graphql-armory 0.1.0.pre9 → 0.1.0.pre10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3200e9b549bc6bb3b7f77d1905fb79a9d41b59d4730452300437572b4c7cdfe3
-  data.tar.gz: 3653d86878c2395602ac78e48f70266cc89ea42d0f393eb122542e958466e36a
+  metadata.gz: 306b875ce5c7b3b423266aac6acad20df8cff2fcfb2de8bd2fd617f18f06ee0a
+  data.tar.gz: 4850e8b8d61f40d0bfe87a25326b5af43a12415c73dc3fcabdfddb1b861cd393
 SHA512:
-  metadata.gz: aa7fbc795c731c4f11cd8e6a002b3178f377ef97caa1669771b8a641a7a2860a9fdf49525f49d25fcb0eaced66901cace0b74bb8acfe05918f456421bbc4d0e6
-  data.tar.gz: c828ed91f9bd66f7856d603e33f8e44ce875861be873061e4ae016b9b6b3714bb6daeb0001a8862fef1c9b21134a7c80476ec861f18dee25a015bf67218bcb7c
+  metadata.gz: 197340f48f89963609828eff4da2250a56c49bd7946546fafccb1aae03a8fa0743c4850ae24b5df7e780f89d29633c42b380c0326838ecdd8389b4693efd8f3a
+  data.tar.gz: b3343756c445fb47b688afc126181cefd94d448396324ac310392a3bbda5a5d17ce789979560fa6761f28d6491d62ddcb4d94a8c9befe9da11ac0ce557056f48

data/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## 0.1.0.pre10 (2026-11-03)
+
+This release closes the ways a client could make an analysis refusal disappear, and makes clients pay for the invalid queries they send. Anyone using [rate limits](docs/rate-limiting.md) together with `max_depth`, `max_complexity` or their own analyzers should read Breaking before upgrading: a query whose analysis keeps raising is now refused instead of run. [Keyset connections](docs/keyset-connections.md) now check the cursor encoder when the app loads.
+
+### Breaking
+
+- On a schema with a rate limiter, an analysis refusal is no longer lost when an analyzer or a `complexity:` lambda raises `ExecutionError`, which a client could choose by asking for that field. A `max_depth` or `max_complexity` refusal, or one another analyzer returned, stands; an `AnalysisError` raised from `result` keeps its message. Any query analyzer that keeps raising when asked again, including `max_complexity` with a raising lambda and your own maximums, refuses the query with `QUERY_LIMIT_UNKNOWN`, in soft mode too. When a raise stops the visit, a query in a multiplex with multiplex analyzers (such as `Schema.multiplex` with `max_complexity`) is refused the same way. To upgrade: if an analyzer or a lambda raises on honest queries, move that check to the field. Limits: a schema with no rate limiter keeps graphql-ruby's behaviour, and an analyzer that remembers in the context that it already refused still loses that refusal. See [Guarantees and limits](docs/rate-limiting.md#guarantees-and-limits). (#49, #53)
+- Invalid queries are now charged. A syntax error, a validation error, no query string or a strict `PersistedQueries` refusal costs `invalid_cost:` points on `Points` (default 1; `nil` turns it off) and, on `Time`, a share of the time of a multiplex where no query ran. Its answer does not change: this penalises the next valid query and does not stop a flood. To upgrade: clients that send many invalid queries spend more, so read `context[:rate_limit_points]` in soft mode first. (#51)
+
+### Added
+
+- `use GraphQL::Armory::Keyset` checks the cursor encoder when the schema loads, and any encoder set later on it or on a subclass, each member of an encoder chain included. It refuses an encoder that does not round trip, leaves the text readable, has a fixed key or nonce, or decodes forged text; it cannot prove encryption. `plain_cursors: true` on `use` becomes the default for `build`. Without `use` nothing changes. See [Checking the encoder](docs/keyset-connections.md#checking-the-encoder-when-the-app-loads). (#52)
+
+### Docs
+
+- How to audit a schema before adopting the plugin and what to fix first, in [Authorization](docs/authorization.md#measuring-before-you-adopt); a missing rate limit key raises when the query runs, in [Rate limiting](docs/rate-limiting.md). Specs that need Redis skip without `REDIS_URL` outside CI. (#50)
+
 ## 0.1.0.pre9 (2026-11-02)
 
 This release is about adopting the gem on a real schema, and about limits that hold when a client tries to get around them. An existing app can now [observe a new rule](docs/authorization.md) before enforcing it and keep the audit green on known problems with a baseline; persisted queries can be published without a server deploy and from several manifests ([persisted queries](docs/persisted-queries.md)); and [rate limits](docs/rate-limiting.md) take several keys per query, against clients that rotate one identity. Anyone running the audit or rate limits in hard mode should read Breaking and Security before upgrading.

data/README.md

@@ -6,12 +6,12 @@
 
 Open-source extensions for [graphql-ruby](https://github.com/rmosolgo/graphql-ruby), built on its public extension points: no fork, no monkey patching. One gem, one module at a time; each module has its own page in [`docs/`](docs) with the problem it solves, how to use it, and its limits.
 
-> **Status: early development.** Prereleases on RubyGems (`0.1.0.pre9`). The API may change before 1.0.
+> **Status: early development.** Prereleases on RubyGems (`0.1.0.pre10`). The API may change before 1.0.
 
 ## Install
 
 ```ruby
-gem "graphql-armory", "~> 0.1.0.pre9"  # a prerelease: `gem install graphql-armory --pre`
+gem "graphql-armory", "~> 0.1.0.pre10"  # a prerelease: `gem install graphql-armory --pre`
 gem "pundit"      # or "cancancan", for the authorization module
 ```
 
