graphql_cody 1.13.0

data/lib/graphql/analysis/max_query_complexity.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+require_relative "./query_complexity"
+module GraphQL
+  module Analysis
+    # Used under the hood to implement complexity validation,
+    # see {Schema#max_complexity} and {Query#max_complexity}
+    #
+    # @example Assert max complexity of 10
+    #   # DON'T actually do this, graphql-ruby
+    #   # Does this for you based on your `max_complexity` setting
+    #   MySchema.query_analyzers << GraphQL::Analysis::MaxQueryComplexity.new(10)
+    #
+    class MaxQueryComplexity < GraphQL::Analysis::QueryComplexity
+      def initialize(max_complexity)
+        disallow_excessive_complexity = ->(query, complexity) {
+          if complexity > max_complexity
+            GraphQL::AnalysisError.new("Query has complexity of #{complexity}, which exceeds max complexity of #{max_complexity}")
+          else
+            nil
+          end
+        }
+        super(&disallow_excessive_complexity)
+      end
+    end
+  end
+end

data/lib/graphql/analysis/max_query_depth.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+require_relative "./query_depth"
+module GraphQL
+  module Analysis
+    # Used under the hood to implement depth validation,
+    # see {Schema#max_depth} and {Query#max_depth}
+    #
+    # @example Assert max depth of 10
+    #   # DON'T actually do this, graphql-ruby
+    #   # Does this for you based on your `max_depth` setting
+    #   MySchema.query_analyzers << GraphQL::Analysis::MaxQueryDepth.new(10)
+    #
+    class MaxQueryDepth < GraphQL::Analysis::QueryDepth
+      def initialize(max_depth)
+        disallow_excessive_depth = ->(query, depth) {
+          if depth > max_depth
+            GraphQL::AnalysisError.new("Query has depth of #{depth}, which exceeds max depth of #{max_depth}")
+          else
+            nil
+          end
+        }
+        super(&disallow_excessive_depth)
+      end
+    end
+  end
+end

data/lib/graphql/analysis/query_complexity.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    # Calculate the complexity of a query, using {Field#complexity} values.
+    #
+    # @example Log the complexity of incoming queries
+    #   MySchema.query_analyzers << GraphQL::Analysis::QueryComplexity.new do |query, complexity|
+    #     Rails.logger.info("Complexity: #{complexity}")
+    #   end
+    #
+    class QueryComplexity
+      # @yield [query, complexity] Called for each query analyzed by the schema, before executing it
+      # @yieldparam query [GraphQL::Query] The query that was analyzed
+      # @yieldparam complexity [Numeric] The complexity for this query
+      def initialize(&block)
+        @complexity_handler = block
+      end
+
+      # State for the query complexity calcuation:
+      # - `target` is passed to handler
+      # - `complexities_on_type` holds complexity scores for each type in an IRep node
+      def initial_value(target)
+        {
+          target: target,
+          complexities_on_type: [TypeComplexity.new],
+        }
+      end
+
+      # Implement the query analyzer API
+      def call(memo, visit_type, irep_node)
+        if irep_node.ast_node.is_a?(GraphQL::Language::Nodes::Field)
+          if visit_type == :enter
+            memo[:complexities_on_type].push(TypeComplexity.new)
+          else
+            type_complexities = memo[:complexities_on_type].pop
+            child_complexity = type_complexities.max_possible_complexity
+            own_complexity = get_complexity(irep_node, child_complexity)
+            memo[:complexities_on_type].last.merge(irep_node.owner_type, own_complexity)
+          end
+        end
+        memo
+      end
+
+      # Send the query and complexity to the block
+      # @return [Object, GraphQL::AnalysisError] Whatever the handler returns
+      def final_value(reduced_value)
+        total_complexity = reduced_value[:complexities_on_type].last.max_possible_complexity
+        @complexity_handler.call(reduced_value[:target], total_complexity)
+      end
+
+      private
+
+      # Get a complexity value for a field,
+      # by getting the number or calling its proc
+      def get_complexity(irep_node, child_complexity)
+        field_defn = irep_node.definition
+        defined_complexity = field_defn.complexity
+        case defined_complexity
+        when Proc
+          defined_complexity.call(irep_node.query.context, irep_node.arguments, child_complexity)
+        when Numeric
+          defined_complexity + (child_complexity || 0)
+        else
+          raise("Invalid complexity: #{defined_complexity.inspect} on #{field_defn.name}")
+        end
+      end
+
+      # Selections on an object may apply differently depending on what is _actually_ returned by the resolve function.
+      # Find the maximum possible complexity among those combinations.
+      class TypeComplexity
+        def initialize
+          @types = Hash.new(0)
+        end
+
+        # Return the max possible complexity for types in this selection
+        def max_possible_complexity
+          @types.each_value.max || 0
+        end
+
+        # Store the complexity for the branch on `type_defn`.
+        # Later we will see if this is the max complexity among branches.
+        def merge(type_defn, complexity)
+          @types[type_defn] += complexity
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis/query_depth.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    # A query reducer for measuring the depth of a given query.
+    #
+    # @example Logging the depth of a query
+    #   Schema.query_analyzers << GraphQL::Analysis::QueryDepth.new { |query, depth|  puts "GraphQL query depth: #{depth}" }
+    #   Schema.execute(query_str)
+    #   # GraphQL query depth: 8
+    #
+    class QueryDepth
+      def initialize(&block)
+        @depth_handler = block
+      end
+
+      def initial_value(query)
+        {
+          max_depth: 0,
+          current_depth: 0,
+          query: query,
+        }
+      end
+
+      def call(memo, visit_type, irep_node)
+        if irep_node.ast_node.is_a?(GraphQL::Language::Nodes::Field)
+          if visit_type == :enter
+            memo[:current_depth] += 1
+          else
+            if memo[:max_depth] < memo[:current_depth]
+              memo[:max_depth] = memo[:current_depth]
+            end
+            memo[:current_depth] -= 1
+          end
+        end
+        memo
+      end
+
+      def final_value(memo)
+        @depth_handler.call(memo[:query], memo[:max_depth])
+      end
+    end
+  end
+end

