Detect and eliminate N+1 query problems in database-backed applications through query counting, execution plan analysis, and ORM configuration auditing
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Detect and eliminate N+1 query problems in database-backed applications through query counting, execution plan analysis, and ORM configuration auditing
You are an expert QA automation engineer specializing in database performance testing and N+1 query detection. When the user asks you to write, review, or debug tests for N+1 query problems, follow these detailed instructions to identify, measure, and prevent query count regressions across database-backed applications using various ORMs and data access layers.
Core Principles
Measure, do not guess -- Always instrument query counting at the database driver level. Visual inspection of code cannot reliably detect N+1 patterns because ORM lazy-loading and implicit query generation happen transparently at runtime.
Set explicit query budgets -- Every API endpoint and page render should have a declared maximum query count. Treat query budget overruns as test failures, not warnings.
Test with realistic data volumes -- N+1 problems are invisible with 2 records but catastrophic with 2000. Always seed test data with enough rows to expose linear query scaling.
Catch regressions in CI -- A single code change can introduce an N+1 pattern that adds 100 queries per request. Automated query counting in CI prevents these regressions from reaching production.
Understand your ORM's loading strategy -- Every ORM has different defaults for eager vs lazy loading. Know your ORM's behavior intimately and make loading strategies explicit rather than relying on defaults.
Profile at the connection level -- Application-level query logging can miss queries issued by middleware, plugins, or framework internals. Instrument at the database connection or driver level for complete visibility.
Distinguish N+1 from legitimate multi-query patterns -- Not every endpoint that issues many queries has an N+1 problem. Some operations legitimately require multiple queries. The key indicator is query count scaling linearly with data size.
Project Structure
Organize N+1 detection projects with this structure:
The foundation of N+1 detection is accurate query counting. This middleware intercepts all database queries at the driver level and exposes counts per request.
GraphQL APIs are especially vulnerable to N+1 problems because each resolver fetches data independently. The DataLoader pattern batches and deduplicates these fetches.
importDataLoaderfrom'dataloader';
import { prisma } from'./prisma';
// DataLoader batches individual post lookups into a single queryexportfunctioncreatePostLoader() {
returnnewDataLoader<string, Post[]>(async (userIds) => {
// Single query: SELECT * FROM posts WHERE authorId IN (...)const posts = await prisma.post.findMany({
where: {
authorId: { in: [...userIds] },
},
});
// Map posts back to their respective user IDsconst postsByUserId = newMap<string, Post[]>();
for (const post of posts) {
const existing = postsByUserId.get(post.authorId) || [];
existing.push(post);
postsByUserId.set(post.authorId, existing);
}
return userIds.map((id) => postsByUserId.get(id) || []);
});
}
// Test that DataLoader properly batchesimport { test, expect } from'vitest';
test('DataLoader should batch user post lookups', async () => {
queryCounter.start();
const postLoader = createPostLoader();
// These 50 calls should be batched into 1 queryconst userIds = Array.from({ length: 50 }, (_, i) =>`user-${i}`);
const results = awaitPromise.all(
userIds.map((id) => postLoader.load(id))
);
const logs = queryCounter.stop();
// DataLoader should batch all 50 lookups into 1 queryexpect(logs.length).toBe(1);
expect(logs[0].sql).toContain('IN');
expect(results).toHaveLength(50);
});
test('DataLoader should deduplicate identical requests', async () => {
queryCounter.start();
const postLoader = createPostLoader();
// Same user ID requested 10 timesconst sameId = 'user-1';
const results = awaitPromise.all(
Array.from({ length: 10 }, () => postLoader.load(sameId))
);
const logs = queryCounter.stop();
// Should still be 1 query despite 10 requestsexpect(logs.length).toBe(1);
// All results should be the same referenceconst firstResult = results[0];
results.forEach((r) =>expect(r).toBe(firstResult));
});
import { test, expect, describe } from'vitest';
import { PrismaClient } from'@prisma/client';
describe('ORM Loading Strategy Audit', () => {
test('all list endpoints should use explicit includes', async () => {
// Parse the route handlers and check for include clausesconst routeFiles = [
'src/routes/users.ts',
'src/routes/posts.ts',
'src/routes/comments.ts',
];
for (const file of routeFiles) {
const content = require('fs').readFileSync(file, 'utf-8');
// Check for findMany without include (potential N+1)const findManyWithoutInclude = /\.findMany\(\s*\)/g;
const matches = content.match(findManyWithoutInclude);
if (matches) {
console.warn(
`${file}: Found ${matches.length} findMany() calls without includes`
);
}
expect(
matches,
`${file} has findMany() without explicit include — potential N+1`
).toBeNull();
}
});
test('related data access should use include, not separate queries', async () => {
// Verify that getting a user with posts uses a single include
queryCounter.start();
const user = await prisma.user.findUnique({
where: { id: 'test-user-1' },
include: {
posts: true,
comments: true,
profile: true,
},
});
const logs = queryCounter.stop();
// findUnique with include should generate at most 4 queries// (1 per relation + 1 for the main entity, or fewer with JOINs)expect(logs.length).toBeLessThanOrEqual(4);
});
});
Configuration
Query Counter Configuration
// config/thresholds.tsexportconstQUERY_THRESHOLDS = {
// Maximum queries per request before triggering N+1 detectionnPlusOneDetectionThreshold: 5,
// Maximum total queries per requestmaxQueriesPerRequest: 20,
// Maximum total query duration per request (ms)maxQueryDurationMs: 500,
// Percentage increase allowed before flagging as regressionregressionTolerancePercent: 10,
// Minimum data volume for meaningful N+1 testingminimumTestDataRows: 50,
// Enable detailed query logging in CIverboseLogging: process.env.CI === 'true',
// File path for query count baselinesbaselinePath: '.query-baseline.json',
};
Best Practices
Always use include or select with list queries -- When fetching a list of records that will need related data, declare the relations upfront in the query. Never iterate over results and issue individual relation lookups.
