graphql 1.8.0 → 1.12.12

data/lib/graphql/analysis/ast/query_complexity.rb

@@ -0,0 +1,234 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    # Calculate the complexity of a query, using {Field#complexity} values.
+    module AST
+      class QueryComplexity < Analyzer
+        # State for the query complexity calculation:
+        # - `complexities_on_type` holds complexity scores for each type in an IRep node
+        def initialize(query)
+          super
+          @complexities_on_type_by_query = {}
+        end
+
+        # Overide this method to use the complexity result
+        def result
+          max_possible_complexity
+        end
+
+        class ScopedTypeComplexity
+          # A single proc for {#scoped_children} hashes. Use this to avoid repeated allocations,
+          # since the lexical binding isn't important.
+          HASH_CHILDREN = ->(h, k) { h[k] = {} }
+
+          attr_reader :field_definition, :response_path, :query
+
+          # @param node [Language::Nodes::Field] The AST node; used for providing argument values when necessary
+          # @param field_definition [GraphQL::Field, GraphQL::Schema::Field] Used for getting the `.complexity` configuration
+          # @param query [GraphQL::Query] Used for `query.possible_types`
+          # @param response_path [Array<String>] The path to the response key for the field
+          def initialize(node, field_definition, query, response_path)
+            @node = node
+            @field_definition = field_definition
+            @query = query
+            @response_path = response_path
+            @scoped_children = nil
+          end
+
+          # Returns true if this field has no selections, ie, it's a scalar.
+          # We need a quick way to check whether we should continue traversing.
+          def terminal?
+            @scoped_children.nil?
+          end
+
+          # This value is only calculated when asked for to avoid needless hash allocations.
+          # Also, if it's never asked for, we determine that this scope complexity
+          # is a scalar field ({#terminal?}).
+          # @return [Hash<Hash<Class => ScopedTypeComplexity>]
+          def scoped_children
+            @scoped_children ||= Hash.new(&HASH_CHILDREN)
+          end
+
+          def own_complexity(child_complexity)
+            defined_complexity = @field_definition.complexity
+            case defined_complexity
+            when Proc
+              arguments = @query.arguments_for(@node, @field_definition)
+              defined_complexity.call(@query.context, arguments.keyword_arguments, child_complexity)
+            when Numeric
+              defined_complexity + child_complexity
+            else
+              raise("Invalid complexity: #{defined_complexity.inspect} on #{@field_definition.name}")
+            end
+          end
+        end
+
+        def on_enter_field(node, parent, visitor)
+          # We don't want to visit fragment definitions,
+          # we'll visit them when we hit the spreads instead
+          return if visitor.visiting_fragment_definition?
+          return if visitor.skipping?
+          parent_type = visitor.parent_type_definition
+          field_key = node.alias || node.name
+          # Find the complexity calculation for this field --
+          # if we're re-entering a selection, we'll already have one.
+          # Otherwise, make a new one and store it.
+          #
+          # `node` and `visitor.field_definition` may appear from a cache,
+          # but I think that's ok. If the arguments _didn't_ match,
+          # then the query would have been rejected as invalid.
+          complexities_on_type = @complexities_on_type_by_query[visitor.query] ||= [ScopedTypeComplexity.new(nil, nil, query, visitor.response_path)]
+
+          complexity = complexities_on_type.last.scoped_children[parent_type][field_key] ||= ScopedTypeComplexity.new(node, visitor.field_definition, visitor.query, visitor.response_path)
+          # Push it on the stack.
+          complexities_on_type.push(complexity)
+        end
+
+        def on_leave_field(node, parent, visitor)
+          # We don't want to visit fragment definitions,
+          # we'll visit them when we hit the spreads instead
+          return if visitor.visiting_fragment_definition?
+          return if visitor.skipping?
