Registry / database / graphile-sql-expression-validator

graphile-sql-expression-validator

library2.14.0jsnpmunverified

PostGraphile v5 plugin for validating SQL expressions before they reach the database. v2.14.0 — stable release with weekly updates. Enforces whitelist allow/block rules on SQL AST nodes, preventing SQL injection and unsafe queries in PostGraphile schemas. Differentiator: works at the AST level (not text regex) for precise, composable security rules; integrates with grafast and graphile-build-pg execution pipeline.

database security

npm install graphile-sql-expression-validator

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · GRAPHILE-SQL-EXPRE

graphile-sql-expression-validator

databasejavascriptv2.14.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

NODE_VALIDATOR_FACTORY

✓ import { NODE_VALIDATOR_FACTORY } from 'graphile-sql-expression-validator'

✗ import NODE_VALIDATOR_FACTORY from 'graphile-sql-expression-validator'

Named export, not default. Requires ESM.

makeNodeValidatorPlugin

✓ import { makeNodeValidatorPlugin } from 'graphile-sql-expression-validator'

✗ const { makeNodeValidatorPlugin } = require('graphile-sql-expression-validator')

ESM-only package — do not use require().

Plugin

✓ import type { Plugin } from 'graphile-sql-expression-validator'

TypeScript type export — use import type.

SQLValidatorConfig

✓ import type { SQLValidatorConfig } from 'graphile-sql-expression-validator'

✗ import { SQLValidatorConfig } from 'graphile-sql-expression-validator'

SQLValidatorConfig is a type, not a value. Use import type.

Creates a PostGraphile plugin that whitelists SQL expression types, blocking DELETE statements and only allowing SELECT.

import { makeNodeValidatorPlugin, NODE_VALIDATOR_FACTORY } from 'graphile-sql-expression-validator'; // Define a whitelist: only allow specific SQL expressions const whitelistPlugin = makeNodeValidatorPlugin({ [NODE_VALIDATOR_FACTORY]: { // Allow only SELECT statements select: true, // Block DELETE statements explicitly delete: false, }, }); // Use with PostGraphile import { postgraphile } from 'postgraphile'; postgraphile(pool, 'public', { plugins: [whitelistPlugin], });

Debug

Known issues

breakingv2.x drops support for PostGraphile v4 — requires PostGraphile v5 and peer deps grafast/graphile-build-pg v5.x.

fix

Upgrade PostGraphile to v5 and install peer dependencies grafast@1.0.2, graphile-build@5.0.2, graphile-build-pg@5.0.2, graphile-config@1.0.1, graphql@16.13.0.

affects: >=2.0.0

breakingESM-only since v2 — CommonJS require() fails.

fix

Convert to ESM (use import/export) or use dynamic import().

affects: >=2.0.0

deprecatedv1 API using SQLValidatorFactory is deprecated. Use NODE_VALIDATOR_FACTORY in v2.

fix

Replace SQLValidatorFactory with NODE_VALIDATOR_FACTORY in makeNodeValidatorPlugin config.

affects: >=2.0.0

gotchaPlugin configuration applied globally — rules cannot be scoped per-resolver. All SQL expressions across all resolvers are validated by the same config.

fix

If per-resolver rules are needed, consider using PostGraphile's makeExtendSchemaPlugin with custom validation logic.

affects: >=0.0.0

gotchaNODE_VALIDATOR_FACTORY only validates expression node types, not parameterized values. SQL injection via values may still be possible if other layers are misconfigured.

fix

Ensure parameterized queries are used and that grafast's value escaping is enabled.

affects: >=0.0.0

Errors

Common errors & fixes

Cannot find module 'graphile-sql-expression-validator'

Missing npm install or wrong version.

fix

Run npm install graphile-sql-expression-validator@^2.14.0

TypeError: graphile_sql_expression_validator_1.default is not a function

Using default import with named export.

fix

Change to import { makeNodeValidatorPlugin } from 'graphile-sql-expression-validator'

SQLValidatorFactory is not exported from graphile-sql-expression-validator

Renamed in v2.

fix

Use NODE_VALIDATOR_FACTORY instead.

require() of ES Module not supported

ESM-only package required with CommonJS.

fix

Use import statements or set type: module in package.json.

Upgrade

Version history

2.14.0latest on npm

Audit

Dependencies

grafastrequiredpeer dependency — provides grafast execution runtime

graphile-buildrequiredpeer dependency — provides Graphile schema build

graphile-build-pgrequiredpeer dependency — provides PostgreSQL schema generation

graphile-configrequiredpeer dependency — configuration framework

graphqlrequiredpeer dependency — GraphQL runtime (v16)

Agent activity

15 hits · last 30 days

node

Amazon

Resources

githubhttps://github.com/constructive-io/constructive ↗

packagegraphile-sql-expression-validator ↗

homepagehttps://github.com/constructive-io/constructive ↗