graphql-http 1.7.0 → 1.7.1

package/README.md

@@ -7,9 +7,9 @@
 
 [![Continuous integration](https://github.com/graphql/graphql-http/workflows/Continuous%20integration/badge.svg)](https://github.com/graphql/graphql-http/actions?query=workflow%3A%22Continuous+integration%22) [![graphql-http](https://img.shields.io/npm/v/graphql-http.svg?label=graphql-http&logo=npm)](https://www.npmjs.com/package/graphql-http)
 
-<i>Need subscriptions? Try <b>[graphql-ws](https://github.com/enisdenjo/graphql-ws)</b> or <b>[graphql-sse](https://github.com/enisdenjo/graphql-sse)</b> instead!</i>
+<i>Want a full-featured server? See the <b>[servers section](#servers)</b>!</i>
 
-<i>Want a full-featured server? See the <b>[servers section](#servers)</b></i>!
+<i>Need subscriptions? Try <b>[graphql-ws](https://github.com/enisdenjo/graphql-ws)</b> or <b>[graphql-sse](https://github.com/enisdenjo/graphql-sse)</b> instead!</i>
 
   <br />
 </div>
@@ -729,12 +729,13 @@ Having said this, graphql-http is mostly aimed for library authors and simple se
 
 If you want a feature-full server with bleeding edge technologies, you're recommended to use one of the following.
 
-| Name                                                           | Audit                                                              |
-| -------------------------------------------------------------- | ------------------------------------------------------------------ |
-| [graphql-yoga](https://www.the-guild.dev/graphql/yoga-server)  | [✅ Fully compliant](/implementations/graphql-yoga/README.md)      |
-| [apollo-server](https://www.the-guild.dev/graphql/yoga-server) | [⚠️ Partially compliant](/implementations/apollo-server/README.md) |
-| [mercurius](https://mercurius.dev)                             | [⚠️ Partially compliant](/implementations/mercurius/README.md)     |
-| [graphql-helix](https://www.graphql-helix.com/)                | [⚠️ Partially compliant](/implementations/graphql-helix/README.md) |
+| Name                                                               | Audit                                                                |
+| ------------------------------------------------------------------ | -------------------------------------------------------------------- |
+| [graphql-yoga](https://www.the-guild.dev/graphql/yoga-server)      | [✅ Compliant (0 warnings)](/implementations/graphql-yoga/README.md) |
+| [hotchocolate](https://chillicream.com/docs/hotchocolate)          | [✅ Compliant (0 warnings)](/implementations/hotchocolate/README.md) |
+| [postgraphile](https://www.graphile.org/postgraphile/)             | [✅ Compliant](/implementations/postgraphile/README.md)              |
+| [apollo-server](https://www.apollographql.com/docs/apollo-server/) | [✅ Compliant](/implementations/apollo-server/README.md)             |
+| [mercurius](https://mercurius.dev)                                 | [✅ Compliant](/implementations/mercurius/README.md)                 |
 
