graphql_cody 1.13.0

data/lib/graphql/static_validation/all_rules.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    # Default rules for {GraphQL::StaticValidation::Validator}
+    #
+    # Order is important here. Some validators return {GraphQL::Language::Visitor::SKIP}
+    # which stops the visit on that node. That way it doesn't try to find fields on types that
+    # don't exist, etc.
+    ALL_RULES = [
+      GraphQL::StaticValidation::NoDefinitionsArePresent,
+      GraphQL::StaticValidation::DirectivesAreDefined,
+      GraphQL::StaticValidation::DirectivesAreInValidLocations,
+      GraphQL::StaticValidation::UniqueDirectivesPerLocation,
+      GraphQL::StaticValidation::OperationNamesAreValid,
+      GraphQL::StaticValidation::FragmentNamesAreUnique,
+      GraphQL::StaticValidation::FragmentsAreFinite,
+      GraphQL::StaticValidation::FragmentsAreNamed,
+      GraphQL::StaticValidation::FragmentsAreUsed,
+      GraphQL::StaticValidation::FragmentTypesExist,
+      GraphQL::StaticValidation::FragmentsAreOnCompositeTypes,
+      GraphQL::StaticValidation::FragmentSpreadsArePossible,
+      GraphQL::StaticValidation::FieldsAreDefinedOnType,
+      GraphQL::StaticValidation::FieldsWillMerge,
+      GraphQL::StaticValidation::FieldsHaveAppropriateSelections,
+      GraphQL::StaticValidation::ArgumentsAreDefined,
+      GraphQL::StaticValidation::ArgumentLiteralsAreCompatible,
+      GraphQL::StaticValidation::RequiredArgumentsArePresent,
+      GraphQL::StaticValidation::RequiredInputObjectAttributesArePresent,
+      GraphQL::StaticValidation::ArgumentNamesAreUnique,
+      GraphQL::StaticValidation::VariableNamesAreUnique,
+      GraphQL::StaticValidation::VariablesAreInputTypes,
+      GraphQL::StaticValidation::VariableDefaultValuesAreCorrectlyTyped,
+      GraphQL::StaticValidation::VariablesAreUsedAndDefined,
+      GraphQL::StaticValidation::VariableUsagesAreAllowed,
+      GraphQL::StaticValidation::MutationRootExists,
+      GraphQL::StaticValidation::SubscriptionRootExists,
+      GraphQL::StaticValidation::InputObjectNamesAreUnique,
+    ]
+  end
+end