+          complexities_on_type = @complexities_on_type_by_query[visitor.query]
+          complexities_on_type.pop
+        end
+
+        private
+
+        # @return [Integer]
+        def max_possible_complexity
+          @complexities_on_type_by_query.reduce(0) do |total, (query, complexities_on_type)|
+            root_complexity = complexities_on_type.last
+            # Use this entry point to calculate the total complexity
+            total_complexity_for_query = merged_max_complexity_for_scopes(query, [root_complexity.scoped_children])
+            total + total_complexity_for_query
+          end
+        end
+
+        # @param query [GraphQL::Query] Used for `query.possible_types`
+        # @param scoped_children_hashes [Array<Hash>] Array of scoped children hashes
+        # @return [Integer]
+        def merged_max_complexity_for_scopes(query, scoped_children_hashes)
+          # Figure out what scopes are possible here.
+          # Use a hash, but ignore the values; it's just a fast way to work with the keys.
+          all_scopes = {}
+          scoped_children_hashes.each do |h|
+            all_scopes.merge!(h)
+          end
+
+          # If an abstract scope is present, but _all_ of its concrete types
+          # are also in the list, remove it from the list of scopes to check,
+          # because every possible type is covered by a concrete type.
+          # (That is, there are no remainder types to check.)
+          prev_keys = all_scopes.keys
+          prev_keys.each do |scope|
+            next unless scope.kind.abstract?
+
+            missing_concrete_types = query.possible_types(scope).select { |t| !all_scopes.key?(t) }
+            # This concrete type is possible _only_ as a member of the abstract type.
+            # So, attribute to it the complexity which belongs to the abstract type.
+            missing_concrete_types.each do |concrete_scope|
+              all_scopes[concrete_scope] = all_scopes[scope]
+            end
+            all_scopes.delete(scope)
+          end
+
+          # This will hold `{ type => int }` pairs, one for each possible branch
+          complexity_by_scope = {}
+
+          # For each scope,
+          # find the lexical selections that might apply to it,
+          # and gather them together into an array.
+          # Then, treat the set of selection hashes
+          # as a set and calculate the complexity for them as a unit
+          all_scopes.each do |scope, _|
+            # These will be the selections on `scope`
+            children_for_scope = []
+            scoped_children_hashes.each do |sc_h|
+              sc_h.each do |inner_scope, children_hash|
+                if applies_to?(query, scope, inner_scope)
+                  children_for_scope << children_hash
+                end
+              end
+            end
+
+            # Calculate the complexity for `scope`, merging all
+            # possible lexical branches.
+            complexity_value = merged_max_complexity(query, children_for_scope)
+            complexity_by_scope[scope] = complexity_value
+          end
+
+          # Return the max complexity among all scopes
+          complexity_by_scope.each_value.max
+        end
+
+        def applies_to?(query, left_scope, right_scope)
+          if left_scope == right_scope
+            # This can happen when several branches are being analyzed together
+            true
+          else
+            # Check if these two scopes have _any_ types in common.
+            possible_right_types = query.possible_types(right_scope)
+            possible_left_types = query.possible_types(left_scope)
+            !(possible_right_types & possible_left_types).empty?
+          end
+        end
+
+        # A hook which is called whenever a field's max complexity is calculated.
+        # Override this method to capture individual field complexity details.
+        #
+        # @param scoped_type_complexity [ScopedTypeComplexity]
+        # @param max_complexity [Numeric] Field's maximum complexity including child complexity
+        # @param child_complexity [Numeric, nil] Field's child complexity
+        def field_complexity(scoped_type_complexity, max_complexity:, child_complexity: nil)
+        end
+
+        # @param children_for_scope [Array<Hash>] An array of `scoped_children[scope]` hashes
+        # (`{field_key => complexity}`)
+        # @return [Integer] Complexity value for all these selections in the current scope
+        def merged_max_complexity(query, children_for_scope)
+          all_keys = []
+          children_for_scope.each do |c|
+            all_keys.concat(c.keys)
+          end
+          all_keys.uniq!
