graphql 1.11.6 → 1.13.19

data/lib/graphql/static_validation/rules/variable_usages_are_allowed.rb

@@ -22,15 +22,15 @@ module GraphQL
         node_values = node_values.select { |value| value.is_a? GraphQL::Language::Nodes::VariableIdentifier }
 
         if node_values.any?
-          arguments = case parent
+          argument_owner = case parent
           when GraphQL::Language::Nodes::Field
-            context.field_definition.arguments
+            context.field_definition
           when GraphQL::Language::Nodes::Directive
-            context.directive_definition.arguments
+            context.directive_definition
           when GraphQL::Language::Nodes::InputObject
             arg_type = context.argument_definition.type.unwrap
-            if arg_type.is_a?(GraphQL::InputObjectType)
-              arguments = arg_type.input_fields
+            if arg_type.kind.input_object?
+              arg_type
             else
               # This is some kind of error
               nil
@@ -43,7 +43,7 @@ module GraphQL
             var_defn_ast = @declared_variables[node_value.name]
             # Might be undefined :(
             # VariablesAreUsedAndDefined can't finalize its search until the end of the document.
-            var_defn_ast && arguments && validate_usage(arguments, node, var_defn_ast)
+            var_defn_ast && argument_owner && validate_usage(argument_owner, node, var_defn_ast)
           end
         end
         super
@@ -51,7 +51,7 @@ module GraphQL
 
       private
 
-      def validate_usage(arguments, arg_node, ast_var)
+      def validate_usage(argument_owner, arg_node, ast_var)
         var_type = context.schema.type_from_ast(ast_var.type, context: context)
         if var_type.nil?
           return
@@ -65,9 +65,15 @@ module GraphQL
           end
         end
 
-        arg_defn = arguments[arg_node.name]
+        arg_defn = context.warden.get_argument(argument_owner, arg_node.name)
         arg_defn_type = arg_defn.type
 
+        # If the argument is non-null, but it was given a default value,
+        # then treat it as nullable in practice, see https://github.com/rmosolgo/graphql-ruby/issues/3793
+        if arg_defn_type.non_null? && arg_defn.default_value?
+          arg_defn_type = arg_defn_type.of_type
+        end
+
         var_inner_type = var_type.unwrap
         arg_inner_type = arg_defn_type.unwrap
 

data/lib/graphql/static_validation/validation_context.rb

@@ -15,14 +15,16 @@ module GraphQL
       extend Forwardable
 
       attr_reader :query, :errors, :visitor,
-        :on_dependency_resolve_handlers
+        :on_dependency_resolve_handlers,
+        :max_errors
 
       def_delegators :@query, :schema, :document, :fragments, :operations, :warden
 
-      def initialize(query, visitor_class)
+      def initialize(query, visitor_class, max_errors)
         @query = query
         @literal_validator = LiteralValidator.new(context: query.context)
         @errors = []
+        @max_errors = max_errors || Float::INFINITY
         @on_dependency_resolve_handlers = []
         @visitor = visitor_class.new(document, self)
       end
@@ -38,6 +40,14 @@ module GraphQL
       def validate_literal(ast_value, type)
         @literal_validator.validate(ast_value, type)
       end
+
+      def too_many_errors?
+        @errors.length >= @max_errors
+      end
+
+      def schema_directives
+        @schema_directives ||= schema.directives
+      end
     end
   end
 end

data/lib/graphql/static_validation/validation_timeout_error.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    class ValidationTimeoutError < StaticValidation::Error
+      def initialize(message, path: nil, nodes: [])
+        super(message, path: path, nodes: nodes)
+      end
+
+      # A hash representation of this Message
+      def to_h
+        extensions = {
+          "code" => code
+        }
+
+        super.merge({
+          "extensions" => extensions
+        })
+      end
+
+      def code
+        "validationTimeout"
+      end
+    end
+  end
+end

data/lib/graphql/static_validation/validator.rb

@@ -1,4 +1,6 @@
 # frozen_string_literal: true
+require "timeout"
+
 module GraphQL
   module StaticValidation
     # Initialized with a {GraphQL::Schema}, then it can validate {GraphQL::Language::Nodes::Documents}s based on that schema.
@@ -20,8 +22,11 @@ module GraphQL
 
