graphql-armory 0.1.0.pre8 → 0.1.0.pre9

data/lib/graphql/armory/persisted_queries.rb

@@ -25,6 +25,16 @@ module GraphQL
       # What a refused request holds: nothing to run.
       EMPTY_DOCUMENT = GraphQL::Language::Nodes::Document.new(definitions: [])
 
+      # What a client reads in `extensions.code`, so an app can tell a refusal from a query that failed for another reason.
+      REFUSAL_CODES = { UNKNOWN_OPERATION => "UNKNOWN_OPERATION", MISMATCH => "OPERATION_MISMATCH", RAW_QUERY_REFUSED => "RAW_QUERY_REFUSED" }.freeze
+
+      # A validation error with its code.
+      class RefusalError < GraphQL::StaticValidation::Error
+        def to_h
+          super.merge("extensions" => { "code" => REFUSAL_CODES.fetch(message, "OPERATION_REFUSED") })
+        end
+      end
+
       # Validates nothing and answers the refusal, through the query's public `static_validator:` option.
       class Refusal < GraphQL::StaticValidation::Validator
         def initialize(schema, message)
@@ -33,14 +43,14 @@ module GraphQL
         end
 
         def validate(_query, **)
-          { errors: [GraphQL::StaticValidation::Error.new(@message)], remaining_timeout: nil }
+          { errors: [RefusalError.new(@message)], remaining_timeout: nil }
         end
       end
 
-      # `store:` answers `fetch(id)` with an operation (`body` and `document`) or nil: a Manifest, or your own.
+      # `store:` answers `fetch(id)` with an operation (`body` and `document`) or nil: a Manifest, a RedisStore, or your own.
       # `strict: true` refuses raw queries unless the context holds `armory_allow_raw_query: true`.
-      def self.use(schema, store:, strict: false, sinks: [])
-        gate = Gate.build(store: store, strict: strict, sinks: sinks)
+      def self.use(schema, store:, strict: false, sinks: [], on_sink_error: nil)
+        gate = Gate.build(store: store, strict: strict, sinks: sinks, on_sink_error: on_sink_error)
 
         if schema.singleton_class.include?(Guard)
           raise ConfigurationError, "#{schema} already uses PersistedQueries (here or in a parent schema): use it once"
@@ -49,6 +59,7 @@ module GraphQL
         schema.instance_variable_set(:@armory_persisted_queries, gate)
         schema.singleton_class.prepend(Guard)
         schema.query_class(schema.query_class)
+        schema.trace_with(BuiltQueries)
       end
 
       # Decides what a request runs: answers `[refusal, document]`, where a refusal is the error message, a
@@ -56,8 +67,8 @@ module GraphQL
       # as it came.
       class Gate
         # Wires the app's store with `use`'s defaults; `use` goes through here.
-        def self.build(store:, strict: false, sinks: [])
-          new(store: store, strict: strict, telemetry: Telemetry.build(sinks: sinks))
+        def self.build(store:, strict: false, sinks: [], on_sink_error: nil)
+          new(store: store, strict: strict, telemetry: Telemetry.build(sinks: sinks, on_sink_error: on_sink_error))
         end
 
         # `new` is inert: with no store wired it refuses every request. It checks what it is given, so it never
@@ -67,7 +78,7 @@ module GraphQL
             raise ConfigurationError, "store: must answer fetch(id) with an operation or nil, like a Manifest"
           end
           raise ConfigurationError, "strict: must be true or false, got #{strict.inspect}" unless strict == true || strict == false
-          raise ConfigurationError, "strict: false needs a store: with the Null store only raw queries would run" if !strict && store.is_a?(Store::Null)
+          raise ConfigurationError, "strict: false needs a store that holds operations: with an empty one only raw queries would run" if !strict && (store.is_a?(Store::Null) || (store.respond_to?(:empty?) && store.empty?))
 