+          complexity_for_keys = {}
+
+          all_keys.each do |child_key|
+            scoped_children_for_key = nil
+            complexity_for_key = nil
+            children_for_scope.each do |children_hash|
+              next unless children_hash.key?(child_key)
+
+              complexity_for_key = children_hash[child_key]
+              if complexity_for_key.terminal?
+                # Assume that all terminals would return the same complexity
+                # Since it's a terminal, its child complexity is zero.
+                complexity = complexity_for_key.own_complexity(0)
+                complexity_for_keys[child_key] = complexity
+
+                field_complexity(complexity_for_key, max_complexity: complexity, child_complexity: nil)
+              else
+                scoped_children_for_key ||= []
+                scoped_children_for_key << complexity_for_key.scoped_children
+              end
+            end
+
+            next unless scoped_children_for_key
+
+            child_complexity = merged_max_complexity_for_scopes(query, scoped_children_for_key)
+            # This is the _last_ one we visited; assume it's representative.
+            max_complexity = complexity_for_key.own_complexity(child_complexity)
+
+            field_complexity(complexity_for_key, max_complexity: max_complexity, child_complexity: child_complexity)
+
+            complexity_for_keys[child_key] = max_complexity
+          end
+
+          # Calculate the child complexity by summing the complexity of all selections
+          complexity_for_keys.each_value.inject(0, &:+)
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/ast/query_depth.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    # A query reducer for measuring the depth of a given query.
+    #
+    # See https://graphql-ruby.org/queries/ast_analysis.html for more examples.
+    #
+    # @example Logging the depth of a query
+    #   class LogQueryDepth < GraphQL::Analysis::QueryDepth
+    #     def result
+    #       log("GraphQL query depth: #{@max_depth}")
+    #     end
+    #   end
+    #
+    #   # In your Schema file:
+    #
+    #   class MySchema < GraphQL::Schema
+    #     use GraphQL::Analysis::AST
+    #     query_analyzer LogQueryDepth
+    #   end
+    #
+    #   # When you run the query, the depth will get logged:
+    #
+    #   Schema.execute(query_str)
+    #   # GraphQL query depth: 8
+    #
+    module AST
+      class QueryDepth < Analyzer
+        def initialize(query)
+          @max_depth = 0
+          @current_depth = 0
+          super
+        end
+
+        def on_enter_field(node, parent, visitor)
+          return if visitor.skipping? || visitor.visiting_fragment_definition?
+
+          @current_depth += 1
+        end
+
+        def on_leave_field(node, parent, visitor)
+          return if visitor.skipping? || visitor.visiting_fragment_definition?
+
+          if @max_depth < @current_depth
+            @max_depth = @current_depth
+          end
+          @current_depth -= 1
+        end
+
+        def result
+          @max_depth
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/ast/visitor.rb

@@ -0,0 +1,268 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    module AST
+      # Depth first traversal through a query AST, calling AST analyzers
+      # along the way.
+      #
+      # The visitor is a special case of GraphQL::Language::Visitor, visiting
+      # only the selected operation, providing helpers for common use cases such
+      # as skipped fields and visiting fragment spreads.
+      #
+      # @see {GraphQL::Analysis::AST::Analyzer} AST Analyzers for queries
+      class Visitor < GraphQL::Language::Visitor
+        def initialize(query:, analyzers:)
+          @analyzers = analyzers
+          @path = []
+          @object_types = []
+          @directives = []
+          @field_definitions = []
+          @argument_definitions = []
+          @directive_definitions = []
+          @rescued_errors = []
+          @query = query
+          @schema = query.schema
+          @response_path = []
+          @skip_stack = [false]
+          super(query.selected_operation)
+        end
+
+        # @return [GraphQL::Query] the query being visited
+        attr_reader :query
+
+        # @return [Array<GraphQL::ObjectType>] Types whose scope we've entered
+        attr_reader :object_types
+
+        # @return [Array<GraphQL::AnalysisError]
+        attr_reader :rescued_errors
+
+        def visit
+          return unless @document
+          super
+        end
+
+        # Visit Helpers
+
+        # @return [GraphQL::Query::Arguments] Arguments for this node, merging default values, literal values and query variables
+        # @see {GraphQL::Query#arguments_for}
+        def arguments_for(ast_node, field_definition)
+          @query.arguments_for(ast_node, field_definition)
+        end
+
+        # @return [Boolean] If the visitor is currently inside a fragment definition
+        def visiting_fragment_definition?