       # Validate `query` against the schema. Returns an array of message hashes.
       # @param query [GraphQL::Query]
+      # @param validate [Boolean]
+      # @param timeout [Float] Number of seconds to wait before aborting validation. Any positive number may be used, including Floats to specify fractional seconds.
+      # @param max_errors [Integer] Maximum number of errors before aborting validation. Any positive number will limit the number of errors. Defaults to nil for no limit.
       # @return [Array<Hash>]
-      def validate(query, validate: true)
+      def validate(query, validate: true, timeout: nil, max_errors: nil)
         query.trace("validate", { validate: validate, query: query }) do
           can_skip_rewrite = query.context.interpreter? && query.schema.using_ast_analysis? && query.schema.is_a?(Class)
           errors = if validate == false && can_skip_rewrite
@@ -30,23 +35,35 @@ module GraphQL
             rules_to_use = validate ? @rules : []
             visitor_class = BaseVisitor.including_rules(rules_to_use, rewrite: !can_skip_rewrite)
 
-            context = GraphQL::StaticValidation::ValidationContext.new(query, visitor_class)
+            context = GraphQL::StaticValidation::ValidationContext.new(query, visitor_class, max_errors)
+
+            begin
+              # CAUTION: Usage of the timeout module makes the assumption that validation rules are stateless Ruby code that requires no cleanup if process was interrupted. This means no blocking IO calls, native gems, locks, or `rescue` clauses that must be reached.
+              # A timeout value of 0 or nil will execute the block without any timeout.
+              Timeout::timeout(timeout) do
+                catch(:too_many_validation_errors) do
+                  # Attach legacy-style rules.
+                  # Only loop through rules if it has legacy-style rules
+                  unless (legacy_rules = rules_to_use - GraphQL::StaticValidation::ALL_RULES).empty?
+                    legacy_rules.each do |rule_class_or_module|
+                      if rule_class_or_module.method_defined?(:validate)
+                        GraphQL::Deprecation.warn "Legacy validator rules will be removed from GraphQL-Ruby 2.0, use a module instead (see the built-in rules: https://github.com/rmosolgo/graphql-ruby/tree/master/lib/graphql/static_validation/rules)"
+                        GraphQL::Deprecation.warn "  -> Legacy validator: #{rule_class_or_module}"
+                        rule_class_or_module.new.validate(context)
+                      end
+                    end
+                  end
 
-            # Attach legacy-style rules.
-            # Only loop through rules if it has legacy-style rules
-            unless (legacy_rules = rules_to_use - GraphQL::StaticValidation::ALL_RULES).empty?
-              legacy_rules.each do |rule_class_or_module|
-                if rule_class_or_module.method_defined?(:validate)
-                  rule_class_or_module.new.validate(context)
+                  context.visitor.visit
                 end
               end
+            rescue Timeout::Error
+              handle_timeout(query, context)
             end
 
-            context.visitor.visit
             context.errors
           end
 
-
           irep = if errors.empty? && context
             # Only return this if there are no errors and validation was actually run
             context.visitor.rewrite_document
@@ -59,6 +76,20 @@ module GraphQL
             irep: irep,
           }
         end
+      rescue GraphQL::ExecutionError => e
+        {
+          errors: [e],
+          irep: nil,
+        }
+      end
+
+      # Invoked when static validation times out.
+      # @param query [GraphQL::Query]
+      # @param context [GraphQL::StaticValidation::ValidationContext]
+      def handle_timeout(query, context)
+        context.errors << GraphQL::StaticValidation::ValidationTimeoutError.new(
+          "Timeout on validation of query"
+        )
       end
     end
   end

data/lib/graphql/static_validation.rb

@@ -4,6 +4,7 @@ require "graphql/static_validation/definition_dependencies"
 require "graphql/static_validation/type_stack"
 require "graphql/static_validation/validator"
 require "graphql/static_validation/validation_context"
+require "graphql/static_validation/validation_timeout_error"
 require "graphql/static_validation/literal_validator"
 require "graphql/static_validation/base_visitor"
 require "graphql/static_validation/no_validate_visitor"