           @store = store
           @strict = strict
@@ -76,30 +87,40 @@ module GraphQL
 
         def call(context, text, document)
           operation_id = context[:operation_id] if context.respond_to?(:[])
+          sink_context = context.respond_to?(:[]) ? context : {}
 
           if !operation_id.nil?
             operation = operation_id.is_a?(String) ? @store.fetch(operation_id) : nil
             if operation.nil?
-              refuse(UNKNOWN_OPERATION, :unknown_operation)
+              refuse(UNKNOWN_OPERATION, :unknown_operation, sink_context)
             elsif document || (text && !same_query?(text, operation))
-              refuse(MISMATCH, :mismatch)
+              refuse(MISMATCH, :mismatch, sink_context)
             else
-              @telemetry.record(:operation_persisted)
+              @telemetry.record(:operation_persisted, context: sink_context)
               [nil, operation.document]
             end
           elsif @strict && !(context.respond_to?(:[]) && context[:armory_allow_raw_query] == true)
-            refuse(RAW_QUERY_REFUSED, :raw_query)
+            refuse(RAW_QUERY_REFUSED, :raw_query, sink_context)
           else
-            @telemetry.record(@strict ? :raw_query_allowed : :raw_query_run) if text || document
+            @telemetry.record(@strict ? :raw_query_allowed : :raw_query_run, context: sink_context) if text || document
             [nil, nil]
           end
         end
 
+        # A query the app built itself, which never went through the lookup. It runs its own text, so an operation id means
+        # nothing on it. Answers the refusal, or nil to let it run.
+        def built_query(context)
+          return refuse(RAW_QUERY_REFUSED, :raw_query, context).first if @strict && context[:armory_allow_raw_query] != true
+
+          @telemetry.record(@strict ? :raw_query_allowed : :raw_query_run, context: context)
+          nil
+        end
+
         private
 
         # The signal says why, never which operation id or query: a client chooses those.
-        def refuse(message, reason)
-          @telemetry.record(:operation_refused, reason: reason)
+        def refuse(message, reason, context)
+          @telemetry.record(:operation_refused, context: context, reason: reason)
           [message, nil]
         end
 
@@ -109,6 +130,21 @@ module GraphQL
         end
       end
 
+      # A `GraphQL::Query` the app builds itself skips the schema's query class. The check sits where a query starts running,
+      # on both engines: an analyzer can be skipped by a variable error, swallowed by another analyzer's ExecutionError, or
+      # ignored with `validate: false`. A `run_partials` answers for the query it came from.
+      module BuiltQueries
+        def execute_query(query:)
+          built = query.respond_to?(:query) ? query.query : query
+          unless Lookup === built
+            refusal = built.schema.armory_persisted_queries.built_query(built.context)
+            raise GraphQL::ExecutionError.new(refusal, extensions: { "code" => REFUSAL_CODES.fetch(refusal) }) if refusal
+          end
+
+          super
+        end
+      end
+
       # Keeps the lookup in every query class the schema uses, including one set after `use` or by a child schema.
       module Guard
         UNSET = Object.new.freeze
@@ -126,7 +162,7 @@ module GraphQL
       end
 
       # The operation id a request sent, from Rack or Rails params: `operationId`, `extensions.operationId` or
-      # Apollo's `extensions.persistedQuery.sha256Hash` (`extensions` may arrive as a JSON string on GET).
+      # Apollo's `extensions.persistedQuery.sha256Hash`, or Relay's `doc_id` (`extensions` may arrive as a JSON string on GET).
       # Answers nil when there is none, or when it is not a non-empty String.
       def self.operation_id(params)
         params = plain(params)
@@ -135,7 +171,7 @@ module GraphQL
         extensions = plain(extensions)
         persisted_query = plain(extensions["persistedQuery"])
 
