graphql 1.8.7 → 1.9.0

data/spec/graphql/authorization_spec.rb

@@ -48,7 +48,7 @@ describe GraphQL::Authorization do
       end
 
       def authorized?(object, context)
-        super && object != :hide
+        super && object != :hide && object != :replace
       end
     end
 
@@ -159,7 +159,7 @@ describe GraphQL::Authorization do
         super && value != "a"
       end
 
-      field :value, String, null: false, method: :object
+      field :value, String, null: false, method: :itself
     end
 
     module UnauthorizedInterface
@@ -186,7 +186,7 @@ describe GraphQL::Authorization do
         Box.new(value: Box.new(value: Box.new(value: Box.new(value: is_authed))))
       end
 
-      field :value, String, null: false, method: :object
+      field :value, String, null: false, method: :itself
     end
 
     class IntegerObject < BaseObject
@@ -197,7 +197,7 @@ describe GraphQL::Authorization do
         is_allowed = !(ctx[:unauthorized_relay] || obj == ctx[:exclude_integer])
         Box.new(value: Box.new(value: is_allowed))
       end
-      field :value, Integer, null: false, method: :object
+      field :value, Integer, null: false, method: :itself
     end
 
     class IntegerObjectEdge < GraphQL::Types::Relay::BaseEdge
@@ -237,7 +237,7 @@ describe GraphQL::Authorization do
 
     class Query < BaseObject
       field :hidden, Integer, null: false
-      field :unauthorized, Integer, null: true, method: :object
+      field :unauthorized, Integer, null: true, method: :itself
       field :int2, Integer, null: true do
         argument :int, Integer, required: false
         argument :hidden, Integer, required: false
@@ -268,22 +268,22 @@ describe GraphQL::Authorization do
       end
 
       def empty_array; []; end
-      field :hidden_object, HiddenObject, null: false, method: :itself
-      field :hidden_interface, HiddenInterface, null: false, method: :itself
-      field :hidden_default_interface, HiddenDefaultInterface, null: false, method: :itself
-      field :hidden_connection, RelayObject.connection_type, null: :false, method: :empty_array
-      field :hidden_edge, RelayObject.edge_type, null: :false, method: :edge_object
+      field :hidden_object, HiddenObject, null: false, resolver_method: :itself
+      field :hidden_interface, HiddenInterface, null: false, resolver_method: :itself
+      field :hidden_default_interface, HiddenDefaultInterface, null: false, resolver_method: :itself
+      field :hidden_connection, RelayObject.connection_type, null: :false, resolver_method: :empty_array
+      field :hidden_edge, RelayObject.edge_type, null: :false, resolver_method: :edge_object
 
       field :inaccessible, Integer, null: false, method: :object_id
-      field :inaccessible_object, InaccessibleObject, null: false, method: :itself
-      field :inaccessible_interface, InaccessibleInterface, null: false, method: :itself
-      field :inaccessible_default_interface, InaccessibleDefaultInterface, null: false, method: :itself
-      field :inaccessible_connection, RelayObject.connection_type, null: :false, method: :empty_array
-      field :inaccessible_edge, RelayObject.edge_type, null: :false, method: :edge_object
+      field :inaccessible_object, InaccessibleObject, null: false, resolver_method: :itself
+      field :inaccessible_interface, InaccessibleInterface, null: false, resolver_method: :itself
+      field :inaccessible_default_interface, InaccessibleDefaultInterface, null: false, resolver_method: :itself
+      field :inaccessible_connection, RelayObject.connection_type, null: :false, resolver_method: :empty_array
+      field :inaccessible_edge, RelayObject.edge_type, null: :false, resolver_method: :edge_object
 
-      field :unauthorized_object, UnauthorizedObject, null: true, method: :itself
-      field :unauthorized_connection, RelayObject.connection_type, null: false, method: :array_with_item
-      field :unauthorized_edge, RelayObject.edge_type, null: false, method: :edge_object
+      field :unauthorized_object, UnauthorizedObject, null: true, resolver_method: :itself
+      field :unauthorized_connection, RelayObject.connection_type, null: false, resolver_method: :array_with_item
+      field :unauthorized_edge, RelayObject.edge_type, null: false, resolver_method: :edge_object
 
       def edge_object
         OpenStruct.new(node: 100)
@@ -305,11 +305,11 @@ describe GraphQL::Authorization do
         [self, self]
       end
 