data/lib/graphql/string_encoding_error.rb

@@ -1,10 +1,20 @@
 # frozen_string_literal: true
 module GraphQL
   class StringEncodingError < GraphQL::RuntimeTypeError
-    attr_reader :string
-    def initialize(str)
+    attr_reader :string, :field, :path
+    def initialize(str, context:)
       @string = str
-      super("String \"#{str}\" was encoded as #{str.encoding}! GraphQL requires an encoding compatible with UTF-8.")
+      @field = context[:current_field]
+      @path = context[:current_path]
+      message = "String #{str.inspect} was encoded as #{str.encoding}".dup
+      if @path
+        message << " @ #{@path.join(".")}"
+      end
+      if @field
+        message << " (#{@field.path})"
+      end
+      message << ". GraphQL requires an encoding compatible with UTF-8."
+      super(message)
     end
   end
 end

data/lib/graphql/string_type.rb

@@ -1,2 +1,2 @@
 # frozen_string_literal: true
-GraphQL::STRING_TYPE = GraphQL::Types::String.graphql_definition
+GraphQL::STRING_TYPE = GraphQL::Types::String.graphql_definition(silence_deprecation_warning: true)

data/lib/graphql/subscriptions/action_cable_subscriptions.rb

@@ -34,12 +34,12 @@ module GraphQL
     #         channel: self,
     #       }
     #
-    #       result = MySchema.execute({
+    #       result = MySchema.execute(
     #         query: query,
     #         context: context,
     #         variables: variables,
     #         operation_name: operation_name
-    #       })
+    #       )
     #
     #       payload = {
     #         result: result.to_h,
@@ -95,6 +95,14 @@ module GraphQL
         @action_cable = action_cable
         @action_cable_coder = action_cable_coder
         @serializer = serializer
+        @serialize_with_context = case @serializer.method(:load).arity
+        when 1
+          false
+        when 2
+          true
+        else
+          raise ArgumentError, "#{@serializer} must repond to `.load` accepting one or two arguments"
+        end
         @transmit_ns = namespace
         super
       end
@@ -119,7 +127,13 @@ module GraphQL
       # It will receive notifications when events come in
       # and re-evaluate the query locally.
       def write_subscription(query, events)
-        channel = query.context.fetch(:channel)
+        unless (channel = query.context[:channel])
+          raise GraphQL::Error, "This GraphQL Subscription client does not support the transport protocol expected"\
+            "by the backend Subscription Server implementation (graphql-ruby ActionCableSubscriptions in this case)."\
+            "Some official client implementation including Apollo (https://graphql-ruby.org/javascript_client/apollo_subscriptions.html), "\
+            "Relay Modern (https://graphql-ruby.org/javascript_client/relay_subscriptions.html#actioncable)."\
+            "GraphiQL via `graphiql-rails` may not work out of box (#1051)."
+        end
         subscription_id = query.context[:subscription_id] ||= build_id
         stream = stream_subscription_name(subscription_id)
         channel.stream_from(stream)
@@ -146,19 +160,22 @@ module GraphQL
       def setup_stream(channel, initial_event)
         topic = initial_event.topic
         channel.stream_from(stream_event_name(initial_event), coder: @action_cable_coder) do |message|
-          object = @serializer.load(message)
           events_by_fingerprint = @events[topic]
+          object = nil
           events_by_fingerprint.each do |_fingerprint, events|
             if events.any? && events.first == initial_event
               # The fingerprint has told us that this response should be shared by all subscribers,
               # so just run it once, then deliver the result to every subscriber
               first_event = events.first
               first_subscription_id = first_event.context.fetch(:subscription_id)
+              object ||= load_action_cable_message(message, first_event.context)
               result = execute_update(first_subscription_id, first_event, object)
-              # Having calculated the result _once_, send the same payload to all subscribers
-              events.each do |event|
-                subscription_id = event.context.fetch(:subscription_id)
-                deliver(subscription_id, result)
+              if !result.nil?
+                # Having calculated the result _once_, send the same payload to all subscribers
+                events.each do |event|
+                  subscription_id = event.context.fetch(:subscription_id)
+                  deliver(subscription_id, result)
+                end
               end
             end
           end
@@ -166,6 +183,18 @@ module GraphQL
         end
       end
 
