graphql 1.9.16 → 1.9.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 75a0bed671ca4979601036351265dfb7a0ce502b4f6937938084f2b9efaa7cd3
-  data.tar.gz: c43fd98af6355bde57ca2e66b1c98831498f3ac71792176063d934f968c1355f
+  metadata.gz: '0486697e594e11affbd5f7d0a661023e2a649abfa654e8faa26b5849fce0b473'
+  data.tar.gz: 3943f0dcdeb83dc593ddf675cee9143180d61ea25f454ac1ba6e8f098f4bfaf3
 SHA512:
-  metadata.gz: '096f8f6cfa0aa0465f13a54297e10e5564555e5f7937ab1ea2c10d4af49db84b3a4dcf2ca30692aac5b55a6df09e163db62e8e2d712ea3ef7763b20230b642e0'
-  data.tar.gz: aa41d320f6ecf571c81d9243179fc5ffd7b53da4f12b741670caed08fb9405725a30dd56c1db5b6e6a20985e7e506a7ee2c1548097fb8a35e71e0094fbe307ff
+  metadata.gz: 5075b2a02ca5dc3d219736b64b768ef6bbb46f09cebb92aac5ab5d3249b4675b229cb058fe44a328543328497f91658078919e04019857802f42e219585d11fa
+  data.tar.gz: 8236278511482220a05461616be330b7c629241f2cb092b67392412d4710c6f5ab2c8e75d342c598bb64bec0fa02b003972d9b1af971562ccaf765daac444492

data/lib/graphql/execution/errors.rb

@@ -2,7 +2,7 @@
 
 module GraphQL
   module Execution
-    # A tracer that wraps query execution with error handling.
+    # A plugin that wraps query execution with error handling.
     # Supports class-based schemas and the new {Interpreter} runtime only.
     #
     # @example Handling ActiveRecord::NotFound
@@ -19,34 +19,35 @@ module GraphQL
     class Errors
       def self.use(schema)
         schema_class = schema.is_a?(Class) ? schema : schema.target.class
-        schema.tracer(self.new(schema_class))
+        schema_class.error_handler = self.new(schema_class)
       end
 
       def initialize(schema)
         @schema = schema
       end
 
-      def trace(event, data)
-        case event
-        when "execute_field", "execute_field_lazy"
-          with_error_handling(data) { yield }
-        else
+      class NullErrorHandler
+        def self.with_error_handling(_ctx)
           yield
         end
       end
 
-      private
-
-      def with_error_handling(trace_data)
+      # Call the given block with the schema's configured error handlers.
+      #
+      # If the block returns a lazy value, it's not wrapped with error handling. That area will have to be wrapped itself.
+      #
+      # @param ctx [GraphQL::Query::Context]
+      # @return [Object] Either the result of the given block, or some object to replace the result, in case of error handling.
+      def with_error_handling(ctx)
         yield
       rescue StandardError => err
         rescues = @schema.rescues
         _err_class, handler = rescues.find { |err_class, handler| err.is_a?(err_class) }
         if handler
-          obj = trace_data[:object]
-          args = trace_data[:arguments]
-          ctx = trace_data[:query].context
-          field = trace_data[:field]
+          runtime_info = ctx.namespace(:interpreter) || {}
+          obj = runtime_info[:current_object]
+          args = runtime_info[:current_arguments]
+          field = runtime_info[:current_field]
           if obj.is_a?(GraphQL::Schema::Object)
             obj = obj.object
           end

data/lib/graphql/execution/interpreter/runtime.rb

@@ -11,7 +11,7 @@ module GraphQL
         # @return [GraphQL::Query]
         attr_reader :query
 
-        # @return [Class]
+        # @return [Class<GraphQL::Schema>]
         attr_reader :schema
 