@@ -26,8 +26,8 @@ Status: ✅ released, 🚧 in progress, ⬜ not started. Update this table in th
 | 1 | Authorization (Pundit, CanCanCan) | ✅ | [docs/authorization.md](docs/authorization.md) | Released in 0.1.0.pre2 (prerelease). Pundit and CanCanCan (the audit checks less with CanCanCan). Global IDs in `loads:` decoded through `object_from_id`; `loads:` inside input objects scoped with `include Base`. `Execution::Next` needs graphql >= 2.6.2. |
 | 2 | Encrypted, versioned IDs and cursors | ✅ | [docs/encrypted-ids.md](docs/encrypted-ids.md) | Released in 0.1.0.pre4 (prerelease). `Encoder` (AES-256-GCM), versioned chains and `Legacy`, `Encoder.default` (ENV or Rails), `use GraphQL::Armory::IDs`. Composite primary keys not supported. |
 | 3 | Persisted queries / operation allowlist | ✅ | [docs/persisted-queries.md](docs/persisted-queries.md) | Released in 0.1.0.pre4 (prerelease). Operations can be published without a server deploy (`RedisStore`, unreleased). Allowlist from a build manifest (Apollo, Relay), `use GraphQL::Armory::PersistedQueries` with strict mode. A runtime store (database, sync endpoint) is planned for later. |
-| 4 | Rate limiting | ✅ | [docs/rate-limiting.md](docs/rate-limiting.md) | Released in 0.1.0.pre5 (prerelease); `RateLimits::Time` in 0.1.0.pre6. Points per client (query complexity) and operations at the same time, `MemoryStore` and `RedisStore`, the budget in response extensions and headers. `RateLimits::Time` charges the wall-clock milliseconds operations take. |
-| 5 | Stable (keyset) connections | ✅ | [docs/keyset-connections.md](docs/keyset-connections.md) | Released in 0.1.0.pre7 (prerelease). `Keyset.build(relation)` per resolver, ActiveRecord only, plain non-null columns of the relation's own table. Base64 cursors refused unless `plain_cursors: true`. No total count. |
+| 4 | Rate limiting | ✅ | [docs/rate-limiting.md](docs/rate-limiting.md) | Released in 0.1.0.pre5 (prerelease); `RateLimits::Time` in 0.1.0.pre6. Points per client (query complexity) and operations at the same time, `MemoryStore` and `RedisStore`, the budget in response extensions and headers. `RateLimits::Time` charges the wall-clock milliseconds operations take. Invalid queries are charged `invalid_cost:` from 0.1.0.pre10. |
+| 5 | Stable (keyset) connections | ✅ | [docs/keyset-connections.md](docs/keyset-connections.md) | Released in 0.1.0.pre7 (prerelease). `Keyset.build(relation)` per resolver, ActiveRecord only, plain non-null columns of the relation's own table. Base64 cursors refused unless `plain_cursors: true`. No total count. `use` checks the cursor encoder when the schema loads, from 0.1.0.pre10. |
 | 6 | Subscriptions over Pusher / Ably | ⬜ | | Research not started. |
 | 7 | Response caching | ⬜ | | Research not started. |
 | 8 | API versioning (changesets) | ⬜ | | Research not started. |

data/docs/authorization.md

@@ -271,6 +271,41 @@ expect(AppSchema).to be_fully_authorized(baseline: "config/graphql_armory_baseli
 
 Run `audit_baseline` again after fixing problems: on a file that exists it only removes what is gone, and it never adds. To accept a new problem, edit the file by hand, so it shows in the pull request: add its kind, path and message as the output prints them; `count` and `covers` may be left out, and then the entry accepts one problem that reaches nothing, so run `audit_baseline` afterwards to fill them in. The file holds each problem's kind, path, message and count, and the names it reaches (`covers`), and no data of the app. Removing what a problem reaches is fine: running `audit_baseline` narrows the entry.
 
+### Measuring before you adopt
+
+With no plugin, the audit reports little more than `:plugin` and each base class without `Base`. To see the real list, audit the schema as if it had adopted the plugin, without touching what runs in production:
+
+```ruby
+# script/armory_audit.rb. Run it on its own, never in the process of your app or of your other specs.
+require_relative "../config/environment"
+Rails.application.eager_load!
+
+z = GraphQL::Armory::Authorization
+[Types::BaseObject, Types::BaseField, Types::BaseArgument, Types::BaseInputObject, Mutations::BaseMutation].each { |base| base.include(z::Base) }
+Types::BaseObject.default_action(:read)
+
+simulated = Class.new(AppSchema) do
+  use z, adapter: :pundit,
+         own_checks: { Types::BaseField => { authorized?: "adds the status check, then calls super" } }
+end
+
+path = "config/graphql_armory_baseline.json"
+report = z::Audit.(simulated)
+z::Audit::Baseline.write(report, path) unless File.exist?(path) # once; commit the file
+result = z::Audit::Baseline.load(path).(report)
+puts result.new_problems
+exit(result.passes? ? 0 : 1)
+```
+
+`Class.new(AppSchema)` leaves `AppSchema` without the plugin, but `include(z::Base)` changes your base classes for the whole process, so its queries no longer behave as in production. That is why the script runs alone. Name your own classes and your user key (`z::Adapters::Pundit.new(user_key: :viewer)` if it is not `current_user`). The first run stops with an error if an undeclared own check or hook remains: declare it or remove it, then run it again. A simulation measures; it protects nothing until the plugin is really installed.
+
+What to do first with a long list:
+
+1. **`:hook` and `:own_check`.** A baseline refuses them. Remove the method, or declare it with its reason. A declaration is your word: the audit does not read whether your check runs.
+2. **`:unscoped_list` and `:unscoped_load`.** These reach data of other users once a rule is in place.
+3. **`:no_rule` on mutations, with `:field_without_rule` on their payloads.** Without a rule, the field of a payload is denied: when the mutation is public and writes, the client gets `null` and cannot tell whether it worked. A rule on the mutation covers its payload, and a public one declares `authorize :none, reason: "...", covers_fields: true`.
+4. **`:model`.** Usually the longest part of the list, and the slowest: each type needs a model and a policy.
+
 ### Redefined fields and arguments
 
 When a field is hidden from a user, by `visible?` or anything else, and the request carries no visibility profile, graphql-ruby does not answer "no such field": it looks for another definition of that name and serves it. So this rule does not run for a user the child's field is hidden from:

