graphql 1.9.0 → 2.1.1

data/lib/graphql/static_validation/rules/one_of_input_objects_are_valid.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    module OneOfInputObjectsAreValid
+      def on_input_object(node, parent)
+        return super unless parent.is_a?(GraphQL::Language::Nodes::Argument)
+
+        parent_type = get_parent_type(context, parent)
+        return super unless parent_type && parent_type.kind.input_object? && parent_type.one_of?
+
+        validate_one_of_input_object(node, context, parent_type)
+        super
+      end
+
+      private
+
+      def validate_one_of_input_object(ast_node, context, parent_type)
+        present_fields = ast_node.arguments.map(&:name)
+        input_object_type = parent_type.to_type_signature
+
+        if present_fields.count != 1
+          add_error(
+            OneOfInputObjectsAreValidError.new(
+              "OneOf Input Object '#{input_object_type}' must specify exactly one key.",
+              path: context.path,
+              nodes: ast_node,
+              input_object_type: input_object_type
+            )
+          )
+          return
+        end
+
+        field = present_fields.first
+        value = ast_node.arguments.first.value
+
+        if value.is_a?(GraphQL::Language::Nodes::NullValue)
+          add_error(
+            OneOfInputObjectsAreValidError.new(
+              "Argument '#{input_object_type}.#{field}' must be non-null.",
+              path: [*context.path, field],
+              nodes: ast_node.arguments.first,
+              input_object_type: input_object_type
+            )
+          )
+          return
+        end
+
+        if value.is_a?(GraphQL::Language::Nodes::VariableIdentifier)
+          variable_name = value.name
+          variable_type = @declared_variables[variable_name].type
+
+          unless variable_type.is_a?(GraphQL::Language::Nodes::NonNullType)
+            add_error(
+              OneOfInputObjectsAreValidError.new(
+                "Variable '#{variable_name}' must be non-nullable to be used for OneOf Input Object '#{input_object_type}'.",
+                path: [*context.path, field],
+                nodes: ast_node,
+                input_object_type: input_object_type
+              )
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/graphql/static_validation/rules/one_of_input_objects_are_valid_error.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    class OneOfInputObjectsAreValidError < StaticValidation::Error
+      attr_reader :input_object_type
+
+      def initialize(message, path:, nodes:, input_object_type:)
+        super(message, path: path, nodes: nodes)
+        @input_object_type = input_object_type
+      end
+
+      # A hash representation of this Message
+      def to_h
+        extensions = {
+          "code" => code,
+          "inputObjectType" => input_object_type
+        }
+
+        super.merge({
+          "extensions" => extensions
+        })
+      end
+
+      def code
+        "invalidOneOfInputObject"
+      end
+    end
+  end
+end

data/lib/graphql/static_validation/rules/query_root_exists.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    module QueryRootExists
+      def on_operation_definition(node, _parent)
+        if (node.operation_type == 'query' || node.operation_type.nil?) && context.warden.root_type_for_operation("query").nil?
+          add_error(GraphQL::StaticValidation::QueryRootExistsError.new(
+            'Schema is not configured for queries',
+            nodes: node
+          ))
+        else
+          super
+        end
+      end
+    end
+  end
+end

data/lib/graphql/static_validation/rules/query_root_exists_error.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    class QueryRootExistsError < StaticValidation::Error
+
+      def initialize(message, path: nil, nodes: [])
+        super(message, path: path, nodes: nodes)
+      end
+
+      # A hash representation of this Message
+      def to_h
+        extensions = {
+          "code" => code,
+        }
+
+        super.merge({
+          "extensions" => extensions
+        })
+      end
+
+      def code
+        "missingQueryConfiguration"
+      end
+    end
+  end
+end

data/lib/graphql/static_validation/rules/required_arguments_are_present.rb

@@ -8,7 +8,7 @@ module GraphQL
       end
 
       def on_directive(node, _parent)
-        directive_defn = context.schema.directives[node.name]
+        directive_defn = context.schema_directives[node.name]
         assert_required_args(node, directive_defn)
         super
       end
@@ -16,10 +16,12 @@ module GraphQL
       private
 
       def assert_required_args(ast_node, defn)
+        args = defn.arguments(context.query.context)
+        return if args.empty?
         present_argument_names = ast_node.arguments.map(&:name)
-        required_argument_names = defn.arguments.values
-          .select { |a| a.type.kind.non_null? }
-          .map(&:name)
+        required_argument_names = context.warden.arguments(defn)
+          .select { |a| a.type.kind.non_null? && !a.default_value? && context.warden.get_argument(defn, a.name) }
+          .map!(&:name)
 
         missing_names = required_argument_names - present_argument_names
         if missing_names.any?