         # @return [GraphQL::Query::Context]
@@ -43,19 +43,22 @@ module GraphQL
         # might be stored up in lazies.
         # @return [void]
         def run_eager
+
           root_operation = query.selected_operation
           root_op_type = root_operation.operation_type || "query"
           legacy_root_type = schema.root_type_for_operation(root_op_type)
           root_type = legacy_root_type.metadata[:type_class] || raise("Invariant: type must be class-based: #{legacy_root_type}")
+          path = []
+          @interpreter_context[:current_object] = query.root_value
+          @interpreter_context[:current_path] = path
           object_proxy = root_type.authorized_new(query.root_value, context)
           object_proxy = schema.sync_lazy(object_proxy)
           if object_proxy.nil?
             # Root .authorized? returned false.
-            write_in_response([], nil)
+            write_in_response(path, nil)
             nil
           else
-            path = []
-            evaluate_selections(path, object_proxy, root_type, root_operation.selections, root_operation_type: root_op_type)
+            evaluate_selections(path, context.scoped_context, object_proxy, root_type, root_operation.selections, root_operation_type: root_op_type)
             nil
           end
         end
@@ -115,7 +118,9 @@ module GraphQL
           end
         end
 
-        def evaluate_selections(path, owner_object, owner_type, selections, root_operation_type: nil)
+        def evaluate_selections(path, scoped_context, owner_object, owner_type, selections, root_operation_type: nil)
+          @interpreter_context[:current_object] = owner_object
+          @interpreter_context[:current_path] = path
           selections_by_name = {}
           gather_selections(owner_object, owner_type, selections, selections_by_name)
           selections_by_name.each do |result_name, field_ast_nodes_or_ast_node|
@@ -158,6 +163,7 @@ module GraphQL
             @interpreter_context[:current_path] = next_path
             @interpreter_context[:current_field] = field_defn
 
+            context.scoped_context = scoped_context
             object = owner_object
 
             if is_introspection
@@ -195,6 +201,8 @@ module GraphQL
               end
             end
 
+            @interpreter_context[:current_arguments] = kwarg_arguments
+
             # Optimize for the case that field is selected only once
             if field_ast_nodes.nil? || field_ast_nodes.size == 1
               next_selections = ast_node.selections
@@ -206,13 +214,15 @@ module GraphQL
             field_result = resolve_with_directives(object, ast_node) do
               # Actually call the field resolver and capture the result
               app_result = begin
-                query.trace("execute_field", {owner: owner_type, field: field_defn, path: next_path, query: query, object: object, arguments: kwarg_arguments}) do
-                  field_defn.resolve(object, kwarg_arguments, context)
+                query.with_error_handling do
+                  query.trace("execute_field", {owner: owner_type, field: field_defn, path: next_path, query: query, object: object, arguments: kwarg_arguments}) do
+                    field_defn.resolve(object, kwarg_arguments, context)
+                  end
                 end
               rescue GraphQL::ExecutionError => err
                 err
               end
-              after_lazy(app_result, owner: owner_type, field: field_defn, path: next_path, owner_object: object, arguments: kwarg_arguments) do |inner_result|
+              after_lazy(app_result, owner: owner_type, field: field_defn, path: next_path, scoped_context: context.scoped_context, owner_object: object, arguments: kwarg_arguments) do |inner_result|
                 continue_value = continue_value(next_path, inner_result, field_defn, return_type.non_null?, ast_node)
                 if HALT != continue_value
                   continue_field(next_path, continue_value, field_defn, return_type, ast_node, next_selections, false, object, kwarg_arguments)
@@ -286,7 +296,7 @@ module GraphQL
             r
           when "UNION", "INTERFACE"
             resolved_type_or_lazy = query.resolve_type(type, value)
-            after_lazy(resolved_type_or_lazy, owner: type, path: path, field: field, owner_object: owner_object, arguments: arguments) do |resolved_type|
+            after_lazy(resolved_type_or_lazy, owner: type, path: path, scoped_context: context.scoped_context, field: field, owner_object: owner_object, arguments: arguments) do |resolved_type|
               possible_types = query.possible_types(type)
 