-      field :unauthorized_lazy_check_box, UnauthorizedCheckBox, null: true, method: :unauthorized_lazy_box do
+      field :unauthorized_lazy_check_box, UnauthorizedCheckBox, null: true, resolver_method: :unauthorized_lazy_box do
         argument :value, String, required: true
       end
 
-      field :unauthorized_interface, UnauthorizedInterface, null: true, method: :unauthorized_lazy_box do
+      field :unauthorized_interface, UnauthorizedInterface, null: true, resolver_method: :unauthorized_lazy_box do
         argument :value, String, required: true
       end
 
@@ -369,14 +369,22 @@ describe GraphQL::Authorization do
     end
 
     class Schema < GraphQL::Schema
+      if TESTING_INTERPRETER
+        use GraphQL::Execution::Interpreter
+      end
       query(Query)
       mutation(Mutation)
 
+      # Opt in to accessible? checks
+      query_analyzer GraphQL::Authorization::Analyzer
+
       lazy_resolve(Box, :value)
 
       def self.unauthorized_object(err)
         if err.object.respond_to?(:replacement)
           err.object.replacement
+        elsif err.object == :replace
+          33
         else
           raise GraphQL::ExecutionError, "Unauthorized #{err.type.graphql_name}: #{err.object}"
         end
@@ -384,6 +392,18 @@ describe GraphQL::Authorization do
 
       # use GraphQL::Backtrace
     end
+
+    class SchemaWithFieldHook < GraphQL::Schema
+      query(Query)
+
+      def self.unauthorized_field(err)
+        if err.object == :replace
+          42
+        else
+          raise GraphQL::ExecutionError, "Unauthorized field #{err.field.graphql_name} on #{err.type.graphql_name}: #{err.object}"
+        end
+      end
+    end
   end
 
   def auth_execute(*args)
@@ -598,7 +618,7 @@ describe GraphQL::Authorization do
   end
 
   describe "applying the authorized? method" do
-    it "halts on unauthorized objects" do
+    it "halts on unauthorized objects, replacing the object with nil" do
       query = "{ unauthorizedObject { __typename } }"
       hidden_response = auth_execute(query, context: { hide: true })
       assert_nil hidden_response["data"].fetch("unauthorizedObject")
@@ -615,6 +635,65 @@ describe GraphQL::Authorization do
       end
     end
 
