graphql 1.10.1 → 1.13.0

data/lib/graphql/static_validation/rules/fields_will_merge.rb

@@ -10,6 +10,7 @@ module GraphQL
       #
       # Original Algorithm: https://github.com/graphql/graphql-js/blob/master/src/validation/rules/OverlappingFieldsCanBeMerged.js
       NO_ARGS = {}.freeze
+
       Field = Struct.new(:node, :definition, :owner_type, :parents)
       FragmentSpread = Struct.new(:name, :parents)
 
@@ -17,20 +18,43 @@ module GraphQL
         super
         @visited_fragments = {}
         @compared_fragments = {}
+        @conflict_count = 0
       end
 
       def on_operation_definition(node, _parent)
-        conflicts_within_selection_set(node, type_definition)
+        setting_errors { conflicts_within_selection_set(node, type_definition) }
         super
       end
 
       def on_field(node, _parent)
-        conflicts_within_selection_set(node, type_definition)
+        setting_errors { conflicts_within_selection_set(node, type_definition) }
         super
       end
 
       private
 
+      def field_conflicts
+        @field_conflicts ||= Hash.new do |errors, field|
+          errors[field] = GraphQL::StaticValidation::FieldsWillMergeError.new(kind: :field, field_name: field)
+        end
+      end
+
+      def arg_conflicts
+        @arg_conflicts ||= Hash.new do |errors, field|
+          errors[field] = GraphQL::StaticValidation::FieldsWillMergeError.new(kind: :argument, field_name: field)
+        end
+      end
+
+      def setting_errors
+        @field_conflicts = nil
+        @arg_conflicts = nil
+
+        yield
+
+        field_conflicts.each_value { |error| add_error(error) }
+        arg_conflicts.each_value { |error| add_error(error) }
+      end
+
       def conflicts_within_selection_set(node, parent_type)
         return if parent_type.nil?
 
@@ -183,6 +207,8 @@ module GraphQL
       end
 
       def find_conflict(response_key, field1, field2, mutually_exclusive: false)
+        return if @conflict_count >= context.max_errors
+
         node1 = field1.node
         node2 = field2.node
 
@@ -191,27 +217,21 @@ module GraphQL
 
         if !are_mutually_exclusive
           if node1.name != node2.name
-            errored_nodes = [node1.name, node2.name].sort.join(" or ")
-            msg = "Field '#{response_key}' has a field conflict: #{errored_nodes}?"
-            context.errors << GraphQL::StaticValidation::FieldsWillMergeError.new(
-              msg,
-              nodes: [node1, node2],
-              path: [],
-              field_name: response_key,
-              conflicts: errored_nodes
-            )
+            conflict = field_conflicts[response_key]
+
+            conflict.add_conflict(node1, node1.name)
+            conflict.add_conflict(node2, node2.name)
+
+            @conflict_count += 1
           end
 
-          args = possible_arguments(node1, node2)
-          if args.size > 1
-            msg = "Field '#{response_key}' has an argument conflict: #{args.map { |arg| GraphQL::Language.serialize(arg) }.join(" or ")}?"
-            context.errors << GraphQL::StaticValidation::FieldsWillMergeError.new(
-              msg,
-              nodes: [node1, node2],
-              path: [],
-              field_name: response_key,
-              conflicts: args.map { |arg| GraphQL::Language.serialize(arg) }.join(" or ")
-            )
+          if !same_arguments?(node1, node2)
+            conflict = arg_conflicts[response_key]
+
+            conflict.add_conflict(node1, GraphQL::Language.serialize(serialize_field_args(node1)))
+            conflict.add_conflict(node2, GraphQL::Language.serialize(serialize_field_args(node2)))
+
+            @conflict_count += 1
           end
         end
 