data/docs/keyset-connections.md

@@ -38,6 +38,21 @@ If the ordering values are not secret (a public list ordered by id), you can kee
 GraphQL::Armory::Keyset.build(Article.order(:id), plain_cursors: true)
 ```
 
+### Checking the encoder when the app loads
+
+Without more, a schema that cannot keep cursors private is refused on the first keyset page, in a request. `use` moves that to when the schema class loads, and looks further than the default encoder:
+
+```ruby
+class AppSchema < GraphQL::Schema
+  cursor_encoder AppEncoder
+  use GraphQL::Armory::Keyset # below cursor_encoder
+end
+```
+
+It probes the encoder, and refuses one that does not give back what it encoded, leaves the text readable (plain, Base64 or hex, also behind a prefix, ROT13, reversed), changes only part of its output when the input changes (a fixed key, or a real cipher with a fixed nonce or IV), or decodes forged text. Any encoder set later on that schema or on a subclass goes through the same check.
+
+`use GraphQL::Armory::Keyset, plain_cursors: true` turns the check off and makes readable cursors the schema's default. Then `Keyset.build(relation)` needs no option of its own, and an explicit `plain_cursors:` on `build` still wins.
+
 ### What it can order by
 
 The relation must be ordered by plain, non-null columns of its own table. The primary key is added as the last column, to break ties, so a relation with no order pages by primary key. `build` raises `Keyset::ConfigurationError` for:
@@ -64,10 +79,14 @@ If your own type defines `scope_items`, it receives the `Keyset` object and not
 
 ## Reference
 
-`GraphQL::Armory::Keyset.build(relation, plain_cursors: false)`
+`use GraphQL::Armory::Keyset, plain_cursors: false`, optional, on a schema.
+
+- `plain_cursors:` is `true` or `false`. `true` skips the check and is what `build` follows when it is given none. A subclass inherits it, and its own `use` replaces it.
+
+`GraphQL::Armory::Keyset.build(relation, plain_cursors: nil)`
 
 - `relation`: an ActiveRecord relation, checked as above.
-- `plain_cursors:` is `true` or `false`. `true` allows the schema's default Base64 encoder.
+- `plain_cursors:` is `true`, `false` or `nil`. `true` allows the schema's default Base64 encoder. `nil` follows the schema's `use`, or `false` with no `use`.
 
 Errors:
 
@@ -75,6 +94,7 @@ Errors:
 |---|---|
 | Boot or resolver, a relation it cannot page | `Keyset::ConfigurationError` |
 | First page, the schema has the default encoder and no `plain_cursors: true` | `Keyset::ConfigurationError` |
+| `use` or a later `cursor_encoder`, an encoder that fails the check | `Keyset::ConfigurationError`, naming an error's class and never its message |
 | A cursor that is tampered, malformed, or made for another ordering | `Invalid ID or cursor`, the same for all |
 | `first` and `last` together | `first and last cannot be used together` |
 
@@ -83,8 +103,12 @@ Errors:
 - Every row present for the whole walk is seen exactly once, whatever is inserted or deleted meanwhile.
 - A row whose ordering value **changes** between pages can be skipped or seen twice: it really moved. Order by columns that do not change (a creation time, an id) when this matters.
 - A row inserted behind the cursor is not seen on the way forward, as in any pagination.
-- The encoder check runs on the first page, not at boot, because the connection reads the encoder from the schema of the query.
-- The check only knows the default Base64 encoder. A custom encoder that does not encrypt passes unnoticed: a keyset cursor is only as private as your `cursor_encoder`.
+- With no `use`, the encoder check runs on the first page and only knows the default Base64 encoder: a custom encoder that does not encrypt passes unnoticed.
+- With `use`, the check runs when the schema class loads, which is not boot if your app autoloads it lazily, and it cannot prove encryption: a keyed cipher that fails none of the probes passes, sound or not. A keyset cursor is only as private as your `cursor_encoder`.
+- The check calls your encoder when the schema loads, so an encoder whose key is not there yet (during `assets:precompile`, or set in a later initializer) is refused. Fix the load order, or leave out `use` for that step: the check on the first page stays.
+- Every member of an `Encoder.versioned` chain is checked on its own, because each one decodes what a client sends. `Encoder.versioned(New, Encoder::Legacy)` is refused: during such a migration a client can read and make its own cursors, so state it with `plain_cursors: true`.
+- `use` checks the encoders set after it. A subclass that already set its own encoder before `use` ran on its parent is not checked: put `use` in the base schema, before any subclass is defined.
+- A `Keyset` subclass that overrides `encode` or `decode` is not checked. Setting the encoder through `instance_variable_set` is not checked.
 - With `plain_cursors: true` a client can read the ordering values and forge a cursor. It stays inside the scope and its values are bound, never interpolated, but it can probe those columns.
 - A forged value on a plain cursor must have the form the column's own cursors have (an Integer, a plain decimal, an ISO 8601 date or time) or it is an invalid cursor. A forged value of the right form is honoured: it pages from there.
 - Encryption keeps length, so the length of an encrypted cursor reveals roughly the length of a string ordering value.

data/docs/rate-limiting.md

@@ -277,6 +277,8 @@ store.calls                                         # [[:take, "user:1", { cost:
 - `window:` positive seconds over which `limit` points refill, continuously.
 - `soft:` `true` (default) charges and records without refusing; `false` refuses.
 - `key:` a callable `(query)` answering the client key; by default `context[:rate_limit_key]`. It must be a non-empty String, or a list of up to 5 different ones for all three limiters: a query runs only if every key allows it. The record, the headers and the extensions show the key that binds, and the record adds `keys:` with each one. The refusals a client sees never name a key. Without one, the query raises `ConfigurationError`, on every query: a key built from something that can be nil (an IP behind a misconfigured balancer) needs a fallback, such as `context[:rate_limit_key] = request.remote_ip.presence || "unknown"`, where all such clients share one bucket.
+- A query with no key raises `RateLimits::ConfigurationError` when it runs, not at boot, so a controller that forgets the key, or a `request.remote_ip` that comes out nil behind a load balancer, breaks every query that reaches the limiter. Cover each controller with a request spec.
+- `invalid_cost:` on `Points`, a positive Integer or nil: the points an invalid query costs. Default 1; nil charges nothing.
 - `on_store_error:` a callable `(error, query)` called when the store raises; the query then runs (fails open). By default it warns.
 - `sinks:` callables that hear `:rate_limit_store_failed` when the store raises; see [Telemetry](telemetry.md#rate-limiting).
 - `extensions:` `true` adds `"rateLimit" => { cost, limit, remaining, resetIn }` to every response of a limited client; `false` (default) leaves responses unchanged.
@@ -311,11 +313,12 @@ Invalid settings raise `RateLimits::ConfigurationError` at boot.
 
 ## Guarantees and limits
 
-- A query this limiter refuses resolves no field and is not charged. A query that fails validation is not charged. A query refused by another analyzer (`max_depth`, `max_complexity`) is still charged: graphql-ruby runs every analyzer.
+- A query this limiter refuses resolves no field and is not charged. A query refused by another analyzer (`max_depth`, `max_complexity`) is still charged: graphql-ruby runs every analyzer.
 - Each query in a multiplex is charged on its own.
 - With several keys, `Points` reads every balance and then charges, so a refused query leaves the others as they were. Two queries racing between those steps can leave a refused one having charged other keys. `Concurrency` gives back the slots a refused query took at once. `Time` charges every key the whole time; a store failure on one key does not stop the others.
