{"id":26267375,"url":"https://github.com/oslabs-beta/guardenoql","last_synced_at":"2025-04-30T19:08:31.207Z","repository":{"id":59854199,"uuid":"530321029","full_name":"oslabs-beta/GuarDenoQL","owner":"oslabs-beta","description":"Simple and customizable security middleware for GraphQL servers in Deno.","archived":false,"fork":false,"pushed_at":"2022-09-24T19:39:38.000Z","size":255,"stargazers_count":43,"open_issues_count":0,"forks_count":8,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-30T19:07:24.737Z","etag":null,"topics":["deno","graphql","open-source","opine","security"],"latest_commit_sha":null,"homepage":"https://www.guardenoql.dev/","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/oslabs-beta.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-08-29T17:23:08.000Z","updated_at":"2023-12-01T21:42:30.000Z","dependencies_parsed_at":"2022-09-23T11:10:50.470Z","dependency_job_id":null,"html_url":"https://github.com/oslabs-beta/GuarDenoQL","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oslabs-beta%2FGuarDenoQL","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oslabs-beta%2FGuarDenoQL/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oslabs-beta%2FGuarDenoQL/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oslabs-beta%2FGuarDenoQL/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/oslabs-beta","download_url":"https://codeload.github.com/oslabs-beta/GuarDenoQL/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251767187,"owners_count":21640469,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["deno","graphql","open-source","opine","security"],"created_at":"2025-03-14T04:16:39.535Z","updated_at":"2025-04-30T19:08:31.184Z","avatar_url":"https://github.com/oslabs-beta.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n  \u003cbr\u003e\n  \u003cbr\u003e\n  \u003cimg alt=\"guardenoql-logo\" height=\"200\" src=\"https://raw.githubusercontent.com/oslabs-beta/GuarDenoQL/main/assets/readme_logo.svg\"\u003e\n  \u003cbr\u003e\n  \u003cbr\u003e\n  \u003ch1\u003eGuarDenoQL\u003c/h1\u003e\n  \u003cp\u003e\u003cem\u003eSimple and customizable security middleware for GraphQL servers in Deno\u003c/em\u003e\u003c/p\u003e\n\u003c/div\u003e\n\n# Features\n\n- Integrates with an Opine server in a Deno runtime.\n- Enables users to customize both a _**maximum depth**_ and a _**cost limit**_\n  for all GraphQL queries and mutations sent to the server.\n- Validates queries and mutations against the depth limiter and/or cost limiter\n  before they are executed by the server.\n\n# Why?\n\n### **Depth Limiting**\n\nBecause GraphQL schemas can be cyclic graphs, it is possible that a client could\nconstruct a query such as this one:\n\n\u003cdiv\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/oslabs-beta/GuarDenoQL/main/assets/evil-query.png\"\u003e\n\u003c/div\u003e\nTherefore, if nested deep enough, a malicious actor could potentially bring your server down with an abusive query.\n\u003cbr /\u003e\n\u003cbr /\u003e\n\nHowever, using a **Depth Limiter**, you can validate the depth of incoming\nqueries against a user-defined limit and prevent these queries from going\nthrough.\n\n### **Cost Limiting**\n\nQueries can still be very expensive even if they aren't nested deeply. Using a\n**Cost Limiter**, your server will calculate the total cost of the query based\non its types before execution.\n\n\u003cdiv\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/oslabs-beta/GuarDenoQL/main/assets/cost-query.png\"\u003e\n\u003c/div\u003e\n\n# Getting Started\n\nA set up with [gql](https://github.com/deno-libs/gql) and\n[Opine](https://github.com/cmorten/opine) out-of-the-box:\n\n```typescript\nimport { opine, OpineRequest } from \"https://deno.land/x/opine@2.2.0/mod.ts\";\nimport { GraphQLHTTP } from \"https://deno.land/x/gql@1.1.2/mod.ts\";\nimport { makeExecutableSchema } from \"https://deno.land/x/graphql_tools@0.0.2/mod.ts\";\nimport { gql } from \"https://deno.land/x/graphql_tag@0.0.1/mod.ts\";\nimport { readAll } from \"https://deno.land/std@0.148.0/streams/conversion.ts\";\n\nimport { guarDenoQL } from \"https://deno.land/x/guardenoql@v1.0.1/mod.ts\";\n// update GuarDenoQL import URL with most recent version \n\ntype Request = OpineRequest \u0026 { json: () =\u003e Promise\u003cany\u003e };\n\nconst typeDefs = gql`\n  type Query {\n    hello: String\n  }\n`;\n\nconst resolvers = { Query: { hello: () =\u003e `Hello World!