graphql-http 2.0.3__tar.gz → 2.0.5__tar.gz

{graphql_http-2.0.3 → graphql_http-2.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: graphql_http
-Version: 2.0.3
+Version: 2.0.5
 Summary: HTTP Server for GraphQL.
 Author-email: Robert Parker <rob@parob.com>
 License: MIT

graphql_http-2.0.5/VERSION

@@ -0,0 +1 @@
+2.0.5

{graphql_http-2.0.3 → graphql_http-2.0.5}/examples/advanced_server.py

@@ -12,8 +12,6 @@ This example demonstrates advanced features including:
 """
 
 import time
-import asyncio
-from typing import Any, Dict, List, Optional
 from graphql import (
     GraphQLSchema,
     GraphQLObjectType,
@@ -33,15 +31,15 @@ from graphql_http import GraphQLHTTP
 # Custom execution context for performance monitoring
 class PerformanceExecutionContext(ExecutionContext):
     """Custom execution context that tracks performance metrics."""
-    
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.start_time = time.time()
         self.field_count = 0
-        
+
     def __enter__(self):
         return super().__enter__()
-        
+
     def __exit__(self, exc_type, exc_val, exc_tb):
         execution_time = time.time() - self.start_time
         print(f"Query executed in {execution_time:.3f}s with {self.field_count} fields")
@@ -51,20 +49,20 @@ class PerformanceExecutionContext(ExecutionContext):
 # Custom context class
 class RequestContext:
     """Custom context that provides request-specific information."""
-    
+
     def __init__(self, request=None):
         self.request = request
         self.start_time = time.time()
         self.user_id = None
         self.cache = {}
-        
+
     def get_user_id(self):
         """Extract user ID from request headers (simplified)."""
         if self.request and not self.user_id:
             # In real apps, this would decode JWT or session
             self.user_id = self.request.headers.get("X-User-ID", "anonymous")
         return self.user_id
-        
+
     def get_elapsed_time(self):
         """Get elapsed time since request started."""
         return time.time() - self.start_time
@@ -88,19 +86,19 @@ posts_data = [
 def performance_middleware(next_fn, root, info, **args):
     """Middleware that measures field resolution time."""
     field_start = time.time()
-    
+
     # Track field count in execution context
     if hasattr(info.context, 'field_count'):
         info.context.field_count += 1
-    
+
     try:
         result = next_fn(root, info, **args)
         field_time = time.time() - field_start
-        
+
         # Log slow fields
         if field_time > 0.1:  # 100ms threshold
             print(f"Slow field detected: {info.field_name} took {field_time:.3f}s")
-        
+
         return result
     except Exception as e:
         field_time = time.time() - field_start
@@ -112,40 +110,40 @@ def caching_middleware(next_fn, root, info, **args):
     """Simple in-memory caching middleware."""
     # Create cache key
     cache_key = f"{info.field_name}:{hash(str(args))}"
-    
+
     # Check if we have cached result
     if hasattr(info.context, 'cache') and cache_key in info.context.cache:
         print(f"Cache hit for {info.field_name}")
         return info.context.cache[cache_key]
-    
+
     # Execute and cache result
     result = next_fn(root, info, **args)
-    
+
     if hasattr(info.context, 'cache'):
         info.context.cache[cache_key] = result
         print(f"Cached result for {info.field_name}")
-    
+
     return result
 
 
 def auth_middleware(next_fn, root, info, **args):
     """Authentication middleware for protected fields."""
     field_name = info.field_name
-    
+
     # Check if field requires authentication
     protected_fields = ["adminData", "deletePost", "promoteUser"]
     if field_name in protected_fields:
         user_id = info.context.get_user_id() if hasattr(info.context, 'get_user_id') else None
         if not user_id or user_id == "anonymous":
             raise GraphQLError(f"Authentication required for field: {field_name}")
-        
+
         # Check admin role for admin fields
         admin_fields = ["adminData", "promoteUser"]
         if field_name in admin_fields:
             # In real apps, check user role from database/JWT
             if not user_id.startswith("admin"):
                 raise GraphQLError(f"Admin access required for field: {field_name}")
-    
+
     return next_fn(root, info, **args)
 
