fix: block introspection queries in production mode

core/api.go

@@ -55,6 +55,7 @@ import (
 	_log "log"
 	"os"
 
+	"github.com/chirino/graphql"
 	"github.com/dosco/super-graph/core/internal/allow"
 	"github.com/dosco/super-graph/core/internal/crypto"
 	"github.com/dosco/super-graph/core/internal/psql"
@@ -92,6 +93,7 @@ type SuperGraph struct {
 	anonExists  bool
 	qc          *qcode.Compiler
 	pc          *psql.Compiler
+	Engine      *graphql.Engine
 }
 
 // NewSuperGraph creates the SuperGraph struct, this involves querying the database to learn its
@@ -123,6 +125,10 @@ func NewSuperGraph(conf *Config, db *sql.DB) (*SuperGraph, error) {
 		return nil, err
 	}
 
+	if err := sg.initGraphQLEgine(); err != nil {
+		return nil, err
+	}
+
 	if len(conf.SecretKey) != 0 {
 		sk := sha256.Sum256([]byte(conf.SecretKey))
 		conf.SecretKey = ""
@@ -154,7 +160,24 @@ type Result struct {
 // In developer mode all names queries are saved into a file `allow.list` and in production mode only
 // queries from this file can be run.
 func (sg *SuperGraph) GraphQL(c context.Context, query string, vars json.RawMessage) (*Result, error) {
-	ct := scontext{Context: c, sg: sg, query: query, vars: vars}
+	var res Result
+
+	res.op = qcode.GetQType(query)
+	res.name = allow.QueryName(query)
+
+	// use the chirino/graphql library for introspection queries
+	// disabled when allow list is enforced
+	if !sg.conf.UseAllowList &&
+		res.op == qcode.QTQuery &&
+		res.name == "IntrospectionQuery" {
+
+		r := sg.Engine.ExecuteOne(&graphql.EngineRequest{Query: query})
+		res.Data = r.Data
+
+		return &res, r.Error()
+	}
+
+	ct := scontext{Context: c, sg: sg, query: query, vars: vars, res: res}
 
 	if len(vars) <= 2 {
 		ct.vars = nil
@@ -166,9 +189,6 @@ func (sg *SuperGraph) GraphQL(c context.Context, query string, vars json.RawMess
 		ct.role = "anon"
 	}
 
-	ct.res.op = qcode.GetQType(query)
-	ct.res.name = allow.QueryName(query)
-
 	data, err := ct.execQuery()
 	if err != nil {
 		return &ct.res, err

core/core.go

@@ -94,15 +94,12 @@ func (c *scontext) execQuery() ([]byte, error) {
 
 	if c.sg.conf.UseAllowList {
 		data, st, err = c.resolvePreparedSQL()
-		if err != nil {
-			return nil, err
-		}
-
 	} else {
 		data, st, err = c.resolveSQL()
-		if err != nil {
-			return nil, err
-		}
+	}
+
+	if err != nil {
+		return nil, err
 	}
 
 	if len(data) == 0 || st.skipped == 0 {

core/graph-schema.go

@@ -0,0 +1,174 @@
+package core
+
+import (
+	"strings"
+
+	"github.com/chirino/graphql"
+	"github.com/chirino/graphql/resolvers"
+	"github.com/chirino/graphql/schema"
+	"github.com/dosco/super-graph/core/internal/psql"
+)
+
+var typeMap map[string]string = map[string]string{
+	"smallint":         "Int",
+	"integer":          "Int",
+	"bigint":           "Int",
+	"smallserial":      "Int",
+	"serial":           "Int",
+	"bigserial":        "Int",
+	"decimal":          "Float",
+	"numeric":          "Float",
+	"real":             "Float",
+	"double precision": "Float",
+	"money":            "Float",
+	"boolean":          "Boolean",
+}
+
+func (sg *SuperGraph) initGraphQLEgine() error {
+	sg.Engine = graphql.New()
+	engineSchema := sg.Engine.Schema
+	dbSchema := sg.schema
+
+	sanitizeForGraphQLSchema := func(value string) string {
+		// TODO:
+		return value
+	}
+
+	gqltype := func(col psql.DBColumn) schema.Type {
+		typeName := typeMap[strings.ToLower(col.Type)]
+		if typeName == "" {
+			typeName = "String"
+		}
+		var t schema.Type = &schema.TypeName{Ident: schema.Ident{Text: typeName}}
+		if col.NotNull {
+			t = &schema.NonNull{OfType: t}
+		}
+		return t
+	}
+
+	query := &schema.Object{
+		Name:   "Query",
+		Fields: schema.FieldList{},
+	}
+	mutation := &schema.Object{
+		Name:   "Mutation",
+		Fields: schema.FieldList{},
+	}
+	engineSchema.Types[query.Name] = query
+	engineSchema.Types[mutation.Name] = mutation
+	engineSchema.EntryPoints[schema.Query] = query
+	engineSchema.EntryPoints[schema.Mutation] = mutation
+
+	tableNames := dbSchema.GetTableNames()
+	for _, table := range tableNames {
+
+		ti, err := dbSchema.GetTable(table)
+		if err != nil {
+			return err
+		}
+
+		if !ti.IsSingular {
+			continue
+		}
+
+		pti, err := dbSchema.GetTable(ti.Plural)
+		if err != nil {
+			return err
+		}
+
+		outputType := &schema.Object{
+			Name:   sanitizeForGraphQLSchema(ti.Singular) + "Output",
+			Fields: schema.FieldList{},
+		}
+
+		inputType := &schema.InputObject{
+			Name:   sanitizeForGraphQLSchema(ti.Singular) + "Input",
+			Fields: schema.InputValueList{},
+		}
+
+		for _, col := range ti.Columns {
+			outputType.Fields = append(outputType.Fields, &schema.Field{
+				Name: sanitizeForGraphQLSchema(col.Name),
+				Type: gqltype(col),
+			})
+			inputType.Fields = append(inputType.Fields, &schema.InputValue{
+				Name: schema.Ident{Text: sanitizeForGraphQLSchema(col.Name)},
+				Type: gqltype(col),
+			})
+		}
+
+		engineSchema.Types[outputType.Name] = outputType
+		engineSchema.Types[inputType.Name] = inputType
+
+		outputTypeName := &schema.TypeName{Ident: schema.Ident{Text: outputType.Name}}
+		inputTypeName := &schema.TypeName{Ident: schema.Ident{Text: inputType.Name}}
+		pluralOutputTypeName := &schema.NonNull{OfType: &schema.List{OfType: &schema.NonNull{OfType: &schema.TypeName{Ident: schema.Ident{Text: outputType.Name}}}}}
+		pluralInputTypeName := &schema.NonNull{OfType: &schema.List{OfType: &schema.NonNull{OfType: &schema.TypeName{Ident: schema.Ident{Text: inputType.Name}}}}}
+
+		args := schema.InputValueList{}
+		if ti.PrimaryCol != nil {
+			t := gqltype(*ti.PrimaryCol)
+			if _, ok := t.(*schema.NonNull); !ok {
+				t = &schema.NonNull{OfType: t}
+			}
+			arg := &schema.InputValue{
+				Name: schema.Ident{Text: "id"},
+				Type: t,
+			}
+			args = append(args, arg)
+		}
+
+		query.Fields = append(query.Fields, &schema.Field{
+			Name: sanitizeForGraphQLSchema(ti.Singular),
+			Type: outputTypeName,
+			Args: args,
+		})
+		query.Fields = append(query.Fields, &schema.Field{
+			Name: sanitizeForGraphQLSchema(pti.Plural),
+			Type: pluralOutputTypeName,
+			Args: args,
+		})
+
+		mutation.Fields = append(mutation.Fields, &schema.Field{
+			Name: sanitizeForGraphQLSchema(ti.Singular),
+			Args: append(args, schema.InputValueList{
+				&schema.InputValue{
+					Name: schema.Ident{Text: "insert"},
+					Type: inputTypeName,
+				},
+				&schema.InputValue{
+					Name: schema.Ident{Text: "inserts"},
+					Type: pluralInputTypeName,
+				},
+				&schema.InputValue{
+					Name: schema.Ident{Text: "update"},
+					Type: inputTypeName,
+				},
+				&schema.InputValue{
+					Name: schema.Ident{Text: "updates"},
+					Type: pluralInputTypeName,
+				},
+			}...),
+			Type: outputType,
+		})
+
+	}
+	err := engineSchema.ResolveTypes()
+	if err != nil {
+		return err
+	}
+
+	sg.Engine.Resolver = resolvers.Func(func(request *resolvers.ResolveRequest, next resolvers.Resolution) resolvers.Resolution {
+		resolver := resolvers.MetadataResolver.Resolve(request, next)
+		if resolver != nil {
+			return resolver
+		}
+		resolver = resolvers.MethodResolver.Resolve(request, next) // needed by the MetadataResolver
+		if resolver != nil {
+			return resolver
+		}
+
+		return nil
+	})
+	return nil
+}

