Skip to content

Commit e1f21d0

Browse files
enisdenjogithub-actions[bot]
enisdenjo
and
github-actions[bot]
authored
chore: audit PostGraphile (#22)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent d784f20 commit e1f21d0

File tree

7 files changed

+265
-0
lines changed

7 files changed

+265
-0
lines changed

‎.github/workflows/audits.yml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,34 @@ jobs:
225225
name: hotchocolate-report
226226
path: README.md
227227

228+
postgraphile:
229+
runs-on: ubuntu-latest
230+
if: "!contains(github.event.head_commit.message, '[skip ci]')"
231+
env:
232+
PORT: 4000
233+
steps:
234+
- name: Checkout
235+
uses: actions/checkout@v3
236+
- name: Set up node
237+
uses: actions/setup-node@v3
238+
with:
239+
node-version: 18
240+
cache: yarn
241+
- name: Install
242+
run: yarn install --immutable
243+
- name: Build
244+
run: yarn build:esm
245+
- name: Start
246+
run: yarn workspace postgraphile start -d --wait
247+
# TODO: cache docker build artifacts
248+
- name: Audit
249+
run: node scripts/audit-implementation.mjs README.md
250+
- name: Upload report
251+
uses: actions/upload-artifact@v3
252+
with:
253+
name: postgraphile-report
254+
path: README.md
255+
228256
report:
229257
name: Report
230258
runs-on: ubuntu-latest
@@ -239,6 +267,7 @@ jobs:
239267
graph-client,
240268
thegraph,
241269
hotchocolate,
270+
postgraphile,
242271
]
243272
steps:
244273
- name: Checkout
@@ -285,6 +314,11 @@ jobs:
285314
with:
286315
name: hotchocolate-report
287316
path: implementations/hotchocolate
317+
- name: Download postgraphile report
318+
uses: actions/download-artifact@v3
319+
with:
320+
name: postgraphile-report
321+
path: implementations/postgraphile
288322
- name: Commit
289323
run: |
290324
git config user.name "github-actions[bot]"

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -733,6 +733,7 @@ If you want a feature-full server with bleeding edge technologies, you're recomm
733733
| ------------------------------------------------------------------ | -------------------------------------------------------------------- |
734734
| [graphql-yoga](https://www.the-guild.dev/graphql/yoga-server) | [✅ Compliant (0 warnings)](/implementations/graphql-yoga/README.md) |
735735
| [hotchocolate](https://chillicream.com/docs/hotchocolate) | [✅ Compliant (0 warnings)](/implementations/hotchocolate/README.md) |
736+
| [postgraphile](https://www.graphile.org/postgraphile/) | [✅ Compliant](/implementations/postgraphile/README.md) |
736737
| [apollo-server](https://www.apollographql.com/docs/apollo-server/) | [✅ Compliant](/implementations/apollo-server/README.md) |
737738
| [mercurius](https://mercurius.dev) | [✅ Compliant](/implementations/mercurius/README.md) |
738739

‎implementations/postgraphile/Dockerfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
FROM node:18
2+
3+
RUN npm install -g postgraphile@4