 
@@ -162,11 +160,11 @@ def get_user_by_id(obj, info, user_id):
     """Get user by ID with validation."""
     if user_id <= 0:
         raise GraphQLError("User ID must be positive")
-    
+
     user = next((u for u in users_data if u["id"] == user_id), None)
     if not user:
         raise GraphQLError(f"User with ID {user_id} not found")
-    
+
     return user
 
 
@@ -325,27 +323,27 @@ def create_custom_context(request):
 def main():
     """Run the advanced GraphQL server."""
     print("Starting advanced GraphQL server...")
-    
+
     # Create server with advanced configuration
     server = GraphQLHTTP(
         schema=schema,
         serve_graphiql=True,
         allow_cors=True,
         health_path="/health",
-        
+
         # Add middleware stack
         middleware=[
             auth_middleware,        # Authentication first
             performance_middleware, # Then performance monitoring
             caching_middleware,     # Finally caching
         ],
-        
+
         # Custom execution context
         execution_context_class=PerformanceExecutionContext,
-        
+
         # Custom context factory
         context_value=lambda: create_custom_context(None),
-        
+
         graphiql_default_query="""
 # Try these queries to see advanced features:
 
@@ -360,17 +358,17 @@ def main():
       likes
     }
   }
-  
+
   # Context information
   contextInfo {
     elapsedTime
     userId
     cacheSize
   }
-  
+
   # This will be slow and trigger performance warning
   # slowField
-  
+
   # This will demonstrate error handling
   # errorField
 }
@@ -384,7 +382,7 @@ def main():
 # }
         """.strip(),
     )
-    
+
     print("Advanced server features enabled:")
     print("  ✓ Performance monitoring middleware")
     print("  ✓ Simple in-memory caching")
@@ -392,17 +390,17 @@ def main():
     print("  ✓ Custom execution context")
     print("  ✓ Custom request context")
     print("  ✓ Error handling and validation")
-    
+
     print(f"\nTesting tips:")
     print(f"  • Set 'X-User-ID: admin123' header for admin access")
     print(f"  • Watch console for performance metrics")
     print(f"  • Try the slowField and errorField for testing")
     print(f"  • Run same query twice to see caching in action")
-    
+
     print(f"\nEndpoints:")
     print(f"  GraphiQL: http://localhost:8000/graphql")
     print(f"  Health:   http://localhost:8000/health")
-    
+
     # Run the server
     server.run(host="0.0.0.0", port=8000)
 

{graphql_http-2.0.3 → graphql_http-2.0.5}/examples/auth_server.py

@@ -221,10 +221,10 @@ def main():
         print("\nAuthentication disabled for development!")
         print("Set ENABLE_AUTH=true to enable authentication")
 
-    print(f"\nEndpoints:")
-    print(f"  GraphiQL: http://localhost:8000/graphql")
-    print(f"  Health:   http://localhost:8000/health")
-    print(f"  API:      http://localhost:8000/graphql")
+    print("\nEndpoints:")
+    print("  GraphiQL: http://localhost:8000/graphql")
+    print("  Health:   http://localhost:8000/health")
+    print("  API:      http://localhost:8000/graphql")
 
     # Run the server
     server.run(host="0.0.0.0", port=8000)

{graphql_http-2.0.3 → graphql_http-2.0.5}/examples/graphql_api_server.py

@@ -11,9 +11,8 @@ Install with: pip install graphql-api
 """
 
 try:
-    from graphql_api import GraphQLAPI, field, type
+    from graphql_api import GraphQLAPI, field
     from graphql_api.context import GraphQLContext
-    from graphql_api.mapper import GraphQLMetaKey
 except ImportError:
     print("This example requires graphql-api to be installed.")
     print("Install with: pip install graphql-api")
@@ -75,52 +74,52 @@ api = GraphQLAPI()
 @api.type
 class AuthorType:
     """Author type with automatic field resolution."""
-    
+
     @field
     def id(self) -> int:
-        return self.id
-    
+        return self._id
+
     @field
     def name(self) -> str:
-        return self.name
-    
+        return self._name
+
     @field
     def email(self) -> str:
-        return self.email
-    
+        return self._email
+
     @field
-    def posts(self) -> List["PostType"]:
+    def posts(self) -> List[Post]:
         """Get all posts by this author."""
-        return [post for post in posts if post.author_id == self.id]
+        return [post for post in posts if post.author_id == self._id]
 
