graphql_cody 1.13.0

data/lib/graphql/query/validation_pipeline.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+module GraphQL
+  class Query
+    # Contain the validation pipeline and expose the results.
+    #
+    # 0. Checks in {Query#initialize}:
+    #   - Rescue a ParseError, halt if there is one
+    #   - Check for selected operation, halt if not found
+    # 1. Validate the AST, halt if errors
+    # 2. Validate the variables, halt if errors
+    # 3. Run query analyzers, halt if errors
+    #
+    # {#valid?} is false if any of the above checks halted the pipeline.
+    #
+    # @api private
+    class ValidationPipeline
+      attr_reader :max_depth, :max_complexity
+
+      def initialize(query:, validate:, parse_error:, operation_name_error:, max_depth:, max_complexity:)
+        @validation_errors = []
+        @internal_representation = nil
+        @validate = validate
+        @parse_error = parse_error
+        @operation_name_error = operation_name_error
+        @query = query
+        @schema = query.schema
+        @max_depth = max_depth
+        @max_complexity = max_complexity
+
+        @has_validated = false
+      end
+
+      # @return [Boolean] does this query have errors that should prevent it from running?
+      def valid?
+        ensure_has_validated
+        @valid
+      end
+
+      # @return [Array<GraphQL::StaticValidation::Error, GraphQL::Query::VariableValidationError>] Static validation errors for the query string
+      def validation_errors
+        ensure_has_validated
+        @validation_errors
+      end
+
+      # @return [Hash<String, nil => GraphQL::InternalRepresentation::Node] Operation name -> Irep node pairs
+      def internal_representation
+        ensure_has_validated
+        @internal_representation
+      end
+
+      def analyzers
+        ensure_has_validated
+        @query_analyzers
+      end
+
+      private
+
+      # If the pipeline wasn't run yet, run it.
+      # If it was already run, do nothing.
+      def ensure_has_validated
+        return if @has_validated
+        @has_validated = true
+
+        if @parse_error
+          # This is kind of crazy: we push the parse error into `ctx`
+          # in {DefaultParseError} so that users can _opt out_ by redefining that hook.
+          # That means we can't _re-add_ the error here (otherwise we'd either
+          # add it twice _or_ override the user's choice to not add it).
+          # So we just have to know that it was invalid and go from there.
+          @valid = false
+          return
+        elsif @operation_name_error
+          @validation_errors << @operation_name_error
+        else
+          validation_result = @schema.static_validator.validate(@query, validate: @validate, timeout: @schema.validate_timeout, max_errors: @schema.validate_max_errors)
+          @validation_errors.concat(validation_result[:errors])
+          @internal_representation = validation_result[:irep]
+
+          if @validation_errors.empty?
+            @validation_errors.concat(@query.variables.errors)
+          end
+
+          if @validation_errors.empty?
+            @query_analyzers = build_analyzers(
+              @schema,
+              @max_depth,
+              @max_complexity
+            )
+          end
+        end
+
+        @valid = @validation_errors.empty?
+      rescue SystemStackError => err
+        @valid = false
+        @schema.query_stack_error(@query, err)
+      end
+
+      # If there are max_* values, add them,
+      # otherwise reuse the schema's list of analyzers.
+      def build_analyzers(schema, max_depth, max_complexity)
+        qa = schema.query_analyzers.dup
+
+        # Filter out the built in authorization analyzer.
+        # It is deprecated and does not have an AST analyzer alternative.
+        qa = qa.select do |analyzer|
+          if analyzer == GraphQL::Authorization::Analyzer && schema.using_ast_analysis?
+            raise "The Authorization analyzer is not supported with AST Analyzers"
+          else
+            true
+          end
+        end
+
+        if max_depth || max_complexity
+          # Depending on the analysis engine, we must use different analyzers
+          # remove this once everything has switched over to AST analyzers
+          if schema.using_ast_analysis?
+            if max_depth
+              qa << GraphQL::Analysis::AST::MaxQueryDepth
+            end
+            if max_complexity
+              qa << GraphQL::Analysis::AST::MaxQueryComplexity
+            end
+          else
+            if max_depth
+              qa << GraphQL::Analysis::MaxQueryDepth.new(max_depth)
+            end
+            if max_complexity
+              qa << GraphQL::Analysis::MaxQueryComplexity.new(max_complexity)
+            end
+          end
+
+          qa
+        else
+          qa
+        end
+      end
+    end
+  end
+end