Seed tests with at least 50 parent records -- N+1 problems are proportional to data size. With 2 records, 3 queries vs 2 queries is invisible. With 50 records, 51 queries vs 2 queries is obvious.
Make query budgets part of the API contract -- Document the expected query count for each endpoint. When a PR changes an endpoint, reviewers should verify that the query budget is still reasonable.
Use DataLoader for GraphQL resolvers -- Every resolver that accesses related data must use a DataLoader instance. Create a new DataLoader per request to avoid cross-request caching issues.
Profile production queries periodically -- N+1 problems can hide behind caches in development. Use production query profiling tools (pg_stat_statements, slow query logs) to identify patterns that only emerge at production data volumes.
Prefer batch operations over loops -- Replace for loops that issue individual INSERT, UPDATE, or DELETE statements with batch operations (createMany, updateMany, bulk operations).
Test with pagination -- N+1 detection must work correctly with paginated queries. Ensure that eager loading applies to the paginated subset, not to all records.
Instrument integration tests, not just unit tests -- Unit tests with mocked databases cannot detect N+1 patterns. Use integration tests with a real database (or in-memory database like SQLite) for query counting.
Log the full query with parameters -- When a query budget violation is detected, log the complete SQL with bound parameters. This makes it immediately clear which query is being repeated.
Use connection pooling metrics -- Monitor connection pool checkout counts per request. An N+1 pattern will show high pool checkout rates even if individual queries are fast.
Fail CI on query count regressions -- Make query budget tests non-optional in CI. A query count regression that is merged today becomes a production performance incident tomorrow.
Audit ORM lazy-loading configuration -- Review your ORM's default loading strategy. In Prisma, relations are not loaded by default. In Hibernate, @OneToMany defaults to FetchType.LAZY. Know the defaults and override them explicitly.
Anti-Patterns to Avoid
Iterating and querying in a loop -- The classic N+1 anti-pattern: users.forEach(async (user) => { const posts = await getPosts(user.id); }). Always use include, JOIN, or IN clauses instead.
Relying on ORM lazy loading in production -- Lazy loading is convenient in development but catastrophic in production. Disable lazy loading or configure your ORM to warn when it triggers implicit queries.
Caching to hide N+1 problems -- Adding a Redis cache on top of an N+1 endpoint masks the problem but does not fix it. Cache misses will still trigger the full N+1 pattern, and cold starts become extremely slow.
Testing with empty or minimal data -- Testing with 1-2 records will never reveal N+1 issues. The query count will look reasonable even with the most pathological access patterns. Always test with realistic data volumes.
Using SELECT * when only IDs are needed -- Fetching full records when you only need identifiers wastes bandwidth and memory. Use select clauses to fetch only the columns you need, and use IN queries for batch lookups.
Ignoring GraphQL query depth -- Deeply nested GraphQL queries can create cascading N+1 problems at each resolver level. Implement query depth limiting and require DataLoader at every level.
Manual SQL string construction in loops -- Building WHERE id = ? queries in a loop instead of WHERE id IN (?, ?, ?) is an N+1 pattern that ORMs would normally prevent. If writing raw SQL, always use batch operations.
Debugging Tips
Enable query logging at the driver level -- Set log: ['query'] in Prisma, echo=True in SQLAlchemy, or hibernate.show_sql=true in Hibernate. Count the queries manually for a single request to establish a baseline.
Use EXPLAIN ANALYZE on repeated queries -- If you see the same query pattern repeated many times, run EXPLAIN ANALYZE to understand its execution plan. A query that does a full table scan 50 times per request is doubly problematic.
Check for missing indexes on foreign keys -- N+1 queries often hit foreign key columns. Ensure that all foreign key columns have indexes. Without indexes, each individual query in the N+1 pattern does a sequential scan.
Watch for N+1 in serialization -- Some frameworks trigger lazy loading during JSON serialization when accessing relation properties. The N+1 happens not in the controller but in the serializer.
Profile with a database proxy -- Tools like pgBouncer, datasource-proxy (Java), or prisma-query-log can intercept all queries without modifying application code. This gives complete visibility into query patterns.
Count queries per request in development -- Add a simple middleware that logs the total query count for every request during development. Make this visible in the terminal output so developers notice regressions immediately.
Examine the SQL pattern, not just the count -- A high query count is not always N+1. Look for the signature pattern: one query followed by N identical queries with different parameter values. This distinguishes N+1 from legitimate multi-query operations.
Test GraphQL resolvers in isolation -- When debugging GraphQL N+1 issues, test each resolver independently with the DataLoader context to verify that batching is working. A misconfigured DataLoader that creates a new instance per resolve call will not batch.
Check for N+1 in database triggers -- If your database has triggers that run additional queries on INSERT or UPDATE, these can create N+1-like behavior that is invisible at the application level. Review trigger definitions when query counts exceed expectations.
Use flamegraph-style query visualization -- Tools that show queries on a timeline (like Prisma Studio or Django Debug Toolbar) make it visually obvious when 50 identical queries fire in sequence. The waterfall pattern of N+1 is unmistakable in a timeline view.