+      # This is called to turn an ActionCable-broadcasted string (JSON)
+      # into a query-ready application object.
+      # @param message [String] n ActionCable-broadcasted string (JSON)
+      # @param context [GraphQL::Query::Context] the context of the first event for a given subscription fingerprint
+      def load_action_cable_message(message, context)
+        if @serialize_with_context
+          @serializer.load(message, context)
+        else
+          @serializer.load(message)
+        end
+      end
+
       # Return the query from "storage" (in memory)
       def read_subscription(subscription_id)
         query = @subscriptions[subscription_id]
@@ -187,6 +216,8 @@ module GraphQL
       # The channel was closed, forget about it.
       def delete_subscription(subscription_id)
         query = @subscriptions.delete(subscription_id)
+        # In case this came from the server, tell the client to unsubscribe:
+        @action_cable.server.broadcast(stream_subscription_name(subscription_id), { more: false })
         # This can be `nil` when `.trigger` happens inside an unsubscribed ActionCable channel,
         # see https://github.com/rmosolgo/graphql-ruby/issues/2478
         if query

data/lib/graphql/subscriptions/broadcast_analyzer.rb

@@ -35,9 +35,6 @@ module GraphQL
           pt = @query.possible_types(current_type)
           pt.each do |object_type|
             ot_field = @query.get_field(object_type, current_field.graphql_name)
-            if !ot_field
-              binding.pry
-            end
             # Inherited fields would be exactly the same object;
             # only check fields that are overrides of the inherited one
             if ot_field && ot_field != current_field

data/lib/graphql/subscriptions/event.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# test_via: ../subscriptions.rb
 module GraphQL
   class Subscriptions
     # This thing can be:
@@ -24,32 +23,24 @@ module GraphQL
         @arguments = arguments
         @context = context
         field ||= context.field
-        scope_val = scope || (context && field.subscription_scope && context[field.subscription_scope])
+        scope_key = field.subscription_scope
+        scope_val = scope || (context && scope_key && context[scope_key])
+        if scope_key &&
+            (subscription = field.resolver) &&
+            (subscription.respond_to?(:subscription_scope_optional?)) &&
+            !subscription.subscription_scope_optional? &&
+            scope_val.nil?
+          raise Subscriptions::SubscriptionScopeMissingError, "#{field.path} (#{subscription}) requires a `scope:` value to trigger updates (Set `subscription_scope ..., optional: true` to disable this requirement)"
+        end
 
-        @topic = self.class.serialize(name, arguments, field, scope: scope_val)
+        @topic = self.class.serialize(name, arguments, field, scope: scope_val, context: context)
       end
 
       # @return [String] an identifier for this unit of subscription
-      def self.serialize(name, arguments, field, scope:)
-        normalized_args = case arguments
-        when GraphQL::Query::Arguments
-          arguments
-        when Hash
-          if field.is_a?(GraphQL::Schema::Field)
-            stringify_args(field, arguments)
-          else
-            GraphQL::Query::LiteralInput.from_arguments(
-              arguments,
-              field,
-              nil,
-            )
-          end
-        else
-          raise ArgumentError, "Unexpected arguments: #{arguments}, must be Hash or GraphQL::Arguments"
-        end
-
-        sorted_h = stringify_args(field, normalized_args.to_h)
-        Serialize.dump_recursive([scope, name, sorted_h])
+      def self.serialize(_name, arguments, field, scope:, context: GraphQL::Query::NullContext)
+        subscription = field.resolver || GraphQL::Schema::Subscription
+        normalized_args = stringify_args(field, arguments.to_h, context)
+        subscription.topic_for(arguments: normalized_args, field: field, scope: scope)
       end
 
