graphql 1.9.5 → 1.13.19

data/lib/graphql/analysis/ast/analyzer.rb

@@ -5,10 +5,21 @@ module GraphQL
       # Query analyzer for query ASTs. Query analyzers respond to visitor style methods
       # but are prefixed by `enter` and `leave`.
       #
-      # @param [GraphQL::Query] The query to analyze
+      # When an analyzer is initialized with a Multiplex, you can always get the current query from
+      # `visitor.query` in the visit methods.
+      #
+      # @param [GraphQL::Query, GraphQL::Execution::Multiplex] The query or multiplex to analyze
       class Analyzer
-        def initialize(query)
-          @query = query
+        def initialize(subject)
+          @subject = subject
+
+          if subject.is_a?(GraphQL::Query)
+            @query = subject
+            @multiplex = nil
+          else
+            @multiplex = subject
+            @query = nil
+          end
         end
 
         # Analyzer hook to decide at analysis time whether a query should
@@ -22,18 +33,21 @@ module GraphQL
         # in a query error.
         # @return [Any] The analyzer result
         def result
-          raise NotImplementedError
+          raise GraphQL::RequiredImplementationMissingError
         end
 
-        # Don't use make_visit_method because it breaks `super`
-        def self.build_visitor_hooks(member_name)
-          class_eval(<<-EOS, __FILE__, __LINE__ + 1)
-            def on_enter_#{member_name}(node, parent, visitor)
-            end
+        class << self
+          private
+
+          def build_visitor_hooks(member_name)
+            class_eval(<<-EOS, __FILE__, __LINE__ + 1)
+              def on_enter_#{member_name}(node, parent, visitor)
+              end
 
-            def on_leave_#{member_name}(node, parent, visitor)
-            end
-          EOS
+              def on_leave_#{member_name}(node, parent, visitor)
+              end
+            EOS
+          end
         end
 
         build_visitor_hooks :argument
@@ -55,7 +69,15 @@ module GraphQL
 
         protected
 
+        # @return [GraphQL::Query, GraphQL::Execution::Multiplex] Whatever this analyzer is analyzing
+        attr_reader :subject
+
+        # @return [GraphQL::Query, nil] `nil` if this analyzer is visiting a multiplex
+        #  (When this is `nil`, use `visitor.query` inside visit methods to get the current query)
         attr_reader :query
+
+        # @return [GraphQL::Execution::Multiplex, nil] `nil` if this analyzer is visiting a query
+        attr_reader :multiplex
       end
     end
   end

data/lib/graphql/analysis/ast/field_usage.rb

@@ -7,21 +7,48 @@ module GraphQL
           super
           @used_fields = Set.new
           @used_deprecated_fields = Set.new
+          @used_deprecated_arguments = Set.new
         end
 
         def on_leave_field(node, parent, visitor)
           field_defn = visitor.field_definition
-          field = "#{visitor.parent_type_definition.name}.#{field_defn.name}"
+          field = "#{visitor.parent_type_definition.graphql_name}.#{field_defn.graphql_name}"
           @used_fields << field
           @used_deprecated_fields << field if field_defn.deprecation_reason
+          arguments = visitor.query.arguments_for(node, visitor.field_definition)
+          # If there was an error when preparing this argument object,
+          # then this might be an error or something:
+          if arguments.respond_to?(:argument_values)
+            extract_deprecated_arguments(arguments.argument_values)
+          end
         end
 
         def result
           {
             used_fields: @used_fields.to_a,
-            used_deprecated_fields: @used_deprecated_fields.to_a
+            used_deprecated_fields: @used_deprecated_fields.to_a,
+            used_deprecated_arguments: @used_deprecated_arguments.to_a,
           }
         end
+
+        private
+
+        def extract_deprecated_arguments(argument_values)
+          argument_values.each_pair do |_argument_name, argument|
+            if argument.definition.deprecation_reason
+              @used_deprecated_arguments << argument.definition.path
+            end
+
+            if argument.definition.type.kind.input_object?
+              extract_deprecated_arguments(argument.value.arguments.argument_values) # rubocop:disable Development/ContextIsPassedCop -- runtime args instance
+            elsif argument.definition.type.list? && !argument.value.nil?
+              argument
+                .value
+                .select { |value| value.respond_to?(:arguments) }
+                .each { |value| extract_deprecated_arguments(value.arguments.argument_values) } # rubocop:disable Development/ContextIsPassedCop -- runtime args instance
+            end
+          end
+        end
       end
     end
   end

data/lib/graphql/analysis/ast/max_query_complexity.rb

@@ -7,12 +7,12 @@ module GraphQL
       # see {Schema#max_complexity} and {Query#max_complexity}
       class MaxQueryComplexity < QueryComplexity
         def result
-          return if query.max_complexity.nil?
+          return if subject.max_complexity.nil?
 
           total_complexity = max_possible_complexity
 
-          if total_complexity > query.max_complexity
-            GraphQL::AnalysisError.new("Query has complexity of #{total_complexity}, which exceeds max complexity of #{query.max_complexity}")
+          if total_complexity > subject.max_complexity
+            GraphQL::AnalysisError.new("Query has complexity of #{total_complexity}, which exceeds max complexity of #{subject.max_complexity}")
           else
             nil
           end

data/lib/graphql/analysis/ast/max_query_depth.rb

@@ -4,10 +4,14 @@ module GraphQL
     module AST
       class MaxQueryDepth < QueryDepth
         def result
-          return unless query.max_depth
+          configured_max_depth = if query
+            query.max_depth
+          else
+            multiplex.schema.max_depth
+          end
 
-          if @max_depth > query.max_depth
-            GraphQL::AnalysisError.new("Query has depth of #{@max_depth}, which exceeds max depth of #{query.max_depth}")
+          if configured_max_depth && @max_depth > configured_max_depth
+            GraphQL::AnalysisError.new("Query has depth of #{@max_depth}, which exceeds max depth of #{configured_max_depth}")
           else
             nil
           end

data/lib/graphql/analysis/ast/query_complexity.rb

@@ -4,11 +4,11 @@ module GraphQL
     # Calculate the complexity of a query, using {Field#complexity} values.
     module AST
       class QueryComplexity < Analyzer
-        # State for the query complexity calcuation:
+        # State for the query complexity calculation:
         # - `complexities_on_type` holds complexity scores for each type in an IRep node
         def initialize(query)
           super
-          @complexities_on_type = [TypeComplexity.new]
+          @complexities_on_type_by_query = {}
         end
 
         # Overide this method to use the complexity result
@@ -16,13 +16,68 @@ module GraphQL
           max_possible_complexity
         end
 
+        class ScopedTypeComplexity
+          # A single proc for {#scoped_children} hashes. Use this to avoid repeated allocations,
+          # since the lexical binding isn't important.
+          HASH_CHILDREN = ->(h, k) { h[k] = {} }
+
+          attr_reader :field_definition, :response_path, :query
+
+          # @param parent_type [Class] The owner of `field_definition`
+          # @param field_definition [GraphQL::Field, GraphQL::Schema::Field] Used for getting the `.complexity` configuration
+          # @param query [GraphQL::Query] Used for `query.possible_types`
+          # @param response_path [Array<String>] The path to the response key for the field
+          def initialize(parent_type, field_definition, query, response_path)
+            @parent_type = parent_type
+            @field_definition = field_definition
+            @query = query
+            @response_path = response_path
+            @scoped_children = nil
+            @nodes = []
+          end
+
+          # @return [Array<GraphQL::Language::Nodes::Field>]
+          attr_reader :nodes
+
+          # Returns true if this field has no selections, ie, it's a scalar.
+          # We need a quick way to check whether we should continue traversing.
+          def terminal?
+            @scoped_children.nil?
+          end
+
+          # This value is only calculated when asked for to avoid needless hash allocations.
+          # Also, if it's never asked for, we determine that this scope complexity
+          # is a scalar field ({#terminal?}).
+          # @return [Hash<Hash<Class => ScopedTypeComplexity>]
+          def scoped_children
+            @scoped_children ||= Hash.new(&HASH_CHILDREN)
+          end
+
+          def own_complexity(child_complexity)
+            @field_definition.calculate_complexity(query: @query, nodes: @nodes, child_complexity: child_complexity)
+          end
+        end
+
         def on_enter_field(node, parent, visitor)
           # We don't want to visit fragment definitions,
           # we'll visit them when we hit the spreads instead
           return if visitor.visiting_fragment_definition?
           return if visitor.skipping?
-
-          @complexities_on_type.push(TypeComplexity.new)
+          parent_type = visitor.parent_type_definition
+          field_key = node.alias || node.name
+          # Find the complexity calculation for this field --
+          # if we're re-entering a selection, we'll already have one.
+          # Otherwise, make a new one and store it.
+          #
+          # `node` and `visitor.field_definition` may appear from a cache,
+          # but I think that's ok. If the arguments _didn't_ match,
+          # then the query would have been rejected as invalid.
+          complexities_on_type = @complexities_on_type_by_query[visitor.query] ||= [ScopedTypeComplexity.new(nil, nil, query, visitor.response_path)]
+
+          complexity = complexities_on_type.last.scoped_children[parent_type][field_key] ||= ScopedTypeComplexity.new(parent_type, visitor.field_definition, visitor.query, visitor.response_path)
+          complexity.nodes.push(node)
+          # Push it on the stack.
+          complexities_on_type.push(complexity)
         end
 