               if !possible_types.include?(resolved_type)
@@ -306,12 +316,12 @@ module GraphQL
             rescue GraphQL::ExecutionError => err
               err
             end
-            after_lazy(object_proxy, owner: type, path: path, field: field, owner_object: owner_object, arguments: arguments) do |inner_object|
+            after_lazy(object_proxy, owner: type, path: path, scoped_context: context.scoped_context, field: field, owner_object: owner_object, arguments: arguments) do |inner_object|
               continue_value = continue_value(path, inner_object, field, is_non_null, ast_node)
               if HALT != continue_value
                 response_hash = {}
                 write_in_response(path, response_hash)
-                evaluate_selections(path, continue_value, type, next_selections)
+                evaluate_selections(path, context.scoped_context, continue_value, type, next_selections)
                 response_hash
               end
             end
@@ -320,6 +330,7 @@ module GraphQL
             write_in_response(path, response_list)
             inner_type = type.of_type
             idx = 0
+            scoped_context = context.scoped_context
             value.each do |inner_value|
               next_path = path.dup
               next_path << idx
@@ -327,7 +338,7 @@ module GraphQL
               idx += 1
               set_type_at_path(next_path, inner_type)
               # This will update `response_list` with the lazy
-              after_lazy(inner_value, owner: inner_type, path: next_path, field: field, owner_object: owner_object, arguments: arguments) do |inner_inner_value|
+              after_lazy(inner_value, owner: inner_type, path: next_path, scoped_context: scoped_context, field: field, owner_object: owner_object, arguments: arguments) do |inner_inner_value|
                 # reset `is_non_null` here and below, because the inner type will have its own nullability constraint
                 continue_value = continue_value(next_path, inner_inner_value, field, false, ast_node)
                 if HALT != continue_value
@@ -393,23 +404,30 @@ module GraphQL
         # @param field [GraphQL::Schema::Field]
         # @param eager [Boolean] Set to `true` for mutation root fields only
         # @return [GraphQL::Execution::Lazy, Object] If loading `object` will be deferred, it's a wrapper over it.
-        def after_lazy(lazy_obj, owner:, field:, path:, owner_object:, arguments:, eager: false)
+        def after_lazy(lazy_obj, owner:, field:, path:, scoped_context:, owner_object:, arguments:, eager: false)
+          @interpreter_context[:current_object] = owner_object
+          @interpreter_context[:current_arguments] = arguments
           @interpreter_context[:current_path] = path
           @interpreter_context[:current_field] = field
           if schema.lazy?(lazy_obj)
             lazy = GraphQL::Execution::Lazy.new(path: path, field: field) do
               @interpreter_context[:current_path] = path
               @interpreter_context[:current_field] = field
+              @interpreter_context[:current_object] = owner_object
+              @interpreter_context[:current_arguments] = arguments
+              context.scoped_context = scoped_context
               # Wrap the execution of _this_ method with tracing,
               # but don't wrap the continuation below
               inner_obj = begin
-                query.trace("execute_field_lazy", {owner: owner, field: field, path: path, query: query, object: owner_object, arguments: arguments}) do
-                  schema.sync_lazy(lazy_obj)
+                query.with_error_handling do
+                  query.trace("execute_field_lazy", {owner: owner, field: field, path: path, query: query, object: owner_object, arguments: arguments}) do
+                    schema.sync_lazy(lazy_obj)
+                  end
                 end
                 rescue GraphQL::ExecutionError, GraphQL::UnauthorizedError => err
                   yield(err)
               end
-              after_lazy(inner_obj, owner: owner, field: field, path: path, owner_object: owner_object, arguments: arguments, eager: eager) do |really_inner_obj|
+              after_lazy(inner_obj, owner: owner, field: field, path: path, scoped_context: context.scoped_context, owner_object: owner_object, arguments: arguments, eager: eager) do |really_inner_obj|
                 yield(really_inner_obj)
               end
             end
@@ -500,7 +518,11 @@ module GraphQL
             args = arguments(nil, arg_type, ast_value)
             # We're not tracking defaults_used, but for our purposes
             # we compare the value to the default value.
-            return true, arg_type.new(ruby_kwargs: args, context: context, defaults_used: nil)
+
+            input_obj = query.with_error_handling do
+              arg_type.new(ruby_kwargs: args, context: context, defaults_used: nil)
+            end
+            return true, input_obj
           else
             flat_value = flatten_ast_value(ast_value)
             return true, arg_type.coerce_input(flat_value, context)

data/lib/graphql/introspection/entry_points.rb

@@ -15,8 +15,9 @@ module GraphQL
       end
 
       def __type(name:)
-        type = context.warden.get_type(name)
+        return unless context.warden.reachable_type?(name)
 
+        type = context.warden.get_type(name)
         if type && context.interpreter?
           type = type.metadata[:type_class] || raise("Invariant: interpreter requires class-based type for #{name}")
         end

data/lib/graphql/introspection/schema_type.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module GraphQL
   module Introspection
     class SchemaType < Introspection::BaseObject
@@ -14,7 +15,7 @@ module GraphQL
       field :directives, [GraphQL::Schema::LateBoundType.new("__Directive")], "A list of all directives supported by this server.", null: false
 
       def types
-        types = @context.warden.types
+        types = @context.warden.reachable_types.sort_by(&:graphql_name)
         if context.interpreter?
           types.map { |t| t.metadata[:type_class] || raise("Invariant: can't introspect non-class-based type: #{t}") }
         else

data/lib/graphql/query.rb

@@ -300,6 +300,13 @@ module GraphQL
       with_prepared_ast { @subscription }
     end
 
+    # @api private
+    def with_error_handling
+      schema.error_handler.with_error_handling(context) do
+        yield
+      end
+    end
+
     private
 
     def find_operation(operations, operation_name)

data/lib/graphql/query/context.rb

@@ -155,6 +155,7 @@ module GraphQL
         @path = []
         @value = nil
         @context = self # for SharedMethods
+        @scoped_context = {}
       end
 
       # @api private
@@ -163,15 +164,30 @@ module GraphQL
       # @api private
       attr_writer :value
 
-      def_delegators :@provided_values, :[], :[]=, :to_h, :to_hash, :key?, :fetch, :dig
-      def_delegators :@query, :trace, :interpreter?
+      # @api private
+      attr_accessor :scoped_context
 
-      # @!method [](key)
-      #   Lookup `key` from the hash passed to {Schema#execute} as `context:`
+      def_delegators :@provided_values, :[]=
+      def_delegators :to_h, :fetch, :dig
+      def_delegators :@query, :trace, :interpreter?
 
       # @!method []=(key, value)
       #   Reassign `key` to the hash passed to {Schema#execute} as `context:`
 
+      # Lookup `key` from the hash passed to {Schema#execute} as `context:`
+      def [](key)
+        return @scoped_context[key] if @scoped_context.key?(key)
+        @provided_values[key]
+      end
+
+      def to_h
+        @provided_values.merge(@scoped_context)
+      end
+      alias :to_hash :to_h
+
+      def key?(key)
+        @scoped_context.key?(key) || @provided_values.key?(key)
+      end
 
       # @return [GraphQL::Schema::Warden]
       def warden
@@ -195,6 +211,15 @@ module GraphQL
         @value = nil
       end
 
+      def scoped_merge!(hash)
+        @scoped_context = @scoped_context.merge(hash)
+      end
+
+      def scoped_set!(key, value)
+        scoped_merge!(key => value)
+        nil
+      end
+
       class FieldResolutionContext
         include SharedMethods
         include Tracing::Traceable

data/lib/graphql/query/null_context.rb

@@ -21,9 +21,13 @@ module GraphQL
         )
       end
 
+      def [](key); end
+
       class << self
         extend Forwardable
 
+        def [](key); end
+
         def instance
           @instance = self.new
         end

data/lib/graphql/query/variables.rb

@@ -35,7 +35,9 @@ module GraphQL
               if validation_result.valid?
                 if value_was_provided
                   # Add the variable if a value was provided
-                  memo[variable_name] = variable_type.coerce_input(provided_value, ctx)
+                  memo[variable_name] = schema.error_handler.with_error_handling(context) do
+                    variable_type.coerce_input(provided_value, ctx)
+                  end
                 elsif default_value != nil
                   # Add the variable if it wasn't provided but it has a default value (including `null`)
                   memo[variable_name] = GraphQL::Query::LiteralInput.coerce(variable_type, default_value, self)

data/lib/graphql/schema.rb

@@ -40,6 +40,7 @@ require "graphql/schema/directive/include"
 require "graphql/schema/directive/skip"
 require "graphql/schema/directive/feature"
 require "graphql/schema/directive/transform"
+require "graphql/schema/type_membership"
 
 require "graphql/schema/resolver"
 require "graphql/schema/mutation"
@@ -448,10 +449,11 @@ module GraphQL
 
     # @see [GraphQL::Schema::Warden] Restricted access to members of a schema
     # @param type_defn [GraphQL::InterfaceType, GraphQL::UnionType] the type whose members you want to retrieve
+    # @param context [GraphQL::Query::Context] The context for the current query
     # @return [Array<GraphQL::ObjectType>] types which belong to `type_defn` in this schema
-    def possible_types(type_defn)
+    def possible_types(type_defn, context = GraphQL::Query::NullContext)
       @possible_types ||= GraphQL::Schema::PossibleTypes.new(self)
-      @possible_types.possible_types(type_defn)
+      @possible_types.possible_types(type_defn, context)
     end
 
     # @see [GraphQL::Schema::Warden] Resticted access to root types
@@ -597,6 +599,7 @@ module GraphQL
     alias :_schema_class :class
     def_delegators :_schema_class, :visible?, :accessible?, :authorized?, :unauthorized_object, :unauthorized_field, :inaccessible_fields
     def_delegators :_schema_class, :directive
+    def_delegators :_schema_class, :error_handler
 
     # A function to call when {#execute} receives an invalid query string
     #
@@ -1027,6 +1030,13 @@ module GraphQL
         DefaultTypeError.call(type_err, ctx)
       end
 
+      attr_writer :error_handler
+
+      # @return [GraphQL::Execution::Errors, Class<GraphQL::Execution::Errors::NullErrorHandler>]
+      def error_handler
+        @error_handler ||= GraphQL::Execution::Errors::NullErrorHandler
+      end
+
       def lazy_resolve(lazy_class, value_method)
         lazy_classes[lazy_class] = value_method
       end

data/lib/graphql/schema/argument.rb

@@ -121,6 +121,10 @@ module GraphQL
       # Used by the runtime.
       # @api private
       def prepare_value(obj, value)
+        if value.is_a?(GraphQL::Schema::InputObject)
+          value = value.prepare
+        end
+
         if @prepare.nil?
           value
         elsif @prepare.is_a?(String) || @prepare.is_a?(Symbol)

data/lib/graphql/schema/base_64_bp.rb

@@ -10,8 +10,9 @@ module Base64Bp
   module_function
 
   def urlsafe_encode64(bin, padding:)
-    str = strict_encode64(bin).tr("+/", "-_")
-    str = str.delete("=") unless padding
+    str = strict_encode64(bin)
+    str.tr!("+/", "-_")
+    str.delete!("=") unless padding
     str
   end
 

data/lib/graphql/schema/member/has_fields.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-require 'irb/ruby-token'
 
 module GraphQL
   class Schema
@@ -43,9 +42,7 @@ module GraphQL
         # A list of Ruby keywords.
         #
         # @api private
-        RUBY_KEYWORDS = RubyToken::TokenDefinitions.select { |definition| definition[1] == RubyToken::TkId }
-                                                   .map { |definition| definition[2] }
-                                                   .compact
+        RUBY_KEYWORDS = [:class, :module, :def, :undef, :begin, :rescue, :ensure, :end, :if, :unless, :then, :elsif, :else, :case, :when, :while, :until, :for, :break, :next, :redo, :retry, :in, :do, :return, :yield, :super, :self, :nil, :true, :false, :and, :or, :not, :alias, :defined?, :BEGIN, :END, :__LINE__, :__FILE__]
 
         # A list of GraphQL-Ruby keywords.
         #

data/lib/graphql/schema/object.rb

@@ -35,10 +35,12 @@ module GraphQL
         # @return [GraphQL::Schema::Object, GraphQL::Execution::Lazy]
         # @raise [GraphQL::UnauthorizedError] if the user-provided hook returns `false`
         def authorized_new(object, context)
-          auth_val = begin
-            authorized?(object, context)
-          rescue GraphQL::UnauthorizedError => err
-            context.schema.unauthorized_object(err)
+          auth_val = context.query.with_error_handling do
+            begin
+              authorized?(object, context)
+            rescue GraphQL::UnauthorizedError => err
+              context.schema.unauthorized_object(err)
+            end
           end
 