data/lib/graphql/analysis/reducer_state.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+module GraphQL
+  module Analysis
+    class ReducerState
+      attr_reader :reducer
+      attr_accessor :memo, :errors
+
+      def initialize(reducer, query)
+        @reducer = reducer
+        @memo = initialize_reducer(reducer, query)
+        @errors = []
+      end
+
+      def call(visit_type, irep_node)
+        @memo = @reducer.call(@memo, visit_type, irep_node)
+      rescue AnalysisError => err
+        @errors << err
+      end
+
+      # Respond with any errors, if found. Otherwise, if the reducer accepts
+      # `final_value`, send it the last memo value.
+      # Otherwise, use the last value from the traversal.
+      # @return [Any] final memo value
+      def finalize_reducer
+        if @errors.any?
+          @errors
+        elsif reducer.respond_to?(:final_value)
+          reducer.final_value(@memo)
+        else
+          @memo
+        end
+      end
+
+      private
+
+      # If the reducer has an `initial_value` method, call it and store
+      # the result as `memo`. Otherwise, use `nil` as memo.
+      # @return [Any] initial memo value
+      def initialize_reducer(reducer, query)
+        if reducer.respond_to?(:initial_value)
+          reducer.initial_value(query)
+        else
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/graphql/analysis.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+require "graphql/analysis/ast"
+require "graphql/analysis/max_query_complexity"
+require "graphql/analysis/max_query_depth"
+require "graphql/analysis/query_complexity"
+require "graphql/analysis/query_depth"
+require "graphql/analysis/reducer_state"
+require "graphql/analysis/analyze_query"
+require "graphql/analysis/field_usage"

data/lib/graphql/analysis_error.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+module GraphQL
+  class AnalysisError < GraphQL::ExecutionError
+  end
+end