+          @in_fragment_def
+        end
+
+        # @return [Boolean] If the current node should be skipped because of a skip or include directive
+        def skipping?
+          @skipping
+        end
+
+        # @return [Array<String>] The path to the response key for the current field
+        def response_path
+          @response_path.dup
+        end
+
+        # Visitor Hooks
+
+        def on_operation_definition(node, parent)
+          object_type = @schema.root_type_for_operation(node.operation_type)
+          @object_types.push(object_type)
+          @path.push("#{node.operation_type}#{node.name ? " #{node.name}" : ""}")
+          call_analyzers(:on_enter_operation_definition, node, parent)
+          super
+          call_analyzers(:on_leave_operation_definition, node, parent)
+          @object_types.pop
+          @path.pop
+        end
+
+        def on_fragment_definition(node, parent)
+          on_fragment_with_type(node) do
+            @path.push("fragment #{node.name}")
+            @in_fragment_def = false
+            call_analyzers(:on_enter_fragment_definition, node, parent)
+            super
+            @in_fragment_def = false
+            call_analyzers(:on_leave_fragment_definition, node, parent)
+          end
+        end
+
+        def on_inline_fragment(node, parent)
+          on_fragment_with_type(node) do
+            @path.push("...#{node.type ? " on #{node.type.name}" : ""}")
+            call_analyzers(:on_enter_inline_fragment, node, parent)
+            super
+            call_analyzers(:on_leave_inline_fragment, node, parent)
+          end
+        end
+
+        def on_field(node, parent)
+          @response_path.push(node.alias || node.name)
+          parent_type = @object_types.last
+          field_definition = @schema.get_field(parent_type, node.name)
+          @field_definitions.push(field_definition)
+          if !field_definition.nil?
+            next_object_type = field_definition.type.unwrap
+            @object_types.push(next_object_type)
+          else
+            @object_types.push(nil)
+          end
+          @path.push(node.alias || node.name)
+
+          @skipping = @skip_stack.last || skip?(node)
+          @skip_stack << @skipping
+
+          call_analyzers(:on_enter_field, node, parent)
+          super
+
+          @skipping = @skip_stack.pop
+
+          call_analyzers(:on_leave_field, node, parent)
+          @response_path.pop
+          @field_definitions.pop
+          @object_types.pop
+          @path.pop
+        end
+
+        def on_directive(node, parent)
+          directive_defn = @schema.directives[node.name]
+          @directive_definitions.push(directive_defn)
+          call_analyzers(:on_enter_directive, node, parent)
+          super
+          call_analyzers(:on_leave_directive, node, parent)
+          @directive_definitions.pop
+        end
+
+        def on_argument(node, parent)
+          argument_defn = if (arg = @argument_definitions.last)
+            arg_type = arg.type.unwrap
+            if arg_type.kind.input_object?
