graphql-persisted_queries 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3121fbd184f715130c9f9f1956dcd89c24d52507d23ac0b35a408a9d53d54e72
-  data.tar.gz: 7e4b32a6b5d0fda8d9b135a435bca92587749ccb61664f37092c593ef4b04eb0
+  metadata.gz: f36403d19c66dd6b6627c571cd87744b7da8a1d27f47bbf1f1dd5f32357ae4b1
+  data.tar.gz: 3f47b64e03c5bba2f498455e53aa136e20955ef7b4045a4088b0c19903ebde43
 SHA512:
-  metadata.gz: a42f753183b5d8aa8c0d8f321a988b61375ad6ae828ef9c232e91f4f20adb5da824b6b095cb034af805e11039f5c7122d52add4cdb4caa36bb873335a85e5847
-  data.tar.gz: 539d3e7da1bed8a470555b2b411cd52a6631663e7f3927e0c9252988488800c205bfe10f4eb03b3baa34899e286420b9d743f411fefc54c9dc091a1406d75a96
+  metadata.gz: 50c222c3023ed556d6c3d46d49c2495e676c149fb8a887b623d76beb04b805dcb53bfb23dd1ed151675e7f2216282c99903b784161f13d7ff65de5837240fdc6
+  data.tar.gz: d9e359c4258a466bbd71fc8aa9873d0a100e878fba185b213e1305fc950c21ea75133e04104822a2f24f828ada9b4982e17f5ed4b068fdcfef055bc4098ac2b5

data/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## master
 
+## 0.3.0 (2020-02-21)
+
+- [PR#24](https://github.com/DmitryTsepelev/graphql-ruby-persisted_queries/pull/24) Add multiplex support ([@DmitryTsepelev][])
+- [PR#23](https://github.com/DmitryTsepelev/graphql-ruby-persisted_queries/pull/23) Adapter for Redis-backed in-memory store ([@bmorton][])
+- [PR#22](https://github.com/DmitryTsepelev/graphql-ruby-persisted_queries/pull/22) Add `verify_http_method` option restricting mutations to be performed via `GET` requests ([@DmitryTsepelev][])
+
 ## 0.2.0 (2020-02-11)
 
 - [PR#17](https://github.com/DmitryTsepelev/graphql-ruby-persisted_queries/pull/17) Allow an optional custom error handler so that implementors can control failure scenarios when query resolution fails ([@bmorton][])

data/README.md

@@ -57,6 +57,10 @@ GraphqlSchema.execute(
 
 5. Run the app! 🔥
 
+## Usage with BatchLink
+
+It's possible to group queries using [batch-link](https://www.apollographql.com/docs/link/links/batch-http/) and send them as a single HTTP request. In this case you need to use `GraphqlSchema.multiplex(queries)` instead of `#execute`. The gem supports it too, no action required!
+
 ## Alternative stores
 
