graphql 1.8.18 → 1.9.0.pre1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA256:
-  metadata.gz: 547740c02589d3565a58a446297703bdd47bd6fa0882b36f9342eb72c6749eae
-  data.tar.gz: 54d33dee9a8c4377c12a6f59509ccdc4170d166f4affe5f23f3a4463f3d574b1
+SHA1:
+  metadata.gz: 8fec9f264c3f8ad38a18cb4f9f0b760341affe81
+  data.tar.gz: b64f5cf4561c22dd6fb45e60e3e1649c298cc461
 SHA512:
-  metadata.gz: 98c57abe2fa9b0559c019af0feb1e941acf8e18ff66521f3e470400ba9f6e8268cce8047e2fab2feb53f3ddfb5fa0e84cd94beea313e9f31823f0e9bb234fca1
-  data.tar.gz: f026adb1bce776e4ae1b66fd989badd52bfc6d8b5090481c49492c01aa50bb8d7fc2b7e18f519e6043c3b987855f2798b494be6b4abc50c8439491567f043d4e
+  metadata.gz: 7908c29710c195d11abe5111bcc66df3f573cc417f6b3360ef86b2ba96e7e14552981392c6e5d6e6f4237fb6ba6674d7300383a37f364e68080afebe4433f88f
+  data.tar.gz: cd1ebc2b2ebba1ee633de058e19e7954a971394989558ce5e7882d4206eef4db8668f939071cb3158eb7c896b2d6bd617ac98a852068a36143fd4c779f9afbe4

data/lib/graphql.rb

@@ -66,9 +66,8 @@ require "graphql/name_validator"
 require "graphql/language"
 require "graphql/analysis"
 require "graphql/tracing"
-require "graphql/execution"
-require "graphql/dig"
 require "graphql/schema"
+require "graphql/execution"
 require "graphql/types"
 require "graphql/relay"
 require "graphql/boolean_type"
@@ -83,7 +82,6 @@ require "graphql/introspection"
 
 require "graphql/analysis_error"
 require "graphql/coercion_error"
-require "graphql/literal_validation_error"
 require "graphql/runtime_type_error"
 require "graphql/invalid_null_error"
 require "graphql/invalid_name_error"

data/lib/graphql/analysis.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+require "graphql/analysis/ast"
 require "graphql/analysis/max_query_complexity"
 require "graphql/analysis/max_query_depth"
 require "graphql/analysis/query_complexity"

data/lib/graphql/analysis/ast.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+require "graphql/analysis/ast/visitor"
+require "graphql/analysis/ast/analyzer"
+require "graphql/analysis/ast/field_usage"
+require "graphql/analysis/ast/query_complexity"
+require "graphql/analysis/ast/max_query_complexity"
+require "graphql/analysis/ast/query_depth"
+require "graphql/analysis/ast/max_query_depth"
+
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    module AST
+      module_function
+
+      def use(schema_defn)
+        schema = schema_defn.target
+        schema.analysis_engine = GraphQL::Analysis::AST
+      end
+
+      # Analyze a multiplex, and all queries within.
+      # Multiplex analyzers are ran for all queries, keeping state.
+      # Query analyzers are ran per query, without carrying state between queries.
+      #
+      # @param multiplex [GraphQL::Execution::Multiplex]
+      # @param analyzers [Array<GraphQL::Analysis::AST::Analyzer>]
+      # @return [void]
+      def analyze_multiplex(multiplex, analyzers)
+        multiplex_analyzers = analyzers.map { |analyzer| analyzer.new(multiplex) }
+
+        multiplex.trace("analyze_multiplex", { multiplex: multiplex }) do
+          query_results = multiplex.queries.map do |query|
+            if query.valid?
+              analyze_query(
+                query,
+                query.analyzers,
+                multiplex_analyzers: multiplex_analyzers
+              )
+            else
+              []
+            end
+          end
+
+          multiplex_results = multiplex_analyzers.map(&:result)
+          multiplex_errors = analysis_errors(multiplex_results)
+
+          multiplex.queries.each_with_index do |query, idx|
+            query.analysis_errors = multiplex_errors + analysis_errors(query_results[idx])
+          end
+        end
+        nil
+      end
+
+      # @param query [GraphQL::Query]
+      # @param analyzers [Array<GraphQL::Analysis::AST::Analyzer>]
+      # @return [Array<Any>] Results from those analyzers
+      def analyze_query(query, analyzers, multiplex_analyzers: [])
+        query.trace("analyze_query", { query: query }) do
+          query_analyzers = analyzers
+            .map { |analyzer| analyzer.new(query) }
+            .select { |analyzer| analyzer.analyze? }
+
+          analyzers_to_run = query_analyzers + multiplex_analyzers
+          return [] unless analyzers_to_run.any?
+
+          visitor = GraphQL::Analysis::AST::Visitor.new(
+            query: query,
+            analyzers: analyzers_to_run
+          )
+
+          visitor.visit
+
+          query_analyzers.map(&:result)
+        end
+      end
+
+      def analysis_errors(results)
+        results.flatten.select { |r| r.is_a?(GraphQL::AnalysisError) }
+      end
+    end
+  end
+end

data/lib/graphql/analysis/ast/analyzer.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    module AST
+      # Query analyzer for query ASTs. Query analyzers respond to visitor style methods
+      # but are prefixed by `enter` and `leave`.
+      #
+      # @param [GraphQL::Query] The query to analyze
+      class Analyzer
+        def initialize(query)
+          @query = query
+        end
+
+        # Analyzer hook to decide at analysis time whether a query should
+        # be analyzed or not.
+        # @return [Boolean] If the query should be analyzed or not
+        def analyze?
+          true
+        end
+
+        # The result for this analyzer. Returning {GraphQL::AnalysisError} results
+        # in a query error.
+        # @return [Any] The analyzer result
+        def result
+          raise NotImplementedError
+        end
+
+        # Don't use make_visit_method becuase it breaks `super`
+        def self.build_visitor_hooks(member_name)
+          class_eval(<<-EOS, __FILE__, __LINE__ + 1)
+            def on_enter_#{member_name}(node, parent, visitor)
+            end
+
+            def on_leave_#{member_name}(node, parent, visitor)
+            end
+          EOS
+        end
+
+        build_visitor_hooks :argument
+        build_visitor_hooks :directive
+        build_visitor_hooks :document
+        build_visitor_hooks :enum
+        build_visitor_hooks :field
+        build_visitor_hooks :fragment_spread
+        build_visitor_hooks :inline_fragment
+        build_visitor_hooks :input_object
+        build_visitor_hooks :list_type
+        build_visitor_hooks :non_null_type
+        build_visitor_hooks :null_value
+        build_visitor_hooks :operation_definition
+        build_visitor_hooks :type_name
+        build_visitor_hooks :variable_definition
+        build_visitor_hooks :variable_identifier
+        build_visitor_hooks :abstract_node
+
+        protected
+
+        attr_reader :query
+      end
+    end
+  end
+end

data/lib/graphql/analysis/ast/field_usage.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    module AST
+      class FieldUsage < Analyzer
+        def initialize(query)
+          super
+          @used_fields = Set.new
+          @used_deprecated_fields = Set.new
+        end
+
+        def on_leave_field(parent,  node, visitor)
+          field_defn = visitor.field_definition
+          field = "#{visitor.parent_type_definition.name}.#{field_defn.name}"
+          @used_fields << field
+          @used_deprecated_fields << field if field_defn.deprecation_reason
+        end
+
+        def result
+          {
+            used_fields: @used_fields.to_a,
+            used_deprecated_fields: @used_deprecated_fields.to_a
+          }
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/ast/max_query_complexity.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+require_relative "./query_complexity"
+module GraphQL
+  module Analysis
+    module AST
+      # Used under the hood to implement complexity validation,
+      # see {Schema#max_complexity} and {Query#max_complexity}
+      class MaxQueryComplexity < QueryComplexity
+        def result
+          return if query.max_complexity.nil?
+
+          total_complexity = super
+
+          if total_complexity > query.max_complexity
+            GraphQL::AnalysisError.new("Query has complexity of #{total_complexity}, which exceeds max complexity of #{query.max_complexity}")
+          else
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/ast/max_query_depth.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    module AST
+      class MaxQueryDepth < QueryDepth
+        def result
+          return unless query.max_depth
+
+          if @max_depth > query.max_depth
+            GraphQL::AnalysisError.new("Query has depth of #{@max_depth}, which exceeds max depth of #{query.max_depth}")
+          else
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/ast/query_complexity.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    # Calculate the complexity of a query, using {Field#complexity} values.
+    module AST
+      class QueryComplexity < Analyzer
+        # State for the query complexity calcuation:
+        # - `complexities_on_type` holds complexity scores for each type in an IRep node
+        def initialize(query)
+          super
+          @complexities_on_type = [TypeComplexity.new]
+        end
+
+        # Overide this method to use the complexity result
+        def result
+          raise NotImplementedError
+        end
+
+        def on_enter_field(node, parent, visitor)
+          # We don't want to visit fragment definitions,
+          # we'll visit them when we hit the spreads instead
+          return if visitor.visiting_fragment_definition?
+          return if visitor.skipping?
+
+          @complexities_on_type.push(TypeComplexity.new)
+        end
+
+        def on_leave_field(node, parent, visitor)
+          # We don't want to visit fragment definitions,
+          # we'll visit them when we hit the spreads instead
+          return if visitor.visiting_fragment_definition?
+          return if visitor.skipping?
+
+          type_complexities = @complexities_on_type.pop
+          child_complexity = type_complexities.max_possible_complexity
+          own_complexity = get_complexity(node, visitor.field_definition, child_complexity, visitor)
+
+          parent_type = visitor.parent_type_definition
+          possible_types = if parent_type.kind.abstract?
+            query.possible_types(parent_type)
+          else
+            [parent_type]
+          end
+
+          key = selection_key(visitor.response_path, visitor.query)
+
+          possible_types.each do |type|
+            @complexities_on_type.last.merge(type, key, own_complexity)
+          end
+        end
+
+        def on_enter_fragment_spread(node, _, visitor)
+          visitor.enter_fragment_spread_inline(node)
+        end
+
+        def on_leave_fragment_spread(node, _, visitor)
+          visitor.leave_fragment_spread_inline(node)
+        end
+
+        def result
+          @complexities_on_type.last.max_possible_complexity
+        end
+
+        private
+
+        def selection_key(response_path, query)
+          # We add the query object id to support multiplex queries
+          # even if they have the same response path, they should
+          # always be added.
+          response_path.join(".") + "-#{query.object_id}"
+        end
+
+        # Get a complexity value for a field,
+        # by getting the number or calling its proc
+        def get_complexity(ast_node, field_defn, child_complexity, visitor)
+        # Return if we've visited this response path before (not counting duplicates)
+          defined_complexity = field_defn.complexity
+
+          arguments = visitor.arguments_for(ast_node, field_defn)
+
+          case defined_complexity
+          when Proc
+            defined_complexity.call(query.context, arguments, child_complexity)
+          when Numeric
+            defined_complexity + (child_complexity || 0)
+          else
+            raise("Invalid complexity: #{defined_complexity.inspect} on #{field_defn.name}")
+          end
+        end
+
+        # Selections on an object may apply differently depending on what is _actually_ returned by the resolve function.
+        # Find the maximum possible complexity among those combinations.
+        class TypeComplexity
+          def initialize
+            @types = Hash.new { |h, k| h[k] = {} }
+          end
+
+          # Return the max possible complexity for types in this selection
+          def max_possible_complexity
+            @types.map do |type, fields|
+              fields.values.inject(:+)
+            end.max
+          end
+
+          # Store the complexity for the branch on `type_defn`.
+          # Later we will see if this is the max complexity among branches.
+          def merge(type_defn, key, complexity)
+            @types[type_defn][key] = complexity
+          end
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/ast/query_depth.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    # A query reducer for measuring the depth of a given query.
+    #
+    # @example Logging the depth of a query
+    #   class LogQueryDepth < GraphQL::Analysis::QueryDepth
+    #     def on_analysis_end
+    #       log("GraphQL query depth: #{@max_depth}")
+    #     end
+    #   end
+    #
+    #   Schema.execute(query_str)
+    #   # GraphQL query depth: 8
+    #
+    module AST
+      class QueryDepth < Analyzer
+        def initialize(query)
+          @max_depth = 0
+          @current_depth = 0
+          @skip_depth = 0
+          super
+        end
+
+        def on_enter_field(node, parent, visitor)
+          return if visitor.skipping? || visitor.visiting_fragment_definition?