         def on_leave_field(node, parent, visitor)
@@ -30,84 +85,144 @@ module GraphQL
           # we'll visit them when we hit the spreads instead
           return if visitor.visiting_fragment_definition?
           return if visitor.skipping?
-
-          type_complexities = @complexities_on_type.pop
-          child_complexity = type_complexities.max_possible_complexity
-          own_complexity = get_complexity(node, visitor.field_definition, child_complexity, visitor)
-
-          parent_type = visitor.parent_type_definition
-          possible_types = if parent_type.kind.abstract?
-            query.possible_types(parent_type)
-          else
-            [parent_type]
-          end
-
-          key = selection_key(visitor.response_path, visitor.query)
-
-          possible_types.each do |type|
-            @complexities_on_type.last.merge(type, key, own_complexity)
-          end
+          complexities_on_type = @complexities_on_type_by_query[visitor.query]
+          complexities_on_type.pop
         end
 
-        def on_enter_fragment_spread(node, _, visitor)
-          visitor.enter_fragment_spread_inline(node)
-        end
-
-        def on_leave_fragment_spread(node, _, visitor)
-          visitor.leave_fragment_spread_inline(node)
-        end
+        private
 
         # @return [Integer]
         def max_possible_complexity
-          @complexities_on_type.last.max_possible_complexity
+          @complexities_on_type_by_query.reduce(0) do |total, (query, complexities_on_type)|
+            root_complexity = complexities_on_type.last
+            # Use this entry point to calculate the total complexity
+            total_complexity_for_query = merged_max_complexity_for_scopes(query, [root_complexity.scoped_children])
+            total + total_complexity_for_query
+          end
         end
 
-        private
+        # @param query [GraphQL::Query] Used for `query.possible_types`
+        # @param scoped_children_hashes [Array<Hash>] Array of scoped children hashes
+        # @return [Integer]
+        def merged_max_complexity_for_scopes(query, scoped_children_hashes)
+          # Figure out what scopes are possible here.
+          # Use a hash, but ignore the values; it's just a fast way to work with the keys.
+          all_scopes = {}
+          scoped_children_hashes.each do |h|
+            all_scopes.merge!(h)
+          end
 
-        def selection_key(response_path, query)
-          # We add the query object id to support multiplex queries
-          # even if they have the same response path, they should
-          # always be added.
-          response_path.join(".") + "-#{query.object_id}"
-        end
+          # If an abstract scope is present, but _all_ of its concrete types
+          # are also in the list, remove it from the list of scopes to check,
+          # because every possible type is covered by a concrete type.
+          # (That is, there are no remainder types to check.)
+          prev_keys = all_scopes.keys
+          prev_keys.each do |scope|
+            next unless scope.kind.abstract?
+
+            missing_concrete_types = query.possible_types(scope).select { |t| !all_scopes.key?(t) }
+            # This concrete type is possible _only_ as a member of the abstract type.
+            # So, attribute to it the complexity which belongs to the abstract type.
+            missing_concrete_types.each do |concrete_scope|
+              all_scopes[concrete_scope] = all_scopes[scope]
+            end
+            all_scopes.delete(scope)
+          end
 
