graphql-http 1.6.0 → 1.6.1

package/README.md

@@ -739,6 +739,10 @@ for (const audit of serverAudits({
 
 Check the [docs folder](docs/) out for [TypeDoc](https://typedoc.org) generated documentation.
 
+## [Audits](implementations/)
+
+Inspect audits of other implementations in the [implementations folder](implementations/). Adding your implementation is very welcome!
+
 ## [Want to help?](CONTRIBUTING.md)
 
 File a bug, contribute with code, or improve documentation? Read up on our guidelines for [contributing](CONTRIBUTING.md) and drive development with `yarn test --watch` away!

package/lib/audits/common.d.mts

@@ -0,0 +1,58 @@
+/**
+ *
+ * audit/common
+ *
+ */
+/**
+ * Audit requirement levels as per [RFC2119](https://www.rfc-editor.org/rfc/rfc2119).
+ *
+ * @category Audits
+ */
+export declare type AuditRequirement = 'MUST' | 'SHOULD' | 'MAY';
+/**
+ * Audit name starting with the audit requirement level.
+ *
+ * @category Audits
+ */
+export declare type AuditName = `${AuditRequirement} ${string}`;
+/**
+ * Actual audit test returning an result.
+ *
+ * The test function will throw only if the error is fatal.
+ *
+ * @category Audits
+ */
+export interface Audit {
+    name: AuditName;
+    fn: () => Promise<AuditResult>;
+}
+/**
+ * Indicates that the audit was successful.
+ *
+ * @category Audits
+ */
+export interface AuditOk {
+    name: AuditName;
+    status: 'ok';
+}
+/**
+ * Indicates that the audit failed.
+ *
+ * If the status is `warn`, the audit is not a requirement but rather a recommendation.
+ *
+ * On the other hand, if the status is `error`, the audit is a requirement and the source
+ * is therefore not compliant.
+ *
+ * @category Audits
+ */
+export interface AuditFail {
+    name: AuditName;
+    status: 'warn' | 'error';
+    reason: string;
+}
+/**
+ * Result of the performed audit. See `AuditOk` and `AuditFail` for more information.
+ *
+ * @category Audits
+ */
+export declare type AuditResult = AuditOk | AuditFail;

package/lib/audits/index.d.mts

@@ -0,0 +1,2 @@
+export * from './common';
+export * from './server';

package/lib/audits/server.d.mts

@@ -0,0 +1,39 @@
+/**
+ *
+ * audit/server
+ *
+ */
+import { Audit, AuditResult } from './common';
+/**
+ * Options for server audits required to check GraphQL over HTTP spec conformance.
+ *
+ * @category Audits
+ */
+export interface ServerAuditOptions {
+    /**
+     * The URL of the GraphQL server for the audit.
+     */
+    url: string;
+    /**
+     * The Fetch function to use.
+     *
+     * For NodeJS environments consider using [`@whatwg-node/fetch`](https://github.com/ardatan/whatwg-node/tree/master/packages/fetch).
+     *
+     * @default global.fetch
+     */
+    fetchFn?: unknown;
+}
+/**
+ * List of server audits required to check GraphQL over HTTP spec conformance.
+ *
+ * @category Audits
+ */
+export declare function serverAudits(opts: ServerAuditOptions): Audit[];
+/**
+ * Performs the full list of server audits required for GraphQL over HTTP spec conformance.
+ *
+ * Please consult the `AuditResult` for more information.
+ *
+ * @category Audits
+ */
+export declare function auditServer(opts: ServerAuditOptions): Promise<AuditResult[]>;