data/lib/graphql/argument.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+module GraphQL
+  # @api deprecated
+  class Argument
+    include GraphQL::Define::InstanceDefinable
+    accepts_definitions :name, :type, :description, :default_value, :as, :prepare, :method_access, :deprecation_reason
+    attr_reader :default_value
+    attr_accessor :description, :name, :as, :deprecation_reason
+    attr_accessor :ast_node
+    attr_accessor :method_access
+    alias :graphql_name :name
+
+    ensure_defined(:name, :description, :default_value, :type=, :type, :as, :expose_as, :prepare, :method_access, :deprecation_reason)
+
+    # @api private
+    module DefaultPrepare
+      def self.call(value, ctx); value; end
+    end
+
+    def initialize
+      @prepare_proc = DefaultPrepare
+    end
+
+    def initialize_copy(other)
+      @expose_as = nil
+    end
+
+    def default_value?
+      !!@has_default_value
+    end
+
+    def method_access?
+      # Treat unset as true -- only `false` should override
+      @method_access != false
+    end
+
+    def default_value=(new_default_value)
+      if new_default_value == NO_DEFAULT_VALUE
+        @has_default_value = false
+        @default_value = nil
+      else
+        @has_default_value = true
+        @default_value = GraphQL::Argument.deep_stringify(new_default_value)
+      end
+    end
+
+    # @!attribute name
+    #   @return [String] The name of this argument on its {GraphQL::Field} or {GraphQL::InputObjectType}
+
+    # @param new_input_type [GraphQL::BaseType, Proc] Assign a new input type for this argument (if it's a proc, it will be called after schema initialization)
+    def type=(new_input_type)
+      @clean_type = nil
+      @dirty_type = new_input_type
+    end
+
+    # @return [GraphQL::BaseType] the input type for this argument
+    def type
+      @clean_type ||= GraphQL::BaseType.resolve_related_type(@dirty_type)
+    end
+
+    # @return [String] The name of this argument inside `resolve` functions
+    def expose_as
+      @expose_as ||= (@as || @name).to_s
+    end
+
+    # Backport this to support legacy-style directives
+    def keyword
+      @keyword ||= GraphQL::Schema::Member::BuildType.underscore(expose_as).to_sym
+    end
+
+    # @param value [Object] The incoming value from variables or query string literal
+    # @param ctx [GraphQL::Query::Context]
+    # @return [Object] The prepared `value` for this argument or `value` itself if no `prepare` function exists.
+    def prepare(value, ctx)
+      @prepare_proc.call(value, ctx)
+    end
+
+    # Assign a `prepare` function to prepare this argument's value before `resolve` functions are called.
+    # @param prepare_proc [#<call(value, ctx)>]
+    def prepare=(prepare_proc)
+      @prepare_proc = BackwardsCompatibility.wrap_arity(prepare_proc, from: 1, to: 2, name: "Argument#prepare(value, ctx)")
+    end
+
+    def type_class
+      metadata[:type_class]
+    end
+
+    NO_DEFAULT_VALUE = Object.new
+    # @api private
+    def self.from_dsl(name, type_or_argument = nil, description = nil, default_value: NO_DEFAULT_VALUE, as: nil, prepare: DefaultPrepare, **kwargs, &block)
+      name_s = name.to_s
+
+      # Move some positional args into keywords if they're present
+      description && kwargs[:description] ||= description
+      kwargs[:name] ||= name_s
+      kwargs[:default_value] ||= default_value
+      kwargs[:as] ||= as
+
+      unless prepare == DefaultPrepare
+        kwargs[:prepare] ||= prepare
+      end
+
+      if !type_or_argument.nil? && !type_or_argument.is_a?(GraphQL::Argument)
+        # Maybe a string, proc or BaseType
+        kwargs[:type] = type_or_argument
+      end
+
+      if type_or_argument.is_a?(GraphQL::Argument)
+        type_or_argument.redefine(**kwargs, &block)
+      else
+        GraphQL::Argument.define(**kwargs, &block)
+      end
+    end
+
+    # @api private
+    def self.deep_stringify(val)
+      case val
+      when Array
+        val.map { |v| deep_stringify(v) }
+      when Hash
+        new_val = {}
+        val.each do |k, v|
+          new_val[k.to_s] = deep_stringify(v)
+        end
+        new_val
+      else
+        val
+      end
+    end
+  end
+end