 All the queries are stored in memory by default, but you can easily switch to _redis_:
@@ -97,6 +101,14 @@ class GraphqlSchema < GraphQL::Schema
 end
 ```
 
+### Supported stores
+
+We currently support a few different stores that can be configured out of the box:
+
+- `:memory`: This is the default in-memory store and is great for getting started, but will require each instance to cache results independently which can result in lots of ["new query path"](https://blog.apollographql.com/improve-graphql-performance-with-automatic-persisted-queries-c31d27b8e6ea) requests.
+- `:redis`: This store will allow you to share a Redis cache across all instances of your GraphQL application so that each instance doesn't have to ask the client for the query again if it hasn't seen it yet.
+- `:redis_with_local_cache`: This store combines both the `:memory` and `:redis` approaches so that we can reduce the number of network requests we make while mitigating the independent cache issue.  This adapter is configured identically to the `:redis` store.
+
 ## Alternative hash functions
 
 [apollo-link-persisted-queries](https://github.com/apollographql/apollo-link-persisted-queries) uses _SHA256_ by default so this gem uses it as a default too, but if you want to override it – you can use `:hash_generator` option:
@@ -144,11 +156,17 @@ end
 
 ## GET requests and HTTP cache
 
-Using `GET` requests for persisted queries allows you to enable HTTP caching (e.g., turn on CDN). In order to make it work you should change the way link is initialized on front-end side (`createPersistedQueryLink({ useGETForHashedQueries: true })`) and register a new route `get "/graphql", to: "graphql#execute"`.
+Using `GET` requests for persisted queries allows you to enable HTTP caching (e.g., turn on CDN). This is how to turn them on:
+1. Change the way link is initialized on front-end side (`createPersistedQueryLink({ useGETForHashedQueries: true })`);
+2. Register a new route `get "/graphql", to: "graphql#execute"`;
+3. Put the request object to the GraphQL context in the controller `GraphqlSchema.execute(query, variables: variables, context: { request: request })`;
+4. Turn the `verify_http_method` option on (`use GraphQL::PersistedQueries, verify_http_method: true`) to enforce using `POST` requests for performing mutations (otherwise the error `Mutations cannot be performed via HTTP GET` will be returned).
+
+HTTP method verification is important, because when mutations are allowed via `GET` requests, it's easy to perform an attack by sending the link containing mutation to a signed in user.
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/DmitryTsepelev/graphql-persisted_queries.
+Bug reports and pull requests are welcome on GitHub at https://github.com/DmitryTsepelev/graphql-ruby-persisted_queries.
 
 ## License
 

data/lib/graphql/persisted_queries/http_method_analyzer.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module GraphQL
+  module PersistedQueries
+    # Verifies that mutations are not executed using GET requests
+    class HttpMethodAnalyzer
+      def analyze?(query)
+        query.context[:request]
+      end
+
+      def initial_value(query)
+        {
+          get_request: query.context[:request]&.get?,
+          mutation: query.mutation?
+        }
+      end
+
+      def call(memo, _visit_type, _irep_node)
+        memo
+      end
+
+      def final_value(memo)
+        return if !memo[:get_request] || !memo[:mutation]
+
+        GraphQL::AnalysisError.new("Mutations cannot be performed via HTTP GET")
+      end
+    end
+  end
+end

data/lib/graphql/persisted_queries/multiplex_resolver.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module GraphQL
+  module PersistedQueries
+    # Resolves multiplex query
+    class MultiplexResolver
+      def initialize(schema, queries, kwargs)
+        @schema = schema
+        @queries = queries
+        @kwargs = kwargs
+      end
+
+      def resolve
+        resolve_persisted_queries
+        perform_multiplex
+        results
+      end
+
+      private
+
+      def results
+        @results ||= Array.new(@queries.count)
+      end
+
+      def resolve_persisted_queries
+        @queries.each_with_index do |query_params, i|