+    describe "field level authorization" do
+      describe "unauthorized field" do
+        describe "with an unauthorized field hook configured" do
+          describe "when the hook returns a value" do
+            it "replaces the response with the return value of the unauthorized field hook" do
+              query = "{ unauthorized }"
+              response = AuthTest::SchemaWithFieldHook.execute(query, root_value: :replace)
+              assert_equal 42, response["data"].fetch("unauthorized")
+            end
+          end
+
+          describe "when the field hook raises an error" do
+            it "returns nil" do
+              query = "{ unauthorized }"
+              response = AuthTest::SchemaWithFieldHook.execute(query, root_value: :hide)
+              assert_nil response["data"].fetch("unauthorized")
+            end
+
+            it "adds the error to the errors key" do
+              query = "{ unauthorized }"
+              response = AuthTest::SchemaWithFieldHook.execute(query, root_value: :hide)
+              assert_equal ["Unauthorized field unauthorized on Query: hide"], response["errors"].map { |e| e["message"] }
+            end
+          end
+        end
+
+        describe "with an unauthorized field hook not configured" do
+          describe "When the object hook replaces the field" do
+            it "delegates to the unauthorized object hook, which replaces the object" do
+              query = "{ unauthorized }"
+              response = AuthTest::Schema.execute(query, root_value: :replace)
+              assert_equal 33, response["data"].fetch("unauthorized")
+            end
+          end
+          describe "When the object hook raises an error" do
+            it "returns nil" do
+              query = "{ unauthorized }"
+              response = AuthTest::Schema.execute(query, root_value: :hide)
+              assert_nil response["data"].fetch("unauthorized")
+            end
+
+            it "adds the error to the errors key" do
+              query = "{ unauthorized }"
+              response = AuthTest::Schema.execute(query, root_value: :hide)
+              assert_equal ["Unauthorized Query: hide"], response["errors"].map { |e| e["message"] }
+            end
+          end
+        end
+      end
+
+      describe "authorized field" do
+        it "returns the field data" do
+          query = "{ unauthorized }"
+          response = AuthTest::SchemaWithFieldHook.execute(query, root_value: 1)
+          assert_equal 1, response["data"].fetch("unauthorized")
+        end
+      end
+    end
+
     it "halts on unauthorized fields, using the parent object" do
       query = "{ unauthorized }"
       hidden_response = auth_execute(query, root_value: :hide)
@@ -658,7 +737,25 @@ describe GraphQL::Authorization do
       unauthorized_res = auth_execute(query, context: { unauthorized_relay: true })
       conn = unauthorized_res["data"].fetch("unauthorizedConnection")
       assert_equal "RelayObjectConnection", conn.fetch("__typename")
-      assert_equal nil, conn.fetch("nodes")
+      # This is tricky: the previous behavior was to replace the _whole_
+      # list with `nil`. This was due to an implementation detail:
+      # The list field's return value (an array of integers) was wrapped
+      # _before_ returning, and during this wrapping, a cascading error
+      # caused the entire field to be nilled out.
+      #
+      # In the interpreter, each list item is contained and the error doesn't propagate
+      # up to the whole list.
+      #
+      # Originally, I thought that this was a _feature_ that obscured list entries.
+      # But really, look at the test below: you don't get this "feature" if
+      # you use `edges { node }`, so it can't be relied on in any way.
+      #
+      # All that to say, in the interpreter, `nodes` and `edges { node }` behave
+      # the same.
+      #
+      # TODO revisit the docs for this.
+      failed_nodes_value = TESTING_INTERPRETER ? [nil] : nil
+      assert_equal failed_nodes_value, conn.fetch("nodes")
       assert_equal [{"node" => nil, "__typename" => "RelayObjectEdge"}], conn.fetch("edges")
 
       edge = unauthorized_res["data"].fetch("unauthorizedEdge")
@@ -667,7 +764,7 @@ describe GraphQL::Authorization do
 
       unauthorized_object_paths = [
         ["unauthorizedConnection", "edges", 0, "node"],
-        ["unauthorizedConnection", "nodes"],
+        TESTING_INTERPRETER ? ["unauthorizedConnection", "nodes", 0] : ["unauthorizedConnection", "nodes"],
         ["unauthorizedEdge", "node"]
       ]
 

data/spec/graphql/base_type_spec.rb

@@ -11,7 +11,7 @@ describe GraphQL::BaseType do
   end
 
   it "can be compared" do
-    obj_type = Dummy::MilkType
+    obj_type = Dummy::Milk.graphql_definition
     assert_equal(!GraphQL::INT_TYPE, !GraphQL::INT_TYPE)
     refute_equal(!GraphQL::FLOAT_TYPE, GraphQL::FLOAT_TYPE)
     assert_equal(
@@ -25,7 +25,7 @@ describe GraphQL::BaseType do
   end
 
   it "Accepts arbitrary metadata" do
-    assert_equal ["Cheese"], Dummy::CheeseType.metadata[:class_names]
+    assert_equal ["Cheese"], Dummy::Cheese.graphql_definition.metadata[:class_names]
   end
 
   describe "#name" do
@@ -63,7 +63,7 @@ describe GraphQL::BaseType do
   end
 
   describe "forwards-compat with new api" do
-    let(:type_defn) { Dummy::CheeseType }
+    let(:type_defn) { Dummy::Cheese.graphql_definition }
     it "responds to new methods" do
       assert_equal "Cheese", type_defn.graphql_name
       assert_equal type_defn, type_defn.graphql_definition
@@ -112,7 +112,9 @@ describe GraphQL::BaseType do
     schema = GraphQL::Schema.define(query: query_root)
 
     expected = <<TYPE
-# A blog post
+"""
+A blog post
+"""
 type Post {
   body: String!
   id: ID!