-- An `ExecutionError` raised during analysis, which graphql-ruby would discard before running the query, does not skip a limiter. A refusal already given stands. A limiter not asked yet is asked on its own, so another analyzer's raise leaves the query charged and running as before. A limiter that cannot answer, because a `complexity:` lambda or its `on_store_error` hook raised, refuses the query in hard mode with the code `RATE_LIMIT_NOT_CHARGED`, and in soft mode lets it run and records `charged: false`. A client with no limit still runs, and a query with no key raises `ConfigurationError`. When a query takes this path it is visited once more per limiter not asked yet, so a `complexity:` lambda can run several times, `key:` and `limit:` are asked again, and a validation timeout can take longer. An analysis your app runs itself outside an execution charges nothing here. A trace that takes no modules from the schema (`context[:trace]` or a class given to `trace_mode`) is outside this: `Points` is not protected on such a trace.
-- A `max_depth` or `max_complexity` refusal is not a limiter's, so it is lost when an analyzer or a `complexity:` lambda raises `ExecutionError`: graphql-ruby discards every analyzer's answer and runs the query. If a lambda raises for a field a client can pick, the client can choose this. Do not raise `ExecutionError` from a lambda or an analyzer: have the analyzer's `result` return a `GraphQL::AnalysisError`.
+- An invalid query (a syntax error, a validation error including a variable of the wrong type or a missing required one, no query string, or a refusal from `PersistedQueries` in strict mode) is charged `invalid_cost:` points after it answers; its answer does not change. This penalises the client's next valid query: it does not stop a flood of invalid ones, which are parsed and validated all the same, and a bucket stops at zero. A query the analyzers refused is not invalid: it is charged as before, also when a multiplex analyzer refuses the whole multiplex. Keys are charged in list order, as if the queries had come one at a time: a key that cannot pay all of it pays what it holds, and the keys after it pay only that much, so sending invalid queries together never costs a client less than sending them apart. Put the narrowest key first: a client with nothing left cannot keep draining a bucket it shares. Keys must not depend on the document or the variables, which an invalid query may not have. Failures here, including a query with no key, go to `on_store_error` and never replace the answer, so a missing key on an invalid query does not raise. A trace does this after the multiplex, also when an exception ends it early: then queries that never reached validation are validated to find the invalid ones. A query run with its own trace (`context[:trace]`, or a class given to `trace_mode`) is not charged.
+- An `ExecutionError` raised during analysis, which graphql-ruby would discard before running the query, does not skip a limiter. A refusal already given stands. A limiter not asked yet is asked on its own, so another analyzer's raise still charges the query. A limiter that cannot answer, because a `complexity:` lambda or its `on_store_error` hook raised, refuses the query in hard mode with the code `RATE_LIMIT_NOT_CHARGED`, and in soft mode lets it run and records `charged: false`. A client with no limit still runs, and a query with no key raises `ConfigurationError`. When a query takes this path it is visited once more per limiter not asked yet and per other analyzer (see below), so a `complexity:` lambda can run several times, `key:` and `limit:` are asked again, and a validation timeout can take longer. An analysis your app runs itself outside an execution charges nothing here. A trace that takes no modules from the schema (`context[:trace]` or a class given to `trace_mode`) is outside this: `Points` is not protected on such a trace.
+- On the same path every query analyzer that is not a limiter is then asked on its own. A refusal it returns stands, such as a `max_depth` or `max_complexity` refusal, and so does an `AnalysisError` it raises from `result`, with its own message. One that raises anything else again cannot answer, and the query is refused with the code `QUERY_LIMIT_UNKNOWN`, in soft mode and for a client with no limit too, because otherwise a client could get past that analyzer by asking for the field that makes it raise. That covers `max_complexity` with a `complexity:` lambda that raises and your own maximums alike. So do not raise `ExecutionError` from a `complexity:` lambda or an analyzer: an authorization check belongs in the field. Multiplex analyzers, including a `max_complexity` for a whole multiplex (which `Schema.multiplex` takes from the schema by default), cannot be asked again. When a raise stopped the visit before its end, a query in a multiplex with any multiplex analyzer is refused the same way. A lambda raises after the visit, when the multiplex analyzers have seen the whole query, so it is not refused for that. Each analyzer is asked once more at most, each with the whole remaining validation timeout, so a query on this path can take one more visit per analyzer, and an analyzer with side effects repeats them. After a validation timeout no other analyzer is asked again, since the query is already refused; a limiter not asked yet still is. Limits: this needs a rate limiter on the schema, since a schema with none keeps graphql-ruby's behaviour and the refusal is lost. An analyzer's refusal stands only if it answers the same way when asked again: one that remembers in the context that it already refused is lost. A refusal an analyzer raises as `AnalysisError` during the visit, followed by an `ExecutionError` from the same analyzer, becomes `QUERY_LIMIT_UNKNOWN` without its message. The multiplex analyzers keep the part of a refused query they saw before its visit raised, though it does not run.
 - On `Execution::Next`, `validate: false` ignores every refusal from analysis, the limiters' included. Never pass it for a client's query.
 - A field with `max_page_size: nil` under a schema with `default_max_page_size` is sized by that default, while at runtime it has no maximum, so it is charged less than it returns. Give such a field a number.
 - An `ExecutionError` from a multiplex analyzer's `result` raises to your app: nothing runs and no slot stays held.
@@ -340,7 +343,7 @@ Invalid settings raise `RateLimits::ConfigurationError` at boot.
 - A multiplex has one measured time, split equally among the queries this limiter charges, rounded up to whole milliseconds: fields of different queries interleave, so their time cannot be told apart. A query refused by `Time`, and one whose key has no limit (`nil`), are not part of the split, so the time of a query with no limit is carried by the limited ones.
 - A schema may `use Time` more than once, with different stores or keys (for example per user and per IP): each limiter charges only its own. `context[:rate_limit_time]`, the response extension and `Time.headers` then hold the record of the last one.
 - The clock must answer a finite number of seconds: one that does not is refused at boot, and one that breaks later raises instead of letting operations run uncharged. A clock that stands still or goes backwards charges 0.
-- Time spent before analysis finishes (parsing, validation) is charged to no one, and inside a multiplex it ends up on the queries that did run. A query that never reaches analysis (a syntax error) costs the client nothing.
+- Time spent before analysis finishes (parsing, validation) is charged to no one, and it is part of what a multiplex splits. Invalid queries pay time only in a multiplex with no query that ran: there they split it, charged like on `Points` (a key that cannot pay all of its share pays what it holds, and the keys after it pay only that much). Next to a query that ran they pay no time, so padding a multiplex with invalid queries never lowers what that query pays.
 - The time is wall-clock, so it grows when the server is loaded: the same query costs a client more on a busy server. Choose `limit` with that in mind, and start in soft mode.