+          resolve_persisted_query(query_params, i)
+        end
+      end
+
+      def resolve_persisted_query(query_params, pos)
+        extensions = query_params.delete(:extensions)
+        return unless extensions
+
+        query_params[:query] = Resolver.new(extensions, @schema).resolve(query_params[:query])
+      rescue Resolver::NotFound, Resolver::WrongHash => e
+        results[pos] = { "errors" => [{ "message" => e.message }] }
+      end
+
+      def perform_multiplex
+        resolve_idx = (0...@queries.count).select { |i| results[i].nil? }
+        multiplex_result = @schema.multiplex_original(
+          resolve_idx.map { |i| @queries.at(i) }, @kwargs
+        )
+        resolve_idx.each_with_index { |res_i, mult_i| results[res_i] = multiplex_result[mult_i] }
+      end
+    end
+  end
+end

data/lib/graphql/persisted_queries/resolver.rb

@@ -18,11 +18,9 @@ module GraphQL
         end
       end
 
-      def initialize(extensions, store, hash_generator_proc, error_handler)
+      def initialize(extensions, schema)
         @extensions = extensions
-        @store = store
-        @hash_generator_proc = hash_generator_proc
-        @error_handler = error_handler
+        @schema = schema
       end
 
       def resolve(query_str)
@@ -31,7 +29,7 @@ module GraphQL
         if query_str
           persist_query(query_str)
         else
-          query_str = with_error_handling { @store.fetch_query(hash) }
+          query_str = with_error_handling { @schema.persisted_query_store.fetch_query(hash) }
           raise NotFound if query_str.nil?
         end
 
@@ -43,13 +41,13 @@ module GraphQL
       def with_error_handling
         yield
       rescue StandardError => e
-        @error_handler.call(e)
+        @schema.persisted_query_error_handler.call(e)
       end
 
       def persist_query(query_str)
-        raise WrongHash if @hash_generator_proc.call(query_str) != hash
+        raise WrongHash if @schema.hash_generator_proc.call(query_str) != hash
 
-        with_error_handling { @store.save_query(hash, query_str) }
+        with_error_handling { @schema.persisted_query_store.save_query(hash, query_str) }
       end
 
       def hash

data/lib/graphql/persisted_queries/schema_patch.rb

@@ -2,11 +2,19 @@
 
 require "graphql/persisted_queries/hash_generator_builder"
 require "graphql/persisted_queries/resolver"
+require "graphql/persisted_queries/multiplex_resolver"
 
 module GraphQL
   module PersistedQueries
     # Patches GraphQL::Schema to support persisted queries
     module SchemaPatch
+      class << self
+        def patch(schema)
+          schema.singleton_class.class_eval { alias_method :multiplex_original, :multiplex }
+          schema.singleton_class.prepend(SchemaPatch)
+        end
+      end
+
       attr_reader :persisted_query_store, :hash_generator_proc, :persisted_query_error_handler
 
       def configure_persisted_query_store(store, options)
@@ -21,16 +29,20 @@ module GraphQL
         @hash_generator_proc = HashGeneratorBuilder.new(hash_generator).build
       end
 
-      def execute(query_str = nil, **kwargs)
-        if (extensions = kwargs.delete(:extensions))
-          resolver = Resolver.new(extensions, persisted_query_store, hash_generator_proc,
-                                  persisted_query_error_handler)
-          query_str = resolver.resolve(query_str)
+      def verify_http_method=(verify)
+        return unless verify
+
+        analyzer = HttpMethodAnalyzer.new
+
+        if Gem::Dependency.new("graphql", ">= 1.10.0").match?("graphql", GraphQL::VERSION)
+          query_analyzer(analyzer)
+        else
+          query_analyzers << analyzer
         end
+      end
 
-        super
-      rescue Resolver::NotFound, Resolver::WrongHash => e
-        { errors: [{ message: e.message }] }
+      def multiplex(queries, **kwargs)
+        MultiplexResolver.new(self, queries, kwargs).resolve
       end
     end
   end

data/lib/graphql/persisted_queries/store_adapters/redis_with_local_cache_store_adapter.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module GraphQL
+  module PersistedQueries
+    module StoreAdapters
+      # Memory adapter for storing persisted queries
+      class RedisWithLocalCacheStoreAdapter < BaseStoreAdapter