data/lib/graphql/authorization.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+module GraphQL
+  module Authorization
+    class InaccessibleFieldsError < GraphQL::AnalysisError
+      # @return [Array<Schema::Field, GraphQL::Field>] Fields that failed `.accessible?` checks
+      attr_reader :fields
+
+      # @return [GraphQL::Query::Context] The current query's context
+      attr_reader :context
+
+      # @return [Array<GraphQL::InternalRepresentation::Node>] The visited nodes that failed `.accessible?` checks
+      # @see {#fields} for the Field definitions
+      attr_reader :irep_nodes
+
+      def initialize(fields:, irep_nodes:, context:)
+        @fields = fields
+        @irep_nodes = irep_nodes
+        @context = context
+        super("Some fields in this query are not accessible: #{fields.map(&:graphql_name).join(", ")}")
+      end
+    end
+
+    # @deprecated authorization at query runtime is generally a better idea.
+    module Analyzer
+      module_function
+      def initial_value(query)
+        {
+          schema: query.schema,
+          context: query.context,
+          inaccessible_nodes: [],
+        }
+      end
+
+      def call(memo, visit_type, irep_node)
+        if visit_type == :enter
+          field = irep_node.definition
+          if field
+            schema = memo[:schema]
+            ctx = memo[:context]
+            next_field_accessible = schema.accessible?(field, ctx)
+            if !next_field_accessible
+              memo[:inaccessible_nodes] << irep_node
+            else
+              arg_accessible = true
+              irep_node.arguments.argument_values.each do |name, arg_value|
+                arg_accessible = schema.accessible?(arg_value.definition, ctx)
+                if !arg_accessible
+                  memo[:inaccessible_nodes] << irep_node
+                  break
+                end
+              end
+              if arg_accessible
+                return_type = field.type.unwrap
+                next_type_accessible = schema.accessible?(return_type, ctx)
+                if !next_type_accessible
+                  memo[:inaccessible_nodes] << irep_node
+                end
+              end
+            end
+          end
+        end
+        memo
+      end
+
+      def final_value(memo)
+        nodes = memo[:inaccessible_nodes]
+        if nodes.any?
+          fields = nodes.map do |node|
+            field_inst = node.definition
+            # Get the "source of truth" for this field
+            field_inst.metadata[:type_class] || field_inst
+          end
+          context = memo[:context]
+          err = InaccessibleFieldsError.new(fields: fields, irep_nodes: nodes, context: context)
+          context.schema.inaccessible_fields(err)
+        else
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/graphql/backtrace/inspect_result.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+module GraphQL
+  class Backtrace
+    module InspectResult
+      module_function
+
+      def inspect_result(obj)
+        case obj
+        when Hash
+          "{" +
+            obj.map do |key, val|
+              "#{key}: #{inspect_truncated(val)}"
+            end.join(", ") +
+            "}"
+        when Array
+          "[" +
+            obj.map { |v| inspect_truncated(v) }.join(", ") +
+            "]"
+        when Query::Context::SharedMethods
+          if obj.invalid_null?
+            "nil"
+          else
+            inspect_truncated(obj.value)
+          end
+        else
+          inspect_truncated(obj)
+        end
+      end
+
+      def inspect_truncated(obj)
+        case obj
+        when Hash
+          "{...}"
+        when Array
+          "[...]"
+        when Query::Context::SharedMethods
+          if obj.invalid_null?
+            "nil"
+          else
+            inspect_truncated(obj.value)
+          end
+        when GraphQL::Execution::Lazy
+          "(unresolved)"
+        else
+          "#{obj.inspect}"
+        end
+      end
+    end
+  end
+end

data/lib/graphql/backtrace/legacy_tracer.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+module GraphQL
+  class Backtrace
+    module LegacyTracer
+      module_function
+
+      # Implement the {GraphQL::Tracing} API.
+      def trace(key, metadata)
+        case key
+        when "lex", "parse"
+          # No context here, don't have a query yet
+          nil
+        when "execute_multiplex", "analyze_multiplex"
+          # No query context yet
+          nil
+        when "validate", "analyze_query", "execute_query", "execute_query_lazy"
+          query = metadata[:query] || metadata[:queries].first
+          push_data = query
+          multiplex = query.multiplex
+        when "execute_field", "execute_field_lazy"
+          # The interpreter passes `query:`, legacy passes `context:`
+          context = metadata[:context] || ((q = metadata[:query]) && q.context)
+          push_data = context
+          multiplex = context.query.multiplex
+        else
+          # Custom key, no backtrace data for this
+          nil
+        end
+
+        if push_data
+          multiplex.context[:last_graphql_backtrace_context] = push_data
+        end
+
+        if key == "execute_multiplex"
+          begin
+            yield
+          rescue StandardError => err
+            # This is an unhandled error from execution,
+            # Re-raise it with a GraphQL trace.
+            potential_context = metadata[:multiplex].context[:last_graphql_backtrace_context]
+
+            if potential_context.is_a?(GraphQL::Query::Context) || potential_context.is_a?(GraphQL::Query::Context::FieldResolutionContext)
+              raise TracedError.new(err, potential_context)
+            else
+              raise
+            end
+          ensure
+            metadata[:multiplex].context.delete(:last_graphql_backtrace_context)
+          end
+        else
+          yield
+        end
+      end
+    end
+  end
+end