@@ -313,7 +333,7 @@ module GraphQL
         selections.each do |node|
           case node
           when GraphQL::Language::Nodes::Field
-            definition = context.schema.get_field(owner_type, node.name)
+            definition = context.query.get_field(owner_type, node.name)
             fields << Field.new(node, definition, owner_type, parents)
           when GraphQL::Language::Nodes::InlineFragment
             fragment_type = node.type ? context.warden.get_type(node.type.name) : owner_type
@@ -326,20 +346,19 @@ module GraphQL
         [fields, fragment_spreads]
       end
 
-      def possible_arguments(field1, field2)
+      def same_arguments?(field1, field2)
         # Check for incompatible / non-identical arguments on this node:
-        [field1, field2].map do |n|
-          if n.arguments.any?
-            serialized_args = {}
-            n.arguments.each do |a|
-              arg_value = a.value
-              serialized_args[a.name] = serialize_arg(arg_value)
-            end
-            serialized_args
-          else
-            NO_ARGS
-          end
-        end.uniq
+        arguments1 = field1.arguments
+        arguments2 = field2.arguments
+
+        return false if arguments1.length != arguments2.length
+
+        arguments1.all? do |argument1|
+          argument2 = arguments2.find { |argument| argument.name == argument1.name }
+          return false if argument2.nil?
+
+          serialize_arg(argument1.value) == serialize_arg(argument2.value)
+        end
       end
 
       def serialize_arg(arg_value)
@@ -353,6 +372,14 @@ module GraphQL
         end
       end
 
+      def serialize_field_args(field)
+        serialized_args = {}
+        field.arguments.each do |argument|
+          serialized_args[argument.name] = serialize_arg(argument.value)
+        end
+        serialized_args
+      end
+
       def compared_fragments_key(frag1, frag2, exclusive)
         # Cache key to not compare two fragments more than once.
         # The key includes both fragment names sorted (this way we
@@ -365,17 +392,26 @@ module GraphQL
       # In this context, `parents` represends the "self scope" of the field,
       # what types may be found at this point in the query.
       def mutually_exclusive?(parents1, parents2)
-        parents1.each do |type1|
-          parents2.each do |type2|
-            # If the types we're comparing are both different object types,
-            # they have to be mutually exclusive.
-            if type1 != type2 && type1.kind.object? && type2.kind.object?
-              return true
+        if parents1.empty? || parents2.empty?
+          false
+        elsif parents1.length == parents2.length
+          parents1.length.times.any? do |i|
+            type1 = parents1[i - 1]
+            type2 = parents2[i - 1]
+            if type1 == type2
+              # If the types we're comparing are the same type,
+              # then they aren't mutually exclusive
+              false
+            else
+              # Check if these two scopes have _any_ types in common.
+              possible_right_types = context.query.possible_types(type1)
+              possible_left_types = context.query.possible_types(type2)
+              (possible_right_types & possible_left_types).empty?
             end
           end
+        else
+          true
         end
-
-        false
       end
     end
   end

data/lib/graphql/static_validation/rules/fields_will_merge_error.rb

@@ -3,12 +3,33 @@ module GraphQL
   module StaticValidation
     class FieldsWillMergeError < StaticValidation::Error
       attr_reader :field_name
-      attr_reader :conflicts
+      attr_reader :kind
+
+      def initialize(kind:, field_name:)
+        super(nil)
 
-      def initialize(message, path: nil, nodes: [], field_name:, conflicts:)
-        super(message, path: path, nodes: nodes)
         @field_name = field_name
-        @conflicts = conflicts
+        @kind = kind
+        @conflicts = []
+      end
+
+      def message
+        "Field '#{field_name}' has #{kind == :argument ? 'an' : 'a'} #{kind} conflict: #{conflicts}?"
+      end
+
+      def path
+        []
+      end
+
+      def conflicts
+        @conflicts.join(' or ')
+      end
+
+      def add_conflict(node, conflict_str)
+        return if nodes.include?(node)
+
+        @nodes << node
+        @conflicts << conflict_str
       end
 
