graphql-http 1.4.0 → 1.5.0

package/README.md

@@ -68,11 +68,12 @@ const server = http.createServer(async (req, res) => {
       url: req.url,
       method: req.method,
       headers: req.headers,
-      body: await new Promise((resolve) => {
-        let body = '';
-        req.on('data', (chunk) => (body += chunk));
-        req.on('end', () => resolve(body));
-      }),
+      body: () =>
+        new Promise((resolve) => {
+          let body = '';
+          req.on('data', (chunk) => (body += chunk));
+          req.on('end', () => resolve(body));
+        }),
       raw: req,
     });
     res.writeHead(init.status, init.statusText, init.headers).end(body);
@@ -119,11 +120,12 @@ const server = http2.createSecureServer(
         url: req.url,
         method: req.method,
         headers: req.headers,
-        body: await new Promise((resolve) => {
-          let body = '';
-          req.on('data', (chunk) => (body += chunk));
-          req.on('end', () => resolve(body));
-        }),
+        body: () =>
+          new Promise((resolve) => {
+            let body = '';
+            req.on('data', (chunk) => (body += chunk));
+            req.on('end', () => resolve(body));
+          }),
         raw: req,
       });
       res.writeHead(init.status, init.statusText, init.headers).end(body);
@@ -155,11 +157,12 @@ app.use('/graphql', async (req, res) => {
       url: req.url,
       method: req.method,
       headers: req.headers,
-      body: await new Promise((resolve) => {
-        let body = '';
-        req.on('data', (chunk) => (body += chunk));
-        req.on('end', () => resolve(body));
-      }),
+      body: () =>
+        new Promise((resolve) => {
+          let body = '';
+          req.on('data', (chunk) => (body += chunk));
+          req.on('end', () => resolve(body));
+        }),
       raw: req,
     });
     res.writeHead(init.status, init.statusText, init.headers).end(body);
@@ -227,7 +230,7 @@ await serve(
       url: req.url,
       method: req.method,
       headers,
-      body: await req.text(),
+      body: () => req.text(),
       raw: req,
     });
     return new Response(body, init);
@@ -686,11 +689,12 @@ const server = http.createServer(async (req, res) => {
       url: req.url,
       method: req.method,
       headers: req.headers,
-      body: await new Promise((resolve) => {
-        let body = '';
-        req.on('data', (chunk) => (body += chunk));
-        req.on('end', () => resolve(body));
-      }),
+      body: () =>
+        new Promise((resolve) => {
+          let body = '';
+          req.on('data', (chunk) => (body += chunk));
+          req.on('end', () => resolve(body));
+        }),
       raw: req,
     });
     res.writeHead(init.status, init.statusText, init.headers).end(body);
@@ -705,6 +709,32 @@ console.log('Listening to port 4000');
 
 </details>
 
+<details id="audit-jest">
+<summary><a href="#audit-jest">🔗</a> Audit for servers usage in <a href="https://jestjs.io">Jest</a> environment</summary>
+
+```js
+import { fetch } from '@whatwg-node/fetch';
+import { serverAudits } from 'graphql-http';
+
+for (const audit of serverAudits({
+  url: 'http://localhost:4000/graphql',
+  fetchFn: fetch,
+})) {
+  test(audit.name, async () => {
+    const result = await audit.fn();
+    if (result.status === 'error') {
+      throw result.reason;
+    }
+    if (result.status === 'warn') {
+      console.warn(result.reason); // or throw if you want full compliance (warnings are not requirements)
+    }
+    // result.status === 'ok'
+  });
+}
+```
+
+</details>
+
 ## [Documentation](docs/)
 
 Check the [docs folder](docs/) out for [TypeDoc](https://typedoc.org) generated documentation.