 - A query run with its own trace (`context: { trace: ... }`) cannot be charged, so it raises `ConfigurationError`, as with `Concurrency`.
 - When the store fails, operations run unlimited and `on_store_error` is called; a failed charge never raises into the query (unless your hook does).

data/lib/graphql/armory/keyset/encoder_check.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require "json"
+
+module GraphQL
+  module Armory
+    class Keyset < GraphQL::Pagination::Connection
+      # Asks an encoder whether it can keep a keyset cursor private, raising `ConfigurationError` when it cannot. It catches
+      # what is common: no encryption, a reversible form, a fixed key, and a chain that decodes forged text. It cannot prove
+      # encryption. It has no dependencies, so `new` is ready at once and there is nothing to `build`.
+      class EncoderCheck
+        NEEDLE = "graphql-armory-probe"
+        # Shaped like a real cursor, because an encoder may parse what it is given. They differ in their first value.
+        PROBE = JSON.generate({ "v" => 1, "o" => "0" * 32, "k" => ["#{NEEDLE}-values"] }).freeze
+        # Differ from PROBE near the start and at the end: a chained mode with a fixed IV changes every block after a change
+        # near the start, and only the last block after a change at the end.
+        OTHERS = [PROBE.sub('"v":1', '"v":2'), PROBE.sub('-values"', '-valuez"')].map(&:freeze).freeze
+
+        def self.call(encoder)
+          new.(encoder)
+        end
+
+        def call(encoder)
+          # Every member of a chain decodes what a client sends, so each one is checked on its own.
+          encoder.encoders.each { |member| call(member) } if encoder.is_a?(Encoder::Versioned)
+          first = encoded(encoder, PROBE)
+          refuse("does not give back what it encoded") unless decoded(encoder, first) == PROBE
+          refuse("leaves the cursor readable: it holds the ordering values") if readable?(first)
+          if OTHERS.any? { |other| local?(first, encoded(encoder, other)) }
+            refuse("changes only part of its output when the input changes, as a fixed key or a fixed nonce does")
+          end
+          refuse("decodes forged text, so a client can make its own cursors") if forged?(encoder)
+          nil
+        rescue ConfigurationError => error
+          raise if error.equal?(@refusal)
+
+          refuse("could not be probed: #{error.class}")
+        rescue StandardError, NotImplementedError => error
+          # The class only: an encoder's message may hold a key.
+          refuse("could not be probed: #{error.class}")
+        end
+
+        private
+
+        def encoded(encoder, text)
+          answer = encoder.encode(text, nonce: true)
+          answer.is_a?(String) ? answer.b : refuse("answers #{answer.class}, not a String")
+        end
+
+        def decoded(encoder, text)
+          answer = encoder.decode(text, nonce: true)
+          answer.is_a?(String) ? answer.b : answer
+        end
+
+        def readable?(output)
+          needle = NEEDLE.b
+          [output, output.reverse, output.tr("A-Za-z", "N-ZA-Mn-za-m")].any? do |form|
+            ([form, form.delete("\0")] + unpacked(form)).any? { |text| text.include?(needle) }
+          end
+        end
+
+        # Each long run of Base64 or hex inside the output, decoded from every offset, so a prefix of any length does not hide it.
+        def unpacked(form)
+          base64 = form.scan(%r{[A-Za-z0-9+/_-]{16,}}).flat_map do |run|
+            (0..3).map { |offset| run[offset..].tr("-_", "+/").unpack1("m").b }
+          end
+          hex = form.scan(/\h{16,}/).flat_map { |run| (0..1).map { |offset| [run[offset..]].pack("H*").b } }
+          base64 + hex
+        end
+
+        # A one-byte change near the start changes most of what a sound encoder answers.
+        def local?(one, other)
+          size = [one.size, other.size].max
+          changed = (0...size).count { |index| one.getbyte(index) != other.getbyte(index) }
+          changed < size / 2
+        end
+
+        def forged?(encoder)
+          [PROBE, [PROBE].pack("m0"), [PROBE].pack("m0").tr("+/", "-_").delete("=")].any? do |forgery|
+            decoded(encoder, forgery) == PROBE.b
+          rescue StandardError
+            false
+          end
+        end
+
+        # Remembers its own refusal, so an encoder that raises a ConfigurationError of its own is named by class, like any other.
+        def refuse(what)
+          @refusal = ConfigurationError.new(
+            "this cursor_encoder #{what}. A keyset cursor holds the row's ordering values: use a GraphQL::Armory::Encoder " \
+            "subclass, or `use GraphQL::Armory::Keyset, plain_cursors: true` if those values are not secret"
+          )
+          raise @refusal
+        end
+      end
+
+      # What `use GraphQL::Armory::Keyset` adds to a schema. A subclass inherits it, so an encoder set there is checked too.
+      module SchemaChecks
+        def armory_keyset_plain_cursors
+          return @armory_keyset_plain_cursors unless @armory_keyset_plain_cursors.nil?
+
+          superclass.respond_to?(:armory_keyset_plain_cursors) ? superclass.armory_keyset_plain_cursors : false
+        end
+
+        attr_writer :armory_keyset_plain_cursors
+
+        def cursor_encoder(new_encoder = nil)
+          EncoderCheck.(new_encoder) if new_encoder && !armory_keyset_plain_cursors
+          super
+        end
+      end
+    end
+  end
+end

data/lib/graphql/armory/keyset.rb

@@ -84,9 +84,26 @@ module GraphQL
 
       attr_reader :columns
 
-      # Checks the relation and its ordering; resolvers go through here.
-      def self.build(relation, plain_cursors: false)
+      # Checks the encoder when the schema loads, and keeps checking any encoder set later on it or on a subclass. Put it
+      # below `cursor_encoder`: graphql-ruby runs `use` at once, with no hook for the end of the class body.
+      def self.use(schema, plain_cursors: false)
         raise ConfigurationError, "plain_cursors: must be true or false, got #{plain_cursors.inspect}" unless [true, false].include?(plain_cursors)
+
+        unless plain_cursors
+          if schema.cursor_encoder == GraphQL::Schema::Base64Encoder
+            raise ConfigurationError, "no cursor_encoder is set on this schema: put cursor_encoder above `use GraphQL::Armory::Keyset`, or pass plain_cursors: true"
+          end
+
+          EncoderCheck.(schema.cursor_encoder)
+        end
+        schema.extend(SchemaChecks)
+        schema.armory_keyset_plain_cursors = plain_cursors
+      end
+
+      # Checks the relation and its ordering; resolvers go through here. With no `plain_cursors:`, the schema's setting
+      # decides when the page loads.
+      def self.build(relation, plain_cursors: nil)
+        raise ConfigurationError, "plain_cursors: must be true, false or nil, got #{plain_cursors.inspect}" unless [true, false, nil].include?(plain_cursors)
         raise ConfigurationError, "a keyset connection needs an ActiveRecord relation, got #{relation.class}" unless relation.respond_to?(:order_values)
 
         new(relation, columns: Ordering.(relation), plain_cursors: plain_cursors)
@@ -181,9 +198,11 @@ module GraphQL
       end
 
       def refuse_plain_cursors
+        schema = context&.schema
+        return if @plain_cursors.nil? && schema.respond_to?(:armory_keyset_plain_cursors) && schema.armory_keyset_plain_cursors
         return if @plain_cursors
 
-        encoder = context&.schema&.cursor_encoder
+        encoder = schema&.cursor_encoder
         return unless encoder.nil? || encoder == GraphQL::Schema::Base64Encoder
 
         raise ConfigurationError,
@@ -277,3 +296,4 @@ module GraphQL
 end
 
 require "graphql/armory/keyset/controls"
+require "graphql/armory/keyset/encoder_check"

data/lib/graphql/armory/rate_limits/analysis_guard.rb

@@ -6,14 +6,34 @@ module GraphQL
       # graphql-ruby discards an ExecutionError raised during analysis, drops what every analyzer answered, and runs the query.
       # A client can choose that by field order when a `complexity:` lambda raises. So on such a raise each limiter still