+        DEFAULT_REDIS_ADAPTER_CLASS = RedisStoreAdapter
+        DEFAULT_MEMORY_ADAPTER_CLASS = MemoryStoreAdapter
+
+        def initialize(redis_client:, expiration: nil, namespace: nil, redis_adapter_class: nil,
+                       memory_adapter_class: nil)
+          redis_adapter_class ||= DEFAULT_REDIS_ADAPTER_CLASS
+          memory_adapter_class ||= DEFAULT_MEMORY_ADAPTER_CLASS
+
+          @redis_adapter = redis_adapter_class.new(
+            redis_client: redis_client,
+            expiration: expiration,
+            namespace: namespace
+          )
+          @memory_adapter = memory_adapter_class.new(nil)
+        end
+
+        def fetch_query(hash)
+          result = @memory_adapter.fetch_query(hash)
+          result ||= begin
+            inner_result = @redis_adapter.fetch_query(hash)
+            @memory_adapter.save_query(hash, inner_result) if inner_result
+            inner_result
+          end
+          result
+        end
+
+        def save_query(hash, query)
+          @redis_adapter.save_query(hash, query)
+          @memory_adapter.save_query(hash, query)
+        end
+
+        private
+
+        attr_reader :redis_adapter, :memory_adapter
+      end
+    end
+  end
+end

data/lib/graphql/persisted_queries/store_adapters.rb

@@ -3,6 +3,7 @@
 require "graphql/persisted_queries/store_adapters/base_store_adapter"
 require "graphql/persisted_queries/store_adapters/memory_store_adapter"
 require "graphql/persisted_queries/store_adapters/redis_store_adapter"
+require "graphql/persisted_queries/store_adapters/redis_with_local_cache_store_adapter"
 
 module GraphQL
   module PersistedQueries

data/lib/graphql/persisted_queries/version.rb

@@ -2,6 +2,6 @@
 
 module GraphQL
   module PersistedQueries
-    VERSION = "0.2.0"
+    VERSION = "0.3.0"
   end
 end

data/lib/graphql/persisted_queries.rb

@@ -5,17 +5,23 @@ require "graphql/persisted_queries/schema_patch"
 require "graphql/persisted_queries/store_adapters"
 require "graphql/persisted_queries/version"
 require "graphql/persisted_queries/builder_helpers"
+require "graphql/persisted_queries/http_method_analyzer"
 
 module GraphQL
   # Plugin definition
   module PersistedQueries
-    def self.use(schema_defn, store: :memory, hash_generator: :sha256,
-                 error_handler: :default, **options)
+    def self.use(schema_defn, options = {})
       schema = schema_defn.is_a?(Class) ? schema_defn : schema_defn.target
+      SchemaPatch.patch(schema)
 
-      schema.singleton_class.prepend(SchemaPatch)
-      schema.hash_generator = hash_generator
+      schema.hash_generator = options.delete(:hash_generator) || :sha256
+
+      schema.verify_http_method = options.delete(:verify_http_method)
+
+      error_handler = options.delete(:error_handler) || :default
       schema.configure_persisted_query_error_handler(error_handler)
+
+      store = options.delete(:store) || :memory
       schema.configure_persisted_query_store(store, options)
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: graphql-persisted_queries
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - DmitryTsepelev
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-02-11 00:00:00.000000000 Z
+date: 2020-02-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: graphql
@@ -122,6 +122,8 @@ files:
 - lib/graphql/persisted_queries/error_handlers/base_error_handler.rb
 - lib/graphql/persisted_queries/error_handlers/default_error_handler.rb
 - lib/graphql/persisted_queries/hash_generator_builder.rb
+- lib/graphql/persisted_queries/http_method_analyzer.rb
+- lib/graphql/persisted_queries/multiplex_resolver.rb
 - lib/graphql/persisted_queries/resolver.rb
 - lib/graphql/persisted_queries/schema_patch.rb
 - lib/graphql/persisted_queries/store_adapters.rb
@@ -129,6 +131,7 @@ files:
 - lib/graphql/persisted_queries/store_adapters/memory_store_adapter.rb
 - lib/graphql/persisted_queries/store_adapters/redis_client_builder.rb
 - lib/graphql/persisted_queries/store_adapters/redis_store_adapter.rb
+- lib/graphql/persisted_queries/store_adapters/redis_with_local_cache_store_adapter.rb
 - lib/graphql/persisted_queries/version.rb
 homepage: https://github.com/DmitryTsepelev/graphql-ruby-persisted_queries
 licenses: