catch(e){throw new n(t,"Response body is not UTF-8 encoded")}})),a("BF61","MUST accept utf-8 encoded request",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json; charset=utf-8"},body:JSON.stringify({query:'{ __type(name: "Run🏃Swim🏊") { name } }'})})).status.toBe(200)})),a("78D5","MUST assume utf-8 in request if encoding is unspecified",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }"})})).status.toBe(200)})),a("2C94","MUST accept POST requests",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }"})})).status.toBe(200)})),a("5A70","MAY accept application/x-www-form-urlencoded formatted GET requests",(async()=>{const t=new URL(await r(e.url));t.searchParams.set("query","{ __typename }");o(await s(t.toString())).status.toBe(200)})),a("9C48","MAY NOT allow executing mutations on GET requests",(async()=>{const t=new URL(await r(e.url));t.searchParams.set("query","mutation { __typename }");o(await s(t.toString(),{headers:{accept:"application/graphql-response+json"}})).status.toBeBetween(400,499)})),a("9ABE","SHOULD respond with 4xx status code if content-type is not supplied on POST requests",(async()=>{o(await s(await r(e.url),{method:"POST",body:JSON.stringify({query:"{ __typename }"})})).status.toBeBetween(400,499)})),a("03D4","MUST accept application/json POST requests",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }"})})).status.toBe(200)})),a("A5BF","MAY use 400 status code when request body is missing on POST",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"}})).status.toBe(400)})),a("423L","MAY use 400 status code on missing {query} parameter",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({notquery:"{ __typename }"})})).status.toBe(400)})),...[{obj:"ect"},0,!1,["array"]].map(((n,i)=>a(`LKJ${i}`,`MAY use 400 status code on ${t(n)} {query} parameter`,(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:n})})).status.toBe(400)})))),a("34A2","SHOULD allow string {query} parameter when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ __typename }"})})).status.toBe(200)})),a("13EE","MUST allow string {query} parameter when accepting application/json",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"{ __typename }"})});o(t).status.toBe(200),await o(t).bodyAsExecutionResult.notToHaveProperty("errors")})),...[{obj:"ect"},0,!1,["array"]].map(((n,i)=>a(`6C0${i}`,`MAY use 400 status code on ${t(n)} {operationName} parameter`,(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({operationName:n,query:"{ __typename }"})})).status.toBe(400)})))),a("8161","SHOULD allow string {operationName} parameter when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({operationName:"Query",query:"query Query { __typename }"})})).status.toBe(200)})),a("B8B3","MUST allow string {operationName} parameter when accepting application/json",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({operationName:"Query",query:"query Query { __typename }"})});o(t).status.toBe(200),await o(t).bodyAsExecutionResult.notToHaveProperty("errors")})),...["variables","operationName","extensions"].flatMap(((t,n)=>[a(`94B${n}`,`SHOULD allow null {${t}} parameter when accepting application/graphql-response+json`,(async()=>{const a=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ __typename }",[t]:null})});o(a).status.toBe(200),await o(a).bodyAsExecutionResult.notToHaveProperty("errors")})),a(`022${n}`,`MUST allow null {${t}} parameter when accepting application/json`,(async()=>{const a=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"{ __typename }",[t]:null})});o(a).status.toBe(200),await o(a).bodyAsExecutionResult.notToHaveProperty("errors")}))])),...["string",0,!1,["array"]].map(((n,i)=>a(`476${i}`,`MAY use 400 status code on ${t(n)} {variables} parameter`,(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }",variables:n})})).status.toBe(400)})))),a("2EA1","SHOULD allow map {variables} parameter when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"query Type($name: String!) { __type(name: $name) { name } }",variables:{name:"sometype"}})})).status.toBe(200)})),a("28B9","MUST allow map {variables} parameter when accepting application/json",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"query Type($name: String!) { __type(name: $name) { name } }",variables:{name:"sometype"}})});o(t).status.toBe(200),await o(t).bodyAsExecutionResult.notToHaveProperty("errors")})),a("D6D5","MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json",(async()=>{const t=new URL(await r(e.url));t.searchParams.set("query","query Type($name: String!) { __type(name: $name) { name } }"),t.searchParams.set("variables",JSON.stringify({name:"sometype"}));const a=await s(t.toString(),{method:"GET",headers:{accept:"application/graphql-response+json"}});o(a).status.toBe(200),await o(a).bodyAsExecutionResult.notToHaveProperty("errors")})),a("6A70","MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json",(async()=>{const t=new URL(await r(e.url));t.searchParams.set("query","query Type($name: String!) { __type(name: $name) { name } }"),t.searchParams.set("variables",JSON.stringify({name:"sometype"}));const a=await s(t.toString(),{method:"GET",headers:{accept:"application/json"}});o(a).status.toBe(200),await o(a).bodyAsExecutionResult.notToHaveProperty("errors")})),...