{"id":42804,"library":"graphile-sql-expression-validator","title":"Graphile SQL Expression Validator","description":"PostGraphile v5 plugin for validating SQL expressions before they reach the database. v2.14.0 — stable release with weekly updates. Enforces whitelist allow/block rules on SQL AST nodes, preventing SQL injection and unsafe queries in PostGraphile schemas. Differentiator: works at the AST level (not text regex) for precise, composable security rules; integrates with grafast and graphile-build-pg execution pipeline.","status":"active","version":"2.14.0","language":"javascript","source_language":"en","source_url":"https://github.com/constructive-io/constructive","tags":["javascript","postgraphile","graphile","constructive","pgpm","plugin","postgres","graphql","sql","typescript"],"install":[{"cmd":"npm install graphile-sql-expression-validator","lang":"bash","label":"npm"},{"cmd":"yarn add graphile-sql-expression-validator","lang":"bash","label":"yarn"},{"cmd":"pnpm add graphile-sql-expression-validator","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"peer dependency — provides grafast execution runtime","package":"grafast","optional":false},{"reason":"peer dependency — provides Graphile schema build","package":"graphile-build","optional":false},{"reason":"peer dependency — provides PostgreSQL schema generation","package":"graphile-build-pg","optional":false},{"reason":"peer dependency — configuration framework","package":"graphile-config","optional":false},{"reason":"peer dependency — GraphQL runtime (v16)","package":"graphql","optional":false}],"imports":[{"note":"Named export, not default. Requires ESM.","wrong":"import NODE_VALIDATOR_FACTORY from 'graphile-sql-expression-validator'","symbol":"NODE_VALIDATOR_FACTORY","correct":"import { NODE_VALIDATOR_FACTORY } from 'graphile-sql-expression-validator'"},{"note":"ESM-only package — do not use require().","wrong":"const { makeNodeValidatorPlugin } = require('graphile-sql-expression-validator')","symbol":"makeNodeValidatorPlugin","correct":"import { makeNodeValidatorPlugin } from 'graphile-sql-expression-validator'"},{"note":"TypeScript type export — use import type.","wrong":null,"symbol":"Plugin","correct":"import type { Plugin } from 'graphile-sql-expression-validator'"},{"note":"SQLValidatorConfig is a type, not a value. Use import type.","wrong":"import { SQLValidatorConfig } from 'graphile-sql-expression-validator'","symbol":"SQLValidatorConfig","correct":"import type { SQLValidatorConfig } from 'graphile-sql-expression-validator'"}],"quickstart":{"code":"import { makeNodeValidatorPlugin, NODE_VALIDATOR_FACTORY } from 'graphile-sql-expression-validator';\n// Define a whitelist: only allow specific SQL expressions\nconst whitelistPlugin = makeNodeValidatorPlugin({\n  [NODE_VALIDATOR_FACTORY]: {\n    // Allow only SELECT statements\n    select: true,\n    // Block DELETE statements explicitly\n    delete: false,\n  },\n});\n// Use with PostGraphile\nimport { postgraphile } from 'postgraphile';\npostgraphile(pool, 'public', {\n  plugins: [whitelistPlugin],\n});","lang":"typescript","description":"Creates a PostGraphile plugin that whitelists SQL expression types, blocking DELETE statements and only allowing SELECT."},"warnings":[{"fix":"Upgrade PostGraphile to v5 and install peer dependencies grafast@1.0.2, graphile-build@5.0.2, graphile-build-pg@5.0.2, graphile-config@1.0.1, graphql@16.13.0.","message":"v2.x drops support for PostGraphile v4 — requires PostGraphile v5 and peer deps grafast/graphile-build-pg v5.x.","severity":"breaking","affected_versions":">=2.0.0"},{"fix":"Convert to ESM (use import/export) or use dynamic import().","message":"ESM-only since v2 — CommonJS require() fails.","severity":"breaking","affected_versions":">=2.0.0"},{"fix":"Replace SQLValidatorFactory with NODE_VALIDATOR_FACTORY in makeNodeValidatorPlugin config.","message":"v1 API using SQLValidatorFactory is deprecated. Use NODE_VALIDATOR_FACTORY in v2.","severity":"deprecated","affected_versions":">=2.0.0"},{"fix":"If per-resolver rules are needed, consider using PostGraphile's makeExtendSchemaPlugin with custom validation logic.","message":"Plugin configuration applied globally — rules cannot be scoped per-resolver. All SQL expressions across all resolvers are validated by the same config.","severity":"gotcha","affected_versions":">=0.0.0"},{"fix":"Ensure parameterized queries are used and that grafast's value escaping is enabled.","message":"NODE_VALIDATOR_FACTORY only validates expression node types, not parameterized values. SQL injection via values may still be possible if other layers are misconfigured.","severity":"gotcha","affected_versions":">=0.0.0"}],"env_vars":null,"search_vec":"'allow/block':25 'ast':29,44 'build':60 'compos':51 'construct':67 'databas':16 'differenti':40 'enforc':23 'execut':62 'express':3,11 'grafast':56 'graphil':1,59,66 'graphile-build-pg':58 'graphql':71 'inject':33 'integr':54 'javascript':64 'level':45 'node':30 'pg':61 'pgpm':68 'pipelin':63 'plugin':7,69 'postgr':70 'postgraphil':5,38,65 'precis':50 'prevent':31 'queri':36 'reach':14 'regex':48 'releas':19 'rule':26,53 'schema':39 'secur':52 'sql':2,10,28,32,72 'stabl':18 'text':47 'typescript':73 'unsaf':35 'updat':22 'v2.14.0':17 'v5':6 'valid':4,9 'week':21 'whitelist':24 'work':41","created_at":"2026-06-05T16:56:44.432393+00:00","updated_at":"2026-06-05T16:56:44.432393+00:00","problems":[{"fix":"Run npm install graphile-sql-expression-validator@^2.14.0","cause":"Missing npm install or wrong version.","error":"Cannot find module 'graphile-sql-expression-validator'"},{"fix":"Change to import { makeNodeValidatorPlugin } from 'graphile-sql-expression-validator'","cause":"Using default import with named export.","error":"TypeError: graphile_sql_expression_validator_1.default is not a function"},{"fix":"Use NODE_VALIDATOR_FACTORY instead.","cause":"Renamed in v2.","error":"SQLValidatorFactory is not exported from graphile-sql-expression-validator"},{"fix":"Use import statements or set type: module in package.json.","cause":"ESM-only package required with CommonJS.","error":"require() of ES Module not supported"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/constructive-io/constructive","github":"https://github.com/constructive-io/constructive","docs":null,"changelog":null,"pypi":null,"npm":"graphile-sql-expression-validator","openapi_spec":null,"status_page":null,"smithery":null,"categories":["database","security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-05","next_check":"2026-09-03","install_tag":null}}