-        # Get a complexity value for a field,
-        # by getting the number or calling its proc
-        def get_complexity(ast_node, field_defn, child_complexity, visitor)
-        # Return if we've visited this response path before (not counting duplicates)
-          defined_complexity = field_defn.complexity
+          # This will hold `{ type => int }` pairs, one for each possible branch
+          complexity_by_scope = {}
+
+          # For each scope,
+          # find the lexical selections that might apply to it,
+          # and gather them together into an array.
+          # Then, treat the set of selection hashes
+          # as a set and calculate the complexity for them as a unit
+          all_scopes.each do |scope, _|
+            # These will be the selections on `scope`
+            children_for_scope = []
+            scoped_children_hashes.each do |sc_h|
+              sc_h.each do |inner_scope, children_hash|
+                if applies_to?(query, scope, inner_scope)
+                  children_for_scope << children_hash
+                end
+              end
+            end
+
+            # Calculate the complexity for `scope`, merging all
+            # possible lexical branches.
+            complexity_value = merged_max_complexity(query, children_for_scope)
+            complexity_by_scope[scope] = complexity_value
+          end
 
-          arguments = visitor.arguments_for(ast_node, field_defn)
+          # Return the max complexity among all scopes
+          complexity_by_scope.each_value.max
+        end
 
-          case defined_complexity
-          when Proc
-            defined_complexity.call(query.context, arguments, child_complexity)
-          when Numeric
-            defined_complexity + (child_complexity || 0)
+        def applies_to?(query, left_scope, right_scope)
+          if left_scope == right_scope
+            # This can happen when several branches are being analyzed together
+            true
           else
-            raise("Invalid complexity: #{defined_complexity.inspect} on #{field_defn.name}")
+            # Check if these two scopes have _any_ types in common.
+            possible_right_types = query.possible_types(right_scope)
+            possible_left_types = query.possible_types(left_scope)
+            !(possible_right_types & possible_left_types).empty?
           end
         end
 
-        # Selections on an object may apply differently depending on what is _actually_ returned by the resolve function.
-        # Find the maximum possible complexity among those combinations.
-        class TypeComplexity
-          def initialize
-            @types = Hash.new { |h, k| h[k] = {} }
-          end
+        # A hook which is called whenever a field's max complexity is calculated.
+        # Override this method to capture individual field complexity details.
+        #
+        # @param scoped_type_complexity [ScopedTypeComplexity]
+        # @param max_complexity [Numeric] Field's maximum complexity including child complexity
+        # @param child_complexity [Numeric, nil] Field's child complexity
+        def field_complexity(scoped_type_complexity, max_complexity:, child_complexity: nil)
+        end
 
-          # Return the max possible complexity for types in this selection
-          def max_possible_complexity
-            @types.map do |type, fields|
-              fields.values.inject(:+)
-            end.max
+        # @param children_for_scope [Array<Hash>] An array of `scoped_children[scope]` hashes
+        # (`{field_key => complexity}`)
+        # @return [Integer] Complexity value for all these selections in the current scope
+        def merged_max_complexity(query, children_for_scope)
+          all_keys = []
+          children_for_scope.each do |c|
+            all_keys.concat(c.keys)
           end
-
-          # Store the complexity for the branch on `type_defn`.
-          # Later we will see if this is the max complexity among branches.
-          def merge(type_defn, key, complexity)
-            @types[type_defn][key] = complexity
+          all_keys.uniq!
+          complexity_for_keys = {}
+
+          all_keys.each do |child_key|
+            scoped_children_for_key = nil
+            complexity_for_key = nil
+            children_for_scope.each do |children_hash|
+              next unless children_hash.key?(child_key)
+
+              complexity_for_key = children_hash[child_key]
+              if complexity_for_key.terminal?
+                # Assume that all terminals would return the same complexity
+                # Since it's a terminal, its child complexity is zero.
+                complexity = complexity_for_key.own_complexity(0)
+                complexity_for_keys[child_key] = complexity
+
+                field_complexity(complexity_for_key, max_complexity: complexity, child_complexity: nil)
+              else
+                scoped_children_for_key ||= []
+                scoped_children_for_key << complexity_for_key.scoped_children
+              end
+            end
+
+            next unless scoped_children_for_key
+
+            child_complexity = merged_max_complexity_for_scopes(query, scoped_children_for_key)
+            # This is the _last_ one we visited; assume it's representative.
+            max_complexity = complexity_for_key.own_complexity(child_complexity)
+
+            field_complexity(complexity_for_key, max_complexity: max_complexity, child_complexity: child_complexity)
+
+            complexity_for_keys[child_key] = max_complexity
           end
+
+          # Calculate the child complexity by summing the complexity of all selections
+          complexity_for_keys.each_value.inject(0, &:+)
         end
       end
     end