       # decides: a refusal already given stands, a limiter not asked yet is asked on its own, and a limiter that cannot answer
-      # refuses the query in hard mode and records `charged: false` in soft mode. Only the analysis of an execution counts: an
-      # analysis the app runs itself takes no slot and charges nothing here. It does not cover a trace that takes no modules
-      # from the schema (`context[:trace]`, or a class given to `trace_mode`).
+      # refuses the query in hard mode and records `charged: false` in soft mode. Every other analyzer is then asked on its
+      # own: a refusal it returns or raises stands, and one that raises anything else cannot answer, so unless another refusal
+      # stands the query is refused with QUERY_LIMIT_UNKNOWN. A multiplex analyzer cannot be asked again, so when the raise
+      # stopped the visit before its end, a query of a multiplex with multiplex analyzers is refused the same way.
+      # Only the analysis of an execution counts: an analysis the app runs itself takes no slot and charges nothing here. It
+      # does not cover a trace that takes no modules from the schema (`context[:trace]`, or a class given to `trace_mode`).
       module AnalysisGuard
         ANSWERS = :limiter_answers
         ASKED = :limiter_asked
         ARMED = :limiter_guard_armed
+        MULTIPLEXED = :limiter_guard_multiplexed
+        # Set just before the guard asks one analyzer again, and taken by that analysis only, so a nested one never sees it.
+        REASK = :limiter_guard_reask
+        RAISED = :limiter_guard_raised
+        VISITED = :limiter_guard_visited
         NOT_CHARGED = "This query could not be charged to its rate limit."
+        LIMIT_UNKNOWN = "The limits of this query could not be computed."
+
+        # Prepended to the limiters' analyzers: records that a visit of the query reached its end. graphql-ruby calls `result`
+        # only after the whole visit, every hook of every analyzer (the multiplex ones too) included; a leave hook is not
+        # enough, since the query analyzers leave before the multiplex ones. Marked before computing anything, because a
+        # `complexity:` lambda raises inside Points' `result`.
+        module Visited
+          def result
+            query.context.namespace(Points::NAMESPACE)[VISITED] = true
+            super
+          end
+        end
 
         # Runs a limiter, keeping per query and per limiter that it was asked and what it answered. A limiter that raised partway
         # may have charged some of its keys, so it is never asked again.
@@ -24,22 +44,83 @@ module GraphQL
         end
 
         def self.decide(query, error)
+          state = query.context.namespace(Points::NAMESPACE)
+          # Read before the guard's own visits below. A limiter answers from `result`, after the whole visit.
+          visited = state[VISITED] || !(state[ASKED] || {}).empty?
+          refusals, late = limiter_refusals(query, error)
+          # Each new visit gets a whole timeout of its own, and the timeout already refuses the query.
+          return [late] if late
+          return refusals if timeout?(error)
+
+          kept, unknown = other_answers(query)
+          unknown ||= !visited && state[MULTIPLEXED]
+          # A lambda's AnalysisError can come back from a limiter and from a maximum alike: show it once.
+          refusals = (refusals + kept).uniq { |refusal| [refusal.message, refusal.extensions] }
+          refusals.empty? && unknown ? [GraphQL::AnalysisError.new(LIMIT_UNKNOWN, extensions: { "code" => "QUERY_LIMIT_UNKNOWN" })] : refusals
+        end
+
+        # Asks one analyzer on its own and answers `[results, the error it raised or nil]`.
+        def self.ask(query, analyzer)
+          state = query.context.namespace(Points::NAMESPACE)
+          state[REASK] = true
+          [GraphQL::Analysis.analyze_query(query, [analyzer]), state.delete(RAISED)]
+        ensure
+          state.delete(REASK)
+        end
+        private_class_method :ask
+
+        def self.limiter_refusals(query, error)
           analyzers = query.analyzers.select { |analyzer| analyzer.respond_to?(:armory_limiter) }
           state = query.context.namespace(Points::NAMESPACE)
           answers = (state[ANSWERS] ||= {})
           asked = (state[ASKED] ||= {})
-          analyzers.reject { |analyzer| asked.key?(analyzer.armory_limiter) }.each { |analyzer| GraphQL::Analysis.analyze_query(query, [analyzer]) }
+          analyzers.reject { |analyzer| asked.key?(analyzer.armory_limiter) }.each do |analyzer|
+            results, raised = ask(query, analyzer)
+            late = timeout?(raised) ? raised : results.flatten.find { |answer| timeout?(answer) }
+            return [[], late] if late
+          end
 
           silent = analyzers.map(&:armory_limiter).reject { |limiter| answers.key?(limiter) || exempt?(limiter, query) }
           silent.each { |limiter| query.context[limiter.class::CONTEXT_KEY] = { limit: nil, soft: limiter.soft?, limited: !limiter.soft?, charged: false } }
 
           refusals = answers.values.compact
-          return refusals unless refusals.empty?
-          return [] if silent.all?(&:soft?)
+          return [refusals, nil] unless refusals.empty?
+          return [[], nil] if silent.all?(&:soft?)
 
-          [error.is_a?(GraphQL::AnalysisError) ? error : GraphQL::AnalysisError.new(NOT_CHARGED, extensions: { "code" => "RATE_LIMIT_NOT_CHARGED" })]
+          [[error.is_a?(GraphQL::AnalysisError) ? error : GraphQL::AnalysisError.new(NOT_CHARGED, extensions: { "code" => "RATE_LIMIT_NOT_CHARGED" })], nil]
         end
 
+        private_class_method :limiter_refusals
+
+        # What the analyzers that are not limiters return or raise, one at a time, and whether one could not answer. Each is
+        # asked once more at most, so a raise the client chose costs one more visit per analyzer of the schema.
+        def self.other_answers(query)
+          kept = []
+          unknown = false
+          query.analyzers.reject { |analyzer| analyzer.respond_to?(:armory_limiter) }.each do |analyzer|
+            results, raised = ask(query, analyzer)
+            answers = results.flatten.grep(GraphQL::AnalysisError)
+            late = timeout?(raised) ? raised : answers.find { |answer| timeout?(answer) }
+            return [[late], false] if late
+
+            if raised.is_a?(GraphQL::AnalysisError)
+              # Raised from `result`: a refusal, with the app's own message.
+              kept << raised
+            elsif raised
+              unknown = true
+            else
+              kept.concat(answers)
+            end
+          end
+          [kept, unknown]
+        end
+        private_class_method :other_answers
+
+        def self.timeout?(error)
+          defined?(GraphQL::Analysis::TimeoutError) && error.is_a?(GraphQL::Analysis::TimeoutError)
+        end
+        private_class_method :timeout?
+
         # A limit that cannot be asked for does not exempt anyone.
         def self.exempt?(limiter, query)
           limiter.exempt?(query)
@@ -48,15 +129,23 @@ module GraphQL
         end
         private_class_method :exempt?
 
+        # Mirrors how graphql-ruby builds the multiplex analyzers on both engines.
         def analyze_multiplex(multiplex:)
-          multiplex.queries.each { |query| query.context.namespace(Points::NAMESPACE)[ARMED] = true }
+          multiplexed = !multiplex.max_complexity.nil? || multiplex.schema.multiplex_analyzers.any?
+          multiplex.queries.each do |query|
+            state = query.context.namespace(Points::NAMESPACE)
+            state[ARMED] = true
+            state[MULTIPLEXED] = multiplexed
+          end
           super
         end
 
-        # The first analysis of each query in an execution. Any other, nested in it or run by the app, passes through, and
-        # each analyzer is asked apart, so one that raises leaves the others asked.
+        # The first analysis of each query in an execution, and each analyzer the guard asks again. Any other, nested in them or
+        # run by the app, passes through. graphql-ruby swallows a raise outside this hook, so the guard records it here.
         def analyze_query(query:)