       # A hash representation of this Message

data/lib/graphql/static_validation/rules/fragments_are_finite.rb

@@ -7,12 +7,12 @@ module GraphQL
         dependency_map = context.dependencies
         dependency_map.cyclical_definitions.each do |defn|
           if defn.node.is_a?(GraphQL::Language::Nodes::FragmentDefinition)
-            context.errors << GraphQL::StaticValidation::FragmentsAreFiniteError.new(
+            add_error(GraphQL::StaticValidation::FragmentsAreFiniteError.new(
               "Fragment #{defn.name} contains an infinite loop",
               nodes: defn.node,
               path: defn.path,
               name: defn.name
-            )
+            ))
           end
         end
       end

data/lib/graphql/static_validation/rules/input_object_names_are_unique.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    module InputObjectNamesAreUnique
+      def on_input_object(node, parent)
+        validate_input_fields(node)
+        super
+      end
+
+      private
+
+      def validate_input_fields(node)
+        input_field_defns = node.arguments
+        input_fields_by_name = Hash.new { |h, k| h[k] = [] }
+        input_field_defns.each { |a| input_fields_by_name[a.name] << a }
+
+        input_fields_by_name.each do |name, defns|
+          if defns.size > 1
+            error = GraphQL::StaticValidation::InputObjectNamesAreUniqueError.new(
+              "There can be only one input field named \"#{name}\"",
+              nodes: defns,
+              name: name
+            )
+            add_error(error)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/graphql/static_validation/rules/input_object_names_are_unique_error.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    class InputObjectNamesAreUniqueError < StaticValidation::Error
+      attr_reader :name
+
+      def initialize(message, path: nil, nodes: [], name:)
+        super(message, path: path, nodes: nodes)
+        @name = name
+      end
+
+      # A hash representation of this Message
+      def to_h
+        extensions = {
+          "code" => code,
+          "name" => name
+        }
+
+        super.merge({
+          "extensions" => extensions
+        })
+      end
+
+      def code
+        "inputFieldNotUnique"
+      end
+    end
+  end
+end
+

data/lib/graphql/static_validation/rules/required_arguments_are_present.rb

@@ -18,7 +18,7 @@ module GraphQL
       def assert_required_args(ast_node, defn)
         present_argument_names = ast_node.arguments.map(&:name)
         required_argument_names = context.warden.arguments(defn)
-          .select { |a| a.type.kind.non_null? && !a.default_value? }
+          .select { |a| a.type.kind.non_null? && !a.default_value? && context.warden.get_argument(defn, a.name) }
           .map(&:name)
 
         missing_names = required_argument_names - present_argument_names

data/lib/graphql/static_validation/rules/required_input_object_attributes_are_present.rb

@@ -23,11 +23,10 @@ module GraphQL
         defn = if arg_defn && arg_defn.type.unwrap.kind.input_object?
           arg_defn.type.unwrap
         else
-          context.field_definition
+          context.directive_definition || context.field_definition
         end
 
-        parent_type = context.warden.arguments(defn)
-          .find{|f| f.name == parent_name(parent, defn) }
+        parent_type = context.warden.get_argument(defn, parent_name(parent, defn))
         parent_type ? parent_type.type.unwrap : nil
       end
 
@@ -35,16 +34,16 @@ module GraphQL
         parent_type = get_parent_type(context, parent)
         return unless parent_type && parent_type.kind.input_object?
 
