graphql 2.3.5 → 2.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e5f20ae656aec8f5ad77a6edd73103d2f5a25511ae3c9b515c5b0c58ecc91cac
-  data.tar.gz: 6b51f66b0f2188c292b34c61e367de84cb37a7894e536b5b8105a95ec60b9c64
+  metadata.gz: 47e1762bc5aa144c21841bf1671a63b2180b8dacd4145688bc6f131ceb2a8f4a
+  data.tar.gz: 9dd05b04b955e83c95cb4ad5d959fb68a49796417ca1759606be21cabc7bfd39
 SHA512:
-  metadata.gz: 96bd289b9d880438ed2c7610b3a7008cb793fd4551191fcf084c0f947c3da195e07f07346e0b2c9b88177fdbeed098591508879756d7f5919c53c9576f5548e8
-  data.tar.gz: ce92d82eee23a710b66f3d29bdc29690b2e368f42ddfd60b159708dac0b018024a87bbf6069d8274878e98e0821f223b0cd2fafba41c23afab86dc7faa97328c
+  metadata.gz: 3bfe0cf261815aed7f739eb797f0c400c5ec97d4caf4f2ab760a67392fb51be2fceefcde7f45ad62d49d5216d7ea19ccf43b8360162a4862d70268115b7395cd
+  data.tar.gz: 50a2a283a121761a4aae7174587e312b9ed39215101f18e9a14ce006844ca22b81572381a9636d63ecee9e7d7a15c62c996f6e736479b80aaec77684904cd392

data/lib/graphql/analysis/analyzer.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    # Query analyzer for query ASTs. Query analyzers respond to visitor style methods
+    # but are prefixed by `enter` and `leave`.
+    #
+    # When an analyzer is initialized with a Multiplex, you can always get the current query from
+    # `visitor.query` in the visit methods.
+    #
+    # @param [GraphQL::Query, GraphQL::Execution::Multiplex] The query or multiplex to analyze
+    class Analyzer
+      def initialize(subject)
+        @subject = subject
+
+        if subject.is_a?(GraphQL::Query)
+          @query = subject
+          @multiplex = nil
+        else
+          @multiplex = subject
+          @query = nil
+        end
+      end
+
+      # Analyzer hook to decide at analysis time whether a query should
+      # be analyzed or not.
+      # @return [Boolean] If the query should be analyzed or not
+      def analyze?
+        true
+      end
+
+      # Analyzer hook to decide at analysis time whether analysis
+      # requires a visitor pass; can be disabled for precomputed results.
+      # @return [Boolean] If analysis requires visitation or not
+      def visit?
+        true
+      end
+
+      # The result for this analyzer. Returning {GraphQL::AnalysisError} results
+      # in a query error.
+      # @return [Any] The analyzer result
+      def result
+        raise GraphQL::RequiredImplementationMissingError
+      end
+
+      class << self
+        private
+
+        def build_visitor_hooks(member_name)
+          class_eval(<<-EOS, __FILE__, __LINE__ + 1)
+            def on_enter_#{member_name}(node, parent, visitor)
+            end
+
+            def on_leave_#{member_name}(node, parent, visitor)
+            end
+          EOS
+        end
+      end
+
+      build_visitor_hooks :argument
+      build_visitor_hooks :directive
+      build_visitor_hooks :document
+      build_visitor_hooks :enum
+      build_visitor_hooks :field
+      build_visitor_hooks :fragment_spread
+      build_visitor_hooks :inline_fragment
+      build_visitor_hooks :input_object
+      build_visitor_hooks :list_type
+      build_visitor_hooks :non_null_type
+      build_visitor_hooks :null_value
+      build_visitor_hooks :operation_definition
+      build_visitor_hooks :type_name
+      build_visitor_hooks :variable_definition
+      build_visitor_hooks :variable_identifier
+      build_visitor_hooks :abstract_node
+
+      protected
+
+      # @return [GraphQL::Query, GraphQL::Execution::Multiplex] Whatever this analyzer is analyzing
+      attr_reader :subject
+
+      # @return [GraphQL::Query, nil] `nil` if this analyzer is visiting a multiplex
+      #  (When this is `nil`, use `visitor.query` inside visit methods to get the current query)
+      attr_reader :query
+
+      # @return [GraphQL::Execution::Multiplex, nil] `nil` if this analyzer is visiting a query
+      attr_reader :multiplex
+    end
+  end
+end

data/lib/graphql/analysis/field_usage.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    class FieldUsage < Analyzer
+      def initialize(query)
+        super
+        @used_fields = Set.new
+        @used_deprecated_fields = Set.new
+        @used_deprecated_arguments = Set.new
+        @used_deprecated_enum_values = Set.new
+      end
+
+      def on_leave_field(node, parent, visitor)
+        field_defn = visitor.field_definition
+        field = "#{visitor.parent_type_definition.graphql_name}.#{field_defn.graphql_name}"
+        @used_fields << field
+        @used_deprecated_fields << field if field_defn.deprecation_reason
+        arguments = visitor.query.arguments_for(node, field_defn)
+        # If there was an error when preparing this argument object,
+        # then this might be an error or something:
+        if arguments.respond_to?(:argument_values)
+          extract_deprecated_arguments(arguments.argument_values)
+        end
+      end
+
+      def result
+        {
+          used_fields: @used_fields.to_a,
+          used_deprecated_fields: @used_deprecated_fields.to_a,
+          used_deprecated_arguments: @used_deprecated_arguments.to_a,
+          used_deprecated_enum_values: @used_deprecated_enum_values.to_a,
+        }
+      end
+
+      private
+
+      def extract_deprecated_arguments(argument_values)
+        argument_values.each_pair do |_argument_name, argument|
+          if argument.definition.deprecation_reason
+            @used_deprecated_arguments << argument.definition.path
+          end
+
+          arg_val = argument.value
+
+          next if arg_val.nil?
+
+          argument_type = argument.definition.type
+          if argument_type.non_null?
+            argument_type = argument_type.of_type
+          end
+
+          if argument_type.kind.input_object?
+            extract_deprecated_arguments(argument.original_value.arguments.argument_values) # rubocop:disable Development/ContextIsPassedCop -- runtime args instance
+          elsif argument_type.kind.enum?
+            extract_deprecated_enum_value(argument_type, arg_val)
+          elsif argument_type.list?
+            inner_type = argument_type.unwrap
+            case inner_type.kind
+            when TypeKinds::INPUT_OBJECT
+              argument.original_value.each do |value|
+                extract_deprecated_arguments(value.arguments.argument_values) # rubocop:disable Development/ContextIsPassedCop -- runtime args instance
+              end
+            when TypeKinds::ENUM
+              arg_val.each do |value|
+                extract_deprecated_enum_value(inner_type, value)
+              end
+            else
+              # Not a kind of input that we track
+            end
+          end
+        end
+      end
+
+      def extract_deprecated_enum_value(enum_type, value)
+        enum_value = @query.types.enum_values(enum_type).find { |ev| ev.value == value }
+        if enum_value&.deprecation_reason
+          @used_deprecated_enum_values << enum_value.path
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/max_query_complexity.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    # Used under the hood to implement complexity validation,
+    # see {Schema#max_complexity} and {Query#max_complexity}
+    class MaxQueryComplexity < QueryComplexity
+      def result
+        return if subject.max_complexity.nil?
+
+        total_complexity = max_possible_complexity
+
+        if total_complexity > subject.max_complexity
+          GraphQL::AnalysisError.new("Query has complexity of #{total_complexity}, which exceeds max complexity of #{subject.max_complexity}")
+        else
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/max_query_depth.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    class MaxQueryDepth < QueryDepth
+      def result
+        configured_max_depth = if query
+          query.max_depth
+        else
+          multiplex.schema.max_depth
+        end
+
+        if configured_max_depth && @max_depth > configured_max_depth
+          GraphQL::AnalysisError.new("Query has depth of #{@max_depth}, which exceeds max depth of #{configured_max_depth}")
+        else
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/query_complexity.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    # Calculate the complexity of a query, using {Field#complexity} values.
+    class QueryComplexity < Analyzer
+      # State for the query complexity calculation:
+      # - `complexities_on_type` holds complexity scores for each type
+      def initialize(query)
+        super
+        @skip_introspection_fields = !query.schema.max_complexity_count_introspection_fields
+        @complexities_on_type_by_query = {}
+      end
+
+      # Override this method to use the complexity result
+      def result
+        max_possible_complexity
+      end
+
+      # ScopedTypeComplexity models a tree of GraphQL types mapped to inner selections, ie:
+      # Hash<GraphQL::BaseType, Hash<String, ScopedTypeComplexity>>
+      class ScopedTypeComplexity < Hash
+        # A proc for defaulting empty namespace requests as a new scope hash.
+        DEFAULT_PROC = ->(h, k) { h[k] = {} }
+
+        attr_reader :field_definition, :response_path, :query
+
+        # @param parent_type [Class] The owner of `field_definition`
+        # @param field_definition [GraphQL::Field, GraphQL::Schema::Field] Used for getting the `.complexity` configuration
+        # @param query [GraphQL::Query] Used for `query.possible_types`
+        # @param response_path [Array<String>] The path to the response key for the field
+        # @return [Hash<GraphQL::BaseType, Hash<String, ScopedTypeComplexity>>]
+        def initialize(parent_type, field_definition, query, response_path)
+          super(&DEFAULT_PROC)
+          @parent_type = parent_type
+          @field_definition = field_definition
+          @query = query
+          @response_path = response_path
+          @nodes = []
+        end
+
+        # @return [Array<GraphQL::Language::Nodes::Field>]
+        attr_reader :nodes
+
+        def own_complexity(child_complexity)
+          @field_definition.calculate_complexity(query: @query, nodes: @nodes, child_complexity: child_complexity)
+        end
+      end
+
+      def on_enter_field(node, parent, visitor)
+        # We don't want to visit fragment definitions,
+        # we'll visit them when we hit the spreads instead
+        return if visitor.visiting_fragment_definition?
+        return if visitor.skipping?
+        return if @skip_introspection_fields && visitor.field_definition.introspection?
+        parent_type = visitor.parent_type_definition
+        field_key = node.alias || node.name
+
+        # Find or create a complexity scope stack for this query.
+        scopes_stack = @complexities_on_type_by_query[visitor.query] ||= [ScopedTypeComplexity.new(nil, nil, query, visitor.response_path)]
+
+        # Find or create the complexity costing node for this field.
+        scope = scopes_stack.last[parent_type][field_key] ||= ScopedTypeComplexity.new(parent_type, visitor.field_definition, visitor.query, visitor.response_path)
+        scope.nodes.push(node)
+        scopes_stack.push(scope)
+      end
+
+      def on_leave_field(node, parent, visitor)
+        # We don't want to visit fragment definitions,
+        # we'll visit them when we hit the spreads instead
+        return if visitor.visiting_fragment_definition?
+        return if visitor.skipping?
+        return if @skip_introspection_fields && visitor.field_definition.introspection?
+        scopes_stack = @complexities_on_type_by_query[visitor.query]
+        scopes_stack.pop
+      end
+
+      private
+
+      # @return [Integer]
+      def max_possible_complexity
+        @complexities_on_type_by_query.reduce(0) do |total, (query, scopes_stack)|
+          total + merged_max_complexity_for_scopes(query, [scopes_stack.first])
+        end
+      end
+
+      # @param query [GraphQL::Query] Used for `query.possible_types`
+      # @param scopes [Array<ScopedTypeComplexity>] Array of scoped type complexities
+      # @return [Integer]
+      def merged_max_complexity_for_scopes(query, scopes)
+        # Aggregate a set of all possible scope types encountered (scope keys).
+        # Use a hash, but ignore the values; it's just a fast way to work with the keys.
+        possible_scope_types = scopes.each_with_object({}) do |scope, memo|
+          memo.merge!(scope)
+        end
+
+        # Expand abstract scope types into their concrete implementations;
+        # overlapping abstracts coalesce through their intersecting types.
+        possible_scope_types.keys.each do |possible_scope_type|
+          next unless possible_scope_type.kind.abstract?
+
+          query.types.possible_types(possible_scope_type).each do |impl_type|
+            possible_scope_types[impl_type] ||= true
+          end
+          possible_scope_types.delete(possible_scope_type)
+        end
+
+        # Aggregate the lexical selections that may apply to each possible type,
+        # and then return the maximum cost among possible typed selections.
+        possible_scope_types.each_key.reduce(0) do |max, possible_scope_type|
+          # Collect inner selections from all scopes that intersect with this possible type.
+          all_inner_selections = scopes.each_with_object([]) do |scope, memo|
+            scope.each do |scope_type, inner_selections|
+              memo << inner_selections if types_intersect?(query, scope_type, possible_scope_type)
+            end
+          end
+
+          # Find the maximum complexity for the scope type among possible lexical branches.
+          complexity = merged_max_complexity(query, all_inner_selections)
+          complexity > max ? complexity : max
+        end
+      end
+
+      def types_intersect?(query, a, b)
+        return true if a == b
+
+        a_types = query.types.possible_types(a)
+        query.types.possible_types(b).any? { |t| a_types.include?(t) }
+      end
+
+      # A hook which is called whenever a field's max complexity is calculated.
+      # Override this method to capture individual field complexity details.
+      #
+      # @param scoped_type_complexity [ScopedTypeComplexity]
+      # @param max_complexity [Numeric] Field's maximum complexity including child complexity
+      # @param child_complexity [Numeric, nil] Field's child complexity
+      def field_complexity(scoped_type_complexity, max_complexity:, child_complexity: nil)
+      end
+
+      # @param inner_selections [Array<Hash<String, ScopedTypeComplexity>>] Field selections for a scope
+      # @return [Integer] Total complexity value for all these selections in the parent scope
+      def merged_max_complexity(query, inner_selections)
+        # Aggregate a set of all unique field selection keys across all scopes.
+        # Use a hash, but ignore the values; it's just a fast way to work with the keys.
+        unique_field_keys = inner_selections.each_with_object({}) do |inner_selection, memo|
+          memo.merge!(inner_selection)
+        end
+
+        # Add up the total cost for each unique field name's coalesced selections
+        unique_field_keys.each_key.reduce(0) do |total, field_key|
+          composite_scopes = nil
+          field_cost = 0
+
+          # Collect composite selection scopes for further aggregation,
+          # leaf selections report their costs directly.
+          inner_selections.each do |inner_selection|
+            child_scope = inner_selection[field_key]
+            next unless child_scope
+
+            # Empty child scopes are leaf nodes with zero child complexity.
+            if child_scope.empty?
+              field_cost = child_scope.own_complexity(0)
+              field_complexity(child_scope, max_complexity: field_cost, child_complexity: nil)
+            else
+              composite_scopes ||= []
+              composite_scopes << child_scope
+            end
+          end
+
+          if composite_scopes
+            child_complexity = merged_max_complexity_for_scopes(query, composite_scopes)
+
+            # This is the last composite scope visited; assume it's representative (for backwards compatibility).
+            # Note: it would be more correct to score each composite scope and use the maximum possibility.
+            field_cost = composite_scopes.last.own_complexity(child_complexity)
+            field_complexity(composite_scopes.last, max_complexity: field_cost, child_complexity: child_complexity)
+          end
+
+          total + field_cost
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/{ast/query_depth.rb → query_depth.rb}