core/internal/integration_tests/integration_tests.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/dosco/super-graph/core"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -90,6 +91,15 @@ func TestSuperGraph(t *testing.T, db *sql.DB, before func(t *testing.T)) {
 		require.Equal(t, `{"line_items": [{"id": 5001}, {"id": 5002}]}`, string(res.Data))
 	})
 
+	t.Run("get line item", func(t *testing.T) {
+		before(t)
+		res, err := sg.GraphQL(ctx,
+			`query { line_item(id:$id) { id, price, quantity } }`,
+			json.RawMessage(`{"id":5001}`))
+		require.NoError(t, err, res.SQL())
+		require.Equal(t, `{"line_item": {"id": 5001, "price": 6.95, "quantity": 10}}`, string(res.Data))
+	})
+
 	t.Run("get line items", func(t *testing.T) {
 		before(t)
 		res, err := sg.GraphQL(ctx,
@@ -140,4 +150,154 @@ func TestSuperGraph(t *testing.T, db *sql.DB, before func(t *testing.T)) {
 		require.Equal(t, `{"line_items": [{"id": 5003, "product": {"name": "Charmin Ultra Soft"}}]}`, string(res.Data))
 	})
 
+	t.Run("schema introspection", func(t *testing.T) {
+		before(t)
+		// fmt.Println(sg.Engine.Schema.String())
+		assert.Equal(t, `type Mutation {
+  line_item(id:Int!, insert:line_itemInput, inserts:[line_itemInput!]!, update:line_itemInput, updates:[line_itemInput!]!):line_itemOutput
+  product(id:Int!, insert:productInput, inserts:[productInput!]!, update:productInput, updates:[productInput!]!):productOutput
+  user(id:Int!, insert:userInput, inserts:[userInput!]!, update:userInput, updates:[userInput!]!):userOutput
 }
+type Query {
+  line_item(id:Int!):line_itemOutput
+  line_items(id:Int!):[line_itemOutput!]!
+  product(id:Int!):productOutput
+  products(id:Int!):[productOutput!]!
+  user(id:Int!):userOutput
+  users(id:Int!):[userOutput!]!
+}
+input line_itemInput {
+  id:Int!
+  price:Float
+  product:Int
+  quantity:Int
+}
+type line_itemOutput {
+  id:Int!
+  price:Float
+  product:Int
+  quantity:Int
+}
+input productInput {
+  id:Int!
+  name:String
+  weight:Float
+}
+type productOutput {
+  id:Int!
+  name:String
+  weight:Float
+}
+input userInput {
+  full_name:String
+  id:Int!
+}
+type userOutput {
+  full_name:String
+  id:Int!
+}
+schema {
+  mutation: Mutation
+  query: Query
+}
+`, sg.Engine.Schema.String())
+	})
+
+	res, err := sg.GraphQL(ctx,introspectionQuery, json.RawMessage(``))
+	assert.NoError(t, err)
+	assert.Contains(t, string(res.Data),
+		`{"queryType":{"name":"Query"},"mutationType":{"name":"Mutation"},"subscriptionType":null,"types":`)
+	assert.Contains(t, string(res.Data),
+		`{"kind":"OBJECT","name":"Mutation","description":null,"fields":[{"name":"line_item","description":null`)
+}
+
+const introspectionQuery = `
+ query {
+   __schema {
+     queryType { name }
+     mutationType { name }
+     subscriptionType { name }
+     types {
+       ...FullType
+     }
+     directives {
+       name
+       description
+       locations
+       args {
+         ...InputValue
+       }
+     }
+   }
+ }
+ fragment FullType on __Type {
+   kind
+   name
+   description
+   fields(includeDeprecated: true) {
+     name
+     description
+     args {
+       ...InputValue
+     }
+     type {
+       ...TypeRef
+     }
+     isDeprecated
+     deprecationReason
+   }
+   inputFields {
+     ...InputValue
+   }
+   interfaces {
+     ...TypeRef
+   }
+   enumValues(includeDeprecated: true) {
+     name
+     description
+     isDeprecated
+     deprecationReason
+   }
+   possibleTypes {
+     ...TypeRef
+   }
+ }
+ fragment InputValue on __InputValue {
+   name
+   description
+   type { ...TypeRef }
+   defaultValue
+ }
+ fragment TypeRef on __Type {
+   kind
+   name
+   ofType {
+     kind
+     name
+     ofType {
+       kind
+       name
+       ofType {
+         kind
+         name
+         ofType {
+           kind
+           name
+           ofType {
+             kind
+             name
+             ofType {
+               kind
+               name
+               ofType {
+                 kind
+                 name
+               }
+             }
+           }
+         }
+       }
+     }
+   }
+ }
+`

core/internal/psql/query.go

@@ -141,7 +141,7 @@ func (co *Compiler) compileQuery(qc *qcode.QCode, w io.Writer, vars Variables) (
 				c.renderLateralJoin(sel)
 			}
 
-			if !ti.Singular {
+			if !ti.IsSingular {
 				c.renderPluralSelect(sel, ti)
 			}
 
@@ -178,7 +178,7 @@ func (co *Compiler) compileQuery(qc *qcode.QCode, w io.Writer, vars Variables) (
 			io.WriteString(c.w, `)`)
 			aliasWithID(c.w, "__sj", sel.ID)
 
-			if !ti.Singular {
+			if !ti.IsSingular {
 				io.WriteString(c.w, `)`)
 				aliasWithID(c.w, "__sj", sel.ID)
 			}
@@ -706,7 +706,7 @@ func (c *compilerContext) renderBaseSelect(sel *qcode.Select, ti *DBTableInfo, r
 	}
 
 	switch {
-	case ti.Singular:
+	case ti.IsSingular:
 		io.WriteString(c.w, ` LIMIT ('1') :: integer`)
 
 	case len(sel.Paging.Limit) != 0:

core/internal/psql/schema.go

@@ -16,12 +16,14 @@ type DBSchema struct {
 type DBTableInfo struct {
 	Name       string
 	Type       string
-	Singular   bool
+	IsSingular bool
 	Columns    []DBColumn
 	PrimaryCol *DBColumn
 	TSVCol     *DBColumn
 	ColMap     map[string]*DBColumn
 	ColIDMap   map[int16]*DBColumn
+	Singular   string
+	Plural     string
 }
 
 type RelType int
@@ -89,23 +91,28 @@ func (s *DBSchema) addTable(
 	colidmap := make(map[int16]*DBColumn, len(cols))
 
 	singular := flect.Singularize(t.Key)
+	plural := flect.Pluralize(t.Key)
+
 	s.t[singular] = &DBTableInfo{
-		Name:     t.Name,
-		Type:     t.Type,
-		Singular: true,
-		Columns:  cols,
-		ColMap:   colmap,
-		ColIDMap: colidmap,
+		Name:       t.Name,
+		Type:       t.Type,
+		IsSingular: true,
+		Columns:    cols,
+		ColMap:     colmap,
+		ColIDMap:   colidmap,
+		Singular:   singular,
+		Plural:     plural,
 	}
 
