/** @category Custom Rules */
import { GraphQLError } from '../../../error/GraphQLError';
import type { FieldNode } from '../../../language/ast';
import type { ASTVisitor } from '../../../language/visitor';
import { getNamedType } from '../../../type/definition';
import { isIntrospectionType } from '../../../type/introspection';
import type { ValidationContext } from '../../ValidationContext';
/**
* Prohibit introspection queries
*
* A GraphQL document is only valid if all fields selected are not fields that
* return an introspection type.
*
* Note: This rule is optional and is not part of the Validation section of the
* GraphQL Specification. This rule effectively disables introspection, which
* does not reflect best practices and should only be done if absolutely necessary.
* @param context - The validation context used while checking the document.
* @returns A visitor that reports validation errors for this rule.
* @example
* ```ts
* import { buildSchema, parse, validate } from 'graphql';
* import { NoSchemaIntrospectionCustomRule } from 'graphql/validation';
*
* const schema = buildSchema(`
* type Query {
* name: String
* }
* `);
*
* const invalidDocument = parse(`
* { __schema { queryType { name } } }
* `);
* const invalidErrors = validate(schema, invalidDocument, [NoSchemaIntrospectionCustomRule]);
*
* invalidErrors.length; // => 1
*
* const validDocument = parse(`
* { name }
* `);
* const validErrors = validate(schema, validDocument, [NoSchemaIntrospectionCustomRule]);
*
* validErrors; // => []
* ```
*/
export function NoSchemaIntrospectionCustomRule(
context: ValidationContext,
): ASTVisitor {
return {
Field(node: FieldNode) {
const type = getNamedType(context.getType());
if (type && isIntrospectionType(type)) {
context.reportError(
new GraphQLError(
`GraphQL introspection has been disabled, but the requested query contained the field "${node.name.value}".`,
{ nodes: node },
),
);
}
},
};
}