       # @return [String] a logical identifier for this event. (Stable when the query is broadcastable.)
@@ -70,37 +61,82 @@ module GraphQL
 
       class << self
         private
-        def stringify_args(arg_owner, args)
+
+        # This method does not support cyclic references in the Hash,
+        # nor does it support Hashes whose keys are not sortable
+        # with respect to their peers ( cases where a <=> b might throw an error )
+        def deep_sort_hash_keys(hash_to_sort)
+          raise ArgumentError.new("Argument must be a Hash") unless hash_to_sort.is_a?(Hash)
+          hash_to_sort.keys.sort.map do |k|
+            if hash_to_sort[k].is_a?(Hash)
+              [k, deep_sort_hash_keys(hash_to_sort[k])]
+            elsif hash_to_sort[k].is_a?(Array)
+              [k, deep_sort_array_hashes(hash_to_sort[k])]
+            else
+              [k, hash_to_sort[k]]
+            end
+          end.to_h
+        end
+
+        def deep_sort_array_hashes(array_to_inspect)
+          raise ArgumentError.new("Argument must be an Array") unless array_to_inspect.is_a?(Array)
+          array_to_inspect.map do |v|
+            if v.is_a?(Hash)
+              deep_sort_hash_keys(v)
+            elsif v.is_a?(Array)
+              deep_sort_array_hashes(v)
+            else
+              v
+            end
+          end
+        end
+
+        def stringify_args(arg_owner, args, context)
+          arg_owner = arg_owner.respond_to?(:unwrap) ? arg_owner.unwrap : arg_owner # remove list and non-null wrappers
           case args
           when Hash
             next_args = {}
             args.each do |k, v|
               arg_name = k.to_s
               camelized_arg_name = GraphQL::Schema::Member::BuildType.camelize(arg_name)
-              arg_defn = get_arg_definition(arg_owner, camelized_arg_name)
+              arg_defn = get_arg_definition(arg_owner, camelized_arg_name, context)
 
               if arg_defn
                 normalized_arg_name = camelized_arg_name
               else
                 normalized_arg_name = arg_name
-                arg_defn = get_arg_definition(arg_owner, normalized_arg_name)
+                arg_defn = get_arg_definition(arg_owner, normalized_arg_name, context)
+              end
+              arg_base_type = arg_defn.type.unwrap
+              # In the case where the value being emitted is seen as a "JSON"
+              # type, treat the value as one atomic unit of serialization
+              is_json_definition = arg_base_type && arg_base_type <= GraphQL::Types::JSON
+              if is_json_definition
+                sorted_value = if v.is_a?(Hash)
+                  deep_sort_hash_keys(v)
+                elsif v.is_a?(Array)
+                  deep_sort_array_hashes(v)
+                else
+                  v
+                end
+                next_args[normalized_arg_name] = sorted_value.respond_to?(:to_json) ? sorted_value.to_json : sorted_value
+              else
+                next_args[normalized_arg_name] = stringify_args(arg_base_type, v, context)
               end
-
-              next_args[normalized_arg_name] = stringify_args(arg_defn.type, v)
             end
             # Make sure they're deeply sorted
             next_args.sort.to_h
           when Array
-            args.map { |a| stringify_args(arg_owner, a) }
+            args.map { |a| stringify_args(arg_owner, a, context) }
           when GraphQL::Schema::InputObject
-            stringify_args(arg_owner, args.to_h)
+            stringify_args(arg_owner, args.to_h, context)
           else
             args
           end
         end
 
-        def get_arg_definition(arg_owner, arg_name)
-          arg_owner.arguments[arg_name] || arg_owner.arguments.each_value.find { |v| v.keyword.to_s == arg_name }
+        def get_arg_definition(arg_owner, arg_name, context)
+          arg_owner.get_argument(arg_name, context) || arg_owner.arguments(context).each_value.find { |v| v.keyword.to_s == arg_name }
         end
       end
     end

data/lib/graphql/subscriptions/instrumentation.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# test_via: ../subscriptions.rb
 module GraphQL
   class Subscriptions
     # Wrap the root fields of the subscription type with special logic for:

data/lib/graphql/subscriptions/serialize.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# test_via: ../subscriptions.rb
 require "set"
 module GraphQL
   class Subscriptions
@@ -10,7 +9,7 @@ module GraphQL
       SYMBOL_KEY = "__sym__"
       SYMBOL_KEYS_KEY = "__sym_keys__"
       TIMESTAMP_KEY = "__timestamp__"
-      TIMESTAMP_FORMAT = "%Y-%m-%d %H:%M:%S.%N%Z" # eg '2020-01-01 23:59:59.123456789+05:00'
+      TIMESTAMP_FORMAT = "%Y-%m-%d %H:%M:%S.%N%z" # eg '2020-01-01 23:59:59.123456789+05:00'
       OPEN_STRUCT_KEY = "__ostruct__"
 