 ## [Documentation](docs/)
 

package/lib/audits/server.js

@@ -19,23 +19,25 @@ function serverAudits(opts) {
         (0, utils_1.audit)(
         // TODO: convert to MUST after watershed
         'SHOULD accept application/graphql-response+json and match the content-type', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString(), {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
                 headers: {
+                    'content-type': 'application/json',
                     accept: 'application/graphql-response+json',
                 },
+                body: JSON.stringify({ query: '{ __typename }' }),
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
             (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('application/graphql-response+json');
         }),
         (0, utils_1.audit)('MUST accept application/json and match the content-type', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString(), {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
                 headers: {
+                    'content-type': 'application/json',
                     accept: 'application/json',
                 },
+                body: JSON.stringify({ query: '{ __typename }' }),
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
             (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('application/json');
@@ -43,12 +45,13 @@ function serverAudits(opts) {
         (0, utils_1.audit)(
         // TODO: convert to MUST after watershed
         'SHOULD accept */* and use application/graphql-response+json for the content-type', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString(), {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
                 headers: {
+                    'content-type': 'application/json',
                     accept: '*/*',
                 },
+                body: JSON.stringify({ query: '{ __typename }' }),
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
             (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('application/graphql-response+json');
@@ -56,16 +59,24 @@ function serverAudits(opts) {
         (0, utils_1.audit)(
         // TODO: convert to MUST after watershed
         'SHOULD assume application/graphql-response+json content-type when accept is missing', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString());
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                },
+                body: JSON.stringify({ query: '{ __typename }' }),
+            });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
             (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('application/graphql-response+json');
         }),
         (0, utils_1.audit)('MUST use utf-8 encoding when responding', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString());
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                },
+                body: JSON.stringify({ query: '{ __typename }' }),
+            });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
             // has charset set to utf-8
             try {
@@ -88,23 +99,23 @@ function serverAudits(opts) {
             }
         }),
         (0, utils_1.audit)('MUST accept utf-8 encoding', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString(), {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
                 headers: {
                     'content-type': 'application/json; charset=utf-8',
                 },
+                body: JSON.stringify({ query: '{ __typename }' }),
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
             (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('utf-8');
         }),
         (0, utils_1.audit)('MUST assume utf-8 if encoding is unspecified', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString(), {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
                 headers: {
                     'content-type': 'application/json',
                 },
+                body: JSON.stringify({ query: '{ __typename }' }),
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
             (0, utils_1.assert)('Content-Type header', res.headers.get('content-type')).toContain('utf-8');
@@ -125,7 +136,8 @@ function serverAudits(opts) {
             (0, utils_1.assert)('Status code', res.status).toBe(200);
         }),
         // Request GET
-        (0, utils_1.audit)('MUST NOT allow executing mutations on GET requests', async () => {
+        // TODO: this is a MUST if the server supports GET requests
+        (0, utils_1.audit)('MAY NOT allow executing mutations on GET requests', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', 'mutation { __typename }');
             const res = await fetchFn(url.toString(), {
@@ -133,15 +145,14 @@ function serverAudits(opts) {
                     accept: 'application/graphql-response+json',
                 },
             });
-            (0, utils_1.assert)('Status code', res.status).toBe(405);
+            (0, utils_1.assert)('Status code', res.status).toBeBetween(400, 499);
         }),
         // Request POST
         (0, utils_1.audit)('SHOULD respond with 4xx status code if content-type is not supplied on POST requests', async () => {
             const res = await fetchFn(opts.url, {
                 method: 'POST',
             });
-            (0, utils_1.assert)('Status code', res.status).toBeGreaterThanOrEqual(400);
-            (0, utils_1.assert)('Status code', res.status).toBeLessThanOrEqual(499);
+            (0, utils_1.assert)('Status code', res.status).toBeBetween(400, 499);
         }),
         (0, utils_1.audit)('MUST accept application/json POST requests', async () => {
             const res = await fetchFn(opts.url, {
@@ -366,9 +377,7 @@ function serverAudits(opts) {
             (0, utils_1.assert)('Status code', res.status).toBe(200);
             (0, utils_1.assert)('Execution result', await (0, utils_1.assertBodyAsExecutionResult)(res)).notToHaveProperty('errors');
         }),
-        (0, utils_1.audit)(
-        // TODO: convert to MUST after watershed