           context.schema.after_lazy(auth_val) do |is_authorized|

data/lib/graphql/schema/possible_types.rb

@@ -20,12 +20,12 @@ module GraphQL
         end
       end
 
-      def possible_types(type_defn)
+      def possible_types(type_defn, ctx)
         case type_defn
         when Module
-          possible_types(type_defn.graphql_definition)
+          possible_types(type_defn.graphql_definition, ctx)
         when GraphQL::UnionType
-          type_defn.possible_types
+          type_defn.possible_types(ctx)
         when GraphQL::InterfaceType
           @interface_implementers[type_defn]
         when GraphQL::BaseType

data/lib/graphql/schema/type_membership.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module GraphQL
+  class Schema
+    # This class joins an object type to an abstract type (interface or union) of which
+    # it is a member.
+    #
+    # TODO: Not yet implemented for interfaces.
+    class TypeMembership
+      # @return [Class<GraphQL::Schema::Object>]
+      attr_reader :object_type
+
+      # @return [Class<GraphQL::Schema::Union>, Module<GraphQL::Schema::Interface>]
+      attr_reader :abstract_type
+
+      # Called when an object is hooked up to an abstract type, such as {Schema::Union.possible_types}
+      # or {Schema::Object.implements} (for interfaces).
+      #
+      # @param abstract_type [Class<GraphQL::Schema::Union>, Module<GraphQL::Schema::Interface>]
+      # @param object_type [Class<GraphQL::Schema::Object>]
+      # @param options [Hash] Any options passed to `.possible_types` or `.implements`
+      def initialize(abstract_type, object_type, options)
+        @abstract_type = abstract_type
+        @object_type = object_type
+        @options = options
+      end
+
+      # @return [Boolean] if false, {#object_type} will be treated as _not_ a member of {#abstract_type}
+      def visible?(_ctx)
+        true
+      end
+    end
+  end
+end

data/lib/graphql/schema/union.rb

@@ -5,13 +5,19 @@ module GraphQL
       extend GraphQL::Schema::Member::AcceptsDefinition
 
       class << self
-        def possible_types(*types)
+        def possible_types(*types, context: GraphQL::Query::NullContext, **options)
           if types.any?
-            @possible_types = types
+            types.each do |t|
+              type_memberships << type_membership_class.new(self, t, options)
+            end
           else
-            all_possible_types = @possible_types || []
-            all_possible_types += super if defined?(super)
-            all_possible_types.uniq
+            visible_types = []
+            type_memberships.each do |type_membership|
+              if type_membership.visible?(context)
+                visible_types << type_membership.object_type
+              end
+            end
+            visible_types
           end
         end
 
@@ -19,7 +25,7 @@ module GraphQL
           type_defn = GraphQL::UnionType.new
           type_defn.name = graphql_name
           type_defn.description = description
-          type_defn.possible_types = possible_types
+          type_defn.type_memberships = type_memberships
           if respond_to?(:resolve_type)
             type_defn.resolve_type = method(:resolve_type)
           end
@@ -27,9 +33,23 @@ module GraphQL
           type_defn
         end
 
+        def type_membership_class(membership_class = nil)
+          if membership_class
+            @type_membership_class = membership_class
+          else
+            @type_membership_class || find_inherited_value(:type_membership_class, GraphQL::Schema::TypeMembership)
+          end
+        end
+
         def kind
           GraphQL::TypeKinds::UNION
         end
+
+        private
+
+        def type_memberships
+          @type_memberships ||= []
+        end
       end
     end
   end

data/lib/graphql/schema/warden.rb

@@ -1,4 +1,7 @@
 # frozen_string_literal: true
+
+require 'set'
+
 module GraphQL
   class Schema
     # Restrict access to a {GraphQL::Schema} with a user-defined filter.
@@ -40,7 +43,8 @@ module GraphQL
       # @param deep_check [Boolean]
       def initialize(filter, context:, schema:)
         @schema = schema
-        @visibility_cache = read_through { |m| filter.call(m, context) }
+        @context = context
+        @visibility_cache = read_through { |m| filter.call(m, @context) }
       end
 