data/lib/graphql/static_validation/base_visitor.rb

@@ -0,0 +1,217 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    class BaseVisitor < GraphQL::Language::Visitor
+      def initialize(document, context)
+        @path = []
+        @object_types = []
+        @directives = []
+        @field_definitions = []
+        @argument_definitions = []
+        @directive_definitions = []
+        @context = context
+        @schema = context.schema
+        super(document)
+      end
+
+      # This will be overwritten by {InternalRepresentation::Rewrite} if it's included
+      def rewrite_document
+        nil
+      end
+
+      attr_reader :context
+
+      # @return [Array<GraphQL::ObjectType>] Types whose scope we've entered
+      attr_reader :object_types
+
+      # @return [Array<String>] The nesting of the current position in the AST
+      def path
+        @path.dup
+      end
+
+      # Build a class to visit the AST and perform validation,
+      # or use a pre-built class if rules is `ALL_RULES` or empty.
+      # @param rules [Array<Module, Class>]
+      # @param rewrite [Boolean] if `false`, don't include rewrite
+      # @return [Class] A class for validating `rules` during visitation
+      def self.including_rules(rules, rewrite: true)
+        if rules.empty?
+          if rewrite
+            NoValidateVisitor
+          else
+            # It's not doing _anything?!?_
+            BaseVisitor
+          end
+        elsif rules == ALL_RULES
+          if rewrite
+            DefaultVisitor
+          else
+            InterpreterVisitor
+          end
+        else
+          visitor_class = Class.new(self) do
+            include(GraphQL::StaticValidation::DefinitionDependencies)
+          end
+
+          rules.reverse_each do |r|
+            # If it's a class, it gets attached later.
+            if !r.is_a?(Class)
+              visitor_class.include(r)
+            end
+          end
+
+          if rewrite
+            visitor_class.include(GraphQL::InternalRepresentation::Rewrite)
+          end
+          visitor_class.include(ContextMethods)
+          visitor_class
+        end
+      end
+
+      module ContextMethods
+        def on_operation_definition(node, parent)
+          object_type = @schema.root_type_for_operation(node.operation_type)
+          push_type(object_type)
+          @path.push("#{node.operation_type}#{node.name ? " #{node.name}" : ""}")
+          super
+          @object_types.pop
+          @path.pop
+        end
+
+        def on_fragment_definition(node, parent)
+          on_fragment_with_type(node) do
+            @path.push("fragment #{node.name}")
+            super
+          end
+        end
+
+        def on_inline_fragment(node, parent)
+          on_fragment_with_type(node) do
+            @path.push("...#{node.type ? " on #{node.type.to_query_string}" : ""}")
+            super
+          end
+        end
+
+        def on_field(node, parent)
+          parent_type = @object_types.last
+          field_definition = @schema.get_field(parent_type, node.name, @context.query.context)
+          @field_definitions.push(field_definition)
+          if !field_definition.nil?
+            next_object_type = field_definition.type.unwrap
+            push_type(next_object_type)
+          else
+            push_type(nil)
+          end
+          @path.push(node.alias || node.name)
+          super
+          @field_definitions.pop
+          @object_types.pop
+          @path.pop
+        end
+
+        def on_directive(node, parent)
+          directive_defn = @schema.directives[node.name]
+          @directive_definitions.push(directive_defn)
+          super
+          @directive_definitions.pop
+        end
+
+        def on_argument(node, parent)
+          argument_defn = if (arg = @argument_definitions.last)
+            arg_type = arg.type.unwrap
+            if arg_type.kind.input_object?
+              @context.warden.get_argument(arg_type, node.name)
+            else
+              nil
+            end
+          elsif (directive_defn = @directive_definitions.last)
+            @context.warden.get_argument(directive_defn, node.name)
+          elsif (field_defn = @field_definitions.last)
+            @context.warden.get_argument(field_defn, node.name)
+          else
+            nil
+          end
+
+          @argument_definitions.push(argument_defn)
+          @path.push(node.name)
+          super
+          @argument_definitions.pop
+          @path.pop
+        end
+
+        def on_fragment_spread(node, parent)
+          @path.push("... #{node.name}")
+          super
+          @path.pop
+        end
+
+        def on_input_object(node, parent)
+          arg_defn = @argument_definitions.last
+          if arg_defn && arg_defn.type.list?
+            @path.push(parent.children.index(node))
+            super
+            @path.pop
+          else
+            super
+          end
+        end
+
+        # @return [GraphQL::BaseType] The current object type
+        def type_definition
+          @object_types.last
+        end
+
+        # @return [GraphQL::BaseType] The type which the current type came from
+        def parent_type_definition
+          @object_types[-2]
+        end
+
+        # @return [GraphQL::Field, nil] The most-recently-entered GraphQL::Field, if currently inside one
+        def field_definition
+          @field_definitions.last
+        end
+
+        # @return [GraphQL::Directive, nil] The most-recently-entered GraphQL::Directive, if currently inside one
+        def directive_definition
+          @directive_definitions.last
+        end
+
+        # @return [GraphQL::Argument, nil] The most-recently-entered GraphQL::Argument, if currently inside one
+        def argument_definition
+          # Don't get the _last_ one because that's the current one.
+          # Get the second-to-last one, which is the parent of the current one.
+          @argument_definitions[-2]
+        end
+
+        private
+
+        def on_fragment_with_type(node)
+          object_type = if node.type
+            @context.warden.get_type(node.type.name)
+          else
+            @object_types.last
+          end
+          push_type(object_type)
+          yield(node)
+          @object_types.pop
+          @path.pop
+        end
+
+        def push_type(t)
+          @object_types.push(t)
+        end
+      end
+
+      private
+
+      def add_error(error, path: nil)
+        if @context.too_many_errors?
+          throw :too_many_validation_errors
+        end
+        error.path ||= (path || @path.dup)
+        context.errors << error
+      end
+
+    end
+  end
+end