+              arg_type.arguments[node.name]
+            else
+              nil
+            end
+          elsif (directive_defn = @directive_definitions.last)
+            directive_defn.arguments[node.name]
+          elsif (field_defn = @field_definitions.last)
+            field_defn.arguments[node.name]
+          else
+            nil
+          end
+
+          @argument_definitions.push(argument_defn)
+          @path.push(node.name)
+          call_analyzers(:on_enter_argument, node, parent)
+          super
+          call_analyzers(:on_leave_argument, node, parent)
+          @argument_definitions.pop
+          @path.pop
+        end
+
+        def on_fragment_spread(node, parent)
+          @path.push("... #{node.name}")
+          call_analyzers(:on_enter_fragment_spread, node, parent)
+          enter_fragment_spread_inline(node)
+          super
+          leave_fragment_spread_inline(node)
+          call_analyzers(:on_leave_fragment_spread, node, parent)
+          @path.pop
+        end
+
+        def on_abstract_node(node, parent)
+          call_analyzers(:on_enter_abstract_node, node, parent)
+          super
+          call_analyzers(:on_leave_abstract_node, node, parent)
+        end
+
+        # @return [GraphQL::BaseType] The current object type
+        def type_definition
+          @object_types.last
+        end
+
+        # @return [GraphQL::BaseType] The type which the current type came from
+        def parent_type_definition
+          @object_types[-2]
+        end
+
+        # @return [GraphQL::Field, nil] The most-recently-entered GraphQL::Field, if currently inside one
+        def field_definition
+          @field_definitions.last
+        end
+
+        # @return [GraphQL::Field, nil] The GraphQL field which returned the object that the current field belongs to
+        def previous_field_definition
+          @field_definitions[-2]
+        end
+
+        # @return [GraphQL::Directive, nil] The most-recently-entered GraphQL::Directive, if currently inside one
+        def directive_definition
+          @directive_definitions.last
+        end
+
+        # @return [GraphQL::Argument, nil] The most-recently-entered GraphQL::Argument, if currently inside one
+        def argument_definition
+          @argument_definitions.last
+        end
+
+        # @return [GraphQL::Argument, nil] The previous GraphQL argument
+        def previous_argument_definition
+          @argument_definitions[-2]
+        end
+
+        private
+
+        # Visit a fragment spread inline instead of visiting the definition
+        # by itself.
+        def enter_fragment_spread_inline(fragment_spread)
+          fragment_def = query.fragments[fragment_spread.name]
+
+          object_type = if fragment_def.type
+            @query.warden.get_type(fragment_def.type.name)
+          else
+            object_types.last
+          end
+
+          object_types << object_type
+
+          fragment_def.selections.each do |selection|
+            visit_node(selection, fragment_def)
+          end
+        end
+
+        # Visit a fragment spread inline instead of visiting the definition
+        # by itself.
+        def leave_fragment_spread_inline(_fragment_spread)
+          object_types.pop
+        end
+
+        def skip?(ast_node)
+          dir = ast_node.directives
+          dir.any? && !GraphQL::Execution::DirectiveChecks.include?(dir, query)
+        end
+
+        def call_analyzers(method, node, parent)
+          @analyzers.each do |analyzer|
+            begin
+              analyzer.public_send(method, node, parent, self)
+            rescue AnalysisError => err
+              @rescued_errors << err
+            end
+          end
+        end
+
+        def on_fragment_with_type(node)
+          object_type = if node.type
+            @query.warden.get_type(node.type.name)
+          else
+            @object_types.last
+          end
+          @object_types.push(object_type)
+          yield(node)
+          @object_types.pop
+          @path.pop
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/ast.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+require "graphql/analysis/ast/visitor"
+require "graphql/analysis/ast/analyzer"
+require "graphql/analysis/ast/field_usage"
+require "graphql/analysis/ast/query_complexity"
+require "graphql/analysis/ast/max_query_complexity"
+require "graphql/analysis/ast/query_depth"
+require "graphql/analysis/ast/max_query_depth"
+
+module GraphQL
+  module Analysis
+    module AST
+      module_function
+
+      def use(schema_class)
+        if schema_class.analysis_engine == self
+          definition_line = caller(2, 1).first
+          GraphQL::Deprecation.warn("GraphQL::Analysis::AST is now the default; remove `use GraphQL::Analysis::AST` from the schema definition (#{definition_line})")
+        else
+          schema_class.analysis_engine = self
+        end
+      end
+
+      # Analyze a multiplex, and all queries within.