       # @return [Array<GraphQL::BaseType>] Visible types in the schema
@@ -62,6 +66,17 @@ module GraphQL
         @visible_types[type_name]
       end
 
+      # @return [Array<GraphQL::BaseType>] Visible and reachable types in the schema
+      def reachable_types
+        @reachable_types ||= reachable_type_set.to_a
+      end
+
+      # @return Boolean True if the type is visible and reachable in the schema
+      def reachable_type?(type_name)
+        type = get_type(type_name)
+        type && reachable_type_set.include?(type)
+      end
+
       # @return [GraphQL::Field, nil] The field named `field_name` on `parent_type`, if it exists
       def get_field(parent_type, field_name)
 
@@ -81,7 +96,7 @@ module GraphQL
 
       # @return [Array<GraphQL::BaseType>] The types which may be member of `type_defn`
       def possible_types(type_defn)
-        @visible_possible_types ||= read_through { |type_defn| @schema.possible_types(type_defn).select { |t| visible_type?(t) } }
+        @visible_possible_types ||= read_through { |type_defn| @schema.possible_types(type_defn, @context).select { |t| visible_type?(t) } }
         @visible_possible_types[type_defn]
       end
 
@@ -170,7 +185,7 @@ module GraphQL
       end
 
       def visible_possible_types?(type_defn)
-        @schema.possible_types(type_defn).any? { |t| visible_type?(t) }
+        @schema.possible_types(type_defn, @context).any? { |t| visible_type?(t) }
       end
 
       def visible?(member)
@@ -180,6 +195,65 @@ module GraphQL
       def read_through
         Hash.new { |h, k| h[k] = yield(k) }
       end
+
+      def reachable_type_set
+        return @reachable_type_set if defined?(@reachable_type_set)
+
+        @reachable_type_set = Set.new
+
+        unvisited_types = []
+        ['query', 'mutation', 'subscription'].each do |op_name|
+          root_type = root_type_for_operation(op_name)
+          unvisited_types << root_type if root_type
+        end
+        unvisited_types.concat(@schema.introspection_system.object_types)
+        @schema.orphan_types.each do |orphan_type|
+          unvisited_types << orphan_type.graphql_definition if get_type(orphan_type.graphql_name)
+        end
+
+        until unvisited_types.empty?
+          type = unvisited_types.pop
+          if @reachable_type_set.add?(type)
+            if type.kind.input_object?
+              # recurse into visible arguments
+              arguments(type).each do |argument|
+                argument_type = argument.type.unwrap
+                unvisited_types << argument_type
+              end
+            elsif type.kind.union?
+              # recurse into visible possible types
+              possible_types(type).each do |possible_type|
+                unvisited_types << possible_type
+              end
+            elsif type.kind.fields?
+              if type.kind.interface?
+                # recurse into visible possible types
+                possible_types(type).each do |possible_type|
+                  unvisited_types << possible_type
+                end
+              elsif type.kind.object?
+                # recurse into visible implemented interfaces
+                interfaces(type).each do |interface|
+                  unvisited_types << interface
+                end
+              end
+
+              # recurse into visible fields
+              fields(type).each do |field|
+                field_type = field.type.unwrap
+                unvisited_types << field_type
+                # recurse into visible arguments
+                arguments(field).each do |argument|
+                  argument_type = argument.type.unwrap
+                  unvisited_types << argument_type
+                end
+              end
+            end
+          end
+        end
+
+        @reachable_type_set
+      end
     end
   end
 end

data/lib/graphql/union_type.rb

@@ -24,22 +24,27 @@ module GraphQL
   #  }
   #
   class UnionType < GraphQL::BaseType
-    accepts_definitions :possible_types, :resolve_type
-    ensure_defined :possible_types, :resolve_type, :resolve_type_proc
+    accepts_definitions :resolve_type, :type_membership_class,
+      possible_types: ->(target, possible_types, options = {}) { target.add_possible_types(possible_types, options) }
+    ensure_defined :possible_types, :resolve_type, :resolve_type_proc, :type_membership_class
 
     attr_accessor :resolve_type_proc
+    attr_reader :type_memberships
+    attr_accessor :type_membership_class
 