@@ -23,37 +23,35 @@ module GraphQL
     #   Schema.execute(query_str)
     #   # GraphQL query depth: 8
     #
-    module AST
-      class QueryDepth < Analyzer
-        def initialize(query)
-          @max_depth = 0
-          @current_depth = 0
-          @count_introspection_fields = query.schema.count_introspection_fields
-          super
-        end
+    class QueryDepth < Analyzer
+      def initialize(query)
+        @max_depth = 0
+        @current_depth = 0
+        @count_introspection_fields = query.schema.count_introspection_fields
+        super
+      end
 
-        def on_enter_field(node, parent, visitor)
-          return if visitor.skipping? ||
-            visitor.visiting_fragment_definition? ||
-              (@count_introspection_fields == false && visitor.field_definition.introspection?)
+      def on_enter_field(node, parent, visitor)
+        return if visitor.skipping? ||
+          visitor.visiting_fragment_definition? ||
+            (@count_introspection_fields == false && visitor.field_definition.introspection?)
 
-          @current_depth += 1
-        end
+        @current_depth += 1
+      end
 
-        def on_leave_field(node, parent, visitor)
-          return if visitor.skipping? ||
-            visitor.visiting_fragment_definition? ||
-            (@count_introspection_fields == false && visitor.field_definition.introspection?)
+      def on_leave_field(node, parent, visitor)
+        return if visitor.skipping? ||
+          visitor.visiting_fragment_definition? ||
+          (@count_introspection_fields == false && visitor.field_definition.introspection?)
 
-          if @max_depth < @current_depth
-            @max_depth = @current_depth
-          end
-          @current_depth -= 1
+        if @max_depth < @current_depth
+          @max_depth = @current_depth
         end
+        @current_depth -= 1
+      end
 
-        def result
-          @max_depth
-        end
+      def result
+        @max_depth
       end
     end
   end