testland/graphql-yoga-tests
Tests a GraphQL Yoga server (the-guild.dev runtime) with `yoga.fetch()` for in-process, no-network request simulation of queries and mutations, `@graphql-tools/executor-http` for subscription and incremental-delivery (streaming) tests, auth-header pass-through, and production-config gates for disabled introspection and persisted operations. Use to test a GraphQL Yoga server, write Yoga query, mutation, or subscription tests, or check its production plugin config; for a different runtime harness use apollo-server-tests, mercurius-tests, or hasura-tests instead, not this skill.
75
94%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Passed
No findings from the security scan
production-config-tests.mdreferences/
Production-config tests
Mirror the production plugin set in test so prod-only gates are exercised. Run these
under NODE_ENV=production in CI.
Introspection disabled
Per introspection-attack-surface-reference:
import { useDisableIntrospection } from '@graphql-yoga/plugin-disable-introspection';
test('introspection disabled', async () => {
const yoga = createYoga({
schema,
plugins: [useDisableIntrospection()],
});
const resp = await yoga.fetch('http://yoga/graphql', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ query: '{ __schema { types { name } } }' }),
});
const result = await resp.json();
expect(result.errors).toBeDefined();
expect(result.errors[0].message).toMatch(/introspection/i);
});Persisted-operations test
Per persisted-query-strategy-reference Mode 2:
import { usePersistedOperations } from '@graphql-yoga/plugin-persisted-operations';
const operations = {
'abcdef': '{ greetings }',
};
test('rejects unregistered hash in strict mode', async () => {
const yoga = createYoga({
schema,
plugins: [
usePersistedOperations({
getPersistedOperation: (key) => operations[key],
}),
],
});
const resp = await yoga.fetch('http://yoga/graphql', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
extensions: {
persistedQuery: { version: 1, sha256Hash: 'unknown' },
},
}),
});
expect(resp.status).toBe(404); // Yoga's default for unknown
});