data/lib/graphql/analysis/ast/query_depth.rb

@@ -3,13 +3,24 @@ module GraphQL
   module Analysis
     # A query reducer for measuring the depth of a given query.
     #
+    # See https://graphql-ruby.org/queries/ast_analysis.html for more examples.
+    #
     # @example Logging the depth of a query
     #   class LogQueryDepth < GraphQL::Analysis::QueryDepth
-    #     def on_analysis_end
+    #     def result
     #       log("GraphQL query depth: #{@max_depth}")
     #     end
     #   end
     #
+    #   # In your Schema file:
+    #
+    #   class MySchema < GraphQL::Schema
+    #     use GraphQL::Analysis::AST
+    #     query_analyzer LogQueryDepth
+    #   end
+    #
+    #   # When you run the query, the depth will get logged:
+    #
     #   Schema.execute(query_str)
     #   # GraphQL query depth: 8
     #
@@ -18,43 +29,22 @@ module GraphQL
         def initialize(query)
           @max_depth = 0
           @current_depth = 0
-          @skip_depth = 0
           super
         end
 
         def on_enter_field(node, parent, visitor)
           return if visitor.skipping? || visitor.visiting_fragment_definition?
 
-          # Don't validate introspection fields or skipped nodes
-          if GraphQL::Schema::DYNAMIC_FIELDS.include?(visitor.field_definition.name)
-            @skip_depth += 1
-          elsif @skip_depth > 0
-            # we're inside an introspection query or skipped node
-          else
-            @current_depth += 1
-          end
+          @current_depth += 1
         end
 
         def on_leave_field(node, parent, visitor)
           return if visitor.skipping? || visitor.visiting_fragment_definition?
 
-          # Don't validate introspection fields or skipped nodes
-          if GraphQL::Schema::DYNAMIC_FIELDS.include?(visitor.field_definition.name)
-            @skip_depth -= 1
-          else
-            if @max_depth < @current_depth
-              @max_depth = @current_depth
-            end
-            @current_depth -= 1
+          if @max_depth < @current_depth
+            @max_depth = @current_depth
           end
-        end
-
-        def on_enter_fragment_spread(node, _, visitor)
-          visitor.enter_fragment_spread_inline(node)
-        end
-
-        def on_leave_fragment_spread(node, _, visitor)
-          visitor.leave_fragment_spread_inline(node)
+          @current_depth -= 1
         end
 
         def result

data/lib/graphql/analysis/ast/visitor.rb

@@ -19,6 +19,7 @@ module GraphQL
           @field_definitions = []
           @argument_definitions = []
           @directive_definitions = []
+          @rescued_errors = []
           @query = query
           @schema = query.schema
           @response_path = []
@@ -32,6 +33,9 @@ module GraphQL
         # @return [Array<GraphQL::ObjectType>] Types whose scope we've entered
         attr_reader :object_types
 