-        [params["operationId"], extensions["operationId"], persisted_query["sha256Hash"]].find do |candidate|
+        [params["operationId"], extensions["operationId"], persisted_query["sha256Hash"], params["doc_id"]].find do |candidate|
           candidate.is_a?(String) && !candidate.empty?
         end
       end
@@ -174,5 +210,8 @@ module GraphQL
 end
 
 require "graphql/armory/persisted_queries/manifest"
+require "graphql/armory/persisted_queries/manifests"
 require "graphql/armory/persisted_queries/store"
+require "graphql/armory/persisted_queries/redis_store"
+require "graphql/armory/persisted_queries/publisher"
 require "graphql/armory/persisted_queries/controls"

data/lib/graphql/armory/railtie.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module GraphQL
+  module Armory
+    # Makes `rake graphql_armory:audit[YourSchema]` available in a Rails app. Rails is not a dependency: this loads only when it is there.
+    class Railtie < ::Rails::Railtie
+      rake_tasks { load "tasks/graphql_armory.rake" }
+    end
+  end
+end

data/lib/graphql/armory/rate_limits/analysis_guard.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+module GraphQL
+  module Armory
+    module RateLimits
+      # graphql-ruby discards an ExecutionError raised during analysis, drops what every analyzer answered, and runs the query.
+      # A client can choose that by field order when a `complexity:` lambda raises. So on such a raise each limiter still
+      # decides: a refusal already given stands, a limiter not asked yet is asked on its own, and a limiter that cannot answer
+      # refuses the query in hard mode and records `charged: false` in soft mode. Only the analysis of an execution counts: an
+      # analysis the app runs itself takes no slot and charges nothing here. It does not cover a trace that takes no modules
+      # from the schema (`context[:trace]`, or a class given to `trace_mode`).
+      module AnalysisGuard
+        ANSWERS = :limiter_answers
+        ASKED = :limiter_asked
+        ARMED = :limiter_guard_armed
+        NOT_CHARGED = "This query could not be charged to its rate limit."
+
+        # Runs a limiter, keeping per query and per limiter that it was asked and what it answered. A limiter that raised partway
+        # may have charged some of its keys, so it is never asked again.
+        def self.answer(query, limiter)
+          state = query.context.namespace(Points::NAMESPACE)
+          (state[ASKED] ||= {})[limiter] = true
+          (state[ANSWERS] ||= {})[limiter] = yield
+        end
+
+        def self.decide(query, error)
+          analyzers = query.analyzers.select { |analyzer| analyzer.respond_to?(:armory_limiter) }
+          state = query.context.namespace(Points::NAMESPACE)
+          answers = (state[ANSWERS] ||= {})
+          asked = (state[ASKED] ||= {})
+          analyzers.reject { |analyzer| asked.key?(analyzer.armory_limiter) }.each { |analyzer| GraphQL::Analysis.analyze_query(query, [analyzer]) }
+
+          silent = analyzers.map(&:armory_limiter).reject { |limiter| answers.key?(limiter) || exempt?(limiter, query) }
+          silent.each { |limiter| query.context[limiter.class::CONTEXT_KEY] = { limit: nil, soft: limiter.soft?, limited: !limiter.soft?, charged: false } }
+
+          refusals = answers.values.compact
+          return refusals unless refusals.empty?
+          return [] if silent.all?(&:soft?)
+
+          [error.is_a?(GraphQL::AnalysisError) ? error : GraphQL::AnalysisError.new(NOT_CHARGED, extensions: { "code" => "RATE_LIMIT_NOT_CHARGED" })]
+        end
+
+        # A limit that cannot be asked for does not exempt anyone.
+        def self.exempt?(limiter, query)
+          limiter.exempt?(query)
+        rescue GraphQL::ExecutionError, GraphQL::UnauthorizedError
+          false
+        end
+        private_class_method :exempt?
+
+        def analyze_multiplex(multiplex:)
+          multiplex.queries.each { |query| query.context.namespace(Points::NAMESPACE)[ARMED] = true }
+          super
+        end
+
+        # The first analysis of each query in an execution. Any other, nested in it or run by the app, passes through, and
+        # each analyzer is asked apart, so one that raises leaves the others asked.
+        def analyze_query(query:)
+          return super unless query.context.namespace(Points::NAMESPACE).delete(ARMED)
+
+          begin
+            super
+          rescue GraphQL::ExecutionError, GraphQL::UnauthorizedError => error
+            decided(query, error)
+          end
+        end
+
+        private
+
+        def decided(query, error)
+          refusals = AnalysisGuard.decide(query, error)
+          raise error if refusals.empty?
+
+          refusals
+        end
+      end
+    end
+  end
+end

data/lib/graphql/armory/rate_limits/concurrency.rb

@@ -18,20 +18,24 @@ module GraphQL
         CONTEXT_KEY = :rate_limit_concurrency
         NAMESPACE = :graphql_armory
 
