Skip to content

Commit 8a183a9

Browse files
committed
feat(aliases.spec.ts): update aliases in test queries to use 'job' instead of 'jobAd' and 'company' instead of 'publisherCompany' for improved clarity and consistency
feat(aliases.spec.ts): refactor test queries to use 'findJobs' instead of 'findJobApplications' for better naming and semantics fix(index.ts): add validation to prevent duplicate operation names in queryMap to avoid conflicts and improve data integrity
1 parent a8843b0 commit 8a183a9

File tree

2 files changed

+34
-33
lines changed

2 files changed

+34
-33
lines changed

src/__tests__/aliases.spec.ts

Lines changed: 26 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -2,27 +2,26 @@ import { getAllowedQueryForRequest } from '../get-allowed-query';
22
import { mergeQueries } from '../merge';
33

44
const allowedQueries = {
5-
'FindMyTalentJobApplications.findJobApplications': `query FindMyTalentJobApplications {
6-
data: findJobApplications {
5+
'FindMyJobs.findJobs': `query FindMyJobs {
6+
data: findJobs {
77
id
88
createdAt
99
deletedAt
10-
jobAd {
10+
job {
1111
id
12-
location
1312
title
14-
publisherCompany {
13+
company {
1514
name
1615
}
1716
workMode
1817
}
1918
}
2019
}`,
21-
'FindMyCompanyTalentJobApplications.findJobApplications': `query FindMyCompanyTalentJobApplications($where: TalentJobApplicationWhereInput, $orderBy: [TalentJobApplicationOrderByWithRelationInput!]) {
22-
data: findJobApplications(where: $where, orderBy: $orderBy) {
20+
'FindMyCompanyTalentJobApplications.findJobs': `query FindMyCompanyTalentJobApplications($where: TalentJobApplicationWhereInput, $orderBy: [TalentJobApplicationOrderByWithRelationInput!]) {
21+
data: findJobs(where: $where, orderBy: $orderBy) {
2322
createdAt
2423
id
25-
jobAd {
24+
job {
2625
title
2726
}
2827
talentProfile {
@@ -33,17 +32,16 @@ const allowedQueries = {
3332
};
3433

3534
describe('aliases', () => {
36-
test('FindMyTalentJobApplications should handle aliases (request talentProfile when it is not allowed)', () => {
37-
const requestQuery = `query FindMyTalentJobApplications {
38-
data: findJobApplications {
35+
test('FindMyJobs should handle aliases (request talentProfile when it is not allowed)', () => {
36+
const requestQuery = `query FindMyJobs {
37+
data: findJobs {
3938
id
4039
createdAt
4140
deletedAt
42-
jobAd {
41+
job {
4342
id
44-
location
4543
title
46-
publisherCompany {
44+
company {
4745
name
4846
}
4947
workMode
@@ -54,16 +52,15 @@ describe('aliases', () => {
5452
}
5553
}`;
5654

57-
const expected = `query FindMyTalentJobApplications {
58-
data: findJobApplications {
55+
const expected = `query FindMyJobs {
56+
data: findJobs {
5957
id
6058
createdAt
6159
deletedAt
62-
jobAd {
60+
job {
6361
id
64-
location
6562
title
66-
publisherCompany {
63+
company {
6764
name
6865
}
6966
workMode
@@ -79,10 +76,10 @@ describe('aliases', () => {
7976

8077
test('FindMyCompanyTalentJobApplications should handle aliases2 (request workMode when it is not allowed)', () => {
8178
const requestQuery = `query FindMyCompanyTalentJobApplications($where: TalentJobApplicationWhereInput, $orderBy: [TalentJobApplicationOrderByWithRelationInput!]) {
82-
data: findJobApplications(where: $where, orderBy: $orderBy) {
79+
data: findJobs(where: $where, orderBy: $orderBy) {
8380
createdAt
8481
id
85-
jobAd {
82+
job {
8683
title
8784
__typename
8885
}
@@ -95,10 +92,10 @@ describe('aliases', () => {
9592
}
9693
}`;
9794
const expected = `query FindMyCompanyTalentJobApplications($where: TalentJobApplicationWhereInput, $orderBy: [TalentJobApplicationOrderByWithRelationInput!]) {
98-
data: findJobApplications(where: $where, orderBy: $orderBy) {
95+
data: findJobs(where: $where, orderBy: $orderBy) {
9996
createdAt
10097
id
101-
jobAd {
98+
job {
10299
title
103100
}
104101
talentProfile {
@@ -115,23 +112,21 @@ describe('aliases', () => {
115112
});
116113

117114
test('Exploit with Aliased Fields to bypass restrictions', () => {
118-
const requestQuery = `query FindMyTalentJobApplications {
119-
data: findJobApplications {
115+
const requestQuery = `query FindMyJobs {
116+
data: findJobs {
120117
id
121-
jobAd {
118+
job {
122119
id
123-
location
124120
secretTitle: secret
125121
workMode
126122
}
127123
}
128124
}`;
129-
const expected = `query FindMyTalentJobApplications {
130-
data: findJobApplications {
125+
const expected = `query FindMyJobs {
126+
data: findJobs {
131127
id
132-
jobAd {
128+
job {
133129
id
134-
location
135130
workMode
136131
}
137132
}

src/index.ts

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,9 +109,15 @@ export class GraphQLQueryPurifier {
109109
const firstFieldName = firstField ? firstField.name.value : '';
110110

111111
const key = `${operationName}.${firstFieldName}`.trim();
112-
this.queryMap[key] = content;
112+
113+
if (this.queryMap[key]) {
114+
throw new Error(
115+
`Duplicate operation name detected: ${key}. File: ${file}`
116+
);
117+
} else {
118+
this.queryMap[key] = content;
119+
}
113120
}
114-
console.log('this.queryMap', this.queryMap);
115121
});
116122
}
117123

0 commit comments

Comments
 (0)