ProhibitIntrospectionQueriesRule-test.js

// @flow strict

import { describe, it } from 'mocha';

import {
  GraphQLSchema,
  GraphQLObjectType,
  GraphQLString,
  __EnumValue,
} from '../../type/index';

import { ProhibitIntrospectionQueriesRule } from '../rules/optional/ProhibitIntrospectionQueriesRule';

import { expectValidationErrorsWithSchema } from './harness';

const schema = new GraphQLSchema({
  query: new GraphQLObjectType({
    name: 'Query',
    fields: {
      someQuery: {
        type: new GraphQLObjectType({
          name: 'SomeType',
          fields: {
            someField: { type: GraphQLString },
            introspectionField: { type: __EnumValue },
          },
        }),
      },
    },
  }),
});

function expectErrors(queryStr) {
  return expectValidationErrorsWithSchema(
    schema,
    ProhibitIntrospectionQueriesRule,
    queryStr,
  );
}

function expectValid(queryStr) {
  expectErrors(queryStr).to.deep.equal([]);
}

describe('Validate: Prohibit introspection queries', () => {
  it('ignores valid fields including __typename', () => {
    expectValid(`
      {
        someQuery {
          __typename
          someField
        }
      }
    `);
  });

  it('ignores fields not in the schema', () => {
    expectValid(`
      {
        __introspect
      }
    `);
  });

  it('reports error when a field with an introspection type is requested', () => {
    expectErrors(`
      {
        __schema {
          queryType {
            name
          }
        }
      }
    `).to.deep.equal([
      {
        message:
          'GraphQL introspection has been disabled, but the requested query contained the field "__schema".',
        locations: [{ line: 3, column: 9 }],
      },
      {
        message:
          'GraphQL introspection has been disabled, but the requested query contained the field "queryType".',
        locations: [{ line: 4, column: 11 }],
      },
    ]);
  });

  it('reports error when a field with an introspection type is requested and aliased', () => {
    expectErrors(`
      {
        s: __schema {
          queryType {
            name
          }
        }
      }
      `).to.deep.equal([
      {
        message:
          'GraphQL introspection has been disabled, but the requested query contained the field "__schema".',
        locations: [{ line: 3, column: 9 }],
      },
      {
        message:
          'GraphQL introspection has been disabled, but the requested query contained the field "queryType".',
        locations: [{ line: 4, column: 11 }],
      },
    ]);
  });

  it('reports error when using a fragment with a field with an introspection type', () => {
    expectErrors(`
      {
        ...QueryFragment
      }

      fragment QueryFragment on Query {
        __schema {
          queryType {
            name
          }
        }
      }
    `).to.deep.equal([
      {
        message:
          'GraphQL introspection has been disabled, but the requested query contained the field "__schema".',
        locations: [{ line: 7, column: 9 }],
      },
      {
        message:
          'GraphQL introspection has been disabled, but the requested query contained the field "queryType".',
        locations: [{ line: 8, column: 11 }],
      },
    ]);
  });

  it('reports error for non-standard introspection fields', () => {
    expectErrors(`
      {
        someQuery {
          introspectionField
        }
      }
    `).to.deep.equal([
      {
        message:
          'GraphQL introspection has been disabled, but the requested query contained the field "introspectionField".',
        locations: [{ line: 4, column: 11 }],
      },
    ]);
  });
});