data/lib/graphql/query/variable_validation_error.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+module GraphQL
+  class Query
+    class VariableValidationError < GraphQL::ExecutionError
+      attr_accessor :value, :validation_result
+
+      def initialize(variable_ast, type, value, validation_result)
+        @value = value
+        @validation_result = validation_result
+
+        msg = "Variable $#{variable_ast.name} of type #{type.to_type_signature} was provided invalid value"
+
+        if problem_fields.any?
+          msg += " for #{problem_fields.join(", ")}"
+        end
+
+        super(msg)
+        self.ast_node = variable_ast
+      end
+
+      def to_h
+        # It is possible there are other extension items in this error, so handle
+        # a one level deep merge explicitly. However beyond that only show the
+        # latest value and problems.
+        super.merge({ "extensions" => { "value" => value, "problems" => validation_result.problems }}) do |key, oldValue, newValue|
+          if oldValue.respond_to?(:merge)
+            oldValue.merge(newValue)
+          else
+            newValue
+          end
+        end
+      end
+
+      private
+
+      def problem_fields
+        @problem_fields ||= @validation_result
+          .problems
+          .reject { |problem| problem["path"].empty? }
+          .map { |problem| "#{problem['path'].join('.')} (#{problem['explanation']})" }
+      end
+    end
+  end
+end

data/lib/graphql/query/variables.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+module GraphQL
+  class Query
+    # Read-only access to query variables, applying default values if needed.
+    class Variables
+      extend Forwardable
+
+      # @return [Array<GraphQL::Query::VariableValidationError>]  Any errors encountered when parsing the provided variables and literal values
+      attr_reader :errors
+
+      attr_reader :context
+
+      def initialize(ctx, ast_variables, provided_variables)
+        schema = ctx.schema
+        @context = ctx
+
+        @provided_variables = GraphQL::Argument.deep_stringify(provided_variables)
+        @errors = []
+        @storage = ast_variables.each_with_object({}) do |ast_variable, memo|
+          # Find the right value for this variable:
+          # - First, use the value provided at runtime
+          # - Then, fall back to the default value from the query string
+          # If it's still nil, raise an error if it's required.
+          variable_type = schema.type_from_ast(ast_variable.type, context: ctx)
+          if variable_type.nil?
+            # Pass -- it will get handled by a validator
+          else
+            variable_name = ast_variable.name
+            default_value = ast_variable.default_value
+            provided_value = @provided_variables[variable_name]
+            value_was_provided =  @provided_variables.key?(variable_name)
+            begin
+              validation_result = variable_type.validate_input(provided_value, ctx)
+              if validation_result.valid?
+                if value_was_provided
+                  # Add the variable if a value was provided
+                  memo[variable_name] = if ctx.interpreter?
+                    provided_value
+                  elsif provided_value.nil?
+                    nil
+                  else
+                    schema.error_handler.with_error_handling(context) do
+                      variable_type.coerce_input(provided_value, ctx)
+                    end
+                  end
+                elsif default_value != nil
+                  memo[variable_name] = if ctx.interpreter?
+                    if default_value.is_a?(Language::Nodes::NullValue)
+                      nil
+                    else
+                      default_value
+                    end
+                  else
+                    # Add the variable if it wasn't provided but it has a default value (including `null`)
+                    GraphQL::Query::LiteralInput.coerce(variable_type, default_value, self)
+                  end
+                end
+              end
+            rescue GraphQL::ExecutionError => ex
+              # TODO: This should really include the path to the problematic node in the variable value
+              # like InputValidationResults generated by validate_non_null_input but unfortunately we don't
+              # have this information available in the coerce_input call chain. Note this path is the path
+              # that appears under errors.extensions.problems.path and NOT the result path under errors.path.
+              validation_result = GraphQL::Query::InputValidationResult.new
+              validation_result.add_problem(ex.message)
+            end
+
+            if !validation_result.valid?
+              @errors << GraphQL::Query::VariableValidationError.new(ast_variable, variable_type, provided_value, validation_result)
+            end
+          end
+        end
+      end
+
+      def_delegators :@storage, :length, :key?, :[], :fetch, :to_h
+    end
+  end
+end