NoSchemaIntrospectionCustomRule.js 1.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041
  1. 'use strict';
  2. Object.defineProperty(exports, '__esModule', {
  3. value: true,
  4. });
  5. exports.NoSchemaIntrospectionCustomRule = NoSchemaIntrospectionCustomRule;
  6. var _GraphQLError = require('../../../error/GraphQLError.js');
  7. var _definition = require('../../../type/definition.js');
  8. var _introspection = require('../../../type/introspection.js');
  9. /**
  10. * Prohibit introspection queries
  11. *
  12. * A GraphQL document is only valid if all fields selected are not fields that
  13. * return an introspection type.
  14. *
  15. * Note: This rule is optional and is not part of the Validation section of the
  16. * GraphQL Specification. This rule effectively disables introspection, which
  17. * does not reflect best practices and should only be done if absolutely necessary.
  18. */
  19. function NoSchemaIntrospectionCustomRule(context) {
  20. return {
  21. Field(node) {
  22. const type = (0, _definition.getNamedType)(context.getType());
  23. if (type && (0, _introspection.isIntrospectionType)(type)) {
  24. context.reportError(
  25. new _GraphQLError.GraphQLError(
  26. `GraphQL introspection has been disabled, but the requested query contained the field "${node.name.value}".`,
  27. {
  28. nodes: node,
  29. },
  30. ),
  31. );
  32. }
  33. },
  34. };
  35. }