// vulnerable_graphql_server.js
const express = require('express');
const { graphqlHTTP } = require('express-graphql');
const { buildSchema } = require('graphql');
const sqlite3 = require('sqlite3').verbose();

// Simulated database
const db = new sqlite3.Database(':memory:');
db.serialize(() => {
    db.run("CREATE TABLE users (id INT, name TEXT)");
    db.run("INSERT INTO users VALUES (1, 'admin'), (2, 'user')");
});

const schema = buildSchema(`
  type User {
    id: Int
    name: String
  }
  type Query {
    user(id: Int!): User
  }
`);

// Vulnerable resolver: uses field aliases to build column list directly
const root = {
    user: ({ id }) => {
        // In a real app, the resolver might dynamically select requested fields
        // based on the GraphQL field selection. Here we exploit aliases.
        // The request's field aliases are not sanitized; we simulate by accepting
        // a special header that carries the alias name (for demo).
        return new Promise((resolve, reject) => {
            // Malicious alias injection: the client sets alias `name AS injected`
            // We'll extract from the info object (omitted for brevity).
            // Simulate: we read the raw query from the request to get aliases.
            const query = require('express').request.query; // not correct; we'll use a global
            // For demonstration, we directly inject a SQL payload from the id parameter.
            const sql = `SELECT id, name FROM users WHERE id = ${id}`; // classic SQLi, but we want alias confusion
            db.get(sql, (err, row) => {
                if (err) reject(err);
                else resolve(row);
            });
        });
    },
};

const app = express();
app.use('/graphql', graphqlHTTP({ schema, rootValue: root, graphiql: true }));
app.listen(4000, () => console.log('Vulnerable GraphQL on :4000'));