package/lib/audits/server.js

@@ -16,7 +16,9 @@ function serverAudits(opts) {
     const fetchFn = (opts.fetchFn || fetch);
     return [
         // Media Types
-        (0, utils_1.audit)('MUST accept application/graphql-response+json and match the content-type', async () => {
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD accept application/graphql-response+json and match the content-type', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', '{ __typename }');
             const res = await fetchFn(url.toString(), {
@@ -38,7 +40,9 @@ function serverAudits(opts) {
             (0, utils_1.assert)('Status code', res.status).toBe(200);
             (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('application/json');
         }),
-        (0, utils_1.audit)('MUST accept */* and use application/graphql-response+json for the content-type', async () => {
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD accept */* and use application/graphql-response+json for the content-type', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', '{ __typename }');
             const res = await fetchFn(url.toString(), {
@@ -49,19 +53,39 @@ function serverAudits(opts) {
             (0, utils_1.assert)('Status code', res.status).toBe(200);
             (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('application/graphql-response+json');
         }),
-        (0, utils_1.audit)('MUST assume application/graphql-response+json content-type when accept is missing', async () => {
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD assume application/graphql-response+json content-type when accept is missing', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', '{ __typename }');
             const res = await fetchFn(url.toString());
             (0, utils_1.assert)('Status code', res.status).toBe(200);
             (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('application/graphql-response+json');
         }),
-        (0, utils_1.audit)('MUST use utf-8 charset in response', async () => {
+        (0, utils_1.audit)('MUST use utf-8 encoding when responding', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', '{ __typename }');
             const res = await fetchFn(url.toString());
             (0, utils_1.assert)('Status code', res.status).toBe(200);
-            (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('charset=utf-8');
+            // has charset set to utf-8
+            try {
+                (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('charset=utf-8');
+                return;
+            }
+            catch (_a) {
+                // noop, continue
+            }
+            // has no charset specified
+            (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).notToContain('charset');
+            // and the content is utf-8 encoded
+            try {
+                const decoder = new TextDecoder('utf-8');
+                const decoded = decoder.decode(await res.arrayBuffer());
+                (0, utils_1.assert)('UTF-8 decoded body', decoded).toBe('{"data":{"__typename":"Query"}}');
+            }
+            catch (_b) {
+                throw 'Body is not UTF-8 encoded';
+            }
         }),
         (0, utils_1.audit)('MUST accept only utf-8 charset', async () => {
             const url = new URL(opts.url);
@@ -71,8 +95,16 @@ function serverAudits(opts) {
                     accept: 'application/graphql-response+json; charset=iso-8859-1',
                 },
             });
-            (0, utils_1.assert)('Status code', res.status).toBe(406);
-            (0, utils_1.assert)('Accept header', res.headers.get('accept')).toContain('charset=utf-8');
+            // application/json is 200 + errors
+            const contentType = res.headers.get('content-type') || '';
+            if (contentType.includes('application/json')) {
+                (0, utils_1.assert)(`Content-Type ${contentType} status code`, res.status).toBe(200);
+                (0, utils_1.assert)('Execution result', await (0, utils_1.assertBodyAsExecutionResult)(res)).toHaveProperty('errors');
+                return;
+            }
+            // other content-types must be 4xx
+            (0, utils_1.assert)(`Content-Type ${contentType} status code`, res.status).toBeGreaterThanOrEqual(400);
+            (0, utils_1.assert)(`Content-Type ${contentType} status code`, res.status).toBeLessThanOrEqual(499);
         }),
         // Request
         (0, utils_1.audit)('MUST accept POST requests', async () => {
@@ -106,7 +138,7 @@ function serverAudits(opts) {
                 method: 'POST',
             });
             (0, utils_1.assert)('Status code', res.status).toBeGreaterThanOrEqual(400);
-            (0, utils_1.assert)('Status code', res.status).toBeLessThanOrEqual(599);
+            (0, utils_1.assert)('Status code', res.status).toBeLessThanOrEqual(499);
