{"id":47910,"library":"graphql-no-alias","title":"graphql-no-alias","description":"GraphQL directive and validation library to limit alias fields on queries and mutations, preventing batch attacks. Current stable version is 3.0.3, actively maintained with regular releases. It provides a @noAlias directive that can be applied to GraphQL types or fields, with customizable alias limits. Key differentiators: supports both schema directive and imperative configuration, includes error message customization, and offers an optional Envelop plugin for integration with Envelop-based servers. Requires graphql ^16.2.0.","status":"active","version":"3.0.3","language":"javascript","source_language":"en","source_url":"https://github.com/ivandotv/graphql-no-alias","tags":["javascript","graphql","graphql directive","graphql validation","graphql alias","graphql query alias","graphql mutation alias","typescript"],"install":[{"cmd":"npm install graphql-no-alias","lang":"bash","label":"npm"},{"cmd":"yarn add graphql-no-alias","lang":"bash","label":"yarn"},{"cmd":"pnpm add graphql-no-alias","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"Peer dependency required for GraphQL schema and validation integration","package":"graphql","optional":true}],"imports":[{"note":"ESM-only since v3; CommonJS require must use .default or import from 'graphql-no-alias/cjs'","wrong":"const createValidation = require('graphql-no-alias')","symbol":"createValidation","correct":"import { createValidation } from 'graphql-no-alias'"},{"note":"typeDefs is a string returned from createValidation(), not a direct export","wrong":"import { typeDefs } from 'graphql-no-alias'","symbol":"typeDefs","correct":"const { typeDefs } = createValidation()"},{"note":"validation is a function returned from createValidation(), not a direct export","wrong":"import { validation } from 'graphql-no-alias'","symbol":"validation","correct":"const { validation } = createValidation()"}],"quickstart":{"code":"import { createValidation } from 'graphql-no-alias';\nimport { buildSchema, graphqlSync } from 'graphql';\n\nconst { typeDefs, validation } = createValidation();\n\nconst schema = buildSchema(`\n  ${typeDefs}\n  type Query {\n    hello: String\n  }\n  type Mutation @noAlias {\n    setMessage(msg: String): String\n  }\n`);\n\nconst result = graphqlSync({\n  schema,\n  source: `\n    mutation {\n      a: setMessage(msg: \"a\")\n      b: setMessage(msg: \"b\")\n    }\n  `,\n  validationRules: [validation]\n});\n\nconsole.log(result.errors?.[0]?.message); // 'You have exceeded the alias limit...'","lang":"typescript","description":"Shows basic setup with @noAlias directive on Mutation type, limiting aliases to 1. Demonstrates schema construction and validation rule integration."},"warnings":[{"fix":"Use import() or switch to ES modules. If CJS required, use require('graphql-no-alias/cjs').","message":"Switched to ESM-only in v3. CommonJS users must use dynamic import or the /cjs entry point.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"Always specify 'allow' explicitly to avoid confusion. Example: @noAlias(allow: 2)","message":"The 'allow' parameter in @noAlias sets the default number of allowed aliases, but if applied on a field, it overrides the type-level default. Without 'allow', the default is 1.","severity":"gotcha","affected_versions":"*"},{"fix":"Call createValidation({ fieldConfig: ... }) with proper configuration per field or type.","message":"If using imperative configuration (no directive in schema), you must call createValidation with options, otherwise no aliases are restricted.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Migrate to imperative configuration for improved performance. See README examples.","message":"The imperative configuration approach (createValidation with options) is preferred over schema directives for better performance. Directive support remains for compatibility.","severity":"deprecated","affected_versions":">=2.0.0"}],"env_vars":null,"search_vec":"'16.2.0':77 '3.0.3':25 'activ':26 'alia':4,12,47,85,88,91 'appli':39 'attack':20 'base':73 'batch':19 'configur':57 'current':21 'custom':61 'customiz':46 'differenti':50 'direct':6,35,54,81 'envelop':66,72 'envelop-bas':71 'error':59 'field':13,44 'graphql':2,5,41,76,79,80,82,84,86,89 'graphql-no-alia':1 'imper':56 'includ':58 'integr':69 'javascript':78 'key':49 'librari':9 'limit':11,48 'maintain':27 'messag':60 'mutat':17,90 'noalia':34 'offer':63 'option':65 'plugin':67 'prevent':18 'provid':32 'queri':15,87 'regular':29 'releas':30 'requir':75 'schema':53 'server':74 'stabl':22 'support':51 'type':42 'typescript':92 'valid':8,83 'version':23","created_at":"2026-06-07T16:53:57.859479+00:00","updated_at":"2026-06-07T16:53:57.859479+00:00","problems":[{"fix":"Reduce number of aliases or increase the 'allow' value in @noAlias directive or imperative config.","cause":"Too many aliases used on a single field beyond the configured limit.","error":"Error: You have exceeded the alias limit for this field."},{"fix":"Use import { createValidation } from 'graphql-no-alias' (ESM) or const { createValidation } = require('graphql-no-alias/cjs').","cause":"Incorrect import when using CommonJS require without .default or without /cjs entry point.","error":"TypeError: createValidation is not a function"},{"fix":"Ensure you interpolate ${typeDefs} into your schema string before building it.","cause":"Missing typeDefs from createValidation() in the schema.","error":"GraphQLError: Unknown directive '@noAlias'"},{"fix":"Apply @noAlias only on Query, Mutation, or their fields, and ensure schema defines them as root types.","cause":"Using @noAlias on a type without making it a root type (Query/Mutation) or missing root type.","error":"Validation failed: Query root type must be provided."}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/ivandotv/graphql-no-alias#readme","github":"https://github.com/ivandotv/graphql-no-alias","docs":null,"changelog":null,"pypi":null,"npm":"graphql-no-alias","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-07","next_check":"2026-09-05","install_tag":null}}