package/lib/audits/common.d.ts

@@ -0,0 +1,58 @@
+/**
+ *
+ * audit/common
+ *
+ */
+/**
+ * Audit requirement levels as per [RFC2119](https://www.rfc-editor.org/rfc/rfc2119).
+ *
+ * @category Audits
+ */
+export declare type AuditRequirement = 'MUST' | 'SHOULD' | 'MAY';
+/**
+ * Audit name starting with the audit requirement level.
+ *
+ * @category Audits
+ */
+export declare type AuditName = `${AuditRequirement} ${string}`;
+/**
+ * Actual audit test returning an result.
+ *
+ * The test function will throw only if the error is fatal.
+ *
+ * @category Audits
+ */
+export interface Audit {
+    name: AuditName;
+    fn: () => Promise<AuditResult>;
+}
+/**
+ * Indicates that the audit was successful.
+ *
+ * @category Audits
+ */
+export interface AuditOk {
+    name: AuditName;
+    status: 'ok';
+}
+/**
+ * Indicates that the audit failed.
+ *
+ * If the status is `warn`, the audit is not a requirement but rather a recommendation.
+ *
+ * On the other hand, if the status is `error`, the audit is a requirement and the source
+ * is therefore not compliant.
+ *
+ * @category Audits
+ */
+export interface AuditFail {
+    name: AuditName;
+    status: 'warn' | 'error';
+    reason: string;
+}
+/**
+ * Result of the performed audit. See `AuditOk` and `AuditFail` for more information.
+ *
+ * @category Audits
+ */
+export declare type AuditResult = AuditOk | AuditFail;

package/lib/audits/common.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ *
+ * audit/common
+ *
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/audits/common.mjs

@@ -0,0 +1,6 @@
+/**
+ *
+ * audit/common
+ *
+ */
+export {};

package/lib/audits/index.d.ts

@@ -0,0 +1,2 @@
+export * from './common';
+export * from './server';

package/lib/audits/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./common"), exports);
+__exportStar(require("./server"), exports);

package/lib/audits/index.mjs

@@ -0,0 +1,2 @@
+export * from './common.mjs';
+export * from './server.mjs';

package/lib/audits/server.d.ts

@@ -0,0 +1,39 @@
+/**
+ *
+ * audit/server
+ *
+ */
+import { Audit, AuditResult } from './common';
+/**
+ * Options for server audits required to check GraphQL over HTTP spec conformance.
+ *
+ * @category Audits
+ */
+export interface ServerAuditOptions {
+    /**
+     * The URL of the GraphQL server for the audit.
+     */
+    url: string;
+    /**
+     * The Fetch function to use.
+     *
+     * For NodeJS environments consider using [`@whatwg-node/fetch`](https://github.com/ardatan/whatwg-node/tree/master/packages/fetch).
+     *
+     * @default global.fetch
+     */
+    fetchFn?: unknown;
+}
+/**
+ * List of server audits required to check GraphQL over HTTP spec conformance.
+ *
+ * @category Audits
+ */
+export declare function serverAudits(opts: ServerAuditOptions): Audit[];
+/**
+ * Performs the full list of server audits required for GraphQL over HTTP spec conformance.
+ *
+ * Please consult the `AuditResult` for more information.
+ *
+ * @category Audits
+ */
+export declare function auditServer(opts: ServerAuditOptions): Promise<AuditResult[]>;