-	plural := flect.Pluralize(t.Key)
 	s.t[plural] = &DBTableInfo{
-		Name:     t.Name,
-		Type:     t.Type,
-		Singular: false,
-		Columns:  cols,
-		ColMap:   colmap,
-		ColIDMap: colidmap,
+		Name:       t.Name,
+		Type:       t.Type,
+		IsSingular: false,
+		Columns:    cols,
+		ColMap:     colmap,
+		ColIDMap:   colidmap,
+		Singular:   singular,
+		Plural:     plural,
 	}
 
 	if al, ok := aliases[t.Key]; ok {
@@ -364,6 +371,14 @@ func (s *DBSchema) updateSchemaOTMT(
 	return nil
 }
 
+func (s *DBSchema) GetTableNames() []string {
+	var names []string
+	for name, _ := range s.t {
+		names = append(names, name)
+	}
+	return names
+}
+
 func (s *DBSchema) GetTable(table string) (*DBTableInfo, error) {
 	t, ok := s.t[table]
 	if !ok {

core/internal/psql/tests.sql

@@ -1,45 +1,3 @@
-?   	github.com/dosco/super-graph	[no test files]
-testing: warning: no tests to run
-PASS
-ok  	github.com/dosco/super-graph/core	0.025s [no tests to run]
-=== RUN   TestGQLName1
---- PASS: TestGQLName1 (0.00s)
-=== RUN   TestGQLName2
---- PASS: TestGQLName2 (0.00s)
-=== RUN   TestGQLName3
---- PASS: TestGQLName3 (0.00s)
-=== RUN   TestGQLName4
---- PASS: TestGQLName4 (0.00s)
-=== RUN   TestGQLName5
---- PASS: TestGQLName5 (0.00s)
-=== RUN   TestFuzzCrashers
---- PASS: TestFuzzCrashers (0.00s)
-PASS
-ok  	github.com/dosco/super-graph/core/internal/allow	0.010s
-?   	github.com/dosco/super-graph/core/internal/crypto	[no test files]
-?   	github.com/dosco/super-graph/core/internal/integration_tests	[no test files]
-=== RUN   TestCockroachDB
-started temporary cockroach db
-=== RUN   TestCockroachDB/seed_fixtures
-=== RUN   TestCockroachDB/get_line_items
-=== RUN   TestCockroachDB/update_line_item
-=== RUN   TestCockroachDB/delete_line_item
-=== RUN   TestCockroachDB/nested_insert
-stopping temporary cockroach db
---- PASS: TestCockroachDB (0.85s)
-    --- PASS: TestCockroachDB/seed_fixtures (0.01s)
-    --- PASS: TestCockroachDB/get_line_items (0.00s)
-    --- PASS: TestCockroachDB/update_line_item (0.00s)
-    --- PASS: TestCockroachDB/delete_line_item (0.00s)
-    --- SKIP: TestCockroachDB/nested_insert (0.00s)
-        cockroachdb_test.go:61: nested inserts currently not working yet on cockroach db
-PASS
-ok  	github.com/dosco/super-graph/core/internal/integration_tests/cockroachdb	0.872s
-=== RUN   TestCockroachDB
---- SKIP: TestCockroachDB (0.00s)
-    postgresql_test.go:17: set the SG_POSTGRESQL_TEST_URL env variable if you want to run integration tests against a PostgreSQL database
-PASS
-ok  	github.com/dosco/super-graph/core/internal/integration_tests/postgresql	0.015s
 === RUN   TestCompileInsert
 === RUN   TestCompileInsert/simpleInsert
 WITH "_sg_input" AS (SELECT '{{data}}' :: json AS j), "users" AS (INSERT INTO "users" ("full_name", "email") SELECT CAST( i.j ->>'full_name' AS character varying), CAST( i.j ->>'email' AS character varying) FROM "_sg_input" i RETURNING *) SELECT jsonb_build_object('user', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "users_0"."id" AS "id" FROM (SELECT "users"."id" FROM "users" LIMIT ('1') :: integer) AS "users_0") AS "__sr_0") AS "__sj_0"
@@ -62,17 +20,17 @@ WITH "_sg_input" AS (SELECT '{{data}}' :: json AS j), "users" AS (INSERT INTO "u
 WITH "_sg_input" AS (SELECT '{{data}}' :: json AS j), "_x_users" AS (SELECT "id" FROM "_sg_input" i,"users" WHERE "users"."id"= ((i.j->'user'->'connect'->>'id'))::bigint LIMIT 1), "products" AS (INSERT INTO "products" ("name", "price", "created_at", "updated_at", "user_id") SELECT CAST( i.j ->>'name' AS character varying), CAST( i.j ->>'price' AS numeric(7,2)), CAST( i.j ->>'created_at' AS timestamp without time zone), CAST( i.j ->>'updated_at' AS timestamp without time zone), "_x_users"."id" FROM "_sg_input" i, "_x_users" RETURNING *) SELECT jsonb_build_object('product', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "products_0"."id" AS "id", "products_0"."name" AS "name", "__sj_1"."json" AS "user", "__sj_2"."json" AS "tags" FROM (SELECT "products"."id", "products"."name", "products"."user_id", "products"."tags" FROM "products" LIMIT ('1') :: integer) AS "products_0" LEFT OUTER JOIN LATERAL (SELECT coalesce(jsonb_agg("__sj_2"."json"), '[]') as "json" FROM (SELECT to_jsonb("__sr_2".*) AS "json"FROM (SELECT "tags_2"."id" AS "id", "tags_2"."name" AS "name" FROM (SELECT "tags"."id", "tags"."name" FROM "tags" WHERE ((("tags"."slug") = any ("products_0"."tags"))) LIMIT ('20') :: integer) AS "tags_2") AS "__sr_2") AS "__sj_2") AS "__sj_2" ON ('true') LEFT OUTER JOIN LATERAL (SELECT to_jsonb("__sr_1".*) AS "json"FROM (SELECT "users_1"."id" AS "id", "users_1"."full_name" AS "full_name", "users_1"."email" AS "email" FROM (SELECT "users"."id", "users"."full_name", "users"."email" FROM "users" WHERE ((("users"."id") = ("products_0"."user_id"))) LIMIT ('1') :: integer) AS "users_1") AS "__sr_1") AS "__sj_1" ON ('true')) AS "__sr_0") AS "__sj_0"
 === RUN   TestCompileInsert/nestedInsertOneToOneWithConnectArray
 WITH "_sg_input" AS (SELECT '{{data}}' :: json AS j), "_x_users" AS (SELECT "id" FROM "_sg_input" i,"users" WHERE "users"."id" = ANY((select a::bigint AS list from json_array_elements_text((i.j->'user'->'connect'->>'id')::json) AS a)) LIMIT 1), "products" AS (INSERT INTO "products" ("name", "price", "created_at", "updated_at", "user_id") SELECT CAST( i.j ->>'name' AS character varying), CAST( i.j ->>'price' AS numeric(7,2)), CAST( i.j ->>'created_at' AS timestamp without time zone), CAST( i.j ->>'updated_at' AS timestamp without time zone), "_x_users"."id" FROM "_sg_input" i, "_x_users" RETURNING *) SELECT jsonb_build_object('product', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "products_0"."id" AS "id", "products_0"."name" AS "name", "__sj_1"."json" AS "user" FROM (SELECT "products"."id", "products"."name", "products"."user_id" FROM "products" LIMIT ('1') :: integer) AS "products_0" LEFT OUTER JOIN LATERAL (SELECT to_jsonb("__sr_1".*) AS "json"FROM (SELECT "users_1"."id" AS "id", "users_1"."full_name" AS "full_name", "users_1"."email" AS "email" FROM (SELECT "users"."id", "users"."full_name", "users"."email" FROM "users" WHERE ((("users"."id") = ("products_0"."user_id"))) LIMIT ('1') :: integer) AS "users_1") AS "__sr_1") AS "__sj_1" ON ('true')) AS "__sr_0") AS "__sj_0"