data/lib/graphql/static_validation/rules/required_input_object_attributes_are_present.rb

@@ -12,9 +12,21 @@ module GraphQL
       private
 
       def get_parent_type(context, parent)
-        defn = context.field_definition
-        parent_type = context.warden.arguments(defn)
-          .find{|f| f.name == parent_name(parent, defn) }
+        # If argument_definition is defined we're at nested object
+        # and need to refer to the containing input object type rather
+        # than the field_definition.
+        # h/t @rmosolgo
+        arg_defn = context.argument_definition
+
+        # Double checking that arg_defn is an input object as nested
+        # scalars, namely JSON, can make it to this branch
+        defn = if arg_defn && arg_defn.type.unwrap.kind.input_object?
+          arg_defn.type.unwrap
+        else
+          context.directive_definition || context.field_definition
+        end
+
+        parent_type = context.warden.get_argument(defn, parent_name(parent, defn))
         parent_type ? parent_type.type.unwrap : nil
       end
 
@@ -22,21 +34,21 @@ module GraphQL
         parent_type = get_parent_type(context, parent)
         return unless parent_type && parent_type.kind.input_object?
 
-        required_fields = parent_type.arguments
-          .select{|k,v| v.type.kind.non_null?}
-          .keys
+        required_fields = context.warden.arguments(parent_type)
+          .select{|arg| arg.type.kind.non_null?}
+          .map!(&:graphql_name)
 
         present_fields = ast_node.arguments.map(&:name)
         missing_fields = required_fields - present_fields
 
         missing_fields.each do |missing_field|
           path = [*context.path, missing_field]
-          missing_field_type = parent_type.arguments[missing_field].type
+          missing_field_type = context.warden.get_argument(parent_type, missing_field).type
           add_error(RequiredInputObjectAttributesArePresentError.new(
-            "Argument '#{missing_field}' on InputObject '#{parent_type}' is required. Expected type #{missing_field_type}",
+            "Argument '#{missing_field}' on InputObject '#{parent_type.to_type_signature}' is required. Expected type #{missing_field_type.to_type_signature}",
             argument_name: missing_field,
-            argument_type: missing_field_type.to_s,
-            input_object_type: parent_type.to_s,
+            argument_type: missing_field_type.to_type_signature,
+            input_object_type: parent_type.to_type_signature,
             path: path,
             nodes: ast_node,
           ))

data/lib/graphql/static_validation/rules/unique_directives_per_location.rb

@@ -34,13 +34,19 @@ module GraphQL
         used_directives = {}
         node.directives.each do |ast_directive|
           directive_name = ast_directive.name
-          if used_directives[directive_name]
-            add_error(GraphQL::StaticValidation::UniqueDirectivesPerLocationError.new(
-              "The directive \"#{directive_name}\" can only be used once at this location.",
-              nodes: [used_directives[directive_name], ast_directive],
-              directive: directive_name,
-            ))
-          else
+          if (first_node = used_directives[directive_name])
+            @directives_are_unique_errors_by_first_node ||= {}
+            err = @directives_are_unique_errors_by_first_node[first_node] ||= begin
+              error = GraphQL::StaticValidation::UniqueDirectivesPerLocationError.new(
+                "The directive \"#{directive_name}\" can only be used once at this location.",
+                nodes: [used_directives[directive_name]],
+                directive: directive_name,
+              )
+              add_error(error)
+              error
+            end
+            err.nodes << ast_directive
+          elsif !((dir_defn = context.schema_directives[directive_name]) && dir_defn.repeatable?)
             used_directives[directive_name] = ast_directive
           end
         end

data/lib/graphql/static_validation/rules/variable_default_values_are_correctly_typed.rb

@@ -13,27 +13,26 @@ module GraphQL
               error_type: VariableDefaultValuesAreCorrectlyTypedError::VIOLATIONS[:INVALID_ON_NON_NULL]
             ))
           else
-            type = context.schema.type_from_ast(node.type)
+            type = context.schema.type_from_ast(node.type, context: context)
             if type.nil?
               # This is handled by another validator
             else
-              begin
-                valid = context.valid_literal?(value, type)
-              rescue GraphQL::CoercionError => err
-                error_message = err.message
-              rescue GraphQL::LiteralValidationError
-                # noop, we just want to stop any LiteralValidationError from propagating
-              end
+              validation_result = context.validate_literal(value, type)
+
+              if !validation_result.valid?
+                problems = validation_result.problems
+                first_problem = problems && problems.first
+                if first_problem
+                  error_message = first_problem["explanation"]
+                end
 