 
 @api.type
 class PostType:
     """Post type with relationships."""
-    
+
     @field
     def id(self) -> int:
-        return self.id
-    
+        return self._id
+
     @field
     def title(self) -> str:
-        return self.title
-    
+        return self._title
+
     @field
     def content(self) -> str:
-        return self.content
-    
+        return self._content
+
     @field
     def published(self) -> bool:
-        return self.published
-    
+        return self._published
+
     @field
     def author(self) -> Optional[AuthorType]:
         """Get the author of this post."""
-        return next((author for author in authors if author.id == self.author_id), None)
-    
+        return next((author for author in authors if author.id == self._author_id), None)
+
     @field
-    def comments(self) -> List["CommentType"]:
+    def comments(self) -> List[Comment]:
         """Get all comments for this post."""
         return [comment for comment in comments if comment.post_id == self.id]
 
@@ -128,56 +127,56 @@ class PostType:
 @api.type
 class CommentType:
     """Comment type."""
-    
+
     @field
     def id(self) -> int:
-        return self.id
-    
+        return self._id
+
     @field
     def author_name(self) -> str:
-        return self.author_name
-    
+        return self._author_name
+
     @field
     def content(self) -> str:
-        return self.content
-    
+        return self._content
+
     @field
     def post(self) -> Optional[PostType]:
         """Get the post this comment belongs to."""
-        return next((post for post in posts if post.id == self.post_id), None)
+        return next((post for post in posts if post.id == self._post_id), None)
 
 
 @api.type(is_root_type=True)
 class Query:
     """Root Query type."""
-    
+
     @field
     def hello(self, name: str = "World") -> str:
         """Simple hello field for testing."""
         return f"Hello, {name}!"
-    
+
     @field
     def authors(self) -> List[AuthorType]:
         """Get all authors."""
         return authors
-    
+
     @field
     def author(self, author_id: int) -> Optional[AuthorType]:
         """Get an author by ID."""
         return next((author for author in authors if author.id == author_id), None)
-    
+
     @field
     def posts(self, published_only: bool = False) -> List[PostType]:
         """Get all posts, optionally filter by published status."""
         if published_only:
             return [post for post in posts if post.published]
         return posts
-    
+
     @field
     def post(self, post_id: int) -> Optional[PostType]:
         """Get a post by ID."""
         return next((post for post in posts if post.id == post_id), None)
-    
+
     @field
     def search_posts(self, query: str) -> List[PostType]:
         """Search posts by title or content."""
@@ -191,7 +190,7 @@ class Query:
 @api.type
 class Mutation:
     """Root Mutation type."""
-    
+
     @field
     def create_post(self, title: str, content: str, author_id: int, published: bool = False) -> PostType:
         """Create a new post."""
@@ -204,30 +203,30 @@ class Mutation:
         )
         posts.append(new_post)
         return new_post
-    
+
     @field
     def update_post(self, post_id: int, title: Optional[str] = None, content: Optional[str] = None, published: Optional[bool] = None) -> Optional[PostType]:
         """Update an existing post."""
         post = next((p for p in posts if p.id == post_id), None)
         if not post:
             return None
-        
+
         if title is not None:
             post.title = title
         if content is not None:
             post.content = content
         if published is not None:
             post.published = published
-        
+
         return post
-    
+
     @field
-    def add_comment(self, post_id: int, author_name: str, content: str) -> Optional["CommentType"]:
+    def add_comment(self, post_id: int, author_name: str, content: str) -> Optional[Comment]:
         """Add a comment to a post."""
         post = next((p for p in posts if p.id == post_id), None)
         if not post:
             return None
-        
+
         new_comment = Comment(
             id=max(comment.id for comment in comments) + 1,
             post_id=post_id,
@@ -247,12 +246,12 @@ def custom_middleware(next_fn, root, info, **args):
     # Log the field being accessed
     field_name = info.field_name
     print(f"Accessing field: {field_name}")
-    
+
     # You could add authentication logic here
     # if field_name in ["sensitive_field"]:
     #     # Check authentication
     #     pass
-    
+
     # Call the next resolver
     return next_fn(root, info, **args)
 