-        'SHOULD allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json', async () => {
+        (0, utils_1.audit)('MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', 'query Type($name: String!) { __type(name: $name) { name } }');
             url.searchParams.set('variables', JSON.stringify({ name: 'sometype' }));
@@ -380,7 +389,7 @@ function serverAudits(opts) {
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
         }),
-        (0, utils_1.audit)('MUST allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json', async () => {
+        (0, utils_1.audit)('MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', 'query Type($name: String!) { __type(name: $name) { name } }');
             url.searchParams.set('variables', JSON.stringify({ name: 'sometype' }));
@@ -469,29 +478,39 @@ function serverAudits(opts) {
             (0, utils_1.assert)('Status code', res.status).toBe(200);
         }),
         (0, utils_1.audit)('SHOULD use 200 status code if parameters are invalid when accepting application/json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('qeury' /* typo */, '{ __typename }');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    qeury: /* typo */ '{ __typename }',
+                }),
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
         }),
         (0, utils_1.audit)('SHOULD use 200 status code on document parsing failure when accepting application/json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({ query: '{' }),
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
         }),
         (0, utils_1.audit)('SHOULD use 200 status code on document validation failure when accepting application/json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ 8f31403dfe404bccbb0e835f2629c6a7 }'); // making sure the field doesnt exist
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
+                }),
             });
             (0, utils_1.assert)('Status code', res.status).toBe(200);
         }),
@@ -507,8 +526,7 @@ function serverAudits(opts) {
                 },
                 body: '{ "not a JSON',
             });
-            (0, utils_1.assert)('Status code', res.status).toBeGreaterThanOrEqual(400);
-            (0, utils_1.assert)('Status code', res.status).toBeLessThanOrEqual(599);
+            (0, utils_1.assert)('Status code', res.status).toBeBetween(400, 499);
         }),
         (0, utils_1.audit)('SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json', async () => {
             const res = await fetchFn(opts.url, {
@@ -535,90 +553,123 @@ function serverAudits(opts) {
         (0, utils_1.audit)(
         // TODO: convert to MUST after watershed
         'SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('qeury' /* typo */, '{ __typename }');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    qeury /* typo */: '{ __typename }',
+                }),
             });
-            (0, utils_1.assert)('Status code', res.status).toBeGreaterThanOrEqual(400);
-            (0, utils_1.assert)('Status code', res.status).toBeLessThanOrEqual(599);
+            (0, utils_1.assert)('Status code', res.status).toBeBetween(400, 599);
         }),
         (0, utils_1.audit)('SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('qeury' /* typo */, '{ __typename }');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    qeury: /* typo */ '{ __typename }',
+                }),
             });
             (0, utils_1.assert)('Status code', res.status).toBe(400);
         }),
         (0, utils_1.audit)('SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('qeury' /* typo */, '{ __typename }');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    qeury: /* typo */ '{ __typename }',
+                }),
             });
             (0, utils_1.assert)('Data entry', (await (0, utils_1.assertBodyAsExecutionResult)(res)).data).toBe(undefined);
         }),
         (0, utils_1.audit)(
         // TODO: convert to MUST after watershed
         'SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{',
+                }),
             });
-            (0, utils_1.assert)('Status code', res.status).toBeGreaterThanOrEqual(400);
-            (0, utils_1.assert)('Status code', res.status).toBeLessThanOrEqual(599);
+            (0, utils_1.assert)('Status code', res.status).toBeBetween(400, 599);
         }),
         (0, utils_1.audit)('SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{',
+                }),
             });
             (0, utils_1.assert)('Status code', res.status).toBe(400);
         }),
         (0, utils_1.audit)('SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{',
+                }),
             });
             (0, utils_1.assert)('Data entry', (await (0, utils_1.assertBodyAsExecutionResult)(res)).data).toBe(undefined);
         }),
         (0, utils_1.audit)(
         // TODO: convert to MUST after watershed
         'SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ 8f31403dfe404bccbb0e835f2629c6a7 }'); // making sure the field doesnt exist
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
+                }),
             });
-            (0, utils_1.assert)('Status code', res.status).toBeGreaterThanOrEqual(400);
-            (0, utils_1.assert)('Status code', res.status).toBeLessThanOrEqual(599);
+            (0, utils_1.assert)('Status code', res.status).toBeBetween(400, 599);
         }),
         (0, utils_1.audit)('SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ 8f31403dfe404bccbb0e835f2629c6a7 }'); // making sure the field doesnt exist
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
+                }),
             });
             (0, utils_1.assert)('Status code', res.status).toBe(400);
         }),
         (0, utils_1.audit)('SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ 8f31403dfe404bccbb0e835f2629c6a7 }'); // making sure the field doesnt exist
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
+                }),
             });
             (0, utils_1.assert)('Data entry', (await (0, utils_1.assertBodyAsExecutionResult)(res)).data).toBe(undefined);
         }),