+
+          # Don't validate introspection fields or skipped nodes
+          if GraphQL::Schema::DYNAMIC_FIELDS.include?(visitor.field_definition.name)
+            @skip_depth += 1
+          elsif @skip_depth > 0
+            # we're inside an introspection query or skipped node
+          else
+            @current_depth += 1
+          end
+        end
+
+        def on_leave_field(node, parent, visitor)
+          return if visitor.skipping? || visitor.visiting_fragment_definition?
+
+          # Don't validate introspection fields or skipped nodes
+          if GraphQL::Schema::DYNAMIC_FIELDS.include?(visitor.field_definition.name)
+            @skip_depth -= 1
+          else
+            if @max_depth < @current_depth
+              @max_depth = @current_depth
+            end
+            @current_depth -= 1
+          end
+        end
+
+        def on_enter_fragment_spread(node, _, visitor)
+          visitor.enter_fragment_spread_inline(node)
+        end
+
+        def on_leave_fragment_spread(node, _, visitor)
+          visitor.leave_fragment_spread_inline(node)
+        end
+
+        def result
+          @max_depth
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/ast/visitor.rb

@@ -0,0 +1,245 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    module AST
+      # Depth first traversal through a query AST, calling AST analyzers
+      # along the way.
+      #
+      # The visitor is a special case of GraphQL::Language::Visitor, visiting
+      # only the selected operation, providing helpers for common use cases such
+      # as skipped fields and visiting fragment spreads.
+      #
+      # @see {GraphQL::Analysis::AST::Analyzer} AST Analyzers for queries
+      class Visitor < GraphQL::Language::Visitor
+        def initialize(query:, analyzers:)
+          @analyzers = analyzers
+          @path = []
+          @object_types = []
+          @directives = []
+          @field_definitions = []
+          @argument_definitions = []
+          @directive_definitions = []
+          @query = query
+          @schema = query.schema
+          @response_path = []
+          @skip_stack = [false]
+          super(query.selected_operation)
+        end
+
+        # @return [GraphQL::Query] the query being visited
+        attr_reader :query
+
+        # @return [Array<GraphQL::ObjectType>] Types whose scope we've entered
+        attr_reader :object_types
+
+        # Visit Helpers
+
+        # @return [GraphQL::Query::Arguments] Arguments for this node, merging default values, literal values and query variables
+        # @see {GraphQL::Query#arguments_for}
+        def arguments_for(ast_node, field_definition)
+          @query.arguments_for(ast_node, field_definition)
+        end
+
+        # @return [Boolean] If the visitor is currently inside a fragment definition
+        def visiting_fragment_definition?
+          @in_fragment_def
+        end
+
+        # @return [Boolean] If the current node should be skipped because of a skip or include directive
+        def skipping?
+          @skipping
+        end
+
+        # @return [Array<String>] The path to the response key for the current field
+        def response_path
+          @response_path.dup
+        end
+
+        # Visitor Hooks
+
+        def on_operation_definition(node, parent)
+          object_type = @schema.root_type_for_operation(node.operation_type)
+          @object_types.push(object_type)
+          @path.push("#{node.operation_type}#{node.name ? " #{node.name}" : ""}")
+          call_analyzers(:on_enter_operation_definition, node, parent)
+          super
+          call_analyzers(:on_leave_operation_definition, node, parent)
+          @object_types.pop
+          @path.pop
+        end
+
+        def on_fragment_definition(node, parent)
+          on_fragment_with_type(node) do
+            @path.push("fragment #{node.name}")
+            @in_fragment_def = false
+            call_analyzers(:on_enter_fragment_definition, node, parent)
+            super
+            @in_fragment_def = false
+            call_analyzers(:on_leave_fragment_definition, node, parent)
+          end
+        end
+
+        def on_inline_fragment(node, parent)
+          on_fragment_with_type(node) do
+            @path.push("...#{node.type ? " on #{node.type.to_query_string}" : ""}")
+            call_analyzers(:on_enter_inline_fragment, node, parent)
+            super
+            call_analyzers(:on_leave_inline_fragment, node, parent)
+          end
+        end
+
+        def on_field(node, parent)
+          @response_path.push(node.alias || node.name)
+          parent_type = @object_types.last
+          field_definition = @schema.get_field(parent_type, node.name)
+          @field_definitions.push(field_definition)
+          if !field_definition.nil?