-        def self.use(schema, store:, limit:, stale_after: 60, soft: true, key: nil, on_store_error: nil)
-          concurrency = build(store: store, limit: limit, stale_after: stale_after, soft: soft, key: key, on_store_error: on_store_error)
-          schema.query_analyzer(Class.new(Analyzer) { define_method(:concurrency) { concurrency } })
+        def self.use(schema, store:, limit:, stale_after: 60, soft: true, key: nil, on_store_error: nil, sinks: [])
+          concurrency = build(store: store, limit: limit, stale_after: stale_after, soft: soft, key: key, on_store_error: on_store_error, sinks: sinks)
+          schema.query_analyzer(Class.new(Analyzer) do
+            define_method(:concurrency) { concurrency }
+            define_singleton_method(:armory_limiter) { concurrency }
+          end)
           schema.trace_with(Release)
+          schema.trace_with(AnalysisGuard)
         end
 
         # Wires the app's store with `use`'s defaults (soft mode); `use` goes through here.
-        def self.build(store:, limit:, stale_after: 60, soft: true, key: nil, on_store_error: nil)
-          new(store: store, limit: limit, stale_after: stale_after, soft: soft, key: key, on_store_error: on_store_error)
+        def self.build(store:, limit:, stale_after: 60, soft: true, key: nil, on_store_error: nil, sinks: [])
+          new(store: store, limit: limit, stale_after: stale_after, soft: soft, key: key, on_store_error: on_store_error, sinks: sinks)
         end
 
         # `new` is inert: with no store wired it refuses every query. It checks every setting, so no partial
         # configuration lets a query through either.
-        def initialize(store: Store::Null.new, limit: 1, stale_after: 60, soft: false, key: nil, on_store_error: nil)
+        def initialize(store: Store::Null.new, limit: 1, stale_after: 60, soft: false, key: nil, on_store_error: nil, sinks: [])
           unless Settings.store_answers?(store, acquire: %i[token limit ttl force], release: %i[token])
             raise ConfigurationError, "store: must answer acquire(key, token:, limit:, ttl:, force:) and release(key, token:), like a MemoryStore"
           end
@@ -41,7 +45,16 @@ module GraphQL
           @stale_after = Settings.seconds(:stale_after, stale_after)
           @soft = Settings.wired_soft(soft, store)
           @key = Settings.key_reader(key)
-          @on_store_error = Settings.store_error_handler(on_store_error)
+          @on_store_error = Settings.store_error_handler(on_store_error, limiter: :concurrency, sinks: sinks)
+        end
+
+        def soft?
+          @soft
+        end
+
+        # Whether this query's client has no limit to charge.
+        def exempt?(query)
+          Settings.exempt?(@key, @limit, query)
         end
 
         # Takes a slot for the query: the refusal when none is free, or nil to let it run.
@@ -51,6 +64,8 @@ module GraphQL
           end
 
           key = Settings.key_for(@key, query)
+          return call_several(query, key) if key.is_a?(Array)
+
           limit = Settings.limit_for(@limit, key, query)
           if limit.nil?
             record(query, key: key, limit: nil, active: nil, limited: false)
@@ -67,7 +82,7 @@ module GraphQL
           acquired, active = Settings.checked(answer, :acquire, "the Integer slots held")
 
           # Per query, not in the context hash: queries of a multiplex may share one hash.
-          query.context.namespace(NAMESPACE)[:concurrency_slot] = [self, key, token] if acquired || @soft
+          slots_of(query) << [self, key, token] if acquired || @soft
           record(query, key: key, limit: limit, active: active, limited: !acquired)
           refusal(limit, active) unless acquired || @soft
         end
@@ -78,10 +93,73 @@ module GraphQL
           @on_store_error.call(error, query)
         end
 