         }),
         (0, utils_1.audit)('MUST accept application/json POST requests', async () => {
             const res = await fetchFn(opts.url, {
@@ -124,7 +156,9 @@ function serverAudits(opts) {
             (0, utils_1.assert)('Status code', res.status).toBe(400);
         }),
         // Request Parameters
-        (0, utils_1.audit)('MUST require the {query} parameter', async () => {
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json', async () => {
             const res = await fetchFn(opts.url, {
                 method: 'POST',
                 headers: {
@@ -135,7 +169,21 @@ function serverAudits(opts) {
             });
             (0, utils_1.assert)('Status code', res.status).toBe(400);
         }),
-        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid) => (0, utils_1.audit)(`MUST NOT allow ${(0, utils_1.extendedTypeof)(invalid)} for the {query} parameter`, async () => {
+        (0, utils_1.audit)('SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({ notquery: '{ __typename }' }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Execution result', await (0, utils_1.assertBodyAsExecutionResult)(res)).toHaveProperty('errors');
+        }),
+        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid) => (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        `SHOULD use 400 status code on ${(0, utils_1.extendedTypeof)(invalid)} {query} parameter when accepting application/graphql-response+json`, async () => {
             const res = await fetchFn(opts.url, {
                 method: 'POST',
                 headers: {
@@ -148,7 +196,23 @@ function serverAudits(opts) {
             });
             (0, utils_1.assert)('Status code', res.status).toBe(400);
         })),
-        (0, utils_1.audit)('MUST accept a string for the {query} parameter', async () => {
+        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid) => (0, utils_1.audit)(`SHOULD use 200 status code with errors field on ${(0, utils_1.extendedTypeof)(invalid)} {query} parameter when accepting application/json`, async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    query: invalid,
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Execution result', await (0, utils_1.assertBodyAsExecutionResult)(res)).toHaveProperty('errors');
+        })),
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD allow string {query} parameter when accepting application/graphql-response+json', async () => {
             const res = await fetchFn(opts.url, {
                 method: 'POST',
                 headers: {
@@ -161,7 +225,23 @@ function serverAudits(opts) {
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
         }),
-        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid) => (0, utils_1.audit)(`MUST NOT allow ${(0, utils_1.extendedTypeof)(invalid)} for the {operationName} parameter`, async () => {
+        (0, utils_1.audit)('MUST allow string {query} parameter when accepting application/json', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    query: '{ __typename }',
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Execution result', await (0, utils_1.assertBodyAsExecutionResult)(res)).notToHaveProperty('errors');
+        }),
+        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid) => (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        `SHOULD use 400 status code on ${(0, utils_1.extendedTypeof)(invalid)} {operationName} parameter when accepting application/graphql-response+json`, async () => {
             const res = await fetchFn(opts.url, {
                 method: 'POST',
                 headers: {
@@ -175,7 +255,24 @@ function serverAudits(opts) {
             });
             (0, utils_1.assert)('Status code', res.status).toBe(400);
         })),
-        (0, utils_1.audit)('MUST accept a string for the {operationName} parameter', async () => {
+        ...[{ obj: 'ect' }, 0, false, ['array']].map((invalid) => (0, utils_1.audit)(`SHOULD use 200 status code with errors field on ${(0, utils_1.extendedTypeof)(invalid)} {operationName} parameter when accepting application/json`, async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    operationName: invalid,
+                    query: '{ __typename }',
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Execution result', await (0, utils_1.assertBodyAsExecutionResult)(res)).toHaveProperty('errors');
+        })),
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD allow string {operationName} parameter when accepting application/graphql-response+json', async () => {
             const res = await fetchFn(opts.url, {
                 method: 'POST',
                 headers: {
@@ -189,7 +286,24 @@ function serverAudits(opts) {
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
         }),