+            next_object_type = field_definition.type.unwrap
+            @object_types.push(next_object_type)
+          else
+            @object_types.push(nil)
+          end
+          @path.push(node.alias || node.name)
+
+          @skipping = @skip_stack.last || skip?(node)
+          @skip_stack << @skipping
+
+          call_analyzers(:on_enter_field, node, parent)
+          super
+
+          @skipping = @skip_stack.pop
+
+          call_analyzers(:on_leave_field, node, parent)
+          @response_path.pop
+          @field_definitions.pop
+          @object_types.pop
+          @path.pop
+        end
+
+        def on_directive(node, parent)
+          directive_defn = @schema.directives[node.name]
+          @directive_definitions.push(directive_defn)
+          call_analyzers(:on_enter_directive, node, parent)
+          super
+          call_analyzers(:on_leave_directive, node, parent)
+          @directive_definitions.pop
+        end
+
+        def on_argument(node, parent)
+          argument_defn = if (arg = @argument_definitions.last)
+            arg_type = arg.type.unwrap
+            if arg_type.kind.input_object?
+              arg_type.input_fields[node.name]
+            else
+              nil
+            end
+          elsif (directive_defn = @directive_definitions.last)
+            directive_defn.arguments[node.name]
+          elsif (field_defn = @field_definitions.last)
+            field_defn.arguments[node.name]
+          else
+            nil
+          end
+
+          @argument_definitions.push(argument_defn)
+          @path.push(node.name)
+          call_analyzers(:on_enter_argument, node, parent)
+          super
+          call_analyzers(:on_leave_argument, node, parent)
+          @argument_definitions.pop
+          @path.pop
+        end
+
+        def on_fragment_spread(node, parent)
+          @path.push("... #{node.name}")
+          call_analyzers(:on_enter_fragment_spread, node, parent)
+          super
+          call_analyzers(:on_leave_fragment_spread, node, parent)
+          @path.pop
+        end
+
+        def on_abstract_node(node, parent)
+          call_analyzers(:on_enter_abstract_node, node, parent)
+          super
+          call_analyzers(:on_leave_abstract_node, node, parent)
+        end
+
+        # Visit a fragment spread inline instead of visiting the definition
+        # by itself.
+        def enter_fragment_spread_inline(fragment_spread)
+          fragment_def = query.fragments[fragment_spread.name]
+
+          object_type = if fragment_def.type
+            query.schema.types.fetch(fragment_def.type.name, nil)
+          else
+            object_types.last
+          end
+
+          object_types << object_type
+
+          fragment_def.selections.each do |selection|
+            visit_node(selection, fragment_def)
+          end
+        end
+
+        # Visit a fragment spread inline instead of visiting the definition
+        # by itself.
+        def leave_fragment_spread_inline(_fragment_spread)
+          object_types.pop
+        end
+
+        # @return [GraphQL::BaseType] The current object type
+        def type_definition
+          @object_types.last
+        end
+
+        # @return [GraphQL::BaseType] The type which the current type came from
+        def parent_type_definition
+          @object_types[-2]
+        end
+
+        # @return [GraphQL::Field, nil] The most-recently-entered GraphQL::Field, if currently inside one
+        def field_definition
+          @field_definitions.last
+        end
+
+        # @return [GraphQL::Directive, nil] The most-recently-entered GraphQL::Directive, if currently inside one
+        def directive_definition
+          @directive_definitions.last
+        end
+
+        # @return [GraphQL::Argument, nil] The most-recently-entered GraphQL::Argument, if currently inside one
+        def argument_definition
+          # Don't get the _last_ one because that's the current one.
+          # Get the second-to-last one, which is the parent of the current one.
+          @argument_definitions[-2]
+        end
+
+        private
+
+        def skip?(ast_node)
+          dir = ast_node.directives
+          dir.any? && !GraphQL::Execution::DirectiveChecks.include?(dir, query)
+        end
+
+        def call_analyzers(method, node, parent)
+          @analyzers.each do |analyzer|
+            analyzer.public_send(method, node, parent, self)
+          end
+        end
+
+        def on_fragment_with_type(node)
+          object_type = if node.type
+            @schema.types.fetch(node.type.name, nil)
+          else
+            @object_types.last
+          end
+          @object_types.push(object_type)
+          yield(node)
+          @object_types.pop
+          @path.pop
+        end
+      end
+    end
+  end
+end