---- PASS: TestCompileInsert (0.04s)
+--- PASS: TestCompileInsert (0.02s)
     --- PASS: TestCompileInsert/simpleInsert (0.00s)
     --- PASS: TestCompileInsert/singleInsert (0.00s)
     --- PASS: TestCompileInsert/bulkInsert (0.00s)
     --- PASS: TestCompileInsert/simpleInsertWithPresets (0.00s)
-    --- PASS: TestCompileInsert/nestedInsertManyToMany (0.01s)
-    --- PASS: TestCompileInsert/nestedInsertOneToMany (0.01s)
+    --- PASS: TestCompileInsert/nestedInsertManyToMany (0.00s)
+    --- PASS: TestCompileInsert/nestedInsertOneToMany (0.00s)
     --- PASS: TestCompileInsert/nestedInsertOneToOne (0.00s)
     --- PASS: TestCompileInsert/nestedInsertOneToManyWithConnect (0.00s)
-    --- PASS: TestCompileInsert/nestedInsertOneToOneWithConnect (0.01s)
-    --- PASS: TestCompileInsert/nestedInsertOneToOneWithConnectArray (0.01s)
+    --- PASS: TestCompileInsert/nestedInsertOneToOneWithConnect (0.00s)
+    --- PASS: TestCompileInsert/nestedInsertOneToOneWithConnectArray (0.00s)
 === RUN   TestCompileMutate
 === RUN   TestCompileMutate/singleUpsert
 WITH "_sg_input" AS (SELECT '{{upsert}}' :: json AS j), "products" AS (INSERT INTO "products" ("name", "description") SELECT CAST( i.j ->>'name' AS character varying), CAST( i.j ->>'description' AS text) FROM "_sg_input" i RETURNING *)  ON CONFLICT (id) DO UPDATE SET name = EXCLUDED.name, description = EXCLUDED.description RETURNING *) SELECT jsonb_build_object('product', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "products_0"."id" AS "id", "products_0"."name" AS "name" FROM (SELECT "products"."id", "products"."name" FROM "products" LIMIT ('1') :: integer) AS "products_0") AS "__sr_0") AS "__sj_0"
@@ -82,7 +40,7 @@ WITH "_sg_input" AS (SELECT '{{upsert}}' :: json AS j), "products" AS (INSERT IN
 WITH "_sg_input" AS (SELECT '{{upsert}}' :: json AS j), "products" AS (INSERT INTO "products" ("name", "description") SELECT CAST( i.j ->>'name' AS character varying), CAST( i.j ->>'description' AS text) FROM "_sg_input" i RETURNING *)  ON CONFLICT (id) DO UPDATE SET name = EXCLUDED.name, description = EXCLUDED.description RETURNING *) SELECT jsonb_build_object('product', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "products_0"."id" AS "id", "products_0"."name" AS "name" FROM (SELECT "products"."id", "products"."name" FROM "products" LIMIT ('1') :: integer) AS "products_0") AS "__sr_0") AS "__sj_0"
 === RUN   TestCompileMutate/delete
 WITH "products" AS (DELETE FROM "products" WHERE (((("products"."price") > '0' :: numeric(7,2)) AND (("products"."price") < '8' :: numeric(7,2))) AND (("products"."id") = '1' :: bigint)) RETURNING "products".*) SELECT jsonb_build_object('product', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "products_0"."id" AS "id", "products_0"."name" AS "name" FROM (SELECT "products"."id", "products"."name" FROM "products" LIMIT ('1') :: integer) AS "products_0") AS "__sr_0") AS "__sj_0"
---- PASS: TestCompileMutate (0.01s)
+--- PASS: TestCompileMutate (0.00s)
     --- PASS: TestCompileMutate/singleUpsert (0.00s)
     --- PASS: TestCompileMutate/singleUpsertWhere (0.00s)
     --- PASS: TestCompileMutate/bulkUpsert (0.00s)
@@ -136,7 +94,7 @@ SELECT jsonb_build_object('products', "__sj_0"."json") as "__root" FROM (SELECT
 SELECT jsonb_build_object('user', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "users_0"."id" AS "id", "users_0"."full_name" AS "full_name", "users_0"."email" AS "email" FROM (SELECT "users"."id", "users"."full_name", "users"."email" FROM "users" WHERE (false) LIMIT ('1') :: integer) AS "users_0") AS "__sr_0") AS "__sj_0"
 === RUN   TestCompileQuery/blockedFunctions
 SELECT jsonb_build_object('users', "__sj_0"."json") as "__root" FROM (SELECT coalesce(jsonb_agg("__sj_0"."json"), '[]') as "json" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "users_0"."email" AS "email" FROM (SELECT , "users"."email" FROM "users" WHERE (false) GROUP BY "users"."email" LIMIT ('20') :: integer) AS "users_0") AS "__sr_0") AS "__sj_0") AS "__sj_0"
---- PASS: TestCompileQuery (0.05s)
+--- PASS: TestCompileQuery (0.02s)
     --- PASS: TestCompileQuery/withComplexArgs (0.00s)
     --- PASS: TestCompileQuery/withWhereAndList (0.00s)
     --- PASS: TestCompileQuery/withWhereIsNull (0.00s)
@@ -155,7 +113,7 @@ SELECT jsonb_build_object('users', "__sj_0"."json") as "__root" FROM (SELECT coa
     --- PASS: TestCompileQuery/syntheticTables (0.00s)
     --- PASS: TestCompileQuery/queryWithVariables (0.00s)
     --- PASS: TestCompileQuery/withWhereOnRelations (0.00s)
-    --- PASS: TestCompileQuery/multiRoot (0.01s)
+    --- PASS: TestCompileQuery/multiRoot (0.00s)
     --- PASS: TestCompileQuery/jsonColumnAsTable (0.00s)
     --- PASS: TestCompileQuery/withCursor (0.00s)
     --- PASS: TestCompileQuery/nullForAuthRequiredInAnon (0.00s)
@@ -176,113 +134,18 @@ WITH "_sg_input" AS (SELECT '{{data}}' :: json AS j), "products" AS (UPDATE "pro
 === RUN   TestCompileUpdate/nestedUpdateOneToManyWithConnect