       module_function
@@ -56,7 +55,14 @@ module GraphQL
         # @return [Object] An object that load Global::Identification recursive
         def load_value(value)
           if value.is_a?(Array)
-            value.map{|item| load_value(item)}
+            is_gids = (v1 = value[0]).is_a?(Hash) && v1.size == 1 && v1[GLOBALID_KEY]
+            if is_gids
+              # Assume it's an array of global IDs
+              ids = value.map { |v| v[GLOBALID_KEY] }
+              GlobalID::Locator.locate_many(ids)
+            else
+              value.map { |item| load_value(item) }
+            end
           elsif value.is_a?(Hash)
             if value.size == 1
               case value.keys.first # there's only 1 key
@@ -65,12 +71,23 @@ module GraphQL
               when SYMBOL_KEY
                 value[SYMBOL_KEY].to_sym
               when TIMESTAMP_KEY
-                timestamp_class_name, timestamp_s = value[TIMESTAMP_KEY]
+                timestamp_class_name, *timestamp_args = value[TIMESTAMP_KEY]
                 timestamp_class = Object.const_get(timestamp_class_name)
-                timestamp_class.strptime(timestamp_s, TIMESTAMP_FORMAT)
+                if defined?(ActiveSupport::TimeWithZone) && timestamp_class <= ActiveSupport::TimeWithZone
+                  zone_name, timestamp_s = timestamp_args
+                  zone = ActiveSupport::TimeZone[zone_name]
+                  raise "Zone #{zone_name} not found, unable to deserialize" unless zone
+                  zone.strptime(timestamp_s, TIMESTAMP_FORMAT)
+                else
+                  timestamp_s = timestamp_args.first
+                  timestamp_class.strptime(timestamp_s, TIMESTAMP_FORMAT)
+                end
               when OPEN_STRUCT_KEY
                 ostruct_values = load_value(value[OPEN_STRUCT_KEY])
                 OpenStruct.new(ostruct_values)
+              else
+                key = value.keys.first
+                { key => load_value(value[key]) }
               end
             else
               loaded_h = {}
@@ -114,6 +131,18 @@ module GraphQL
             { SYMBOL_KEY => obj.to_s }
           elsif obj.respond_to?(:to_gid_param)
             {GLOBALID_KEY => obj.to_gid_param}
+          elsif defined?(ActiveSupport::TimeWithZone) && obj.is_a?(ActiveSupport::TimeWithZone) && obj.class.name != Time.name
+            # This handles a case where Rails prior to 7 would
+            # make the class ActiveSupport::TimeWithZone return "Time" for
+            # its name. In Rails 7, it will now return "ActiveSupport::TimeWithZone",
+            # which happens to be incompatible with expectations we have
+            # with what a Time class supports ( notably, strptime in `load_value` ).
+            #
+            # This now passes along the name of the zone, such that a future deserialization
+            # of this string will use the correct time zone from the ActiveSupport TimeZone
+            # list to produce the time.
+            #
+            { TIMESTAMP_KEY => [obj.class.name, obj.time_zone.name, obj.strftime(TIMESTAMP_FORMAT)] }
           elsif obj.is_a?(Date) || obj.is_a?(Time)
             # DateTime extends Date; for TimeWithZone, call `.utc` first.
             { TIMESTAMP_KEY => [obj.class.name, obj.strftime(TIMESTAMP_FORMAT)] }

data/lib/graphql/subscriptions/subscription_root.rb

@@ -6,7 +6,7 @@ module GraphQL
     # @deprecated This module is no longer needed.
     module SubscriptionRoot
       def self.extended(child_cls)
-        warn "`extend GraphQL::Subscriptions::SubscriptionRoot` is no longer required; you can remove it from your Subscription type (#{child_cls})"
+        GraphQL::Deprecation.warn "`extend GraphQL::Subscriptions::SubscriptionRoot` is no longer required; you can remove it from your Subscription type (#{child_cls})"
         child_cls.include(InstanceMethods)
       end