package/lib/audits/server.mjs

@@ -16,23 +16,25 @@ export function serverAudits(opts) {
         audit(
         // TODO: convert to MUST after watershed
         'SHOULD accept application/graphql-response+json and match the content-type', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString(), {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
                 headers: {
+                    'content-type': 'application/json',
                     accept: 'application/graphql-response+json',
                 },
+                body: JSON.stringify({ query: '{ __typename }' }),
             });
             assert('Status code', res.status).toBe(200);
             assert('Content-Type header', res.headers.get('content-type')).toContain('application/graphql-response+json');
         }),
         audit('MUST accept application/json and match the content-type', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString(), {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
                 headers: {
+                    'content-type': 'application/json',
                     accept: 'application/json',
                 },
+                body: JSON.stringify({ query: '{ __typename }' }),
             });
             assert('Status code', res.status).toBe(200);
             assert('Content-Type header', res.headers.get('content-type')).toContain('application/json');
@@ -40,12 +42,13 @@ export function serverAudits(opts) {
         audit(
         // TODO: convert to MUST after watershed
         'SHOULD accept */* and use application/graphql-response+json for the content-type', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString(), {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
                 headers: {
+                    'content-type': 'application/json',
                     accept: '*/*',
                 },
+                body: JSON.stringify({ query: '{ __typename }' }),
             });
             assert('Status code', res.status).toBe(200);
             assert('Content-Type header', res.headers.get('content-type')).toContain('application/graphql-response+json');
@@ -53,16 +56,24 @@ export function serverAudits(opts) {
         audit(
         // TODO: convert to MUST after watershed
         'SHOULD assume application/graphql-response+json content-type when accept is missing', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString());
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                },
+                body: JSON.stringify({ query: '{ __typename }' }),
+            });
             assert('Status code', res.status).toBe(200);
             assert('Content-Type header', res.headers.get('content-type')).toContain('application/graphql-response+json');
         }),
         audit('MUST use utf-8 encoding when responding', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString());
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                },
+                body: JSON.stringify({ query: '{ __typename }' }),
+            });
             assert('Status code', res.status).toBe(200);
             // has charset set to utf-8
             try {
@@ -85,23 +96,23 @@ export function serverAudits(opts) {
             }
         }),
         audit('MUST accept utf-8 encoding', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString(), {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
                 headers: {
                     'content-type': 'application/json; charset=utf-8',
                 },
+                body: JSON.stringify({ query: '{ __typename }' }),
             });
             assert('Status code', res.status).toBe(200);
             assert('Content-Type header', res.headers.get('content-type')).toContain('utf-8');
         }),
         audit('MUST assume utf-8 if encoding is unspecified', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ __typename }');
-            const res = await fetchFn(url.toString(), {
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
                 headers: {
                     'content-type': 'application/json',
                 },
+                body: JSON.stringify({ query: '{ __typename }' }),
             });
             assert('Status code', res.status).toBe(200);
             assert('Content-Type header', res.headers.get('content-type')).toContain('utf-8');
@@ -122,7 +133,8 @@ export function serverAudits(opts) {
             assert('Status code', res.status).toBe(200);
         }),
         // Request GET
-        audit('MUST NOT allow executing mutations on GET requests', async () => {
+        // TODO: this is a MUST if the server supports GET requests
+        audit('MAY NOT allow executing mutations on GET requests', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', 'mutation { __typename }');
             const res = await fetchFn(url.toString(), {
@@ -130,15 +142,14 @@ export function serverAudits(opts) {
                     accept: 'application/graphql-response+json',
                 },
             });
-            assert('Status code', res.status).toBe(405);
+            assert('Status code', res.status).toBeBetween(400, 499);
         }),
         // Request POST
         audit('SHOULD respond with 4xx status code if content-type is not supplied on POST requests', async () => {
             const res = await fetchFn(opts.url, {
                 method: 'POST',
             });
-            assert('Status code', res.status).toBeGreaterThanOrEqual(400);
-            assert('Status code', res.status).toBeLessThanOrEqual(499);
+            assert('Status code', res.status).toBeBetween(400, 499);
         }),
         audit('MUST accept application/json POST requests', async () => {
             const res = await fetchFn(opts.url, {
@@ -363,9 +374,7 @@ export function serverAudits(opts) {
             assert('Status code', res.status).toBe(200);
             assert('Execution result', await assertBodyAsExecutionResult(res)).notToHaveProperty('errors');
         }),
-        audit(
-        // TODO: convert to MUST after watershed
-        'SHOULD allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json', async () => {