 WITH "_sg_input" AS (SELECT '{{data}}' :: json AS j), "users" AS (UPDATE "users" SET ("full_name", "email", "created_at", "updated_at") = (SELECT CAST( i.j ->>'full_name' AS character varying), CAST( i.j ->>'email' AS character varying), CAST( i.j ->>'created_at' AS timestamp without time zone), CAST( i.j ->>'updated_at' AS timestamp without time zone) FROM "_sg_input" i)  WHERE (("users"."id") =  '{{id}}' :: bigint) RETURNING "users".*), "products_c" AS ( UPDATE "products" SET "user_id" = "users"."id" FROM "users" WHERE ("products"."id"= ((i.j->'product'->'connect'->>'id'))::bigint) RETURNING "products".*), "products_d" AS ( UPDATE "products" SET "user_id" =  NULL FROM "users" WHERE ("products"."id"= ((i.j->'product'->'disconnect'->>'id'))::bigint) RETURNING "products".*), "products" AS (SELECT * FROM "products_c" UNION ALL SELECT * FROM "products_d") SELECT jsonb_build_object('user', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "users_0"."id" AS "id", "users_0"."full_name" AS "full_name", "users_0"."email" AS "email", "__sj_1"."json" AS "product" FROM (SELECT "users"."id", "users"."full_name", "users"."email" FROM "users" LIMIT ('1') :: integer) AS "users_0" LEFT OUTER JOIN LATERAL (SELECT to_jsonb("__sr_1".*) AS "json"FROM (SELECT "products_1"."id" AS "id", "products_1"."name" AS "name", "products_1"."price" AS "price" FROM (SELECT "products"."id", "products"."name", "products"."price" FROM "products" WHERE ((("products"."user_id") = ("users_0"."id"))) LIMIT ('1') :: integer) AS "products_1") AS "__sr_1") AS "__sj_1" ON ('true')) AS "__sr_0") AS "__sj_0"
 === RUN   TestCompileUpdate/nestedUpdateOneToOneWithConnect
-WITH "_sg_input" AS (SELECT '{{data}}' :: json AS j), "_x_users" AS (SELECT "id" FROM "_sg_input" i,"users" WHERE "users"."id"= ((i.j->'user'->'connect'->>'id'))::bigint AND "users"."email"= ((i.j->'user'->'connect'->>'email'))::character varying LIMIT 1), "products" AS (UPDATE "products" SET ("name", "price", "user_id") = (SELECT CAST( i.j ->>'name' AS character varying), CAST( i.j ->>'price' AS numeric(7,2)), "_x_users"."id" FROM "_sg_input" i", "_x_users)  WHERE (("products"."id") =  '{{product_id}}' :: bigint) RETURNING "products".*) SELECT jsonb_build_object('product', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "products_0"."id" AS "id", "products_0"."name" AS "name", "__sj_1"."json" AS "user" FROM (SELECT "products"."id", "products"."name", "products"."user_id" FROM "products" LIMIT ('1') :: integer) AS "products_0" LEFT OUTER JOIN LATERAL (SELECT to_jsonb("__sr_1".*) AS "json"FROM (SELECT "users_1"."id" AS "id", "users_1"."full_name" AS "full_name", "users_1"."email" AS "email" FROM (SELECT "users"."id", "users"."full_name", "users"."email" FROM "users" WHERE ((("users"."id") = ("products_0"."user_id"))) LIMIT ('1') :: integer) AS "users_1") AS "__sr_1") AS "__sj_1" ON ('true')) AS "__sr_0") AS "__sj_0"
-WITH "_sg_input" AS (SELECT '{{data}}' :: json AS j), "_x_users" AS (SELECT "id" FROM "_sg_input" i,"users" WHERE "users"."email"= ((i.j->'user'->'connect'->>'email'))::character varying AND "users"."id"= ((i.j->'user'->'connect'->>'id'))::bigint LIMIT 1), "products" AS (UPDATE "products" SET ("name", "price", "user_id") = (SELECT CAST( i.j ->>'name' AS character varying), CAST( i.j ->>'price' AS numeric(7,2)), "_x_users"."id" FROM "_sg_input" i", "_x_users)  WHERE (("products"."id") =  '{{product_id}}' :: bigint) RETURNING "products".*) SELECT jsonb_build_object('product', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "products_0"."id" AS "id", "products_0"."name" AS "name", "__sj_1"."json" AS "user" FROM (SELECT "products"."id", "products"."name", "products"."user_id" FROM "products" LIMIT ('1') :: integer) AS "products_0" LEFT OUTER JOIN LATERAL (SELECT to_jsonb("__sr_1".*) AS "json"FROM (SELECT "users_1"."id" AS "id", "users_1"."full_name" AS "full_name", "users_1"."email" AS "email" FROM (SELECT "users"."id", "users"."full_name", "users"."email" FROM "users" WHERE ((("users"."id") = ("products_0"."user_id"))) LIMIT ('1') :: integer) AS "users_1") AS "__sr_1") AS "__sj_1" ON ('true')) AS "__sr_0") AS "__sj_0"
+WITH "_sg_input" AS (SELECT '{{data}}' :: json AS j), "_x_users" AS (SELECT "id" FROM "_sg_input" i,"users" WHERE "users"."id"= ((i.j->'user'->'connect'->>'id'))::bigint AND "users"."email"= ((i.j->'user'->'connect'->>'email'))::character varying LIMIT 1), "products" AS (UPDATE "products" SET ("name", "price", "user_id") = (SELECT CAST( i.j ->>'name' AS character varying), CAST( i.j ->>'price' AS numeric(7,2)), "_x_users"."id" FROM "_sg_input" i, "_x_users")  WHERE (("products"."id") =  '{{product_id}}' :: bigint) RETURNING "products".*) SELECT jsonb_build_object('product', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "products_0"."id" AS "id", "products_0"."name" AS "name", "__sj_1"."json" AS "user" FROM (SELECT "products"."id", "products"."name", "products"."user_id" FROM "products" LIMIT ('1') :: integer) AS "products_0" LEFT OUTER JOIN LATERAL (SELECT to_jsonb("__sr_1".*) AS "json"FROM (SELECT "users_1"."id" AS "id", "users_1"."full_name" AS "full_name", "users_1"."email" AS "email" FROM (SELECT "users"."id", "users"."full_name", "users"."email" FROM "users" WHERE ((("users"."id") = ("products_0"."user_id"))) LIMIT ('1') :: integer) AS "users_1") AS "__sr_1") AS "__sj_1" ON ('true')) AS "__sr_0") AS "__sj_0"
+WITH "_sg_input" AS (SELECT '{{data}}' :: json AS j), "_x_users" AS (SELECT "id" FROM "_sg_input" i,"users" WHERE "users"."email"= ((i.j->'user'->'connect'->>'email'))::character varying AND "users"."id"= ((i.j->'user'->'connect'->>'id'))::bigint LIMIT 1), "products" AS (UPDATE "products" SET ("name", "price", "user_id") = (SELECT CAST( i.j ->>'name' AS character varying), CAST( i.j ->>'price' AS numeric(7,2)), "_x_users"."id" FROM "_sg_input" i, "_x_users")  WHERE (("products"."id") =  '{{product_id}}' :: bigint) RETURNING "products".*) SELECT jsonb_build_object('product', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "products_0"."id" AS "id", "products_0"."name" AS "name", "__sj_1"."json" AS "user" FROM (SELECT "products"."id", "products"."name", "products"."user_id" FROM "products" LIMIT ('1') :: integer) AS "products_0" LEFT OUTER JOIN LATERAL (SELECT to_jsonb("__sr_1".*) AS "json"FROM (SELECT "users_1"."id" AS "id", "users_1"."full_name" AS "full_name", "users_1"."email" AS "email" FROM (SELECT "users"."id", "users"."full_name", "users"."email" FROM "users" WHERE ((("users"."id") = ("products_0"."user_id"))) LIMIT ('1') :: integer) AS "users_1") AS "__sr_1") AS "__sj_1" ON ('true')) AS "__sr_0") AS "__sj_0"