-        required_fields = parent_type.arguments
-          .select{|k,v| v.type.kind.non_null?}
-          .keys
+        required_fields = context.warden.arguments(parent_type)
+          .select{|arg| arg.type.kind.non_null?}
+          .map(&:graphql_name)
 
         present_fields = ast_node.arguments.map(&:name)
         missing_fields = required_fields - present_fields
 
         missing_fields.each do |missing_field|
           path = [*context.path, missing_field]
-          missing_field_type = parent_type.arguments[missing_field].type
+          missing_field_type = context.warden.get_argument(parent_type, missing_field).type
           add_error(RequiredInputObjectAttributesArePresentError.new(
             "Argument '#{missing_field}' on InputObject '#{parent_type.to_type_signature}' is required. Expected type #{missing_field_type.to_type_signature}",
             argument_name: missing_field,

data/lib/graphql/static_validation/rules/variable_default_values_are_correctly_typed.rb

@@ -17,23 +17,22 @@ module GraphQL
             if type.nil?
               # This is handled by another validator
             else
-              begin
-                valid = context.valid_literal?(value, type)
-              rescue GraphQL::CoercionError => err
-                error_message = err.message
-              rescue GraphQL::LiteralValidationError
-                # noop, we just want to stop any LiteralValidationError from propagating
-              end
+              validation_result = context.validate_literal(value, type)
+
+              if !validation_result.valid?
+                problems = validation_result.problems
+                first_problem = problems && problems.first
+                if first_problem
+                  error_message = first_problem["message"]
+                end
 
-              if !valid
                 error_message ||= "Default value for $#{node.name} doesn't match type #{type.to_type_signature}"
-                VariableDefaultValuesAreCorrectlyTypedError
                 add_error(GraphQL::StaticValidation::VariableDefaultValuesAreCorrectlyTypedError.new(
                   error_message,
                   nodes: node,
                   name: node.name,
                   type: type.to_type_signature,
-                  error_type: VariableDefaultValuesAreCorrectlyTypedError::VIOLATIONS[:INVALID_TYPE]
+                  error_type: VariableDefaultValuesAreCorrectlyTypedError::VIOLATIONS[:INVALID_TYPE],
                 ))
               end
             end

data/lib/graphql/static_validation/rules/variable_usages_are_allowed.rb

@@ -22,15 +22,15 @@ module GraphQL
         node_values = node_values.select { |value| value.is_a? GraphQL::Language::Nodes::VariableIdentifier }
 
         if node_values.any?
-          arguments = case parent
+          argument_owner = case parent
           when GraphQL::Language::Nodes::Field
-            context.field_definition.arguments
+            context.field_definition
           when GraphQL::Language::Nodes::Directive
-            context.directive_definition.arguments
+            context.directive_definition
           when GraphQL::Language::Nodes::InputObject
             arg_type = context.argument_definition.type.unwrap
-            if arg_type.is_a?(GraphQL::InputObjectType)
-              arguments = arg_type.input_fields
+            if arg_type.kind.input_object?
+              arg_type
             else
               # This is some kind of error
               nil
@@ -43,7 +43,7 @@ module GraphQL
             var_defn_ast = @declared_variables[node_value.name]
             # Might be undefined :(
             # VariablesAreUsedAndDefined can't finalize its search until the end of the document.
-            var_defn_ast && arguments && validate_usage(arguments, node, var_defn_ast)
+            var_defn_ast && argument_owner && validate_usage(argument_owner, node, var_defn_ast)
           end
         end
         super
@@ -51,7 +51,7 @@ module GraphQL
 
       private
 
-      def validate_usage(arguments, arg_node, ast_var)
+      def validate_usage(argument_owner, arg_node, ast_var)
         var_type = context.schema.type_from_ast(ast_var.type, context: context)
         if var_type.nil?
           return
@@ -65,7 +65,7 @@ module GraphQL
           end
         end
 