data/lib/graphql/static_validation/default_visitor.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    class DefaultVisitor < BaseVisitor
+      include(GraphQL::StaticValidation::DefinitionDependencies)
+
+      StaticValidation::ALL_RULES.reverse_each do |r|
+        include(r)
+      end
+
+      include(GraphQL::InternalRepresentation::Rewrite)
+      include(ContextMethods)
+    end
+  end
+end

data/lib/graphql/static_validation/definition_dependencies.rb

@@ -0,0 +1,198 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    # Track fragment dependencies for operations
+    # and expose the fragment definitions which
+    # are used by a given operation
+    module DefinitionDependencies
+      attr_reader :dependencies
+
+      def initialize(*)
+        super
+        @defdep_node_paths = {}
+
+        # { name => [node, ...] } pairs for fragments (although duplicate-named fragments are _invalid_, they are _possible_)
+        @defdep_fragment_definitions = Hash.new{ |h, k| h[k] = [] }
+
+        # This tracks dependencies from fragment to Node where it was used
+        # { fragment_definition_name => [dependent_node, dependent_node]}
+        @defdep_dependent_definitions = Hash.new { |h, k| h[k] = Set.new }
+
+        # First-level usages of spreads within definitions
+        # (When a key has an empty list as its value,
+        #  we can resolve that key's dependents)
+        # { definition_node => [node, node ...] }
+        @defdep_immediate_dependencies = Hash.new { |h, k| h[k] = Set.new }
+
+        # When we encounter a spread,
+        # this node is the one who depends on it
+        @defdep_current_parent = nil
+      end
+
+      def on_document(node, parent)
+        node.definitions.each do |definition|
+          if definition.is_a? GraphQL::Language::Nodes::FragmentDefinition
+            @defdep_fragment_definitions[definition.name] << definition
+          end
+        end
+        super
+        @dependencies = dependency_map { |defn, spreads, frag|
+          context.on_dependency_resolve_handlers.each { |h| h.call(defn, spreads, frag) }
+        }
+      end
+
+      def on_operation_definition(node, prev_node)
+        @defdep_node_paths[node.name] = NodeWithPath.new(node, context.path)
+        @defdep_current_parent = node
+        super
+        @defdep_current_parent = nil
+      end
+
+      def on_fragment_definition(node, parent)
+        @defdep_node_paths[node] = NodeWithPath.new(node, context.path)
+        @defdep_current_parent = node
+        super
+        @defdep_current_parent = nil
+      end
+
+      def on_fragment_spread(node, parent)
+        @defdep_node_paths[node] = NodeWithPath.new(node, context.path)
+
+        # Track both sides of the dependency
+        @defdep_dependent_definitions[node.name] << @defdep_current_parent
+        @defdep_immediate_dependencies[@defdep_current_parent] << node
+        super
+      end
+
+      # A map of operation definitions to an array of that operation's dependencies
+      # @return [DependencyMap]
+      def dependency_map(&block)
+        @dependency_map ||= resolve_dependencies(&block)
+      end
+
+      # Map definition AST nodes to the definition AST nodes they depend on.
+      # Expose circular dependencies.
+      class DependencyMap
+        # @return [Array<GraphQL::Language::Nodes::FragmentDefinition>]
+        attr_reader :cyclical_definitions
+
+        # @return [Hash<Node, Array<GraphQL::Language::Nodes::FragmentSpread>>]
+        attr_reader :unmet_dependencies
+
+        # @return [Array<GraphQL::Language::Nodes::FragmentDefinition>]
+        attr_reader :unused_dependencies
+
+        def initialize
+          @dependencies = Hash.new { |h, k| h[k] = [] }
+          @cyclical_definitions = []
+          @unmet_dependencies = Hash.new { |h, k| h[k] = [] }
+          @unused_dependencies = []
+        end
+
+        # @return [Array<GraphQL::Language::Nodes::AbstractNode>] dependencies for `definition_node`
+        def [](definition_node)
+          @dependencies[definition_node]
+        end
+      end
+
+      class NodeWithPath
+        extend Forwardable
+        attr_reader :node, :path
+        def initialize(node, path)
+          @node = node
+          @path = path
+        end