+        # Gives every slot back, even if one release raises (an on_store_error that raises); the first such error is
+        # raised afterwards.
+        def self.release_all(query, slots)
+          failure = nil
+          slots.each do |concurrency, key, token|
+            concurrency.release(query, key, token)
+          rescue StandardError => error
+            failure ||= error
+          end
+          raise failure if failure
+        end
+
         private
 
+        def slots_of(query)
+          query.context.namespace(NAMESPACE)[:concurrency_slots] ||= []
+        end
+
+        # Takes a slot per key, in order, and stops at the first full key, so a refused client holds a shared key as little
+        # as it can. A refusal gives back what this query took here, at once: a multiplex can run on for long. Each slot is
+        # listed as it is taken, so a raise later on still lets `Release` give it back. A key whose store fails is left out,
+        # and the others still decide.
+        def call_several(query, keys)
+          limits = Settings.limits_for(@limit, keys, query)
+          if limits.empty?
+            record(query, key: keys.first, limit: nil, active: nil, limited: false, keys: [])
+            return nil
+          end
+
+          taken = []
+          held = []
+          limits.each do |key, limit|
+            token = SecureRandom.hex(16)
+            answer = begin
+              @store.acquire(key, token: token, limit: limit, ttl: @stale_after, force: @soft)
+            rescue StandardError => error
+              @on_store_error.call(error, query)
+              next
+            end
+            acquired, active = Settings.checked(answer, :acquire, "the Integer slots held")
+            if acquired || @soft
+              slot = [self, key, token]
+              taken << slot
+              slots_of(query) << slot
+            end
+            held << { key: key, limit: limit, active: active, acquired: acquired }
+            break unless acquired || @soft
+          end
+          return nil if held.empty?
+
+          settle_several(query, held, taken)
+        end
+
+        def settle_several(query, held, taken)
+          full = held.find { |slot| !slot[:acquired] }
+          binding = full || held.max_by { |slot| slot[:active] / slot[:limit].to_f }
+          record(query, key: binding[:key], limit: binding[:limit], active: binding[:active], limited: !full.nil?,
+                        keys: held.map { |slot| slot.slice(:key, :limit, :active) })
+          return unless full && !@soft
+
+          slots_of(query).reject! { |slot| taken.include?(slot) }
+          self.class.release_all(query, taken)
+          refusal(full[:limit], full[:active])
+        end
+
         def record(query, **info)
-          query.context[CONTEXT_KEY] = { **info.slice(:key, :limit, :active), soft: @soft, limited: info[:limited] }
+          query.context[CONTEXT_KEY] = { **info.slice(:key, :limit, :active), soft: @soft, limited: info[:limited], **info.slice(:keys) }
         end
 
         def refusal(limit, active)
@@ -94,7 +172,7 @@ module GraphQL
         # Takes the slot during analysis, before anything runs.
         class Analyzer < GraphQL::Analysis::Analyzer
           def result
-            concurrency.(query)
+            AnalysisGuard.answer(query, concurrency) { concurrency.(query) }
           end
         end
 
@@ -108,12 +186,11 @@ module GraphQL
             # error is raised afterwards.
             failure = nil
             multiplex.queries.each do |query|
-              slots = query.context.namespace(NAMESPACE)
-              concurrency, key, token = slots.delete(:concurrency_slot)
-              next unless concurrency
+              slots = query.context.namespace(NAMESPACE).delete(:concurrency_slots)
+              next unless slots
 
               begin
-                concurrency.release(query, key, token)
+                Concurrency.release_all(query, slots)
               rescue StandardError => error
                 failure ||= error
               end

data/lib/graphql/armory/rate_limits/points.rb

@@ -16,9 +16,13 @@ module GraphQL
         CONTEXT_KEY = :rate_limit_points
         NAMESPACE = :graphql_armory
 