 === RUN   TestCompileUpdate/nestedUpdateOneToOneWithDisconnect
-WITH "_sg_input" AS (SELECT '{{data}}' :: json AS j), "_x_users" AS (SELECT * FROM (VALUES(NULL::bigint)) AS LOOKUP("id")), "products" AS (UPDATE "products" SET ("name", "price", "user_id") = (SELECT CAST( i.j ->>'name' AS character varying), CAST( i.j ->>'price' AS numeric(7,2)), "_x_users"."id" FROM "_sg_input" i", "_x_users)  WHERE (("products"."id") =  '{{id}}' :: bigint) RETURNING "products".*) SELECT jsonb_build_object('product', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "products_0"."id" AS "id", "products_0"."name" AS "name", "products_0"."user_id" AS "user_id" FROM (SELECT "products"."id", "products"."name", "products"."user_id" FROM "products" LIMIT ('1') :: integer) AS "products_0") AS "__sr_0") AS "__sj_0"
---- PASS: TestCompileUpdate (0.04s)
+WITH "_sg_input" AS (SELECT '{{data}}' :: json AS j), "_x_users" AS (SELECT * FROM (VALUES(NULL::bigint)) AS LOOKUP("id")), "products" AS (UPDATE "products" SET ("name", "price", "user_id") = (SELECT CAST( i.j ->>'name' AS character varying), CAST( i.j ->>'price' AS numeric(7,2)), "_x_users"."id" FROM "_sg_input" i, "_x_users")  WHERE (("products"."id") =  '{{id}}' :: bigint) RETURNING "products".*) SELECT jsonb_build_object('product', "__sj_0"."json") as "__root" FROM (SELECT to_jsonb("__sr_0".*) AS "json"FROM (SELECT "products_0"."id" AS "id", "products_0"."name" AS "name", "products_0"."user_id" AS "user_id" FROM (SELECT "products"."id", "products"."name", "products"."user_id" FROM "products" LIMIT ('1') :: integer) AS "products_0") AS "__sr_0") AS "__sj_0"
+--- PASS: TestCompileUpdate (0.02s)
     --- PASS: TestCompileUpdate/singleUpdate (0.00s)
     --- PASS: TestCompileUpdate/simpleUpdateWithPresets (0.00s)
-    --- PASS: TestCompileUpdate/nestedUpdateManyToMany (0.01s)
-    --- PASS: TestCompileUpdate/nestedUpdateOneToMany (0.01s)
+    --- PASS: TestCompileUpdate/nestedUpdateManyToMany (0.00s)
+    --- PASS: TestCompileUpdate/nestedUpdateOneToMany (0.00s)
     --- PASS: TestCompileUpdate/nestedUpdateOneToOne (0.00s)
     --- PASS: TestCompileUpdate/nestedUpdateOneToManyWithConnect (0.00s)
-    --- PASS: TestCompileUpdate/nestedUpdateOneToOneWithConnect (0.01s)
+    --- PASS: TestCompileUpdate/nestedUpdateOneToOneWithConnect (0.00s)
     --- PASS: TestCompileUpdate/nestedUpdateOneToOneWithDisconnect (0.00s)
 PASS
-ok  	github.com/dosco/super-graph/core/internal/psql	0.154s
-=== RUN   TestCompile1
---- PASS: TestCompile1 (0.00s)
-=== RUN   TestCompile2
---- PASS: TestCompile2 (0.00s)
-=== RUN   TestCompile3
---- PASS: TestCompile3 (0.00s)
-=== RUN   TestInvalidCompile1
---- PASS: TestInvalidCompile1 (0.00s)
-=== RUN   TestInvalidCompile2
---- PASS: TestInvalidCompile2 (0.00s)
-=== RUN   TestEmptyCompile
---- PASS: TestEmptyCompile (0.00s)
-=== RUN   TestInvalidPostfixCompile
---- PASS: TestInvalidPostfixCompile (0.00s)
-=== RUN   TestGetQType
-=== RUN   TestGetQType/query
-=== RUN   TestGetQType/mutation
-=== RUN   TestGetQType/default_query
-=== RUN   TestGetQType/default_query_with_comment
-=== RUN   TestGetQType/failed_query_with_comment
---- PASS: TestGetQType (0.00s)
-    --- PASS: TestGetQType/query (0.00s)
-    --- PASS: TestGetQType/mutation (0.00s)
-    --- PASS: TestGetQType/default_query (0.00s)
-    --- PASS: TestGetQType/default_query_with_comment (0.00s)
-    --- PASS: TestGetQType/failed_query_with_comment (0.00s)
-PASS
-ok  	github.com/dosco/super-graph/core/internal/qcode	0.012s
-?   	github.com/dosco/super-graph/core/internal/util	[no test files]
-=== RUN   TestFuzzCrashers
---- PASS: TestFuzzCrashers (0.00s)
-=== RUN   TestGQLHash1
---- PASS: TestGQLHash1 (0.00s)
-=== RUN   TestGQLHash2
---- PASS: TestGQLHash2 (0.00s)
-=== RUN   TestGQLHash3
---- PASS: TestGQLHash3 (0.00s)
-=== RUN   TestGQLHash4
---- PASS: TestGQLHash4 (0.00s)
-=== RUN   TestGQLHashWithVars1
---- PASS: TestGQLHashWithVars1 (0.00s)
-=== RUN   TestGQLHashWithVars2
---- PASS: TestGQLHashWithVars2 (0.00s)
-PASS
-ok  	github.com/dosco/super-graph/internal/serv	0.033s
-?   	github.com/dosco/super-graph/internal/serv/internal/auth	[no test files]
-testing: warning: no tests to run
-PASS
-ok  	github.com/dosco/super-graph/internal/serv/internal/migrate	0.011s [no tests to run]
-=== RUN   TestRailsEncryptedSession1
---- PASS: TestRailsEncryptedSession1 (0.01s)
-=== RUN   TestRailsEncryptedSession52
---- PASS: TestRailsEncryptedSession52 (0.00s)
-=== RUN   TestRailsJsonSession
---- PASS: TestRailsJsonSession (0.00s)
-=== RUN   TestRailsMarshaledSession
---- PASS: TestRailsMarshaledSession (0.00s)
-PASS
-ok  	github.com/dosco/super-graph/internal/serv/internal/rails	0.023s
-=== RUN   TestFuzzCrashers
---- PASS: TestFuzzCrashers (0.00s)
-=== RUN   TestGet
---- PASS: TestGet (0.00s)
-=== RUN   TestGet1
---- PASS: TestGet1 (0.00s)
-=== RUN   TestGet2
---- PASS: TestGet2 (0.00s)
-=== RUN   TestGet3
---- PASS: TestGet3 (0.00s)
-=== RUN   TestGet4
---- PASS: TestGet4 (0.00s)
-=== RUN   TestValue
---- PASS: TestValue (0.00s)
-=== RUN   TestFilter1
---- PASS: TestFilter1 (0.00s)
-=== RUN   TestFilter2
---- PASS: TestFilter2 (0.00s)
-=== RUN   TestStrip
---- PASS: TestStrip (0.00s)
-=== RUN   TestValidateTrue
---- PASS: TestValidateTrue (0.00s)
-=== RUN   TestValidateFalse
---- PASS: TestValidateFalse (0.00s)
-=== RUN   TestReplace
---- PASS: TestReplace (0.00s)
-=== RUN   TestReplaceEmpty
---- PASS: TestReplaceEmpty (0.00s)
-=== RUN   TestKeys1
---- PASS: TestKeys1 (0.00s)
-=== RUN   TestKeys2
---- PASS: TestKeys2 (0.00s)
-=== RUN   TestKeys3
---- PASS: TestKeys3 (0.00s)
-PASS
-ok  	github.com/dosco/super-graph/jsn	0.014s
+ok  	github.com/dosco/super-graph/core/internal/psql	0.306s