+
+        def_delegators :@node, :name, :eql?, :hash
+      end
+
+      private
+
+      # Return a hash of { node => [node, node ... ]} pairs
+      # Keys are top-level definitions
+      # Values are arrays of flattened dependencies
+      def resolve_dependencies
+        dependency_map = DependencyMap.new
+        # Don't allow the loop to run more times
+        # than the number of fragments in the document
+        max_loops = 0
+        @defdep_fragment_definitions.each_value do |v|
+          max_loops += v.size
+        end
+
+        loops = 0
+
+        # Instead of tracking independent fragments _as you visit_,
+        # determine them at the end. This way, we can treat fragments with the
+        # same name as if they were the same name. If _any_ of the fragments
+        # with that name has a dependency, we record it.
+        independent_fragment_nodes = @defdep_fragment_definitions.values.flatten - @defdep_immediate_dependencies.keys
+
+        while fragment_node = independent_fragment_nodes.pop
+          loops += 1
+          if loops > max_loops
+            raise("Resolution loops exceeded the number of definitions; infinite loop detected. (Max: #{max_loops}, Current: #{loops})")
+          end
+          # Since it's independent, let's remove it from here.
+          # That way, we can use the remainder to identify cycles
+          @defdep_immediate_dependencies.delete(fragment_node)
+          fragment_usages = @defdep_dependent_definitions[fragment_node.name]
+          if fragment_usages.empty?
+            # If we didn't record any usages during the visit,
+            # then this fragment is unused.
+            dependency_map.unused_dependencies << @defdep_node_paths[fragment_node]
+          else
+            fragment_usages.each do |definition_node|
+              # Register the dependency AND second-order dependencies
+              dependency_map[definition_node] << fragment_node
+              dependency_map[definition_node].concat(dependency_map[fragment_node])
+              # Since we've registered it, remove it from our to-do list
+              deps = @defdep_immediate_dependencies[definition_node]
+              # Can't find a way to _just_ delete from `deps` and return the deleted entries
+              removed, remaining = deps.partition { |spread| spread.name == fragment_node.name }
+              @defdep_immediate_dependencies[definition_node] = remaining
+              if block_given?
+                yield(definition_node, removed, fragment_node)
+              end
+              if remaining.empty? &&
+                definition_node.is_a?(GraphQL::Language::Nodes::FragmentDefinition) &&
+                definition_node.name != fragment_node.name
+                # If all of this definition's dependencies have
+                # been resolved, we can now resolve its
+                # own dependents.
+                #
+                # But, it's possible to have a duplicate-named fragment here.
+                # Skip it in that case
+                independent_fragment_nodes << definition_node
+              end
+            end
+          end
+        end
+
+        # If any dependencies were _unmet_
+        # (eg, spreads with no corresponding definition)
+        # then they're still in there
+        @defdep_immediate_dependencies.each do |defn_node, deps|
+          deps.each do |spread|
+            if !@defdep_fragment_definitions.key?(spread.name)
+              dependency_map.unmet_dependencies[@defdep_node_paths[defn_node]] << @defdep_node_paths[spread]
+              deps.delete(spread)
+            end
+          end
+          if deps.empty?
+            @defdep_immediate_dependencies.delete(defn_node)
+          end
+        end
+
+        # Anything left in @immediate_dependencies is cyclical
+        cyclical_nodes = @defdep_immediate_dependencies.keys.map { |n| @defdep_node_paths[n] }
+        # @immediate_dependencies also includes operation names, but we don't care about
+        # those. They became nil when we looked them up on `@fragment_definitions`, so remove them.
+        cyclical_nodes.compact!
+        dependency_map.cyclical_definitions.concat(cyclical_nodes)
+
+        dependency_map
+      end
+    end
+  end
+end