-        def self.use(schema, store:, limit:, window: 60, soft: true, key: nil, on_store_error: nil, extensions: false)
-          points = build(store: store, limit: limit, window: window, soft: soft, key: key, on_store_error: on_store_error, extensions: extensions)
-          schema.query_analyzer(Class.new(Analyzer) { define_method(:points) { points } })
+        def self.use(schema, store:, limit:, window: 60, soft: true, key: nil, on_store_error: nil, sinks: [], extensions: false)
+          points = build(store: store, limit: limit, window: window, soft: soft, key: key, on_store_error: on_store_error, sinks: sinks, extensions: extensions)
+          schema.query_analyzer(Class.new(Analyzer) do
+            define_method(:points) { points }
+            define_singleton_method(:armory_limiter) { points }
+          end)
+          schema.trace_with(AnalysisGuard)
         end
 
         # HTTP headers for the budget a result recorded: `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset`
@@ -35,13 +39,13 @@ module GraphQL
         end
 
         # Wires the app's store with `use`'s defaults (soft mode); `use` goes through here.
-        def self.build(store:, limit:, window: 60, soft: true, key: nil, on_store_error: nil, extensions: false)
-          new(store: store, limit: limit, window: window, soft: soft, key: key, on_store_error: on_store_error, extensions: extensions)
+        def self.build(store:, limit:, window: 60, soft: true, key: nil, on_store_error: nil, sinks: [], extensions: false)
+          new(store: store, limit: limit, window: window, soft: soft, key: key, on_store_error: on_store_error, sinks: sinks, extensions: extensions)
         end
 
         # `new` is inert: with no store wired it refuses every query. It checks every setting, so no partial
         # configuration lets a query through either.
-        def initialize(store: Store::Null.new, limit: 1, window: 60, soft: false, key: nil, on_store_error: nil, extensions: false)
+        def initialize(store: Store::Null.new, limit: 1, window: 60, soft: false, key: nil, on_store_error: nil, sinks: [], extensions: false)
           unless Settings.store_answers?(store, take: %i[cost limit window force])
             raise ConfigurationError, "store: must answer take(key, cost:, limit:, window:, force:), like a MemoryStore"
           end
@@ -52,13 +56,24 @@ module GraphQL
           @window = Settings.seconds(:window, window)
           @soft = Settings.wired_soft(soft, store)
           @key = Settings.key_reader(key)
-          @on_store_error = Settings.store_error_handler(on_store_error)
+          @on_store_error = Settings.store_error_handler(on_store_error, limiter: :points, sinks: sinks)
           @extensions = extensions
         end
 
+        def soft?
+          @soft
+        end
+
+        # Whether this query's client has no limit to charge.
+        def exempt?(query)
+          Settings.exempt?(@key, @limit, query)
+        end
+
         # The refusal for a query that costs `cost`, or nil to let it run.
         def call(query, cost)
           key = Settings.key_for(@key, query)
+          return call_several(query, key, cost) if key.is_a?(Array)
+
           limit = Settings.limit_for(@limit, key, query)
           if limit.nil?
             record(query, key: key, cost: cost, limit: nil, remaining: nil, limited: false)
@@ -76,19 +91,70 @@ module GraphQL
           taken, remaining = Settings.checked(answer, :take, "the Integer points left")
 
           info = record(query, key: key, cost: cost, limit: limit, remaining: remaining, limited: !taken)
-          if @extensions
-            query.context.response_extensions["rateLimit"] =
-              { "cost" => cost, "limit" => limit, "remaining" => remaining, "resetIn" => self.class.reset_in(info) }
-          end
+          announce(query, info, cost) if @extensions
           refusal(cost, limit, remaining) unless taken || @soft
         end
 