+        # @return [Array<GraphQL::AnalysisError]
+        attr_reader :rescued_errors
+
         def visit
           return unless @document
           super
@@ -96,7 +100,8 @@ module GraphQL
         def on_field(node, parent)
           @response_path.push(node.alias || node.name)
           parent_type = @object_types.last
-          field_definition = @schema.get_field(parent_type, node.name)
+          # This could be nil if the previous field wasn't found:
+          field_definition = parent_type && @schema.get_field(parent_type, node.name, @query.context)
           @field_definitions.push(field_definition)
           if !field_definition.nil?
             next_object_type = field_definition.type.unwrap
@@ -134,14 +139,14 @@ module GraphQL
           argument_defn = if (arg = @argument_definitions.last)
             arg_type = arg.type.unwrap
             if arg_type.kind.input_object?
-              arg_type.input_fields[node.name]
+              arg_type.get_argument(node.name, @query.context)
             else
               nil
             end
           elsif (directive_defn = @directive_definitions.last)
-            directive_defn.arguments[node.name]
+            directive_defn.get_argument(node.name, @query.context)
           elsif (field_defn = @field_definitions.last)
-            field_defn.arguments[node.name]
+            field_defn.get_argument(node.name, @query.context)
           else
             nil
           end
@@ -158,7 +163,9 @@ module GraphQL
         def on_fragment_spread(node, parent)
           @path.push("... #{node.name}")
           call_analyzers(:on_enter_fragment_spread, node, parent)
+          enter_fragment_spread_inline(node)
           super
+          leave_fragment_spread_inline(node)
           call_analyzers(:on_leave_fragment_spread, node, parent)
           @path.pop
         end
@@ -169,30 +176,6 @@ module GraphQL
           call_analyzers(:on_leave_abstract_node, node, parent)
         end
 
-        # Visit a fragment spread inline instead of visiting the definition
-        # by itself.
-        def enter_fragment_spread_inline(fragment_spread)
-          fragment_def = query.fragments[fragment_spread.name]
-
-          object_type = if fragment_def.type
-            query.schema.types.fetch(fragment_def.type.name, nil)
-          else
-            object_types.last
-          end
-
-          object_types << object_type
-
-          fragment_def.selections.each do |selection|
-            visit_node(selection, fragment_def)
-          end
-        end
-
-        # Visit a fragment spread inline instead of visiting the definition
-        # by itself.
-        def leave_fragment_spread_inline(_fragment_spread)
-          object_types.pop
-        end
-
         # @return [GraphQL::BaseType] The current object type
         def type_definition
           @object_types.last
@@ -220,13 +203,40 @@ module GraphQL
 
         # @return [GraphQL::Argument, nil] The most-recently-entered GraphQL::Argument, if currently inside one
         def argument_definition
-          # Don't get the _last_ one because that's the current one.
-          # Get the second-to-last one, which is the parent of the current one.
+          @argument_definitions.last
+        end
+
+        # @return [GraphQL::Argument, nil] The previous GraphQL argument
+        def previous_argument_definition
           @argument_definitions[-2]
         end
 
         private
 
+        # Visit a fragment spread inline instead of visiting the definition
+        # by itself.
+        def enter_fragment_spread_inline(fragment_spread)
+          fragment_def = query.fragments[fragment_spread.name]
+
+          object_type = if fragment_def.type
+            @query.warden.get_type(fragment_def.type.name)
+          else
+            object_types.last
+          end
+
+          object_types << object_type
+
+          fragment_def.selections.each do |selection|
+            visit_node(selection, fragment_def)
+          end
+        end
+
+        # Visit a fragment spread inline instead of visiting the definition
+        # by itself.
+        def leave_fragment_spread_inline(_fragment_spread)
+          object_types.pop
+        end
+
         def skip?(ast_node)
           dir = ast_node.directives
           dir.any? && !GraphQL::Execution::DirectiveChecks.include?(dir, query)
@@ -234,13 +244,17 @@ module GraphQL
 
         def call_analyzers(method, node, parent)
           @analyzers.each do |analyzer|
-            analyzer.public_send(method, node, parent, self)
+            begin
+              analyzer.public_send(method, node, parent, self)
+            rescue AnalysisError => err
+              @rescued_errors << err
+            end
           end
         end
 
         def on_fragment_with_type(node)
           object_type = if node.type
-            @schema.types.fetch(node.type.name, nil)
+            @query.warden.get_type(node.type.name)
           else
             @object_types.last
           end