@@ -279,7 +278,7 @@ class ContextQuery:
 def main():
     """Run the GraphQL server with GraphQL-API integration."""
     print("Starting GraphQL server with GraphQL-API integration...")
-    
+
     # Create server from the GraphQL API
     server = GraphQLHTTP.from_api(
         api=api,
@@ -294,7 +293,7 @@ def main():
 {
   # Simple greeting
   hello(name: "GraphQL API User")
-  
+
   # Get all authors with their posts
   authors {
     id
@@ -311,7 +310,7 @@ def main():
       }
     }
   }
-  
+
   # Get only published posts
   posts(publishedOnly: true) {
     id
@@ -321,7 +320,7 @@ def main():
       email
     }
   }
-  
+
   # Search posts
   searchPosts(query: "GraphQL") {
     id
@@ -347,18 +346,18 @@ def main():
 # }
         """.strip(),
     )
-    
+
     print("GraphQL-API server features:")
     print("  ✓ Automatic type inference from Python types")
     print("  ✓ Dataclass integration")
     print("  ✓ Relationship resolution")
     print("  ✓ Context injection")
     print("  ✓ Custom middleware support")
-    
-    print(f"\nEndpoints:")
-    print(f"  GraphiQL: http://localhost:8000/graphql")
-    print(f"  Health:   http://localhost:8000/health")
-    
+
+    print("\nEndpoints:")
+    print("  GraphiQL: http://localhost:8000/graphql")
+    print("  Health:   http://localhost:8000/health")
+
     # Run the server
     server.run(host="0.0.0.0", port=8000)
 

{graphql_http-2.0.3 → graphql_http-2.0.5}/graphql_http/server.py

@@ -3,9 +3,11 @@ import json
 import os
 from json import JSONDecodeError
 from typing import Any, Awaitable, Callable, Dict, List, Optional, Type, Union
+from logging import getLogger
 
 import jwt
 import uvicorn
+
 from graphql import GraphQLError, ExecutionResult
 from graphql.execution.execute import ExecutionContext
 from graphql.type.schema import GraphQLSchema
@@ -33,6 +35,7 @@ try:
 except ImportError:
     GraphQLContext = None  # type: ignore
 
+logger = getLogger(__name__)
 # Constants
 GRAPHIQL_DIR = os.path.join(os.path.dirname(__file__), "graphiql")
 DEFAULT_HOST = "127.0.0.1"
@@ -317,36 +320,265 @@ class GraphQLHTTP:
         return PlainTextResponse("OK", headers=response_headers)
 