package/lib/audits/server.js

@@ -0,0 +1,400 @@
+"use strict";
+/**
+ *
+ * audit/server
+ *
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditServer = exports.serverAudits = void 0;
+const utils_1 = require("./utils");
+/**
+ * List of server audits required to check GraphQL over HTTP spec conformance.
+ *
+ * @category Audits
+ */
+function serverAudits(opts) {
+    const fetchFn = (opts.fetchFn || fetch);
+    return [
+        // Media Types
+        (0, utils_1.audit)('MUST accept application/graphql-response+json and match the content-type', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{ __typename }');
+            const res = await fetchFn(url.toString(), {
+                headers: {
+                    accept: 'application/graphql-response+json',
+                },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('application/graphql-response+json');
+        }),
+        (0, utils_1.audit)('MUST accept application/json and match the content-type', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{ __typename }');
+            const res = await fetchFn(url.toString(), {
+                headers: {
+                    accept: 'application/json',
+                },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('application/json');
+        }),
+        (0, utils_1.audit)('MUST accept */* and use application/graphql-response+json for the content-type', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{ __typename }');
+            const res = await fetchFn(url.toString(), {
+                headers: {
+                    accept: '*/*',
+                },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('application/graphql-response+json');
+        }),
+        (0, utils_1.audit)('MUST assume application/graphql-response+json content-type when accept is missing', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{ __typename }');
+            const res = await fetchFn(url.toString());
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('application/graphql-response+json');
+        }),
+        (0, utils_1.audit)('MUST use utf-8 charset in response', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{ __typename }');
+            const res = await fetchFn(url.toString());
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('charset=utf-8');
+        }),
+        (0, utils_1.audit)('MUST accept only utf-8 charset', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{ __typename }');
+            const res = await fetchFn(url.toString(), {
+                headers: {
+                    accept: 'application/graphql-response+json; charset=iso-8859-1',
+                },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(406);
+            (0, utils_1.assert)('Accept header', res.headers.get('accept')).toContain('charset=utf-8');
+        }),
+        // Request
+        (0, utils_1.audit)('MUST accept POST requests', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ query: '{ __typename }' }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+        }),
+        (0, utils_1.audit)('MAY accept application/x-www-form-urlencoded formatted GET requests', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{ __typename }');
+            const res = await fetchFn(url.toString());
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+        }),
+        // Request GET
+        (0, utils_1.audit)('MUST NOT allow executing mutations on GET requests', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', 'mutation { __typename }');
+            const res = await fetchFn(url.toString(), {
+                headers: {
+                    accept: 'application/graphql-response+json',
+                },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(405);
+        }),
+        // Request POST
+        (0, utils_1.audit)('SHOULD respond with 4xx status code if content-type is not supplied on POST requests', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+            });
+            (0, utils_1.assert)('Status code', res.status).toBeGreaterThanOrEqual(400);
+            (0, utils_1.assert)('Status code', res.status).toBeLessThanOrEqual(599);
+        }),
+        (0, utils_1.audit)('MUST accept application/json POST requests', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ query: '{ __typename }' }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+        }),
+        (0, utils_1.audit)('MUST require a request body on POST', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(400);
+        }),
+        // Request Parameters
+        (0, utils_1.audit)('MUST require the {query} parameter', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({ notquery: '{ __typename }' }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(400);
+        }),
+        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid) => (0, utils_1.audit)(`MUST NOT allow ${(0, utils_1.extendedTypeof)(invalid)} for the {query} parameter`, async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: invalid,
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(400);
+        })),
+        (0, utils_1.audit)('MUST accept a string for the {query} parameter', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{ __typename }',
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+        }),
+        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid) => (0, utils_1.audit)(`MUST NOT allow ${(0, utils_1.extendedTypeof)(invalid)} for the {operationName} parameter`, async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    operationName: invalid,
+                    query: '{ __typename }',
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(400);
+        })),
+        (0, utils_1.audit)('MUST accept a string for the {operationName} parameter', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    operationName: 'Query',
+                    query: 'query Query { __typename }',
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+        }),
+        ...['string', 0, false, ['array']].map((invalid) => (0, utils_1.audit)(`MUST NOT allow ${(0, utils_1.extendedTypeof)(invalid)} for the {variables} parameter`, async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{ __typename }',
+                    variables: invalid,
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(400);
+        })),
+        (0, utils_1.audit)('MUST accept a map for the {variables} parameter', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: 'query Type($name: String!) { __type(name: $name) { name } }',
+                    variables: { name: 'sometype' },
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            const result = (await res.json());