core/internal/psql/update.go

@@ -188,9 +188,9 @@ func renderNestedUpdateRelTables(w io.Writer, item kvitem) error {
 	// relationship is one-to-many
 	for _, v := range item.items {
 		if v._ctype > 0 && v.relCP.Type == RelOneToMany {
-			io.WriteString(w, `", `)
-			io.WriteString(w, `"_x_`)
+			io.WriteString(w, `, "_x_`)
 			io.WriteString(w, v.relCP.Left.Table)
+			io.WriteString(w, `"`)
 		}
 	}
 

core/prepare.go

@@ -58,21 +58,14 @@ func (sg *SuperGraph) initPrepared() error {
 		}
 
 		err := sg.prepareStmt(v)
-		if err == nil {
+		if err != nil {
+			sg.log.Printf("WRN %s: %v", v.Name, err)
+		} else {
 			success++
-			continue
 		}
-
-		// if len(v.Vars) == 0 {
-		// 	logger.Warn().Err(err).Msg(v.Query)
-		// } else {
-		// 	logger.Warn().Err(err).Msgf("%s %s", v.Vars, v.Query)
-		// }
 	}
 
-	// logger.Info().
-	// 	Msgf("Registered %d of %d queries from allow.list as prepared statements",
-	// 		success, len(list))
+	sg.log.Printf("INF allow list: prepared %d / %d queries", success, len(list))
 
 	return nil
 }
@@ -84,13 +77,6 @@ func (sg *SuperGraph) prepareStmt(item allow.Item) error {
 
 	qt := qcode.GetQType(query)
 	ct := context.Background()
-
-	tx, err := sg.db.BeginTx(ct, nil)
-	if err != nil {
-		return err
-	}
-	defer tx.Rollback() //nolint: errcheck
-
 	switch qt {
 	case qcode.QTQuery:
 		var stmts1 []stmt
@@ -108,7 +94,7 @@ func (sg *SuperGraph) prepareStmt(item allow.Item) error {
 
 		//logger.Debug().Msgf("Prepared statement 'query %s' (user)", item.Name)
 
-		err = sg.prepare(ct, tx, stmts1, stmtHash(item.Name, "user"))
+		err = sg.prepare(ct, stmts1, stmtHash(item.Name, "user"))
 		if err != nil {
 			return err
 		}
@@ -124,7 +110,7 @@ func (sg *SuperGraph) prepareStmt(item allow.Item) error {
 				return err
 			}
 
-			err = sg.prepare(ct, tx, stmts2, stmtHash(item.Name, "anon"))
+			err = sg.prepare(ct, stmts2, stmtHash(item.Name, "anon"))
 			if err != nil {
 				return err
 			}
@@ -135,36 +121,29 @@ func (sg *SuperGraph) prepareStmt(item allow.Item) error {
 			// logger.Debug().Msgf("Prepared statement 'mutation %s' (%s)", item.Name, role.Name)
 
 			stmts, err := sg.buildRoleStmt(qb, vars, role.Name)
-
+			if err == psql.ErrAllTablesSkipped {
+				return nil
+			}
 			if err != nil {
-				// if len(item.Vars) == 0 {
-				// 	logger.Warn().Err(err).Msg(item.Query)
-				// } else {
-				// 	logger.Warn().Err(err).Msgf("%s %s", item.Vars, item.Query)
-				// }
-				continue
+				return err
 			}
 
-			err = sg.prepare(ct, tx, stmts, stmtHash(item.Name, role.Name))
+			err = sg.prepare(ct, stmts, stmtHash(item.Name, role.Name))
 			if err != nil {
 				return err
 			}
 		}
 	}
 
-	if err := tx.Commit(); err != nil {
-		return err
-	}
-
 	return nil
 }
 
-func (sg *SuperGraph) prepare(ct context.Context, tx *sql.Tx, st []stmt, key string) error {
+func (sg *SuperGraph) prepare(ct context.Context, st []stmt, key string) error {
 	finalSQL, am := processTemplate(st[0].sql)
 
-	sd, err := tx.Prepare(finalSQL)
+	sd, err := sg.db.Prepare(finalSQL)
 	if err != nil {
-		return err
+		return fmt.Errorf("prepare failed: %v: %s", err, finalSQL)
 	}
 
 	sg.prepared[key] = &preparedItem{
@@ -256,6 +235,8 @@ func (sg *SuperGraph) initAllowList() error {
 		sg.log.Printf("WRN allow list disabled no file specified")
 	}
 
+	// When list is not eabled it is still created and
+	// and new queries are saved to it.
 	if !sg.conf.UseAllowList {
 		ac = allow.Config{CreateIfNotExists: true, Persist: true}
 	}

go.mod

@@ -7,6 +7,7 @@ require (
 	github.com/bradfitz/gomemcache v0.0.0-20190913173617-a41fca850d0b
 	github.com/brianvoe/gofakeit/v5 v5.2.0
 	github.com/cespare/xxhash/v2 v2.1.1
+	github.com/chirino/graphql v0.0.0-20200419184546-f015b9dab85d
 	github.com/daaku/go.zipexe v1.0.1 // indirect
 	github.com/dgrijalva/jwt-go v3.2.0+incompatible
 	github.com/dlclark/regexp2 v1.2.0 // indirect
@@ -32,9 +33,10 @@ require (
 	github.com/valyala/fasttemplate v1.1.0
 	go.uber.org/zap v1.14.1
 	golang.org/x/crypto v0.0.0-20200414173820-0848c9571904
+	golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e // indirect
 	golang.org/x/sys v0.0.0-20200413165638-669c56c373c4 // indirect
-	golang.org/x/tools v0.0.0-20191114200427-caa0b0f7d508 // indirect
 	golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 // indirect
+	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
 	gopkg.in/ini.v1 v1.55.0 // indirect
 )
 

go.sum

@@ -25,9 +25,13 @@ github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chirino/graphql v0.0.0-20200419184546-f015b9dab85d h1:JnYHwwRhFmQ8DeyfqmIrzpkkxnZ+iT5V1CUd3Linin0=
+github.com/chirino/graphql v0.0.0-20200419184546-f015b9dab85d/go.mod h1:+34LPrbHFfKVDPsNfi445UArMEjbeTlCm7C+OpdC7IU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
 github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
+github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd h1:qMd81Ts1T2OTKmB4acZcyKaMtRnY5Y44NuXGX2GFJ1w=
+github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
@@ -51,6 +55,7 @@ github.com/dlclark/regexp2 v1.2.0 h1:8sAhBGEM0dRWogWqWyQeIJnxjWO6oIjl8FKqREDsGfk
 github.com/dlclark/regexp2 v1.2.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dop251/goja v0.0.0-20200414142002-77e84ffb8c65 h1:Nud597JuGCF/MScrb6NNVDRgmuk8X7w3pFc5GvSsm5E=
 github.com/dop251/goja v0.0.0-20200414142002-77e84ffb8c65/go.mod h1:Mw6PkjjMXWbTj+nnj4s3QPXq1jaT0s5pC0iFD4+BOAA=
+github.com/friendsofgo/graphiql v0.2.2/go.mod h1:8Y2kZ36AoTGWs78+VRpvATyt3LJBx0SZXmay80ZTRWo=
 github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
@@ -83,6 +88,7 @@ github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGa
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/websocket v1.4.0 h1:WDFjx/TMzVgy9VdMMQi2K2Emtwi2QcUQsztZ/zLaH/Q=
 github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
+github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gosimple/slug v1.9.0 h1:r5vDcYrFz9BmfIAMC829un9hq7hKM4cHUrsv36LbEqs=
 github.com/gosimple/slug v1.9.0/go.mod h1:AMZ+sOVe65uByN3kgEyf9WEBKBCSS+dJjMX9x4vDJbg=
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
@@ -181,6 +187,8 @@ github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRW
 github.com/nkovacs/streamquote v0.0.0-20170412213628-49af9bddb229 h1:E2B8qYyeSgv5MXpmzZXRNp8IAQ4vjxIjhpAf5hv/tAg=
 github.com/nkovacs/streamquote v0.0.0-20170412213628-49af9bddb229/go.mod h1:0aYXnNPJ8l7uZxf45rWW1a/uME32OF0rhiYGNQ2oF2E=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
+github.com/opentracing/opentracing-go v1.0.2 h1:3jA2P6O1F9UOrWVpwrIo17pu01KWvNWg4X946/Y5Zwg=
+github.com/opentracing/opentracing-go v1.0.2/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/pelletier/go-toml v1.2.0 h1:T5zMGML61Wp+FlcbWjRDT7yAxhJNAiPPLOFECq181zc=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/pelletier/go-toml v1.7.0 h1:7utD74fnzVc/cpcyy8sjrlFr5vYpypUixARcHIMIGuI=
@@ -213,9 +221,13 @@ github.com/rs/zerolog v1.15.0 h1:uPRuwkWF4J6fGsJ2R0Gn2jB1EQiav9k3S6CSdygQJXY=
 github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
+github.com/segmentio/ksuid v1.0.2 h1:9yBfKyw4ECGTdALaF09Snw3sLJmYIX6AbPJrAy6MrDc=
+github.com/segmentio/ksuid v1.0.2/go.mod h1:BXuJDr2byAiHuQaQtSKoXh1J0YmUDurywOXgB2w+OSU=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24 h1:pntxY8Ary0t43dCZ5dqY4YTJCObLY1kIXl0uzMv+7DE=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
+github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/shurcooL/vfsgen v0.0.0-20181202132449-6a9ea43bcacd/go.mod h1:TrYk7fJVaAttu97ZZKrO9UbRa8izdowaMIZcxYMbVaw=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
@@ -260,6 +272,12 @@ github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5
 github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/uber-go/atomic v1.3.2 h1:Azu9lPBWRNKzYXSIwRfgRuDuS0YKsK4NFhiQv98gkxo=
+github.com/uber-go/atomic v1.3.2/go.mod h1:/Ct5t2lcmbJ4OSe/waGBoaVvVqtO0bmtfVNex1PFV8g=
+github.com/uber/jaeger-client-go v2.14.1-0.20180928181052-40fb3b2c4120+incompatible h1:Dw0AFQs6RGO8RxMPGP2LknN/VtHolVH82P9PP0Ni+9w=
+github.com/uber/jaeger-client-go v2.14.1-0.20180928181052-40fb3b2c4120+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk=
+github.com/uber/jaeger-lib v1.5.0 h1:OHbgr8l656Ub3Fw5k9SWnBfIEwvoHQ+W2y+Aa9D1Uyo=
+github.com/uber/jaeger-lib v1.5.0/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
@@ -290,6 +308,7 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200414173820-0848c9571904 h1:bXoxMPcSLOq08zI3/c5dEBT6lE4eh+jOh886GHrn6V8=
 golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -298,6 +317,7 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de h1:5hukYrvBGR8/eNkX5mdUezrA6JiaEZDtJb9Ei+1LlBs=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
+golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -308,6 +328,8 @@ golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7 h1:fHDIZ2oxGnUZRN6WgWFCbYBjH9uqVPRCUVUDhs0wnbA=
 golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e h1:3G+cUijn7XD+S4eJFddp53Pv7+slrESplyjG25HgL+k=
+golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -328,6 +350,7 @@ golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456 h1:ng0gs1AKnRRuEMZoTLLlbOd+C17zUDepwGQBb/n+JVg=
 golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200413165638-669c56c373c4 h1:opSr2sbRXk5X5/givKrrKj9HXxFpW2sdCiP8MJSKLQY=
 golang.org/x/sys v0.0.0-20200413165638-669c56c373c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
@@ -346,12 +369,13 @@ golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5 h1:hKsoRgsbwY1NafxrwTs+k64bikrLBkAgPir1TNCj3Zs=
 golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191114200427-caa0b0f7d508 h1:0FYNp0PF9kFm/ZUrvcJiQ12IUJJG7iAc6Cu01wbKrbU=
-golang.org/x/tools v0.0.0-20191114200427-caa0b0f7d508/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200128220307-520188d60f50 h1:0qnG0gwzB6QPiLDow10WJDdB38c+hQ7ArxO26Qc1boM=
+golang.org/x/tools v0.0.0-20200128220307-520188d60f50/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7 h1:9zdDQZ7Thm29KFXgAX/+yaf3eVbP7djjWp/dXAppNCc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
@@ -363,6 +387,8 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
 gopkg.in/ini.v1 v1.51.0 h1:AQvPpx3LzTDM0AjnIRlVFwFFGC+npRopjZxLJj6gdno=