data/spec/graphql/enum_type_spec.rb

@@ -2,7 +2,7 @@
 require "spec_helper"
 
 describe GraphQL::EnumType do
-  let(:enum) { Dummy::DairyAnimalEnum }
+  let(:enum) { Dummy::DairyAnimal.graphql_definition }
 
   it "coerces names to underlying values" do
     assert_equal("YAK", enum.coerce_isolated_input("YAK"))
@@ -130,6 +130,11 @@ describe GraphQL::EnumType do
     assert_equal({ "COW" => cow, "GOAT" => goat }, enum.values)
   end
 
+  it "values respond to graphql_name" do
+    cow = GraphQL::EnumType::EnumValue.define(name: "COW")
+    assert_equal("COW", cow.graphql_name)
+  end
+
   describe "#dup" do
     it "copies the values map without altering the original" do
       enum_2 = enum.dup

data/spec/graphql/execution/execute_spec.rb

@@ -236,7 +236,7 @@ describe GraphQL::Execution::Execute do
   end
 
   describe "tracing" do
-    if rails_should_be_installed?
+    if defined?(Rails)
       it "emits traces" do
         query_string = <<-GRAPHQL
         query Bases($id1: ID!, $id2: ID!){
@@ -280,20 +280,20 @@ describe GraphQL::Execution::Execute do
           field_3_lazy, field_4_lazy,
           query_lazy, multiplex = exec_traces
 
-        assert_equal ["b1"], field_1_eager[:context].path
-        assert_equal ["b2"], field_2_eager[:context].path
+        assert_equal ["b1"], field_1_eager[:path]
+        assert_equal ["b2"], field_2_eager[:path]
         assert_instance_of GraphQL::Query, query_eager[:query]
 
         assert_equal [first_id.to_s, last_id.to_s], lazy_loader[:ids]
         assert_equal StarWars::Base, lazy_loader[:model]
 
-        assert_equal ["b1", "name"], field_3_eager[:context].path
-        assert_equal ["b1"], field_1_lazy[:context].path
-        assert_equal ["b2", "name"], field_4_eager[:context].path
-        assert_equal ["b2"], field_2_lazy[:context].path
+        assert_equal ["b1", "name"], field_3_eager[:path]
+        assert_equal ["b1"], field_1_lazy[:path]
+        assert_equal ["b2", "name"], field_4_eager[:path]
+        assert_equal ["b2"], field_2_lazy[:path]
 
-        assert_equal ["b1", "name"], field_3_lazy[:context].path
-        assert_equal ["b2", "name"], field_4_lazy[:context].path
+        assert_equal ["b1", "name"], field_3_lazy[:path]
+        assert_equal ["b2", "name"], field_4_lazy[:path]
         assert_instance_of GraphQL::Query, query_lazy[:query]
 
         assert_instance_of GraphQL::Execution::Multiplex, multiplex[:multiplex]

data/spec/graphql/execution/instrumentation_spec.rb

@@ -51,6 +51,17 @@ describe GraphQL::Schema do
     class FirstInstrumenter < LogInstrumenter; end
     class SecondInstrumenter < LogInstrumenter; end
 
+    class ExecutionErrorInstrumenter
+      def before_query(query)
+        if query.context[:raise_execution_error]
+          raise GraphQL::ExecutionError, "Raised from instrumenter before_query"
+        end
+      end
+
+      def after_query(query)
+      end
+    end
+
     let(:query_type) {
       GraphQL::ObjectType.define do
         name "Query"
@@ -67,6 +78,7 @@ describe GraphQL::Schema do
         query(spec.query_type)
         instrument(:query, FirstInstrumenter.new)
         instrument(:query, SecondInstrumenter.new)
+        instrument(:query, ExecutionErrorInstrumenter.new)
       end
     }
 
@@ -95,6 +107,13 @@ describe GraphQL::Schema do
         assert context[:second_instrumenter_did_begin]
         assert context[:second_instrumenter_did_end]
       end
+
+      it "rescues execution errors from before_query" do
+        context = {raise_execution_error: true}
+        res = schema.execute(" { int(value: 2) } ", context: context)
+        assert_equal "Raised from instrumenter before_query", res["errors"].first["message"]
+        refute res.key?("data"), "The query doesn't run"
+      end
     end
 
     describe "within a multiplex" do