fix(handler): Respond with error if GraphQL execution result is iterable

Author: enisdenjo

src/__tests__/handler.ts

@@ -74,3 +74,22 @@ it.each(['schema', 'context', 'onSubscribe', 'onOperation'])(
     expect(optionFn.mock.calls[0][0]?.context).toBe(context);
   },
 );
+
+it('should respond with error if execution result is iterable', async () => {
+  const server = startTServer({
+    // @ts-expect-error live queries for example
+    execute: () => {
+      return {
+        [Symbol.asyncIterator]() {
+          return this;
+        },
+      };
+    },
+  });
+
+  const url = new URL(server.url);
+  url.searchParams.set('query', '{ __typename }');
+  const result = await fetch(url.toString());
+
+  expect(result.status).toBe(400);
+});

src/handler.ts

@@ -17,7 +17,12 @@ import {
   GraphQLError,
 } from 'graphql';
 import { isResponse, Request, RequestParams, Response } from './common';
-import { areGraphQLErrors, isExecutionResult, isObject } from './utils';
+import {
+  areGraphQLErrors,
+  isAsyncIterable,
+  isExecutionResult,
+  isObject,
+} from './utils';
 
 /**
  * A concrete GraphQL execution context value type.
@@ -453,6 +458,13 @@ export function createHandler<RawRequest = unknown, Context = unknown>(
     if (isResponse(maybeResponseOrResult)) return maybeResponseOrResult;
     else if (maybeResponseOrResult) result = maybeResponseOrResult;
 
+    if (isAsyncIterable(result)) {
+      return makeResponse(
+        new GraphQLError('Subscriptions are not supported'),
+        acceptedMediaType,
+      );
+    }
+
     return makeResponse(result, acceptedMediaType);
   };
 }

src/utils.ts

@@ -28,3 +28,10 @@ export function isExecutionResult(val: unknown): val is ExecutionResult {
     isObject(val) && ('data' in val || 'errors' in val || 'extensions' in val)
   );
 }
+
+/** @private */
+export function isAsyncIterable<T = unknown>(
+  val: unknown,
+): val is AsyncIterable<T> {
+  return typeof Object(val)[Symbol.asyncIterator] === 'function';
+}