-        ...['string', 0, false, ['array']].map((invalid) => (0, utils_1.audit)(`MUST NOT allow ${(0, utils_1.extendedTypeof)(invalid)} for the {variables} parameter`, async () => {
+        (0, utils_1.audit)('MUST allow string {operationName} parameter when accepting application/json', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    operationName: 'Query',
+                    query: 'query Query { __typename }',
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Execution result', await (0, utils_1.assertBodyAsExecutionResult)(res)).notToHaveProperty('errors');
+        }),
+        ...['string', 0, false, ['array']].map((invalid) => (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        `SHOULD use 400 status code on ${(0, utils_1.extendedTypeof)(invalid)} {variables} parameter when accepting application/graphql-response+json`, async () => {
             const res = await fetchFn(opts.url, {
                 method: 'POST',
                 headers: {
@@ -203,7 +317,24 @@ function serverAudits(opts) {
             });
             (0, utils_1.assert)('Status code', res.status).toBe(400);
         })),
-        (0, utils_1.audit)('MUST accept a map for the {variables} parameter', async () => {
+        ...['string', 0, false, ['array']].map((invalid) => (0, utils_1.audit)(`SHOULD use 200 status code with errors field on ${(0, utils_1.extendedTypeof)(invalid)} {variables} parameter when accepting application/json`, async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    query: '{ __typename }',
+                    variables: invalid,
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Execution result', await (0, utils_1.assertBodyAsExecutionResult)(res)).toHaveProperty('errors');
+        })),
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD allow map {variables} parameter when accepting application/graphql-response+json', async () => {
             const res = await fetchFn(opts.url, {
                 method: 'POST',
                 headers: {
@@ -216,21 +347,52 @@ function serverAudits(opts) {
                 }),
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
-            const result = (await res.json());
-            (0, utils_1.assert)('Execution result', result).notToHaveProperty('errors');
         }),
-        (0, utils_1.audit)('MUST accept a URL-encoded JSON string for the {variables} parameter in GETs', async () => {
+        (0, utils_1.audit)('MUST allow map {variables} parameter when accepting application/json', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    query: 'query Type($name: String!) { __type(name: $name) { name } }',
+                    variables: { name: 'sometype' },
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Execution result', await (0, utils_1.assertBodyAsExecutionResult)(res)).notToHaveProperty('errors');
+        }),
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', 'query Type($name: String!) { __type(name: $name) { name } }');
             url.searchParams.set('variables', JSON.stringify({ name: 'sometype' }));
             const res = await fetchFn(url.toString(), {
                 method: 'GET',
+                headers: {
+                    accept: 'application/graphql-response+json',
+                },
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
-            const result = (await res.json());
-            (0, utils_1.assert)('Execution result', result).notToHaveProperty('errors');
         }),
-        ...['string', 0, false, ['array']].map((invalid) => (0, utils_1.audit)(`MUST NOT allow ${(0, utils_1.extendedTypeof)(invalid)} for the {extensions} parameter`, async () => {
+        (0, utils_1.audit)('MUST allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json', async () => {
+            const url = new URL(opts.url);
+            url.searchParams.set('query', 'query Type($name: String!) { __type(name: $name) { name } }');
+            url.searchParams.set('variables', JSON.stringify({ name: 'sometype' }));
+            const res = await fetchFn(url.toString(), {
+                method: 'GET',
+                headers: {
+                    accept: 'application/json',
+                },
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Execution result', await (0, utils_1.assertBodyAsExecutionResult)(res)).notToHaveProperty('errors');
+        }),
+        ...['string', 0, false, ['array']].map((invalid) => (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        `SHOULD use 400 status code on ${(0, utils_1.extendedTypeof)(invalid)} {extensions} parameter when accepting application/graphql-response+json`, async () => {
             const res = await fetchFn(opts.url, {
                 method: 'POST',
                 headers: {
@@ -244,7 +406,24 @@ function serverAudits(opts) {
             });
             (0, utils_1.assert)('Status code', res.status).toBe(400);
         })),