["string",0,!1,["array"]].map(((n,i)=>a(`58B${i}`,`MAY use 400 status code on ${t(n)} {extensions} parameter`,(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"{ __typename }",extensions:n})})).status.toBe(400)})))),a("428F","SHOULD allow map {extensions} parameter when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ __typename }",extensions:{some:"value"}})})).status.toBe(200)})),a("1B7A","MUST allow map {extensions} parameter when accepting application/json",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"{ __typename }",extensions:{some:"value"}})});o(t).status.toBe(200),await o(t).bodyAsExecutionResult.notToHaveProperty("errors")})),a("B6DC","MAY use 2xx, 4xx, or 5xx status codes on JSON parsing failure when accepting application/json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:'{ "not a JSON'})).status.toBeBetweenMultiple([[200,299],[400,499],[500,599]])})),a("BCF8","SHOULD use 400 status code on JSON parsing failure when accepting application/json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:'{ "not a JSON'})).status.toBe(400)})),a("B7N8","SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:'{ "not a JSON'})).status.toBe(400)})),a("8764","MAY use 4xx or 5xx status codes if parameters are invalid",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({qeury:"{ __typename }"})})).status.toBeBetween(400,599)})),a("3E3A","MAY use 400 status code if parameters are invalid",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({qeury:"{ __typename }"})})).status.toBe(400)})),a("572B","SHOULD use 200 status code on document parsing failure when accepting application/json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"{"})})).status.toBe(200)})),a("FDE2","SHOULD use 200 status code on document validation failure when accepting application/json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"{ 8f31403dfe404bccbb0e835f2629c6a7 }"})})).status.toBe(200)})),a("7B9B","SHOULD use a status code of 200 on variable coercion failure when accepting application/json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({query:"query CoerceFailure($id: ID!){ __typename }",variables:{id:null}})})).status.toBe(200)})),a("865D","SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{"})})).status.toBeBetween(400,599)})),a("556A","SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{"})})).status.toBe(400)})),a("D586","SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{"})});await o(t).bodyAsExecutionResult.data.toBe(void 0)})),a("51FE","SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ 8f31403dfe404bccbb0e835f2629c6a7 }"})})).status.toBeBetween(400,599)})),a("74FF","SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ 8f31403dfe404bccbb0e835f2629c6a7 }"})})).status.toBe(400)})),a("5E5B","SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json",(async()=>{const t=await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"{ 8f31403dfe404bccbb0e835f2629c6a7 }"})});await o(t).bodyAsExecutionResult.data.toBe(void 0)})),a("86EE","SHOULD use a status code of 400 on variable coercion failure when accepting application/graphql-response+json",(async()=>{o(await s(await r(e.url),{method:"POST",headers:{"content-type":"application/json",accept:"application/graphql-response+json"},body:JSON.stringify({query:"query CoerceFailure($id: ID!){ __typename }",variables:{id:null}})})).status.toBe(400)}))]}async function r(e){return"function"==typeof e?await e():e}async function p(e){var t;let a="";a+=`<li><code>${e.id}</code> ${e.name}\n`,a+="<details>\n",a+=`<summary>${function(e,t=1024){if(e.length>t)return e.substring(0,t)+"...";return e}(e.reason)}</summary>\n`,a+='<pre><code class="lang-json">';const n=e.response,o={};for(const[e,t]of n.headers.entries())["date","expires"].includes(e)?o[e]="<timestamp>":["cf-ray","server-timing","set-cookie","age"].includes(e)?o[e]="<omitted>":o[e]=t;let s,i="";try{i=await n.text(),s=JSON.parse(i)}catch(e){(null===(t=n.headers.get("content-type"))||void 0===t?void 0:t.includes("text/html"))&&(i="<html omitted>")}return a+=JSON.stringify({status:n.status,statusText:n.statusText,headers:o,body:s||((null==i?void 0:i.length)>5120?"<body is too long>":i)||null},((e,t)=>{if(null!=t&&"object"==typeof t&&!Array.isArray(t)){const e={};return Object.keys(t).sort().reverse().reduce(((e,a)=>(e[a]=t[a],e)),e)}return t}),2)+"\n",a+="</code></pre>\n",a+="</details>\n",a+="</li>\n",a}e.auditServer=async function(e){const t=i(e);return await Promise.all(t.map((({fn:e})=>e())))},e.renderAuditResultsToHTML=async function(e){const t={total:0,ok:[],notice:[],warn:[],error:[]};for(const a of e)t.total++,a.status,t[a.status].push(a);let a="<i>* This report was auto-generated by graphql-http</i>\n";if(a+="\n",a+="<h1>GraphQL over HTTP audit report</h1>\n",a+="\n",a+="<ul>\n",a+=`<li><b>${t.total}</b> audits in total</li>\n`,t.ok.length&&(a+=`<li><span style="font-family: monospace">✅</span> <b>${t.ok.length}</b> pass</li>\n`),t.notice.length&&(a+=`<li><span style="font-family: monospace">💡</span> <b>${t.notice.length}</b> notices (suggestions)</li>\n`),t.warn.length&&(a+=`<li><span style="font-family: monospace">❗️</span> <b>${t.warn.length}</b> warnings (optional)</li>\n`),t.error.length&&(a+=`<li><span style="font-family: monospace">❌</span> <b>${t.error.length}</b> errors (required)</li>\n`),a+="</ul>\n",a+="\n",t.ok.length){a+="<h2>Passing</h2>\n",a+="<ol>\n";for(const[,e]of t.ok.entries())a+=`<li><code>${e.id}</code> ${e.name}</li>\n`;a+="</ol>\n",a+="\n"}if(t.notice.length){a+="<h2>Notices</h2>\n",a+="The server <i>MAY</i> support these, but are truly optional. These are suggestions following recommended conventions.\n",a+="<ol>\n";for(const[,e]of t.notice.entries())a+=await p(e);a+="</ol>\n",a+="\n"}if(t.warn.length){a+="<h2>Warnings</h2>\n",a+="The server <i>SHOULD</i> support these, but is not required.\n",a+="<ol>\n";for(const[,e]of t.warn.entries())a+=await p(e);a+="</ol>\n",a+="\n"}if(t.error.length){a+="<h2>Errors</h2>\n",a+="The server <b>MUST</b> support these.\n",a+="<ol>\n";for(const[,e]of t.error.entries())a+=await p(e);a+="</ol>\n"}return a},e.serverAudits=i}));