-              if !valid
-                error_message ||= "Default value for $#{node.name} doesn't match type #{type}"
-                VariableDefaultValuesAreCorrectlyTypedError
+                error_message ||= "Default value for $#{node.name} doesn't match type #{type.to_type_signature}"
                 add_error(GraphQL::StaticValidation::VariableDefaultValuesAreCorrectlyTypedError.new(
                   error_message,
                   nodes: node,
                   name: node.name,
-                  type: type.to_s,
-                  error_type: VariableDefaultValuesAreCorrectlyTypedError::VIOLATIONS[:INVALID_TYPE]
+                  type: type.to_type_signature,
+                  error_type: VariableDefaultValuesAreCorrectlyTypedError::VIOLATIONS[:INVALID_TYPE],
                 ))
               end
             end

data/lib/graphql/static_validation/rules/variable_usages_are_allowed.rb

@@ -22,15 +22,15 @@ module GraphQL
         node_values = node_values.select { |value| value.is_a? GraphQL::Language::Nodes::VariableIdentifier }
 
         if node_values.any?
-          arguments = case parent
+          argument_owner = case parent
           when GraphQL::Language::Nodes::Field
-            context.field_definition.arguments
+            context.field_definition
           when GraphQL::Language::Nodes::Directive
-            context.directive_definition.arguments
+            context.directive_definition
           when GraphQL::Language::Nodes::InputObject
             arg_type = context.argument_definition.type.unwrap
-            if arg_type.is_a?(GraphQL::InputObjectType)
-              arguments = arg_type.input_fields
+            if arg_type.kind.input_object?
+              arg_type
             else
               # This is some kind of error
               nil
@@ -43,7 +43,7 @@ module GraphQL
             var_defn_ast = @declared_variables[node_value.name]
             # Might be undefined :(
             # VariablesAreUsedAndDefined can't finalize its search until the end of the document.
-            var_defn_ast && arguments && validate_usage(arguments, node, var_defn_ast)
+            var_defn_ast && argument_owner && validate_usage(argument_owner, node, var_defn_ast)
           end
         end
         super
@@ -51,24 +51,29 @@ module GraphQL
 
       private
 
-      def validate_usage(arguments, arg_node, ast_var)
-        var_type = context.schema.type_from_ast(ast_var.type)
+      def validate_usage(argument_owner, arg_node, ast_var)
+        var_type = context.schema.type_from_ast(ast_var.type, context: context)
         if var_type.nil?
           return
         end
         if !ast_var.default_value.nil?
-          unless var_type.is_a?(GraphQL::NonNullType)
+          unless var_type.kind.non_null?
             # If the value is required, but the argument is not,
             # and yet there's a non-nil default, then we impliclty
             # make the argument also a required type.
-
-            var_type = GraphQL::NonNullType.new(of_type: var_type)
+            var_type = var_type.to_non_null_type
           end
         end
 
-        arg_defn = arguments[arg_node.name]
+        arg_defn = context.warden.get_argument(argument_owner, arg_node.name)
         arg_defn_type = arg_defn.type
 
+        # If the argument is non-null, but it was given a default value,
+        # then treat it as nullable in practice, see https://github.com/rmosolgo/graphql-ruby/issues/3793
+        if arg_defn_type.non_null? && arg_defn.default_value?
+          arg_defn_type = arg_defn_type.of_type
+        end
+
         var_inner_type = var_type.unwrap
         arg_inner_type = arg_defn_type.unwrap
 
@@ -85,10 +90,10 @@ module GraphQL
 
       def create_error(error_message, var_type, ast_var, arg_defn, arg_node)
         add_error(GraphQL::StaticValidation::VariableUsagesAreAllowedError.new(
-          "#{error_message} on variable $#{ast_var.name} and argument #{arg_node.name} (#{var_type.to_s} / #{arg_defn.type.to_s})",
+          "#{error_message} on variable $#{ast_var.name} and argument #{arg_node.name} (#{var_type.to_type_signature} / #{arg_defn.type.to_type_signature})",
           nodes: arg_node,
           name: ast_var.name,
-          type: var_type.to_s,
+          type: var_type.to_type_signature,
           argument: arg_node.name,
           error: error_message
         ))