‎implementations/postgraphile/README.md

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
_* This report was auto-generated by graphql-http_
2+
3+
# GraphQL over HTTP audit report
4+
5+
- **73** audits in total
6+
- ✅ **39** pass
7+
- ⚠️ **34** warnings (optional)
8+
9+
## Passing
10+
1. MUST accept application/json and match the content-type
11+
2. MUST use utf-8 encoding when responding
12+
3. MUST accept utf-8 encoding
13+
4. MUST assume utf-8 if encoding is unspecified
14+
5. MUST accept POST requests
15+
6. MAY NOT allow executing mutations on GET requests
16+
7. SHOULD respond with 4xx status code if content-type is not supplied on POST requests
17+
8. MUST accept application/json POST requests
18+
9. MUST require a request body on POST
19+
10. SHOULD use 400 status code on missing {query} parameter when accepting application/graphql-response+json
20+
11. SHOULD use 400 status code on number {query} parameter when accepting application/graphql-response+json
21+
12. SHOULD use 400 status code on boolean {query} parameter when accepting application/graphql-response+json
22+
13. SHOULD allow string {query} parameter when accepting application/graphql-response+json
23+
14. MUST allow string {query} parameter when accepting application/json
24+
15. SHOULD use 400 status code on object {operationName} parameter when accepting application/graphql-response+json
25+
16. SHOULD use 400 status code on number {operationName} parameter when accepting application/graphql-response+json
26+
17. SHOULD use 400 status code on boolean {operationName} parameter when accepting application/graphql-response+json
27+
18. SHOULD use 400 status code on array {operationName} parameter when accepting application/graphql-response+json
28+
19. SHOULD allow string {operationName} parameter when accepting application/graphql-response+json
29+
20. MUST allow string {operationName} parameter when accepting application/json
30+
21. SHOULD use 400 status code on string {variables} parameter when accepting application/graphql-response+json
31+
22. SHOULD use 400 status code on number {variables} parameter when accepting application/graphql-response+json
32+
23. SHOULD use 400 status code on boolean {variables} parameter when accepting application/graphql-response+json
33+
24. SHOULD allow map {variables} parameter when accepting application/graphql-response+json
34+
25. MUST allow map {variables} parameter when accepting application/json
35+
26. SHOULD allow map {extensions} parameter when accepting application/graphql-response+json
36+
27. MUST allow map {extensions} parameter when accepting application/json
37+
28. SHOULD use 4xx or 5xx status codes on JSON parsing failure when accepting application/graphql-response+json
38+
29. SHOULD use 400 status code on JSON parsing failure when accepting application/graphql-response+json
39+
30. SHOULD not contain the data entry on JSON parsing failure when accepting application/graphql-response+json
40+
31. SHOULD use 4xx or 5xx status codes if parameters are invalid when accepting application/graphql-response+json
41+
32. SHOULD use 400 status code if parameters are invalid when accepting application/graphql-response+json
42+
33. SHOULD not contain the data entry if parameters are invalid when accepting application/graphql-response+json
43+
34. SHOULD use 4xx or 5xx status codes on document parsing failure when accepting application/graphql-response+json
44+
35. SHOULD use 400 status code on document parsing failure when accepting application/graphql-response+json
45+
36. SHOULD not contain the data entry on document parsing failure when accepting application/graphql-response+json
46+
37. SHOULD use 4xx or 5xx status codes on document validation failure when accepting application/graphql-response+json
47+
38. SHOULD use 400 status code on document validation failure when accepting application/graphql-response+json
48+
39. SHOULD not contain the data entry on document validation failure when accepting application/graphql-response+json
49+
50+
## Warnings
51+
The server _SHOULD_ support these, but is not required.
52+
1. SHOULD accept application/graphql-response+json and match the content-type<br />
53+
```
54+
Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json"
55+
```
56+
2. SHOULD accept \*/\* and use application/graphql-response+json for the content-type<br />
57+
```
58+
Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json"
59+
```
60+
3. SHOULD assume application/graphql-response+json content-type when accept is missing<br />
61+
```
62+
Content-Type header "application/json; charset=utf-8" does not contain "application/graphql-response+json"
63+
```
64+
4. MAY accept application/x-www-form-urlencoded formatted GET requests<br />
65+
```
66+
Status code 405 is not 200
67+
```
68+
5. SHOULD use 200 status code with errors field on missing {query} parameter when accepting application/json<br />
69+
```
70+
Status code 400 is not 200
71+
```
72+
6. SHOULD use 400 status code on object {query} parameter when accepting application/graphql-response+json<br />
73+
```
74+
Status code 500 is not 400
75+
```
76+
7. SHOULD use 400 status code on array {query} parameter when accepting application/graphql-response+json<br />
77+
```
78+
Status code 500 is not 400
79+
```
80+
8. SHOULD use 200 status code with errors field on object {query} parameter when accepting application/json<br />
81+
```
82+
Status code 500 is not 200
83+
```
84+
9. SHOULD use 200 status code with errors field on number {query} parameter when accepting application/json<br />
85+
```
86+
Status code 400 is not 200
87+
```
88+
10. SHOULD use 200 status code with errors field on boolean {query} parameter when accepting application/json<br />
89+
```
90+
Status code 400 is not 200
91+
```
92+
11. SHOULD use 200 status code with errors field on array {query} parameter when accepting application/json<br />
93+
```
94+
Status code 500 is not 200
95+
```
96+
12. SHOULD use 200 status code with errors field on object {operationName} parameter when accepting application/json<br />
97+
```
98+
Status code 400 is not 200
99+
```
100+
13. SHOULD use 200 status code with errors field on number {operationName} parameter when accepting application/json<br />
101+
```
102+
Status code 400 is not 200
103+
```
104+
14. SHOULD use 200 status code with errors field on boolean {operationName} parameter when accepting application/json<br />
105+
```
106+
Status code 400 is not 200
107+
```
108+
15. SHOULD use 200 status code with errors field on array {operationName} parameter when accepting application/json<br />
109+
```
110+
Status code 400 is not 200
111+
```
112+
16. SHOULD use 400 status code on array {variables} parameter when accepting application/graphql-response+json<br />
113+
```
114+
Status code 200 is not 400
115+
```
116+
17. SHOULD use 200 status code with errors field on string {variables} parameter when accepting application/json<br />
117+
```
118+
Status code 400 is not 200
119+
```
120+
18. SHOULD use 200 status code with errors field on number {variables} parameter when accepting application/json<br />
121+
```
122+
Status code 400 is not 200
123+
```
124+
19. SHOULD use 200 status code with errors field on boolean {variables} parameter when accepting application/json<br />
125+
```
126+
Status code 400 is not 200
127+
```
128+
20. SHOULD use 200 status code with errors field on array {variables} parameter when accepting application/json<br />
129+
```
130+
Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'
131+
```
132+
21. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/graphql-response+json<br />
133+
```
134+
Status code 405 is not 200
135+
```
136+
22. MAY allow URL-encoded JSON string {variables} parameter in GETs when accepting application/json<br />
137+
```
138+
Status code 405 is not 200
139+
```
140+
23. SHOULD use 400 status code on string {extensions} parameter when accepting application/graphql-response+json<br />
141+
```
142+
Status code 200 is not 400
143+
```
144+
24. SHOULD use 400 status code on number {extensions} parameter when accepting application/graphql-response+json<br />
145+
```
146+
Status code 200 is not 400
147+
```
148+
25. SHOULD use 400 status code on boolean {extensions} parameter when accepting application/graphql-response+json<br />
149+
```
150+
Status code 200 is not 400
151+
```
152+
26. SHOULD use 400 status code on array {extensions} parameter when accepting application/graphql-response+json<br />
153+
```
154+
Status code 200 is not 400
155+
```
156+
27. SHOULD use 200 status code with errors field on string {extensions} parameter when accepting application/json<br />
157+
```
158+
Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'
159+
```
160+
28. SHOULD use 200 status code with errors field on number {extensions} parameter when accepting application/json<br />
161+
```
162+
Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'
163+
```
164+
29. SHOULD use 200 status code with errors field on boolean {extensions} parameter when accepting application/json<br />
165+
```
166+
Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'
167+
```
168+
30. SHOULD use 200 status code with errors field on array {extensions} parameter when accepting application/json<br />
169+
```
170+
Execution result {"data":{"__typename":"Query"}} does not have a property 'errors'
171+
```
172+
31. SHOULD use 200 status code on JSON parsing failure when accepting application/json<br />
173+
```
174+
Status code 400 is not 200
175+
```
176+
32. SHOULD use 200 status code if parameters are invalid when accepting application/json<br />
177+
```
178+
Status code 400 is not 200
179+
```
180+
33. SHOULD use 200 status code on document parsing failure when accepting application/json<br />
181+
```
182+
Status code 400 is not 200
183+
```
184+
34. SHOULD use 200 status code on document validation failure when accepting application/json<br />
185+
```
186+
Status code 400 is not 200
187+
```
188+