-        arg_defn = arguments[arg_node.name]
+        arg_defn = context.warden.get_argument(argument_owner, arg_node.name)
         arg_defn_type = arg_defn.type
 
         var_inner_type = var_type.unwrap

data/lib/graphql/static_validation/rules/variables_are_used_and_defined.rb

@@ -126,8 +126,9 @@ module GraphQL
         node_variables
           .select { |name, usage| usage.declared? && !usage.used? }
           .each { |var_name, usage|
+            declared_by_error_name = usage.declared_by.name || "anonymous #{usage.declared_by.operation_type}"
             add_error(GraphQL::StaticValidation::VariablesAreUsedAndDefinedError.new(
-              "Variable $#{var_name} is declared by #{usage.declared_by.name} but not used",
+              "Variable $#{var_name} is declared by #{declared_by_error_name} but not used",
               nodes: usage.declared_by,
               path: usage.path,
               name: var_name,
@@ -139,8 +140,9 @@ module GraphQL
         node_variables
           .select { |name, usage| usage.used? && !usage.declared? }
           .each { |var_name, usage|
+            used_by_error_name = usage.used_by.name || "anonymous #{usage.used_by.operation_type}"
             add_error(GraphQL::StaticValidation::VariablesAreUsedAndDefinedError.new(
-              "Variable $#{var_name} is used by #{usage.used_by.name} but not declared",
+              "Variable $#{var_name} is used by #{used_by_error_name} but not declared",
               nodes: usage.ast_node,
               path: usage.path,
               name: var_name,

data/lib/graphql/static_validation/validation_context.rb

@@ -15,14 +15,16 @@ module GraphQL
       extend Forwardable
 
       attr_reader :query, :errors, :visitor,
-        :on_dependency_resolve_handlers
+        :on_dependency_resolve_handlers,
+        :max_errors
 
       def_delegators :@query, :schema, :document, :fragments, :operations, :warden
 
-      def initialize(query, visitor_class)
+      def initialize(query, visitor_class, max_errors)
         @query = query
         @literal_validator = LiteralValidator.new(context: query.context)
         @errors = []
+        @max_errors = max_errors || Float::INFINITY
         @on_dependency_resolve_handlers = []
         @visitor = visitor_class.new(document, self)
       end
@@ -35,9 +37,13 @@ module GraphQL
         @on_dependency_resolve_handlers << handler
       end
 
-      def valid_literal?(ast_value, type)
+      def validate_literal(ast_value, type)
         @literal_validator.validate(ast_value, type)
       end
+
+      def too_many_errors?
+        @errors.length >= @max_errors
+      end
     end
   end
 end

data/lib/graphql/static_validation/validation_timeout_error.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    class ValidationTimeoutError < StaticValidation::Error
+      def initialize(message, path: nil, nodes: [])
+        super(message, path: path, nodes: nodes)
+      end
+
+      # A hash representation of this Message
+      def to_h
+        extensions = {
+          "code" => code
+        }
+
+        super.merge({
+          "extensions" => extensions
+        })
+      end
+
+      def code
+        "validationTimeout"
+      end
+    end
+  end
+end

data/lib/graphql/static_validation/validator.rb

@@ -1,4 +1,6 @@
 # frozen_string_literal: true
+require "timeout"
+
 module GraphQL
   module StaticValidation
     # Initialized with a {GraphQL::Schema}, then it can validate {GraphQL::Language::Nodes::Documents}s based on that schema.
@@ -20,8 +22,11 @@ module GraphQL
 
       # Validate `query` against the schema. Returns an array of message hashes.
       # @param query [GraphQL::Query]
+      # @param validate [Boolean]
+      # @param timeout [Float] Number of seconds to wait before aborting validation. Any positive number may be used, including Floats to specify fractional seconds.
+      # @param max_errors [Integer] Maximum number of errors before aborting validation. Any positive number will limit the number of errors. Defaults to nil for no limit.
       # @return [Array<Hash>]
-      def validate(query, validate: true)
+      def validate(query, validate: true, timeout: nil, max_errors: nil)
         query.trace("validate", { validate: validate, query: query }) do
           can_skip_rewrite = query.context.interpreter? && query.schema.using_ast_analysis? && query.schema.is_a?(Class)
           errors = if validate == false && can_skip_rewrite
@@ -30,20 +35,35 @@ module GraphQL
             rules_to_use = validate ? @rules : []
             visitor_class = BaseVisitor.including_rules(rules_to_use, rewrite: !can_skip_rewrite)
 