data/lib/graphql/static_validation/rules/variables_are_input_types.rb

@@ -15,7 +15,7 @@ module GraphQL
           ))
         elsif !type.kind.input?
           add_error(GraphQL::StaticValidation::VariablesAreInputTypesError.new(
-            "#{type.name} isn't a valid input type (on $#{node.name})",
+            "#{type.graphql_name} isn't a valid input type (on $#{node.name})",
             nodes: node,
             name: node.name,
             type: type_name

data/lib/graphql/static_validation/rules/variables_are_used_and_defined.rb

@@ -2,7 +2,7 @@
 module GraphQL
   module StaticValidation
     # The problem is
-    #   - Variable usage must be determined at the OperationDefinition level
+    #   - Variable $usage must be determined at the OperationDefinition level
     #   - You can't tell how fragments use variables until you visit FragmentDefinitions (which may be at the end of the document)
     #
     #  So, this validator includes some crazy logic to follow fragment spreads recursively, while avoiding infinite loops.
@@ -126,8 +126,9 @@ module GraphQL
         node_variables
           .select { |name, usage| usage.declared? && !usage.used? }
           .each { |var_name, usage|
+            declared_by_error_name = usage.declared_by.name || "anonymous #{usage.declared_by.operation_type}"
             add_error(GraphQL::StaticValidation::VariablesAreUsedAndDefinedError.new(
-              "Variable $#{var_name} is declared by #{usage.declared_by.name} but not used",
+              "Variable $#{var_name} is declared by #{declared_by_error_name} but not used",
               nodes: usage.declared_by,
               path: usage.path,
               name: var_name,
@@ -139,8 +140,9 @@ module GraphQL
         node_variables
           .select { |name, usage| usage.used? && !usage.declared? }
           .each { |var_name, usage|
+            used_by_error_name = usage.used_by.name || "anonymous #{usage.used_by.operation_type}"
             add_error(GraphQL::StaticValidation::VariablesAreUsedAndDefinedError.new(
-              "Variable $#{var_name} is used by #{usage.used_by.name} but not declared",
+              "Variable $#{var_name} is used by #{used_by_error_name} but not declared",
               nodes: usage.ast_node,
               path: usage.path,
               name: var_name,

data/lib/graphql/static_validation/validation_context.rb

@@ -8,21 +8,23 @@ module GraphQL
     # It provides access to the schema & fragments which validators may read from.
     #
     # It holds a list of errors which each validator may add to.
-    #
-    # It also provides limited access to the {TypeStack} instance,
-    # which tracks state as you climb in and out of different fields.
     class ValidationContext
       extend Forwardable
 
       attr_reader :query, :errors, :visitor,
-        :on_dependency_resolve_handlers
+        :on_dependency_resolve_handlers,
+        :max_errors, :warden, :schema
+
 
-      def_delegators :@query, :schema, :document, :fragments, :operations, :warden
+      def_delegators :@query, :document, :fragments, :operations
 
-      def initialize(query, visitor_class)
+      def initialize(query, visitor_class, max_errors)
         @query = query
+        @warden = query.warden
+        @schema = query.schema
         @literal_validator = LiteralValidator.new(context: query.context)
         @errors = []
+        @max_errors = max_errors || Float::INFINITY
         @on_dependency_resolve_handlers = []
         @visitor = visitor_class.new(document, self)
       end
@@ -35,9 +37,17 @@ module GraphQL
         @on_dependency_resolve_handlers << handler
       end
 
-      def valid_literal?(ast_value, type)
+      def validate_literal(ast_value, type)
         @literal_validator.validate(ast_value, type)
       end
+
+      def too_many_errors?
+        @errors.length >= @max_errors
+      end
+
+      def schema_directives
+        @schema_directives ||= schema.directives
+      end
     end
   end
 end

data/lib/graphql/static_validation/validation_timeout_error.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    class ValidationTimeoutError < StaticValidation::Error
+      def initialize(message, path: nil, nodes: [])
+        super(message, path: path, nodes: nodes)
+      end
+
+      # A hash representation of this Message
+      def to_h
+        extensions = {
+          "code" => code
+        }
+
+        super.merge({
+          "extensions" => extensions
+        })
+      end
+
+      def code
+        "validationTimeout"
+      end
+    end
+  end
+end

data/lib/graphql/static_validation/validator.rb

@@ -1,4 +1,6 @@
 # frozen_string_literal: true
+require "timeout"
+
 module GraphQL
   module StaticValidation
     # Initialized with a {GraphQL::Schema}, then it can validate {GraphQL::Language::Nodes::Documents}s based on that schema.
@@ -20,42 +22,52 @@ module GraphQL
 