     def _check_introspection_only(self, data: Union[Dict, List]) -> bool:
-        """Check if request contains only introspection queries.
+        """Check if request contains only introspection queries using GraphQL's built-in validation.
+
+        This approach uses GraphQL's execution preparation to determine if a query
+        is introspection-only by checking what fields would actually be resolved.
+
+        Args:
+            data: Request data (dict for single query, list for batched queries)
+
+        Returns:
+            True if all queries are introspection-only
+        """
+        try:
+            from graphql import parse, validate
+            from graphql.type.introspection import is_introspection_type
+            # Try to import execution context functions, fall back gracefully if not available
+            try:
+                from graphql.execution import build_execution_context
+                from graphql.execution.collect_fields import collect_fields
+                has_execution_context = True
+            except ImportError:
+                has_execution_context = False
+        except ImportError:
+            # Fallback to AST-based check if advanced GraphQL features not available
+            return self._check_introspection_only_ast(data)
+
+        # Handle batched queries
+        if isinstance(data, list):
+            return all(self._check_introspection_only(item) for item in data)
+
+        if not isinstance(data, dict) or 'query' not in data:
+            return False
+
+        query_str = data.get('query', '')
+        if not query_str or not isinstance(query_str, str):
+            return False
+
+        # Pre-validation security checks
+        query_stripped = query_str.strip()
+        if not query_stripped:
+            return False
+
+        # Basic syntax validation - ensure query looks structurally sound
+        if query_stripped.count('{') != query_stripped.count('}'):
+            return False
+        if query_stripped.count('(') != query_stripped.count(')'):
+            return False
+
+        try:
+            # Parse and validate the query - this will catch syntax errors
+            document = parse(query_str)
+            validation_errors = validate(self.schema, document)
+
+            # If query has validation errors, it's not a valid introspection query
+            if validation_errors:
+                return False
+
+            # If execution context is not available, fall back to AST method
+            if not has_execution_context:
+                return self._check_introspection_only_ast(data)
+
+            # Additional security checks before execution analysis
+            # Check if document contains only query operations (no mutations/subscriptions)
+            for definition in document.definitions:
+                if hasattr(definition, 'operation'):
+                    # Only allow query operations for introspection bypass
+                    if definition.operation != 'query':
+                        return False
+
+            # Build execution context to analyze what fields would be resolved
+            try:
+                context_value = {}
+                variable_values = data.get('variables') or {}
+                operation_name = data.get('operationName')
+
+                exe_context = build_execution_context(
+                    self.schema,
+                    document,
+                    context_value=context_value,
+                    variable_values=variable_values,
+                    operation_name=operation_name
+                )
+
+                # If execution context building fails, be conservative
+                if isinstance(exe_context, list):  # List of GraphQLError
+                    return False
+
+                # Get the operation
+                operation = exe_context.operation
+                if not operation or not operation.selection_set:
+                    return False
+
+                # Collect the fields that would be executed
+                fields = collect_fields(
+                    exe_context,
+                    exe_context.schema.query_type,
+                    operation.selection_set,
+                    set(),
+                    set()
+                )
+
+                # Strict validation: only allow official introspection fields
+                official_introspection_fields = {'__schema', '__type', '__typename'}
+
+                for field_name in fields.keys():
+                    # Must start with __ (introspection convention)
+                    if not field_name.startswith('__'):
+                        return False
+
+                    # Must be an official introspection field
+                    if field_name not in official_introspection_fields:
+                        return False
+
+                # Double-check by examining the field types being accessed
+                query_type = self.schema.query_type
+                for field_name in fields.keys():
+                    field_def = query_type.fields.get(field_name)
+                    if field_def:
+                        field_type = field_def.type
+                        # Unwrap non-null and list types to get the base type
+                        while hasattr(field_type, 'of_type'):
+                            field_type = field_type.of_type
+
+                        # Check if the field type is an introspection type
+                        if not is_introspection_type(field_type):
+                            return False
+                    else:
+                        # Field doesn't exist in schema - should not happen with validation
+                        return False
+
+                return True
+
+            except Exception:
+                # If execution context fails, fall back to AST method
+                return self._check_introspection_only_ast(data)
+
+        except Exception:
+            # If parsing fails, it's not a valid query - BLOCK IT
+            # Parse errors indicate malformed GraphQL which should never bypass auth
+            return False
+
+    def _check_introspection_only_ast(self, data: Union[Dict, List]) -> bool:
+        """AST-based fallback for introspection detection.
+
+        This is the previous implementation as a fallback when execution context
+        analysis is not available.
+        """
+        try:
+            from graphql import parse, FieldNode, visit, Visitor
+        except ImportError:
+            # Final fallback to string-based check
+            return self._check_introspection_only_fallback(data)
+
+        # Handle batched queries
+        if isinstance(data, list):
+            return all(self._check_introspection_only_ast(item) for item in data)
+
+        if not isinstance(data, dict) or 'query' not in data:
+            return False
+
+        query_str = data.get('query', '')
+        if not query_str or not isinstance(query_str, str):
+            return False
+
+        try:
+            # Parse the GraphQL query into an AST
+            document = parse(query_str)
+
+            # Extract only root-level field names from the query
+            root_field_names = set()
+
+            class RootFieldCollector(Visitor):
+                def __init__(self):
+                    super().__init__()
+                    self.depth = 0
+
+                def enter_selection_set(self, node, *_):
+                    self.depth += 1
+
+                def leave_selection_set(self, node, *_):
+                    self.depth -= 1
+
+                def enter_field(self, node: FieldNode, *_):
+                    # Only collect fields at depth 1 (root level fields)
+                    if self.depth == 1 and hasattr(node, 'name') and hasattr(node.name, 'value'):
+                        root_field_names.add(node.name.value)
+
+            visit(document, RootFieldCollector())
+
+            # Check if all root fields are introspection fields
+            introspection_fields = {'__schema', '__type', '__typename'}
+
+            # If no fields found, it's not a valid query
+            if not root_field_names:
+                return False
+
+            # All root fields must be introspection fields
+            return root_field_names.issubset(introspection_fields)
+
+        except Exception:
+            # If AST parsing fails, it's not a valid query - BLOCK IT
+            return False
+
+    def _check_introspection_only_fallback(self, data: Union[Dict, List]) -> bool:
+        """Fallback string-based introspection check for when GraphQL parsing fails.
 