-        (0, utils_1.audit)('MUST accept a map for the {extensions} parameter', async () => {
+        ...['string', 0, false, ['array']].map((invalid) => (0, utils_1.audit)(`SHOULD use 200 status code with errors field on ${(0, utils_1.extendedTypeof)(invalid)} {extensions} parameter when accepting application/json`, async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    query: '{ __typename }',
+                    extensions: invalid,
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Execution result', await (0, utils_1.assertBodyAsExecutionResult)(res)).toHaveProperty('errors');
+        })),
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD allow map {extensions} parameter when accepting application/graphql-response+json', async () => {
             const res = await fetchFn(opts.url, {
                 method: 'POST',
                 headers: {
@@ -258,6 +437,21 @@ function serverAudits(opts) {
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
         }),
+        (0, utils_1.audit)('MUST allow map {extensions} parameter when accepting application/json', async () => {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    query: '{ __typename }',
+                    extensions: { some: 'value' },
+                }),
+            });
+            (0, utils_1.assert)('Status code', res.status).toBe(200);
+            (0, utils_1.assert)('Execution result', await (0, utils_1.assertBodyAsExecutionResult)(res)).notToHaveProperty('errors');
+        }),
         // TODO: audit('MUST accept a map for the {extensions} parameter'),
         // Response application/json
         (0, utils_1.audit)('SHOULD use 200 status code on JSON parsing failure when accepting application/json', async () => {
@@ -299,7 +493,9 @@ function serverAudits(opts) {
             (0, utils_1.assert)('Status code', res.status).toBe(200);
         }),
         // Response application/graphql-response+json
-        (0, utils_1.audit)('MUST use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json', async () => {
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json', async () => {
             const res = await fetchFn(opts.url, {
                 method: 'POST',
                 headers: {
@@ -331,9 +527,11 @@ function serverAudits(opts) {
                 },
                 body: '{ "not a JSON',
             });
-            (0, utils_1.assert)('Data entry', (await res.json()).data).toBe(undefined);
+            (0, utils_1.assert)('Data entry', (await (0, utils_1.assertBodyAsExecutionResult)(res)).data).toBe(undefined);
         }),
-        (0, utils_1.audit)('MUST use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json', async () => {
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('qeury' /* typo */, '{ __typename }');
             const res = await fetchFn(url.toString(), {
@@ -359,9 +557,11 @@ function serverAudits(opts) {
                 method: 'GET',
                 headers: { accept: 'application/graphql-response+json' },
             });
-            (0, utils_1.assert)('Data entry', (await res.json()).data).toBe(undefined);
+            (0, utils_1.assert)('Data entry', (await (0, utils_1.assertBodyAsExecutionResult)(res)).data).toBe(undefined);
         }),
-        (0, utils_1.audit)('MUST use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json', async () => {
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', '{');
             const res = await fetchFn(url.toString(), {
@@ -387,9 +587,11 @@ function serverAudits(opts) {
                 method: 'GET',
                 headers: { accept: 'application/graphql-response+json' },
             });
-            (0, utils_1.assert)('Data entry', (await res.json()).data).toBe(undefined);
+            (0, utils_1.assert)('Data entry', (await (0, utils_1.assertBodyAsExecutionResult)(res)).data).toBe(undefined);
         }),
-        (0, utils_1.audit)('MUST use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json', async () => {
+        (0, utils_1.audit)(
+        // TODO: convert to MUST after watershed
+        'SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', '{ 8f31403dfe404bccbb0e835f2629c6a7 }'); // making sure the field doesnt exist
             const res = await fetchFn(url.toString(), {
@@ -415,7 +617,7 @@ function serverAudits(opts) {
                 method: 'GET',
                 headers: { accept: 'application/graphql-response+json' },
             });
-            (0, utils_1.assert)('Data entry', (await res.json()).data).toBe(undefined);
+            (0, utils_1.assert)('Data entry', (await (0, utils_1.assertBodyAsExecutionResult)(res)).data).toBe(undefined);
         }),
         // TODO: how to fail and have the data entry?
         // audit('MUST use 2xx status code if response contains the data entry and it is not null when accepting application/graphql-response+json'),