-          return super unless query.context.namespace(Points::NAMESPACE).delete(ARMED)
+          state = query.context.namespace(Points::NAMESPACE)
+          return reasked(state) { super } if state.delete(REASK)
+          return super unless state.delete(ARMED)
 
           begin
             super
@@ -67,6 +156,13 @@ module GraphQL
 
         private
 
+        def reasked(state)
+          yield
+        rescue GraphQL::ExecutionError, GraphQL::UnauthorizedError => error
+          state[RAISED] = error
+          raise
+        end
+
         def decided(query, error)
           refusals = AnalysisGuard.decide(query, error)
           raise error if refusals.empty?

data/lib/graphql/armory/rate_limits/concurrency.rb

@@ -171,6 +171,8 @@ module GraphQL
 
         # Takes the slot during analysis, before anything runs.
         class Analyzer < GraphQL::Analysis::Analyzer
+          prepend AnalysisGuard::Visited
+
           def result
             AnalysisGuard.answer(query, concurrency) { concurrency.(query) }
           end

data/lib/graphql/armory/rate_limits/invalid_queries.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module GraphQL
+  module Armory
+    module RateLimits
+      # Finds what a limiter owes for a multiplex's invalid queries, which no analyzer ever sees. It runs after the answers are
+      # made, so a failure here is reported and never replaces them.
+      module InvalidQueries
+        # The invalid queries this limiter did not handle, grouped by what they draw from: `{ { key => limit } => [query] }`.
+        def self.grouped(multiplex, limiter, reader, limit, handler)
+          groups = {}
+          multiplex.queries.each do |query|
+            next unless invalid?(query, limiter)
+
+            key = Settings.key_for(reader, query)
+            limits = Settings.limits_for(limit, Array(key), query)
+            (groups[limits] ||= []) << query unless limits.empty?
+          rescue StandardError => error
+            report(handler, error, query)
+          end
+          groups
+        end
+
+        # Takes `cost` from each key in order, as if the queries had come one at a time. A key that cannot pay all of it pays
+        # what it holds, and the keys after it pay only that much: sending invalid queries together never costs a client less
+        # than sending them apart, and a client with nothing left cannot keep draining a bucket it shares. Never with `force`,
+        # never below zero. A key whose store fails is left out. Answers `[budgets, every key paid in full]`.
+        def self.charge(store, limits, cost, window, handler, query, bucket: ->(key) { key })
+          budgets = []
+          paid = true
+          limits.each do |key, limit|
+            break if cost.zero?
+
+            stored = bucket.call(key)
+            taken, remaining = take(store, stored, cost, limit, window)
+            unless taken
+              paid = false
+              # A refused take changes nothing and answers what the key holds. Taking that can still fail when another request
+              # got there first; then the keys after it pay nothing.
+              held = remaining
+              cost = 0
+              if held.positive?
+                again, remaining = take(store, stored, held, limit, window)
+                cost = held if again
+              end
+            end
+            budgets << { key: key, limit: limit, remaining: remaining }
+          rescue StandardError => error
+            report(handler, error, query)
+          end
+          [budgets, paid]
+        end
+
+        def self.take(store, key, cost, limit, window)
+          Settings.checked(store.take(key, cost: cost, limit: limit, window: window, force: false), :take, "the Integer left")
+        end
+        private_class_method :take
+
+        def self.report(handler, error, query)
+          handler.call(error, query)
+        rescue StandardError => raised
+          warn("graphql-armory: on_store_error raised while charging an invalid query: #{raised.class}: #{raised.message}")
+        end
+
+        # Only validation decides: `valid?` is also false for a query an analyzer refused, and graphql-ruby copies a multiplex
+        # analyzer's errors into every query, invalid ones included. A query that was analyzed is not invalid: what the
+        # limiter decided on it stands.
+        def self.invalid?(query, limiter)
+          !query.validation_pipeline.valid? && !query.context.namespace(Points::NAMESPACE)[AnalysisGuard::ASKED]&.key?(limiter)
+        end
+        private_class_method :invalid?
+      end
+    end
+  end
+end

data/lib/graphql/armory/rate_limits/points.rb

@@ -11,18 +11,19 @@ module GraphQL
       #
       # A query that costs more than the client has left is refused before any field resolves, and charged
       # nothing. Soft mode (the default) charges and records but refuses nothing. What happened is in
-      # `context[:rate_limit_points]`.
+      # `context[:rate_limit_points]`. An invalid query, which no analyzer sees, costs `invalid_cost:`, charged by a trace.
       class Points
         CONTEXT_KEY = :rate_limit_points
         NAMESPACE = :graphql_armory
 
-        def self.use(schema, store:, limit:, window: 60, soft: true, key: nil, on_store_error: nil, sinks: [], extensions: false)
-          points = build(store: store, limit: limit, window: window, soft: soft, key: key, on_store_error: on_store_error, sinks: sinks, extensions: extensions)
+        def self.use(schema, store:, limit:, window: 60, soft: true, key: nil, on_store_error: nil, sinks: [], extensions: false, invalid_cost: 1)
+          points = build(store: store, limit: limit, window: window, soft: soft, key: key, on_store_error: on_store_error, sinks: sinks, extensions: extensions, invalid_cost: invalid_cost)
           schema.query_analyzer(Class.new(Analyzer) do
             define_method(:points) { points }
             define_singleton_method(:armory_limiter) { points }
           end)
           schema.trace_with(AnalysisGuard)
+          schema.trace_with(points.invalid_trace)
         end
 
         # HTTP headers for the budget a result recorded: `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset`
@@ -39,13 +40,13 @@ module GraphQL
         end
 
         # Wires the app's store with `use`'s defaults (soft mode); `use` goes through here.
-        def self.build(store:, limit:, window: 60, soft: true, key: nil, on_store_error: nil, sinks: [], extensions: false)
-          new(store: store, limit: limit, window: window, soft: soft, key: key, on_store_error: on_store_error, sinks: sinks, extensions: extensions)
+        def self.build(store:, limit:, window: 60, soft: true, key: nil, on_store_error: nil, sinks: [], extensions: false, invalid_cost: 1)
+          new(store: store, limit: limit, window: window, soft: soft, key: key, on_store_error: on_store_error, sinks: sinks, extensions: extensions, invalid_cost: invalid_cost)
         end
 
         # `new` is inert: with no store wired it refuses every query. It checks every setting, so no partial
         # configuration lets a query through either.
-        def initialize(store: Store::Null.new, limit: 1, window: 60, soft: false, key: nil, on_store_error: nil, sinks: [], extensions: false)
+        def initialize(store: Store::Null.new, limit: 1, window: 60, soft: false, key: nil, on_store_error: nil, sinks: [], extensions: false, invalid_cost: 1)
           unless Settings.store_answers?(store, take: %i[cost limit window force])
             raise ConfigurationError, "store: must answer take(key, cost:, limit:, window:, force:), like a MemoryStore"
           end
@@ -58,6 +59,40 @@ module GraphQL
           @key = Settings.key_reader(key)
           @on_store_error = Settings.store_error_handler(on_store_error, limiter: :points, sinks: sinks)
           @extensions = extensions
+          unless invalid_cost.nil? || (invalid_cost.is_a?(Integer) && invalid_cost.positive?)
+            raise ConfigurationError, "invalid_cost: must be a positive Integer or nil, got #{invalid_cost.inspect}"
+          end
+
+          @invalid_cost = invalid_cost
+        end
+