+      # Multiplex analyzers are ran for all queries, keeping state.
+      # Query analyzers are ran per query, without carrying state between queries.
+      #
+      # @param multiplex [GraphQL::Execution::Multiplex]
+      # @param analyzers [Array<GraphQL::Analysis::AST::Analyzer>]
+      # @return [Array<Any>] Results from multiplex analyzers
+      def analyze_multiplex(multiplex, analyzers)
+        multiplex_analyzers = analyzers.map { |analyzer| analyzer.new(multiplex) }
+
+        multiplex.trace("analyze_multiplex", { multiplex: multiplex }) do
+          query_results = multiplex.queries.map do |query|
+            if query.valid?
+              analyze_query(
+                query,
+                query.analyzers,
+                multiplex_analyzers: multiplex_analyzers
+              )
+            else
+              []
+            end
+          end
+
+          multiplex_results = multiplex_analyzers.map(&:result)
+          multiplex_errors = analysis_errors(multiplex_results)
+
+          multiplex.queries.each_with_index do |query, idx|
+            query.analysis_errors = multiplex_errors + analysis_errors(query_results[idx])
+          end
+          multiplex_results
+        end
+      end
+
+      # @param query [GraphQL::Query]
+      # @param analyzers [Array<GraphQL::Analysis::AST::Analyzer>]
+      # @return [Array<Any>] Results from those analyzers
+      def analyze_query(query, analyzers, multiplex_analyzers: [])
+        query.trace("analyze_query", { query: query }) do
+          query_analyzers = analyzers
+            .map { |analyzer| analyzer.new(query) }
+            .select { |analyzer| analyzer.analyze? }
+
+          analyzers_to_run = query_analyzers + multiplex_analyzers
+          if analyzers_to_run.any?
+            visitor = GraphQL::Analysis::AST::Visitor.new(
+              query: query,
+              analyzers: analyzers_to_run
+            )
+
+            visitor.visit
+
+            if visitor.rescued_errors.any?
+              visitor.rescued_errors
+            else
+              query_analyzers.map(&:result)
+            end
+          else
+            []
+          end
+        end
+      end
+
+      def analysis_errors(results)
+        results.flatten.select { |r| r.is_a?(GraphQL::AnalysisError) }
+      end
+    end
+  end
+end

data/lib/graphql/analysis/query_depth.rb

@@ -17,32 +17,19 @@ module GraphQL
         {
           max_depth: 0,
           current_depth: 0,
-          skip_depth: 0,
           query: query,
         }
       end
 
       def call(memo, visit_type, irep_node)
         if irep_node.ast_node.is_a?(GraphQL::Language::Nodes::Field)
-          # Don't validate introspection fields or skipped nodes
-          not_validated_node = GraphQL::Schema::DYNAMIC_FIELDS.include?(irep_node.definition_name)
           if visit_type == :enter
-            if not_validated_node
-              memo[:skip_depth] += 1
-            elsif memo[:skip_depth] > 0
-              # we're inside an introspection query or skipped node
-            else
-              memo[:current_depth] += 1
-            end
+            memo[:current_depth] += 1
           else
-            if not_validated_node
-              memo[:skip_depth] -= 1
-            else
-              if memo[:max_depth] < memo[:current_depth]
-                memo[:max_depth] = memo[:current_depth]
-              end
-              memo[:current_depth] -= 1
+            if memo[:max_depth] < memo[:current_depth]
+              memo[:max_depth] = memo[:current_depth]
             end
+            memo[:current_depth] -= 1
           end
         end
         memo

data/lib/graphql/analysis.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+require "graphql/analysis/ast"
 require "graphql/analysis/max_query_complexity"
 require "graphql/analysis/max_query_depth"
 require "graphql/analysis/query_complexity"