+        audit('MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', 'query Type($name: String!) { __type(name: $name) { name } }');
             url.searchParams.set('variables', JSON.stringify({ name: 'sometype' }));
@@ -377,7 +386,7 @@ export function serverAudits(opts) {
             });
             assert('Status code', res.status).toBe(200);
         }),
-        audit('MUST allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json', async () => {
+        audit('MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json', async () => {
             const url = new URL(opts.url);
             url.searchParams.set('query', 'query Type($name: String!) { __type(name: $name) { name } }');
             url.searchParams.set('variables', JSON.stringify({ name: 'sometype' }));
@@ -466,29 +475,39 @@ export function serverAudits(opts) {
             assert('Status code', res.status).toBe(200);
         }),
         audit('SHOULD use 200 status code if parameters are invalid when accepting application/json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('qeury' /* typo */, '{ __typename }');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    qeury: /* typo */ '{ __typename }',
+                }),
             });
             assert('Status code', res.status).toBe(200);
         }),
         audit('SHOULD use 200 status code on document parsing failure when accepting application/json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({ query: '{' }),
             });
             assert('Status code', res.status).toBe(200);
         }),
         audit('SHOULD use 200 status code on document validation failure when accepting application/json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ 8f31403dfe404bccbb0e835f2629c6a7 }'); // making sure the field doesnt exist
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
+                }),
             });
             assert('Status code', res.status).toBe(200);
         }),
@@ -504,8 +523,7 @@ export function serverAudits(opts) {
                 },
                 body: '{ "not a JSON',
             });
-            assert('Status code', res.status).toBeGreaterThanOrEqual(400);
-            assert('Status code', res.status).toBeLessThanOrEqual(599);
+            assert('Status code', res.status).toBeBetween(400, 499);
         }),
         audit('SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json', async () => {
             const res = await fetchFn(opts.url, {
@@ -532,90 +550,123 @@ export function serverAudits(opts) {
         audit(
         // TODO: convert to MUST after watershed
         'SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('qeury' /* typo */, '{ __typename }');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    qeury /* typo */: '{ __typename }',
+                }),
             });
-            assert('Status code', res.status).toBeGreaterThanOrEqual(400);
-            assert('Status code', res.status).toBeLessThanOrEqual(599);
+            assert('Status code', res.status).toBeBetween(400, 599);
         }),
         audit('SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('qeury' /* typo */, '{ __typename }');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    qeury: /* typo */ '{ __typename }',
+                }),
             });
             assert('Status code', res.status).toBe(400);
         }),
         audit('SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('qeury' /* typo */, '{ __typename }');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    qeury: /* typo */ '{ __typename }',
+                }),
             });
             assert('Data entry', (await assertBodyAsExecutionResult(res)).data).toBe(undefined);
         }),
         audit(
         // TODO: convert to MUST after watershed
         'SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{',
+                }),
             });
-            assert('Status code', res.status).toBeGreaterThanOrEqual(400);
-            assert('Status code', res.status).toBeLessThanOrEqual(599);
+            assert('Status code', res.status).toBeBetween(400, 599);
         }),
         audit('SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{',
+                }),
             });
             assert('Status code', res.status).toBe(400);
         }),
         audit('SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{');
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{',
+                }),
             });
             assert('Data entry', (await assertBodyAsExecutionResult(res)).data).toBe(undefined);
         }),
         audit(
         // TODO: convert to MUST after watershed
         'SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ 8f31403dfe404bccbb0e835f2629c6a7 }'); // making sure the field doesnt exist
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
+                }),
             });
-            assert('Status code', res.status).toBeGreaterThanOrEqual(400);
-            assert('Status code', res.status).toBeLessThanOrEqual(599);
+            assert('Status code', res.status).toBeBetween(400, 599);
         }),
         audit('SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ 8f31403dfe404bccbb0e835f2629c6a7 }'); // making sure the field doesnt exist
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
+                }),
             });
             assert('Status code', res.status).toBe(400);
         }),
         audit('SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json', async () => {
-            const url = new URL(opts.url);
-            url.searchParams.set('query', '{ 8f31403dfe404bccbb0e835f2629c6a7 }'); // making sure the field doesnt exist
-            const res = await fetchFn(url.toString(), {
-                method: 'GET',
-                headers: { accept: 'application/graphql-response+json' },
+            const res = await fetchFn(opts.url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/graphql-response+json',
+                },
+                body: JSON.stringify({
+                    query: '{ 8f31403dfe404bccbb0e835f2629c6a7 }', // making sure the field doesnt exist
+                }),
             });
             assert('Data entry', (await assertBodyAsExecutionResult(res)).data).toBe(undefined);
         }),