         Args:
             data: Request data
 
         Returns:
-            True if request is introspection-only
+            True if request appears to be introspection-only (conservative check)
         """
+        # Handle batched queries
+        if isinstance(data, list):
+            return all(self._check_introspection_only_fallback(item) for item in data)
 
-        # Simple heuristic: if it contains introspection fields AND no regular fields
-        query_data_lower = str(data).lower()
+        if not isinstance(data, dict) or 'query' not in data:
+            return False
+
+        query_str = data.get('query', '')
+        if not query_str or not isinstance(query_str, str):
+            return False
+
+        query_lower = query_str.lower()
 
         # Check for introspection fields
-        introspection_fields = ["__schema", "__type", "__typename"]
-        has_introspection = any(
-            f in query_data_lower for f in introspection_fields)
+        introspection_fields = ['__schema', '__type', '__typename']
+        has_introspection = any(field in query_lower for field in introspection_fields)
 
         if not has_introspection:
             return False
 
-        # Check for regular fields (non-introspection)
-        # This is a simple heuristic - in a mixed query, we require auth
-        regular_field_patterns = [
-            "hello", "users", "posts", "data", "mutation"]
-        has_regular_fields = any(
-            pattern in query_data_lower for pattern in regular_field_patterns
-        )
+        # Conservative approach: check for common non-introspection patterns
+        # Remove comments and strings to avoid false positives
+        import re
+        clean_query = re.sub(r'#.*', '', query_str)  # Remove comments
+        clean_query = re.sub(r'"[^"]*"', '', clean_query)  # Remove string literals
+        clean_query = re.sub(r"'[^']*'", '', clean_query)  # Remove string literals
+        clean_query = clean_query.lower()
+
+        # Look for non-introspection field patterns in clean query
+        # Use word boundaries to avoid matching substrings
+        suspicious_patterns = [
+            r'\b(query|mutation|subscription)\s+\w+',  # Named operations
+            r'\{[^}]*[a-z_][a-z0-9_]*\s*[({]',  # Regular field selections
+        ]
+
+        # If we find suspicious patterns, be conservative and require auth
+        for pattern in suspicious_patterns:
+            if re.search(pattern, clean_query):
+                # Double-check it's not just introspection
+                remaining = clean_query
+                for intro_field in introspection_fields:
+                    remaining = remaining.replace(intro_field, '')
+
+                # If there's still substantial content, likely has regular fields
+                if len(re.findall(r'\w+', remaining)) > 3:  # Threshold for field names
+                    return False
 
