Production install fails at runtime, missing @apollo/client peer dep

[Moumouls]

New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest version of Parse Server.

Issue Description

Missing apollo client peer dep from graphql tools, so a production install will fail at runtime if GraphQL is used

Steps to reproduce

Install a parse-server in production mode and use graphql

Actual Outcome

Error: Cannot find module '@apollo/client/link/core'
Require stack:
- /srv/app/node_modules/@graphql-tools/links/index.js
- /srv/app/node_modules/parse-server/lib/GraphQL/loaders/defaultGraphQLTypes.js
- /srv/app/node_modules/parse-server/lib/GraphQL/ParseGraphQLSchema.js
- /srv/app/node_modules/parse-server/lib/GraphQL/ParseGraphQLServer.js
- /srv/app/node_modules/parse-server/lib/ParseServer.js
- /srv/app/node_modules/parse-server/lib/index.js
- /srv/app/packages/dashboard-back/lib/src/server.js
- /srv/app/packages/dashboard-back/lib/index.js

Expected Outcome

Not to crash

Environment

Server

• Parse Server version: 5.0.0-alpha.20
• Operating system: Docker Alpine
• Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): N/A

Database

• System (MongoDB or Postgres): N/A
• Database version: N/A
• Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): N/A

Client

• SDK (iOS, Android, JavaScript, PHP, Unity, etc): N/A
• SDK version: N/A

Logs

[parse-github-assistant]

Thanks for opening this issue!

• 🚀 You can help us to fix this issue faster by opening a pull request with a failing test. See our Contribution Guide for how to make a pull request, or read our New Contributor's Guide if this is your first time contributing.

[Moumouls]

@mtrezza i see in npm i logs this

npm WARN @graphql-tools/links@8.2.1 requires a peer of @apollo/client@~3.2.5 || ~3.3.0 || ~3.4.0 but none is installed. You must install peer dependencies yourself.

What do you think about adding a new C that check that we do not have npm warnings on a production install ? This could avoid major outage in the futur 🙂

[mtrezza]

What do you think about adding a new C that check that we do not have npm warnings on a production install ? This could avoid major outage in the futur

Sure, if we can find a reliable logic to check? A WARN may also just indicate a deprecation or other info that may not be urgent, and we probably wouldn't want this check to fail for everyone of these. So I wonder how we could distinguish these.

Could we just add a test that fails for "Install a parse-server in production mode and use graphql"? I mean, why didn't any of the GraphQL tests fail in the CI so far? Where did they get the @apollo/client dependency from?

[Moumouls]

@mtrezza if you check the PR you can see that @apollo/client was in the devDep, since the CI use a dev install npm ci everything works correctly.

@apollo/client is needed by graphql-tools

Here i can't add a failing test since the bug is only reproducible with a npm install --only=prod and in prod we do not have tools to run the test suite.

Here i can admit it's hard to test, even my company CI do not catch the issue until we pushed the new docker image onto our staging env.

[Moumouls]

Sure, if we can find a reliable logic to check? A WARN may also just indicate a deprecation or other info that may not be urgent, and we probably wouldn't want this check to fail for everyone of these. So I wonder how we could distinguish these.

May be an explicit whitelist could be provided on the tool that check the warnings ?

[mtrezza]

Yes that may be the easiest way, not sure how maintainable that would be. Any other ideas?

Not sure if that works, but how about installing with npm i and then look whether all import / require have a dependency installed? Just found this: https://www.npmjs.com/package/dependency-check, it seems to be quite a popular package as well.

Added #7796 to discuss this further.