-            context = GraphQL::StaticValidation::ValidationContext.new(query, visitor_class)
+            context = GraphQL::StaticValidation::ValidationContext.new(query, visitor_class, max_errors)
+
+            begin
+              # CAUTION: Usage of the timeout module makes the assumption that validation rules are stateless Ruby code that requires no cleanup if process was interrupted. This means no blocking IO calls, native gems, locks, or `rescue` clauses that must be reached.
+              # A timeout value of 0 or nil will execute the block without any timeout.
+              Timeout::timeout(timeout) do
+                catch(:too_many_validation_errors) do
+                  # Attach legacy-style rules.
+                  # Only loop through rules if it has legacy-style rules
+                  unless (legacy_rules = rules_to_use - GraphQL::StaticValidation::ALL_RULES).empty?
+                    legacy_rules.each do |rule_class_or_module|
+                      if rule_class_or_module.method_defined?(:validate)
+                        GraphQL::Deprecation.warn "Legacy validator rules will be removed from GraphQL-Ruby 2.0, use a module instead (see the built-in rules: https://github.com/rmosolgo/graphql-ruby/tree/master/lib/graphql/static_validation/rules)"
+                        GraphQL::Deprecation.warn "  -> Legacy validator: #{rule_class_or_module}"
+                        rule_class_or_module.new.validate(context)
+                      end
+                    end
+                  end
 
-            # Attach legacy-style rules
-            rules_to_use.each do |rule_class_or_module|
-              if rule_class_or_module.method_defined?(:validate)
-                rule_class_or_module.new.validate(context)
+                  context.visitor.visit
+                end
               end
+            rescue Timeout::Error
+              handle_timeout(query, context)
             end
 
-            context.visitor.visit
             context.errors
           end
 
-
           irep = if errors.empty? && context
             # Only return this if there are no errors and validation was actually run
             context.visitor.rewrite_document
@@ -56,6 +76,20 @@ module GraphQL
             irep: irep,
           }
         end
+      rescue GraphQL::ExecutionError => e
+        {
+          errors: [e],
+          irep: nil,
+        }
+      end
+
+      # Invoked when static validation times out.
+      # @param query [GraphQL::Query]
+      # @param context [GraphQL::StaticValidation::ValidationContext]
+      def handle_timeout(query, context)
+        context.errors << GraphQL::StaticValidation::ValidationTimeoutError.new(
+          "Timeout on validation of query"
+        )
       end
     end
   end

data/lib/graphql/static_validation.rb

@@ -4,6 +4,7 @@ require "graphql/static_validation/definition_dependencies"
 require "graphql/static_validation/type_stack"
 require "graphql/static_validation/validator"
 require "graphql/static_validation/validation_context"
+require "graphql/static_validation/validation_timeout_error"
 require "graphql/static_validation/literal_validator"
 require "graphql/static_validation/base_visitor"
 require "graphql/static_validation/no_validate_visitor"

data/lib/graphql/string_encoding_error.rb

@@ -1,10 +1,20 @@
 # frozen_string_literal: true
 module GraphQL
   class StringEncodingError < GraphQL::RuntimeTypeError
-    attr_reader :string
-    def initialize(str)
+    attr_reader :string, :field, :path
+    def initialize(str, context:)
       @string = str
-      super("String \"#{str}\" was encoded as #{str.encoding}! GraphQL requires an encoding compatible with UTF-8.")
+      @field = context[:current_field]
+      @path = context[:current_path]
+      message = "String #{str.inspect} was encoded as #{str.encoding}".dup
+      if @path
+        message << " @ #{@path.join(".")}"
+      end
+      if @field
+        message << " (#{@field.path})"
+      end
+      message << ". GraphQL requires an encoding compatible with UTF-8."
+      super(message)
     end
   end
 end