‎implementations/postgraphile/docker-compose.yml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
services:
2+
database:
3+
image: postgres:15
4+
environment:
5+
- POSTGRES_HOST_AUTH_METHOD=trust
6+
healthcheck:
7+
test: pg_isready -U postgres || exit 1
8+
interval: 3s
9+
timeout: 1s
10+
server:
11+
build: .
12+
depends_on:
13+
database:
14+
condition: service_healthy
15+
environment:
16+
- PGHOST=database
17+
- PGUSER=postgres
18+
- PORT=${PORT}
19+
ports:
20+
- ${PORT}:${PORT}
21+
entrypoint: postgraphile --host 0.0.0.0 --port ${PORT}
22+
healthcheck:
23+
test: "curl -f -H 'content-type: application/json' -d '{ \"query\": \"{ __typename }\" }' http://localhost:$$PORT/graphql || exit 1"
24+
interval: 3s
25+
timeout: 1s

‎implementations/postgraphile/package.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"private": true,
3+
"name": "postgraphile",
4+
"packageManager": "[email protected]",
5+
"scripts": {
6+
"start": "docker compose up --build"
7+
}
8+
}

‎yarn.lock

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10181,6 +10181,12 @@ __metadata:
1018110181
languageName: node
1018210182
linkType: hard
1018310183

10184+
"postgraphile@workspace:implementations/postgraphile":
10185+
version: 0.0.0-use.local
10186+
resolution: "postgraphile@workspace:implementations/postgraphile"
10187+
languageName: unknown
10188+
linkType: soft
10189+
1018410190
"prelude-ls@npm:^1.2.1":
1018510191
version: 1.2.1
1018610192
resolution: "prelude-ls@npm:1.2.1"

0 commit comments

Comments
 (0)