     def initialize
       super
-      @dirty_possible_types = []
-      @clean_possible_types = nil
+      @type_membership_class = GraphQL::Schema::TypeMembership
+      @type_memberships = []
+      @cached_possible_types = nil
       @resolve_type_proc = nil
     end
 
     def initialize_copy(other)
       super
-      @clean_possible_types = nil
-      @dirty_possible_types = other.dirty_possible_types.dup
+      @type_membership_class = other.type_membership_class
+      @type_memberships = other.type_memberships.dup
+      @cached_possible_types = nil
     end
 
     def kind
@@ -47,33 +52,44 @@ module GraphQL
     end
 
     # @return [Boolean] True if `child_type_defn` is a member of this {UnionType}
-    def include?(child_type_defn)
-      possible_types.include?(child_type_defn)
-    end
-
-    def possible_types=(new_possible_types)
-      @clean_possible_types = nil
-      @dirty_possible_types = new_possible_types
+    def include?(child_type_defn, ctx = GraphQL::Query::NullContext)
+      possible_types(ctx).include?(child_type_defn)
     end
 
     # @return [Array<GraphQL::ObjectType>] Types which may be found in this union
-    def possible_types
-      @clean_possible_types ||= begin
-        if @dirty_possible_types.respond_to?(:map)
-          @dirty_possible_types.map { |type| GraphQL::BaseType.resolve_related_type(type) }
-        else
-          @dirty_possible_types
-        end
+    def possible_types(ctx = GraphQL::Query::NullContext)
+      if ctx == GraphQL::Query::NullContext
+        # Only cache the default case; if we cached for every `ctx`, it would be a memory leak
+        # (The warden should cache calls to this method, so it's called only once per query,
+        # unless user code calls it directly.)
+        @cached_possible_types ||= possible_types_for_context(ctx)
+      else
+        possible_types_for_context(ctx)
       end
     end
 
+    def possible_types=(types)
+      # This is a re-assignment, so clear the previous values
+      @type_memberships = []
+      @cached_possible_types = nil
+      add_possible_types(types, {})
+    end
+
+    def add_possible_types(types, options)
+      @type_memberships ||= []
+      Array(types).each { |t|
+        @type_memberships << self.type_membership_class.new(self, t, options)
+      }
+      nil
+    end
+
     # Get a possible type of this {UnionType} by type name
     # @param type_name [String]
     # @param ctx [GraphQL::Query::Context] The context for the current query
     # @return [GraphQL::ObjectType, nil] The type named `type_name` if it exists and is a member of this {UnionType}, (else `nil`)
     def get_possible_type(type_name, ctx)
       type = ctx.query.get_type(type_name)
-      type if type && ctx.query.schema.possible_types(self).include?(type)
+      type if type && ctx.query.schema.possible_types(self, ctx).include?(type)
     end
 
     # Check if a type is a possible type of this {UnionType}
@@ -93,8 +109,20 @@ module GraphQL
       @resolve_type_proc = new_resolve_type_proc
     end
 
-    protected
+    def type_memberships=(type_memberships)
+      @type_memberships = type_memberships
+    end
+
+    private
 
-    attr_reader :dirty_possible_types
+    def possible_types_for_context(ctx)
+      visible_types = []
+      @type_memberships.each do |type_membership|
+        if type_membership.visible?(ctx)
+          visible_types << BaseType.resolve_related_type(type_membership.object_type)
+        end
+      end
+      visible_types
+    end
   end
 end

data/lib/graphql/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module GraphQL
-  VERSION = "1.9.16"
+  VERSION = "1.9.17"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: graphql
 version: !ruby/object:Gem::Version
-  version: 1.9.16
+  version: 1.9.17
 platform: ruby
 authors:
 - Robert Mosolgo
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-12-02 00:00:00.000000000 Z
+date: 2019-12-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: benchmark-ips
@@ -588,6 +588,7 @@ files:
 - lib/graphql/schema/timeout_middleware.rb
 - lib/graphql/schema/traversal.rb
 - lib/graphql/schema/type_expression.rb
+- lib/graphql/schema/type_membership.rb
 - lib/graphql/schema/union.rb
 - lib/graphql/schema/unique_within_type.rb
 - lib/graphql/schema/validation.rb