+            (0, utils_1.assert)('Execution result', result).notToHaveProperty('errors');
+        }),
+        (0, utils_1.audit)('MUST accept a URL-encoded JSON string for the {variables} parameter in GETs', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', 'query Type($name: String!) { __type(name: $name) { name } }');
+            url.searchParams.set('variables', JSON.stringify({ name: 'sometype' }));
+            const res = await fetchFn(url.toString(), {
+                method: 'GET',
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            const result = (await res.json());
+            (0, utils_1.assert)('Execution result', result).notToHaveProperty('errors');
+        }),
+        ...['string', 0, false, ['array']].map((invalid) => (0, utils_1.audit)(`MUST NOT allow ${(0, utils_1.extendedTypeof)(invalid)} for the {extensions} parameter`, async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{ __typename }',
+                    extensions: invalid,
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(400);
+        })),
+        (0, utils_1.audit)('MUST accept a map for the {extensions} parameter', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{ __typename }',
+                    extensions: { some: 'value' },
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+        }),
+        // TODO: audit('MUST accept a map for the {extensions} parameter'),
+        // Response application/json
+        (0, utils_1.audit)('SHOULD use 200 status code on JSON parsing failure when accepting application/json', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: '{ "not a JSON',
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+        }),
+        (0, utils_1.audit)('SHOULD use 200 status code if parameters are invalid when accepting application/json', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('qeury' /* typo */, '{ __typename }');
+            const res = await fetchFn(url.toString(), {
+                method: 'GET',
+                headers: { accept: 'application/json' },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+        }),
+        (0, utils_1.audit)('SHOULD use 200 status code on document parsing failure when accepting application/json', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{');
+            const res = await fetchFn(url.toString(), {
+                method: 'GET',
+                headers: { accept: 'application/json' },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+        }),
+        (0, utils_1.audit)('SHOULD use 200 status code on document validation failure when accepting application/json', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{ 8f31403dfe404bccbb0e835f2629c6a7 }'); // making sure the field doesnt exist
+            const res = await fetchFn(url.toString(), {
+                method: 'GET',
+                headers: { accept: 'application/json' },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+        }),
+        // Response application/graphql-response+json
+        (0, utils_1.audit)('MUST use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: '{ "not a JSON',
+            });
+            (0, utils_1.assert)('Status code', res.status).toBeGreaterThanOrEqual(400);
+            (0, utils_1.assert)('Status code', res.status).toBeLessThanOrEqual(599);
+        }),
+        (0, utils_1.audit)('SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: '{ "not a JSON',
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(400);
+        }),
+        (0, utils_1.audit)('MUST use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('qeury' /* typo */, '{ __typename }');
+            const res = await fetchFn(url.toString(), {
+                method: 'GET',
+                headers: { accept: 'application/graphql-response+json' },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBeGreaterThanOrEqual(400);
+            (0, utils_1.assert)('Status code', res.status).toBeLessThanOrEqual(599);
+        }),
+        (0, utils_1.audit)('SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('qeury' /* typo */, '{ __typename }');
+            const res = await fetchFn(url.toString(), {
+                method: 'GET',
+                headers: { accept: 'application/graphql-response+json' },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(400);
+        }),
+        (0, utils_1.audit)('MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{');
+            const res = await fetchFn(url.toString(), {
+                method: 'GET',
+                headers: { accept: 'application/graphql-response+json' },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBeGreaterThanOrEqual(400);
+            (0, utils_1.assert)('Status code', res.status).toBeLessThanOrEqual(599);
+        }),
+        (0, utils_1.audit)('SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{');
+            const res = await fetchFn(url.toString(), {
+                method: 'GET',
+                headers: { accept: 'application/graphql-response+json' },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(400);
+        }),
+        (0, utils_1.audit)('MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{ 8f31403dfe404bccbb0e835f2629c6a7 }'); // making sure the field doesnt exist
+            const res = await fetchFn(url.toString(), {
+                method: 'GET',
+                headers: { accept: 'application/graphql-response+json' },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBeGreaterThanOrEqual(400);
+            (0, utils_1.assert)('Status code', res.status).toBeLessThanOrEqual(599);
+        }),
+        (0, utils_1.audit)('SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', '{ 8f31403dfe404bccbb0e835f2629c6a7 }'); // making sure the field doesnt exist
+            const res = await fetchFn(url.toString(), {
+                method: 'GET',
+                headers: { accept: 'application/graphql-response+json' },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(400);
+        }),
+        // TODO: how to make an unauthorized request?
+        // https://graphql.github.io/graphql-over-http/draft/#sel-EANNNDTAAEVBAAqqc
+        // audit('SHOULD use 401 or 403 status codes when the request is not permitted')
+    ];
+}
+exports.serverAudits = serverAudits;
+/**
+ * Performs the full list of server audits required for GraphQL over HTTP spec conformance.
+ *
+ * Please consult the `AuditResult` for more information.
+ *
+ * @category Audits
+ */
+async function auditServer(opts) {
+    const audits = serverAudits(opts);
+    // audit tests will throw only on fatal errors, tests are contained within the AuditResult
+    return await Promise.all(audits.map(({ fn }) => fn()));
+}
+exports.auditServer = auditServer;