+        # One module per limiter, so a schema with several charges each. Inside `ensure`: the answers are already made.
+        def invalid_trace
+          points = self
+          Module.new do
+            define_method(:execute_multiplex) do |multiplex:, &block|
+              super(multiplex: multiplex, &block)
+            ensure
+              points.charge_invalid(multiplex)
+            end
+          end
+        end
+
+        # Charges the multiplex's invalid queries, together per client. It never raises over the answers.
+        def charge_invalid(multiplex)
+          return if @invalid_cost.nil?
+
+          InvalidQueries.grouped(multiplex, self, @key, @limit, @on_store_error).each do |limits, queries|
+            budgets, paid = InvalidQueries.charge(@store, limits, @invalid_cost * queries.size, @window, @on_store_error, queries.first)
+            next if budgets.empty?
+
+            binding = budgets.min_by { |budget| budget[:remaining] }
+            queries.each do |query|
+              record(query, key: binding[:key], cost: @invalid_cost, limit: binding[:limit], remaining: binding[:remaining], limited: !paid, invalid: true)
+            end
+          end
+        rescue StandardError => error
+          InvalidQueries.report(@on_store_error, error, multiplex.queries.first)
         end
 
         def soft?
@@ -154,7 +189,7 @@ module GraphQL
         # In the context hash for instrumentation, and per query for `headers`: queries of a multiplex may share one
         # context hash, where the last query's record wins.
         def record(query, **info)
-          info = { **info.slice(:key, :cost, :limit, :remaining), window: @window, soft: @soft, limited: info[:limited], **info.slice(:keys) }
+          info = { **info.slice(:key, :cost, :limit, :remaining), window: @window, soft: @soft, limited: info[:limited], **info.slice(:keys, :invalid) }
           query.context.namespace(NAMESPACE)[:points] = info
           query.context[CONTEXT_KEY] = info
         end
@@ -176,6 +211,8 @@ module GraphQL
 
         # graphql-ruby's own complexity analysis, then the charge.
         class Analyzer < GraphQL::Analysis::QueryComplexity
+          prepend AnalysisGuard::Visited
+
           # graphql-ruby's words when a connection has no `first:`, `last:` or page size. A client can send that, so it answers
           # an error for the client and not a server error. Nothing is charged, and any other error while scoring still raises.
           UNSIZED_CONNECTION = "Can't calculate complexity for "

data/lib/graphql/armory/rate_limits/time.rb

@@ -13,7 +13,8 @@ module GraphQL
       # field resolves, when none is left. A trace measures the multiplex with a monotonic clock and charges the
       # elapsed milliseconds when it ends, even when it raises. A running operation is never interrupted: the one
       # that spends the last milliseconds finishes, and the next is refused. Soft mode (the default) charges and
-      # records but refuses nothing. What happened is in `context[:rate_limit_time]`.
+      # records but refuses nothing. What happened is in `context[:rate_limit_time]`. An invalid query, which no analyzer
+      # sees, takes its share of the time too.
       class Time
         CONTEXT_KEY = :rate_limit_time
         NAMESPACE = :graphql_armory
@@ -143,9 +144,14 @@ module GraphQL
             debt = query.context.namespace(NAMESPACE)[:time_charges]&.delete(self)
             [query, debt] if debt
           end
-          return if owed.empty?
-
-          share = (seconds * 1000 / owed.size.to_f).ceil
+          # Invalid queries pay only a multiplex that has nothing else to charge: next to a query that ran, they would lower
+          # its share, and that query pays with `force` while they cannot.
+          invalid = owed.empty? ? invalid_queries(multiplex) : {}
+          payers = owed.size + invalid.values.sum(&:size)
+          return if payers.zero?
+
+          share = (seconds * 1000 / payers.to_f).ceil
+          invalid.each { |limits, queries| charge_invalid(limits, queries, share) }
           # Every query is charged even if one hook raises; the first such error is raised afterwards.
           failure = nil
           owed.each do |query, debt|
@@ -158,6 +164,28 @@ module GraphQL
 
         private
 
+        def invalid_queries(multiplex)
+          InvalidQueries.grouped(multiplex, self, @key, @limit, @on_store_error)
+        rescue StandardError => error
+          InvalidQueries.report(@on_store_error, error, multiplex.queries.first)
+          {}
+        end
+
+        # Never raises over the answers, and never with `force`: a key that cannot pay all of it pays what it holds, and the
+        # keys after it pay only that much.
+        def charge_invalid(limits, queries, share)
+          bucket = self.class.method(:bucket_key)
+          budgets, paid = InvalidQueries.charge(@store, limits, share * queries.size, @window, @on_store_error, queries.first, bucket: bucket)
+          return if budgets.empty?
+
+          binding = budgets.min_by { |budget| budget[:remaining] }
+          queries.each do |query|
+            record(query, key: binding[:key], limit: binding[:limit], remaining: binding[:remaining], limited: !paid, invalid: true, elapsed: share)
+          end
+        rescue StandardError => error
+          InvalidQueries.report(@on_store_error, error, queries.first)
+        end
+
         # Each key is charged on its own: a store failure on one, or a hook that raises for it, leaves the others charged. The
         # first error a hook raises is raised afterwards.
         def charge_one(query, debt, cost)
@@ -253,8 +281,8 @@ module GraphQL
         end
 
         # `elapsed` is nil until the operation ends and is charged; it stays nil for a refused one.
-        def base_record(key:, limit:, limited:, remaining: nil, keys: nil)
-          { key: key, limit: limit, remaining: remaining, elapsed: nil, window: @window, soft: @soft, limited: limited, **(keys ? { keys: keys } : {}) }
+        def base_record(key:, limit:, limited:, remaining: nil, keys: nil, invalid: false, elapsed: nil)
+          { key: key, limit: limit, remaining: remaining, elapsed: elapsed, window: @window, soft: @soft, limited: limited, **(keys ? { keys: keys } : {}), **(invalid ? { invalid: true } : {}) }
         end
 
         # The budget before the run; the charge completes the same hash, which the response already holds.
@@ -287,6 +315,8 @@ module GraphQL
 
         # Asks for the balance during analysis, before anything runs.
         class Analyzer < GraphQL::Analysis::Analyzer
+          prepend AnalysisGuard::Visited
+
           def result
             AnalysisGuard.answer(query, time) { time.(query) }
           end

data/lib/graphql/armory/rate_limits.rb

@@ -149,6 +149,7 @@ require "graphql/armory/rate_limits/store"
 require "graphql/armory/rate_limits/clock"
 require "graphql/armory/rate_limits/redis_store"
 require "graphql/armory/rate_limits/analysis_guard"
+require "graphql/armory/rate_limits/invalid_queries"
 require "graphql/armory/rate_limits/points"
 require "graphql/armory/rate_limits/concurrency"
 require "graphql/armory/rate_limits/time"

data/lib/graphql/armory/version.rb

@@ -2,6 +2,6 @@
 
 module GraphQL
   module Armory
-    VERSION = "0.1.0.pre9"
+    VERSION = "0.1.0.pre10"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: graphql-armory
 version: !ruby/object:Gem::Version
-  version: 0.1.0.pre9
+  version: 0.1.0.pre10
 platform: ruby
 authors:
 - Israel
@@ -107,6 +107,7 @@ files:
 - lib/graphql/armory/ids/controls.rb
 - lib/graphql/armory/keyset.rb
 - lib/graphql/armory/keyset/controls.rb
+- lib/graphql/armory/keyset/encoder_check.rb
 - lib/graphql/armory/persisted_queries.rb
 - lib/graphql/armory/persisted_queries/controls.rb
 - lib/graphql/armory/persisted_queries/manifest.rb
@@ -120,6 +121,7 @@ files:
 - lib/graphql/armory/rate_limits/clock.rb
 - lib/graphql/armory/rate_limits/concurrency.rb
 - lib/graphql/armory/rate_limits/controls.rb
+- lib/graphql/armory/rate_limits/invalid_queries.rb
 - lib/graphql/armory/rate_limits/memory_store.rb
 - lib/graphql/armory/rate_limits/points.rb
 - lib/graphql/armory/rate_limits/redis_store.rb