internal/serv/cmd_serv.go

@@ -24,10 +24,6 @@ func cmdServ(cmd *cobra.Command, args []string) {
 		fatalInProd(err, "failed to connect to database")
 	}
 
-	// if conf != nil && db != nil {
-	// 	initResolvers()
-	// }
-
 	sg, err = core.NewSuperGraph(&conf.Core, db)
 	if err != nil {
 		fatalInProd(err, "failed to initialize Super Graph")

internal/serv/config.go

@@ -49,10 +49,6 @@ func ReadInConfig(configFile string) (*Config, error) {
 		return nil, fmt.Errorf("failed to decode config, %v", err)
 	}
 
-	if len(c.Core.AllowListFile) == 0 {
-		c.Core.AllowListFile = path.Join(cpath, "allow.list")
-	}
-
 	return c, nil
 }
 

internal/serv/http.go

@@ -6,7 +6,6 @@ import (
 	"io"
 	"io/ioutil"
 	"net/http"
-	"strings"
 
 	"github.com/dosco/super-graph/core"
 	"github.com/dosco/super-graph/internal/serv/internal/auth"
@@ -75,14 +74,14 @@ func apiV1(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if strings.EqualFold(req.OpName, introspectionQuery) {
-		introspect(w)
-		return
-	}
-
+	doLog := true
 	res, err := sg.GraphQL(ct, req.Query, req.Vars)
 
-	if logLevel >= LogLevelDebug {
+	if !conf.Production && res.QueryName() == "IntrospectionQuery" {
+		doLog = false
+	}
+
+	if doLog && logLevel >= LogLevelDebug {
 		log.Printf("DBG query %s: %s", res.QueryName(), res.SQL())
 	}
 
@@ -93,7 +92,7 @@ func apiV1(w http.ResponseWriter, r *http.Request) {
 
 	json.NewEncoder(w).Encode(res)
 
-	if logLevel >= LogLevelInfo {
+	if doLog && logLevel >= LogLevelInfo {
 		zlog.Info("success",
 			zap.String("op", res.Operation()),
 			zap.String("name", res.QueryName()),

internal/serv/init.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"path"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -21,7 +22,12 @@ const (
 )
 
 func initConf() (*Config, error) {
-	c, err := ReadInConfig(path.Join(confPath, GetConfigName()))
+	cp, err := filepath.Abs(confPath)
+	if err != nil {
+		return nil, err
+	}
+
+	c, err := ReadInConfig(path.Join(cp, GetConfigName()))
 	if err != nil {
 		return nil, err
 	}
@@ -86,6 +92,14 @@ func initConf() (*Config, error) {
 		c.AuthFailBlock = false
 	}
 
+	if len(c.AllowListFile) == 0 {
+		c.AllowListFile = c.relPath("./allow.list")
+	}
+
+	if c.Production {
+		c.UseAllowList = true
+	}
+
 	return c, nil
 }
 

internal/serv/reload.go

@@ -190,17 +190,3 @@ func self() (string, error) {
 	}
 	return bin, nil
 }
-
-// Get path relative to cwd
-func relpath(p string) string {
-	cwd, err := os.Getwd()
-	if err != nil {
-		return p
-	}
-
-	if strings.HasPrefix(p, cwd) {
-		return "./" + strings.TrimLeft(p[len(cwd):], "/")
-	}
-
-	return p
-}

internal/serv/rice-box.go

@@ -317,11 +317,11 @@ func init() {
 			"static/media": dirr,
 		},
 		Files: map[string]*embedded.EmbeddedFile{
-			"asset-manifest.json":                                      file9,
-			"favicon.ico":                                              filea,
-			"index.html":                                               fileb,
-			"manifest.json":                                            filec,
-			"precache-manifest.ac47d060293cf05e2bbe249faba24591.js":    filed,
+			"asset-manifest.json": file9,
+			"favicon.ico":         filea,
+			"index.html":          fileb,
+			"manifest.json":       filec,
+			"precache-manifest.ac47d060293cf05e2bbe249faba24591.js": filed,
 			"service-worker.js":                                        filee,
 			"static/css/main.c6b5c55c.chunk.css":                       fileh,
 			"static/css/main.c6b5c55c.chunk.css.map":                   filei,

internal/serv/utils.go

@@ -119,3 +119,17 @@ func isDev() bool {
 func sanitize(value string) string {
 	return strings.ToLower(strings.TrimSpace(value))
 }
+
+// Get path relative to cwd
+func relpath(p string) string {
+	cwd, err := os.Getwd()
+	if err != nil {
+		return p
+	}
+
+	if strings.HasPrefix(p, cwd) {
+		return "./" + strings.TrimLeft(p[len(cwd):], "/")
+	}
+
+	return p
+}