         private
 
+        # Reads every balance first, so a query one key refuses leaves the others as they were, then charges each key.
+        # Two queries can race between the two steps: then the refused one leaves the other keys charged. A key whose store
+        # fails is left out, and the others still decide: an attacker who can pick a dead shard must not cancel a refusal.
+        def call_several(query, keys, cost)
+          limits = Settings.limits_for(@limit, keys, query)
+          if limits.empty?
+            record(query, key: keys.first, cost: cost, limit: nil, remaining: nil, limited: false, keys: [])
+            return nil
+          end
+
+          read = takes(query, limits, 0, false) unless @soft
+          budgets = if read&.any? { |budget| budget[:remaining] < cost }
+                      read
+                    else
+                      takes(query, read ? read.to_h { |budget| budget.values_at(:key, :limit) } : limits, cost, @soft, charging: true)
+                    end
+          if budgets.empty?
+            query.context[CONTEXT_KEY] = nil
+            return nil
+          end
+
+          refused = budgets.select { |budget| budget.fetch(:taken) { budget[:remaining] >= cost } == false }
+          binding = binding_budget(refused, cost) || budgets.min_by { |budget| budget[:remaining] }
+          limited = !refused.empty?
+          info = record(query, key: binding[:key], cost: cost, limit: binding[:limit], remaining: binding[:remaining], limited: limited,
+                               keys: budgets.map { |budget| budget.slice(:key, :limit, :remaining) })
+          announce(query, info, cost) if @extensions
+          refusal(cost, binding[:limit], binding[:remaining]) if limited && !@soft
+        end
+
+        # What the store answers for each key, without the keys whose store failed.
+        def takes(query, limits, cost, force, charging: false)
+          limits.filter_map do |key, limit|
+            answer = begin
+              @store.take(key, cost: cost, limit: limit, window: @window, force: force)
+            rescue StandardError => error
+              @on_store_error.call(error, query)
+              next
+            end
+            taken, remaining = Settings.checked(answer, :take, "the Integer points left")
+            { key: key, limit: limit, remaining: remaining, **(charging ? { taken: taken } : {}) }
+          end
+        end
+
+        # What the client is told: a key that can never pay, otherwise the longest wait.
+        def binding_budget(refused, cost)
+          refused.find { |budget| cost > budget[:limit] } || refused.max_by { |budget| (cost - budget[:remaining]) / budget[:limit].to_f }
+        end
+
+        def announce(query, info, cost)
+          query.context.response_extensions["rateLimit"] =
+            { "cost" => cost, "limit" => info[:limit], "remaining" => info[:remaining], "resetIn" => self.class.reset_in(info) }
+        end
+
         # In the context hash for instrumentation, and per query for `headers`: queries of a multiplex may share one
         # context hash, where the last query's record wins.
         def record(query, **info)
-          info = { **info.slice(:key, :cost, :limit, :remaining), window: @window, soft: @soft, limited: info[:limited] }
+          info = { **info.slice(:key, :cost, :limit, :remaining), window: @window, soft: @soft, limited: info[:limited], **info.slice(:keys) }
           query.context.namespace(NAMESPACE)[:points] = info
           query.context[CONTEXT_KEY] = info
         end
@@ -110,14 +176,25 @@ module GraphQL
 
         # graphql-ruby's own complexity analysis, then the charge.
         class Analyzer < GraphQL::Analysis::QueryComplexity
+          # graphql-ruby's words when a connection has no `first:`, `last:` or page size. A client can send that, so it answers
+          # an error for the client and not a server error. Nothing is charged, and any other error while scoring still raises.
+          UNSIZED_CONNECTION = "Can't calculate complexity for "
+
           def result
-            cost = super
+            cost = begin
+              super
+            rescue GraphQL::Error => error
+              raise unless error.instance_of?(GraphQL::Error) && error.message.start_with?(UNSIZED_CONNECTION)
+
+              query.context[CONTEXT_KEY] = nil
+              return AnalysisGuard.answer(query, points) { GraphQL::AnalysisError.new("This connection needs first: or last:", extensions: { "code" => "PAGE_SIZE_REQUIRED" }) }
+            end
             unless cost.is_a?(Numeric) && cost.finite? && !cost.negative?
               raise ConfigurationError, "the query complexity is #{cost.inspect}: field complexities must be numbers of zero or more"
             end
 
             # Fractional complexities (`complexity: 0.5`) are charged whole points, rounded up.
-            points.(query, cost.ceil)
+            AnalysisGuard.answer(query, points) { points.(query, cost.ceil) }
           end
         end
       end