       # Validate `query` against the schema. Returns an array of message hashes.
       # @param query [GraphQL::Query]
+      # @param validate [Boolean]
+      # @param timeout [Float] Number of seconds to wait before aborting validation. Any positive number may be used, including Floats to specify fractional seconds.
+      # @param max_errors [Integer] Maximum number of errors before aborting validation. Any positive number will limit the number of errors. Defaults to nil for no limit.
       # @return [Array<Hash>]
-      def validate(query, validate: true)
-        query.trace("validate", { validate: validate, query: query }) do
-          can_skip_rewrite = query.context.interpreter? && query.schema.using_ast_analysis?
-          errors = if validate == false && can_skip_rewrite
+      def validate(query, validate: true, timeout: nil, max_errors: nil)
+        query.current_trace.validate(validate: validate, query: query) do
+          errors = if validate == false
             []
           else
             rules_to_use = validate ? @rules : []
-            visitor_class = BaseVisitor.including_rules(rules_to_use, rewrite: !can_skip_rewrite)
+            visitor_class = BaseVisitor.including_rules(rules_to_use)
 
-            context = GraphQL::StaticValidation::ValidationContext.new(query, visitor_class)
+            context = GraphQL::StaticValidation::ValidationContext.new(query, visitor_class, max_errors)
 
-            # Attach legacy-style rules
-            rules_to_use.each do |rule_class_or_module|
-              if rule_class_or_module.method_defined?(:validate)
-                rule_class_or_module.new.validate(context)
+            begin
+              # CAUTION: Usage of the timeout module makes the assumption that validation rules are stateless Ruby code that requires no cleanup if process was interrupted. This means no blocking IO calls, native gems, locks, or `rescue` clauses that must be reached.
+              # A timeout value of 0 or nil will execute the block without any timeout.
+              Timeout::timeout(timeout) do
+                catch(:too_many_validation_errors) do
+                  context.visitor.visit
+                end
               end
+            rescue Timeout::Error
+              handle_timeout(query, context)
             end
 
-            context.visitor.visit
             context.errors
           end
 
-
-          irep = if errors.empty? && context
-            # Only return this if there are no errors and validation was actually run
-            context.visitor.rewrite_document
-          else
-            nil
-          end
-
           {
             errors: errors,
-            irep: irep,
           }
         end
+      rescue GraphQL::ExecutionError => e
+        {
+          errors: [e],
+        }
+      end
+
+      # Invoked when static validation times out.
+      # @param query [GraphQL::Query]
+      # @param context [GraphQL::StaticValidation::ValidationContext]
+      def handle_timeout(query, context)
+        context.errors << GraphQL::StaticValidation::ValidationTimeoutError.new(
+          "Timeout on validation of query"
+        )
       end
     end
   end

data/lib/graphql/static_validation.rb

@@ -1,12 +1,11 @@
 # frozen_string_literal: true
 require "graphql/static_validation/error"
 require "graphql/static_validation/definition_dependencies"
-require "graphql/static_validation/type_stack"
 require "graphql/static_validation/validator"
 require "graphql/static_validation/validation_context"
+require "graphql/static_validation/validation_timeout_error"
 require "graphql/static_validation/literal_validator"
 require "graphql/static_validation/base_visitor"
-require "graphql/static_validation/no_validate_visitor"
 
 rules_glob = File.expand_path("../static_validation/rules/*.rb", __FILE__)
 Dir.glob(rules_glob).each do |file|
@@ -14,5 +13,4 @@ Dir.glob(rules_glob).each do |file|
 end
 
 require "graphql/static_validation/all_rules"
-require "graphql/static_validation/default_visitor"
 require "graphql/static_validation/interpreter_visitor"

data/lib/graphql/string_encoding_error.rb

@@ -1,10 +1,20 @@
 # frozen_string_literal: true
 module GraphQL
   class StringEncodingError < GraphQL::RuntimeTypeError
-    attr_reader :string
-    def initialize(str)
+    attr_reader :string, :field, :path
+    def initialize(str, context:)
       @string = str
-      super("String \"#{str}\" was encoded as #{str.encoding}! GraphQL requires an encoding compatible with UTF-8.")
+      @field = context[:current_field]
+      @path = context[:current_path]
+      message = "String #{str.inspect} was encoded as #{str.encoding}".dup
+      if @path
+        message << " @ #{@path.join(".")}"
+      end
+      if @field
+        message << " (#{@field.path})"
+      end
+      message << ". GraphQL requires an encoding compatible with UTF-8."
+      super(message)
     end
   end
 end