` } };\nconst dec = new TextDecoder();\nconst schema = makeExecutableSchema({ resolvers, typeDefs });\nconst app = opine();\n\napp\n  .use(\"/graphql\", async (req, res) =\u003e {\n    const request = req as Request;\n\n    request.json = async () =\u003e {\n      const rawBody = await readAll(req.raw);\n      const body = JSON.parse(dec.decode(rawBody));\n      const query = body.query;\n\n      const error = guarDenoQL(schema, query, {\n        depthLimitOptions: {\n          maxDepth: 4, // maximum depth allowed before a request is rejected\n          callback: (args) =\u003e console.log(\"query depth is:\", args), // optional\n        },\n        costLimitOptions: {\n          maxCost: 5000, // maximum cost allowed before a request is rejected\n          mutationCost: 5, // cost of a mutation\n          objectCost: 2, // cost of retrieving an object\n          scalarCost: 1, // cost of retrieving a scalar\n          depthCostFactor: 1.5, // multiplicative cost of each depth level\n          callback: (args) =\u003e console.log(\"query cost is:\", args), // optional\n        },\n      });\n\n      if (error !== undefined \u0026\u0026 !error.length) {\n        return body;\n      } else {\n        const errorMessage = { error };\n        return res.send(JSON.stringify(errorMessage));\n      }\n    };\n\n    const resp = await GraphQLHTTP\u003cRequest\u003e({\n      schema,\n      context: (request) =\u003e ({ request }),\n      graphiql: true,\n    })(request);\n\n    for (const [k, v] of resp.headers.entries()) res.headers?.append(k, v);\n    res.status = resp.status;\n    res.send(await resp.text());\n  })\n  .listen(3000, () =\u003e console.log(`☁  Started on http://localhost:3000`));\n```\n\nGuarDenoQL is fully customizable.\n\nUsers can use either the depth limiter, cost limiter or both.\n\nThe first argument is the `schema`, the second argument is the `query`, and the\nthird argument is an `Object` with up to two properties: `depthLimitOptions`\nand/or `costLimitOptions`.\n\n### **Depth Limit Configuration**\n\nThis feature limits the depth of a document.\n\n```typescript\nconst error = guarDenoQL(schema, query, {\n  depthLimitOptions: {\n    maxDepth: 4, // maximum depth allowed before a request is rejected\n    callback: (args) =\u003e console.log(\"query depth is:\", args), // optional\n  },\n});\n```\n\nThe `depthLimitOptions` object has two properties to configure:\n\n1. `maxDepth`: the depth limiter will throw a validation error if the document\n   has a greater depth than the user-supplied `maxDepth`\n\n2. optional `callback` function: receives an `Object` that maps the name of the\n   operation to its corresponding query depth\n\n### **Cost Limit Configuration**\n\nThis feature applies a cost analysis algorithm to block queries that are too\nexpensive.\n\n```typescript\nconst error = guarDenoQL(schema, query, {\n  costLimitOptions: {\n    maxCost: 5000, // maximum cost allowed before a request is rejected\n    mutationCost: 5, // cost of a mutation\n    objectCost: 2, // cost of retrieving an object\n    scalarCost: 1, // cost of retrieving a scalar\n    depthCostFactor: 1.5, // multiplicative cost of each depth level\n    callback: (args) =\u003e console.log(\"query cost is:\", args), // optional\n  },\n});\n```\n\nThe `costLimitOptions` object has six properties to configure:\n\n1. `maxCost`: the cost limiter will throw a validation error if the document has\n   a greater cost than the user-supplied `maxCost`\n\n2. `mutationCost`: represents the cost of a mutation (some popular\n   [cost analysis algorithms](https://shopify.engineering/rate-limiting-graphql-apis-calculating-query-complexity)\n   make mutations more expensive than queries)\n\n3. `objectCost`: represents the cost of an object that has subfields\n\n4. `scalarCost`: represents the cost of a scalar\n\n5. `depthCostFactor`: the multiplicative cost of each depth level\n\n6. optional `callback` function: receives an `Object` that maps the name of the\n   operation to its corresponding query cost\n\n# Functionality\n\n### **Depth Limiter**\n\n\u003cdiv\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/oslabs-beta/GuarDenoQL/main/assets/depth-limiter.png\"\u003e\n\u003c/div\u003e\n\n### **Cost Limiter**\n\n\u003cdiv\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/oslabs-beta/GuarDenoQL/main/assets/cost-limiter.png\"\u003e\n\u003c/div\u003e\n\n# How to Contribute\n\nIf you would like to contribute, please see\n[CONTRIBUTING.md](https://github.com/oslabs-beta/GuarDenoQL/blob/main/CONTRIBUTING.md)\nfor more information.\n\n# Authors\n\nFinley Decker: [GitHub](https://github.com/finleydecker) |\n[LinkedIn](https://www.linkedin.com/in/finleydecker/)\n\nHannah McDowell: [GitHub](https://github.com/hannahmcdowell) |\n[LinkedIn](https://www.linkedin.com/in/hannah-lisbeth-mcdowell/)\n\nJane You: [GitHub](https://github.com/janeyou94) |\n[LinkedIn](https://www.linkedin.com/in/janeyou-pharmd-bcacp/)\n\nLucien Hsu: [GitHub](https://github.com/LBLuc) |\n[LinkedIn](https://www.linkedin.com/in/lucien-hsu/)\n\n# License\n\nDistributed under the MIT License. See\n[LICENSE](https://github.com/oslabs-beta/GuarDenoQL/blob/main/LICENSE) for more\ninformation.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foslabs-beta%2Fguardenoql","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Foslabs-beta%2Fguardenoql","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foslabs-beta%2Fguardenoql/lists"}