package/lib/audits/utils.d.mts

@@ -21,8 +21,7 @@ export declare function audit(name: AuditName, fn: () => Promise<void>): Audit;
  */
 export declare function assert<T = unknown>(name: string, actual: T): {
     toBe: (expected: T) => void;
-    toBeLessThanOrEqual: (expected: T extends number ? T : never) => void;
-    toBeGreaterThanOrEqual: (expected: T extends number ? T : never) => void;
+    toBeBetween: (min: T extends number ? T : never, max: T extends number ? T : never) => void;
     toContain: (expected: T extends (infer U)[] ? U : T extends string ? T : never) => void;
     notToContain: (expected: T extends (infer U_1)[] ? U_1 : T extends string ? T : never) => void;
     toHaveProperty: (prop: T extends Record<any, any> ? PropertyKey : never) => void;

package/lib/audits/utils.d.ts

@@ -21,8 +21,7 @@ export declare function audit(name: AuditName, fn: () => Promise<void>): Audit;
  */
 export declare function assert<T = unknown>(name: string, actual: T): {
     toBe: (expected: T) => void;
-    toBeLessThanOrEqual: (expected: T extends number ? T : never) => void;
-    toBeGreaterThanOrEqual: (expected: T extends number ? T : never) => void;
+    toBeBetween: (min: T extends number ? T : never, max: T extends number ? T : never) => void;
     toContain: (expected: T extends (infer U)[] ? U : T extends string ? T : never) => void;
     notToContain: (expected: T extends (infer U_1)[] ? U_1 : T extends string ? T : never) => void;
     toHaveProperty: (prop: T extends Record<any, any> ? PropertyKey : never) => void;

package/lib/audits/utils.js

@@ -70,14 +70,9 @@ function assert(name, actual) {
                 throw `${name} ${actual} is not ${expected}`;
             }
         },
-        toBeLessThanOrEqual: (expected) => {
-            if (!(actual <= expected)) {
-                throw `${name} ${actual} is not less than or equal to ${expected}`;
-            }
-        },
-        toBeGreaterThanOrEqual: (expected) => {
-            if (!(actual >= expected)) {
-                throw `${name} ${actual} is not greater than or equal to ${expected}`;
+        toBeBetween: (min, max) => {
+            if (!(min <= actual && actual <= max)) {
+                throw `${name} ${actual} is not between ${min} and ${max}`;
             }
         },
         toContain: (expected) => {

package/lib/audits/utils.mjs

@@ -52,14 +52,9 @@ export function assert(name, actual) {
                 throw `${name} ${actual} is not ${expected}`;
             }
         },
-        toBeLessThanOrEqual: (expected) => {
-            if (!(actual <= expected)) {
-                throw `${name} ${actual} is not less than or equal to ${expected}`;
-            }
-        },
-        toBeGreaterThanOrEqual: (expected) => {
-            if (!(actual >= expected)) {
-                throw `${name} ${actual} is not greater than or equal to ${expected}`;
+        toBeBetween: (min, max) => {
+            if (!(min <= actual && actual <= max)) {
+                throw `${name} ${actual} is not between ${min} and ${max}`;
             }
         },
         toContain: (expected) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphql-http",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Simple, pluggable, zero-dependency, GraphQL over HTTP Protocol compliant server and client",
   "keywords": [
     "graphql",
@@ -82,7 +82,7 @@
     "release": "semantic-release"
   },
   "workspaces": [
-    "implementations/*"
+    "implementations/**/*"
   ],
   "peerDependencies": {
     "graphql": ">=0.11 <=16"