-        # Only allow introspection-only queries to bypass auth
-        return has_introspection and not has_regular_fields
+        return True
 
     def _authenticate_request(self, request: Request) -> Optional[Response]:
         """Authenticate JWT token from request.
@@ -442,9 +674,11 @@ class GraphQLHTTP:
             # Handle authentication
             allow_only_introspection = False
             if self.auth_enabled:
-                if not self.auth_bypass_during_introspection or not self._check_introspection_only(data):
-                    auth_error = self._authenticate_request(request)
-                    if auth_error:
+                auth_error = self._authenticate_request(request)
+                if auth_error:
+                    if self.auth_bypass_during_introspection and self._check_introspection_only(data):
+                        logger.info("Authentication bypassed as introspection only query.")
+                    else:
                         return auth_error
 
             # Prepare context for GraphQL execution

{graphql_http-2.0.3 → graphql_http-2.0.5}/graphql_http.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: graphql_http
-Version: 2.0.3
+Version: 2.0.5
 Summary: HTTP Server for GraphQL.
 Author-email: Robert Parker <rob@parob.com>
 License: MIT

{graphql_http-2.0.3 → graphql_http-2.0.5}/tests/test_auth.py

@@ -162,7 +162,7 @@ class TestGraphQLHTTPAuthentication:
         assert "errors" in result
         assert "Invalid token" in result["errors"][0]["message"]
 
-    def test_introspection_without_auth_when_disabled(self, schema):
+    def test_introspection_without_auth_bypass(self, schema):
         """Test introspection queries work without auth when auth_introspection_bypass=False."""
         server = GraphQLHTTP(
             schema=schema,
@@ -184,7 +184,7 @@ class TestGraphQLHTTPAuthentication:
         assert "errors" in result
         assert "Authorization header is missing" in result["errors"][0]["message"]
 
-    def test_introspection_with_auth_when_enabled(self, schema):
+    def test_introspection_with_auth_bypass(self, schema):
         """Test introspection queries require auth when auth_introspection_bypass=True."""
 
         server = GraphQLHTTP(
@@ -197,7 +197,7 @@ class TestGraphQLHTTPAuthentication:
         )
         client = server.client()
 
-        # Introspection query should require auth
+        # Introspection query not require auth
         response = client.post(
             "/graphql",
             json={"query": "{ __schema { queryType { name } } }"}
@@ -205,7 +205,7 @@ class TestGraphQLHTTPAuthentication:
         assert response.status_code == 200
         # Should get a valid introspection response, not an auth error
 
-    def test_regular_query_requires_auth(self, schema):
+    def test_regular_query_without_auth_bypass(self, schema):
         """Test that regular queries always require auth when auth is enabled."""
         server = GraphQLHTTP(
             schema=schema,
@@ -227,6 +227,28 @@ class TestGraphQLHTTPAuthentication:
         assert "errors" in result
         assert "Authorization header is missing" in result["errors"][0]["message"]
 
+    def test_regular_query_with_auth_bypass(self, schema):
+        """Test that regular queries always require auth when auth is enabled."""
+        server = GraphQLHTTP(
+            schema=schema,
+            auth_enabled=True,
+            auth_bypass_during_introspection=True,  # Only introspection is exempt
+            auth_jwks_uri="https://example.com/.well-known/jwks.json",
+            auth_issuer="https://example.com/",
+            auth_audience="test-audience"
+        )
+        client = server.client()
+
+        # Regular query should require auth
+        response = client.post(
+            "/graphql",
+            json={"query": "{ hello }"}
+        )
+        assert response.status_code == 401
+        result = response.json()
+        assert "errors" in result
+        assert "Authorization header is missing" in result["errors"][0]["message"]
+
     def test_jwks_client_initialization_failure(self, schema):
         """Test server initialization when JWKS URI is not provided."""
         # This should raise a ValueError during initialization now due to validation

graphql_http-2.0.3/VERSION

@@ -1 +0,0 @@
-2.0.3