使用常规graphQL查询复制GraphQL自省查询以避免安全风险(同时使用graphql-compose-mongoose)

Question

正在尝试从graphQL查询中取回IdTypes列表。目前使用自省来获取列表，但是在安全审计之后，我们被建议禁用自省。

这是我目前得到的，显然它不起作用:(

import mongoose from 'mongoose'
import { GQC } from 'graphql-compose';
import { composeWithMongoose } from 'graphql-compose-mongoose';

export const IdTypeSchema = new mongoose.Schema({
  idType: {
    type: String,
    enum: ['ID', 'Passport', 'None']
  }
})

const IdType = mongoose.model('IdType', IdTypeSchema)

export const IdTypeTC = composeWithMongoose(IdType, {})

GQC.rootQuery().addFields({
  idTypesMany: IdTypeTC.getResolver('findMany')
})

枚举不太可能经常更改。

Answer 1

我没有解决这个问题--但这里是有效的:D根本不需要涉及mongoose……

import { GQC, Resolver } from 'graphql-compose'
import { validateSession } from '../authentication'
import { ID_TYPES } from './constants'

export function _idTypeResolveHandler () {
  return ID_TYPES
}

const idTypeResolver = new Resolver({
  name: 'getIdTypes',
  type: ['String'],
  resolve: _idTypeResolveHandler
})

GQC.rootQuery().addFields({
  idTypes: idTypeResolver
    .wrapResolve(next => resolveParams => {
      const { user } = resolveParams.context.state
      return next(resolveParams)
    })
})