data/lib/graphql/static_validation/error.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    # Generates GraphQL-compliant validation message.
+    class Error
+      # Convenience for validators
+      module ErrorHelper
+        # Error `error_message` is located at `node`
+        def error(error_message, nodes, context: nil, path: nil, extensions: {})
+          path ||= context.path
+          nodes = Array(nodes)
+          GraphQL::StaticValidation::Error.new(error_message, nodes: nodes, path: path)
+        end
+      end
+
+      attr_reader   :message
+      attr_accessor :path
+
+      def initialize(message, path: nil, nodes: [])
+        @message = message
+        @nodes = Array(nodes)
+        @path = path
+      end
+
+      # A hash representation of this Message
+      def to_h
+        {
+          "message" => message,
+          "locations" => locations
+        }.tap { |h| h["path"] = path unless path.nil? }
+      end
+
+      private
+
+      attr_reader :nodes
+
+      def locations
+        nodes.map do |node|
+          h = {"line" => node.line, "column" => node.col}
+          h["filename"] = node.filename if node.filename
+          h
+        end
+      end
+    end
+  end
+end

data/lib/graphql/static_validation/interpreter_visitor.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    class InterpreterVisitor < BaseVisitor
+      include(GraphQL::StaticValidation::DefinitionDependencies)
+
+      StaticValidation::ALL_RULES.reverse_each do |r|
+        include(r)
+      end
+
+      include(ContextMethods)
+    end
+  end
+end

data/lib/graphql/static_validation/literal_validator.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    # Test whether `ast_value` is a valid input for `type`
+    class LiteralValidator
+      def initialize(context:)
+        @context = context
+        @warden = context.warden
+        @invalid_response = GraphQL::Query::InputValidationResult.new(valid: false, problems: [])
+        @valid_response = GraphQL::Query::InputValidationResult.new(valid: true, problems: [])
+      end
+
+      def validate(ast_value, type)
+        catch(:invalid) do
+          recursively_validate(ast_value, type)
+        end
+      end
+
+      private
+
+      def recursively_validate(ast_value, type)
+        if type.nil?
+          # this means we're an undefined argument, see #present_input_field_values_are_valid
+          maybe_raise_if_invalid(ast_value) do
+            @invalid_response
+          end
+        elsif ast_value.is_a?(GraphQL::Language::Nodes::NullValue)
+          maybe_raise_if_invalid(ast_value) do
+            type.kind.non_null? ? @invalid_response : @valid_response
+          end
+        elsif type.kind.non_null?
+          maybe_raise_if_invalid(ast_value) do
+            ast_value.nil? ?
+              @invalid_response :
+              recursively_validate(ast_value, type.of_type)
+          end
+        elsif type.kind.list?
+          item_type = type.of_type
+          results = ensure_array(ast_value).map { |val| recursively_validate(val, item_type) }
+          merge_results(results)
+        elsif ast_value.is_a?(GraphQL::Language::Nodes::VariableIdentifier)
+          @valid_response
+        elsif type.kind.scalar? && constant_scalar?(ast_value)
+          maybe_raise_if_invalid(ast_value) do
+            type.validate_input(ast_value, @context)
+          end
+        elsif type.kind.enum?
+          maybe_raise_if_invalid(ast_value) do
+            if ast_value.is_a?(GraphQL::Language::Nodes::Enum)
+              type.validate_input(ast_value.name, @context)
+            else
+              # if our ast_value isn't an Enum it's going to be invalid so return false
+              @invalid_response
+            end
+          end
+        elsif type.kind.input_object? && ast_value.is_a?(GraphQL::Language::Nodes::InputObject)
+          maybe_raise_if_invalid(ast_value) do
+            merge_results([
+              required_input_fields_are_present(type, ast_value),
+              present_input_field_values_are_valid(type, ast_value)
+            ])
+          end
+        else
+          maybe_raise_if_invalid(ast_value) do
+            @invalid_response
+          end
+        end
+      end
+
+      # When `error_bubbling` is false, we want to bail on the first failure that we find.
+      # Use `throw` to escape the current call stack, returning the invalid response.
+      def maybe_raise_if_invalid(ast_value)
+        ret = yield
+        if !@context.schema.error_bubbling && !ret.valid?
+          throw(:invalid, ret)
+        else
+          ret
+        end
+      end
+
+      # The GraphQL grammar supports variables embedded within scalars but graphql.js
+      # doesn't support it so we won't either for simplicity
+      def constant_scalar?(ast_value)
+        if ast_value.is_a?(GraphQL::Language::Nodes::VariableIdentifier)
+          false
+        elsif ast_value.is_a?(Array)
+          ast_value.all? { |element| constant_scalar?(element) }
+        elsif ast_value.is_a?(GraphQL::Language::Nodes::InputObject)
+          ast_value.arguments.all? { |arg| constant_scalar?(arg.value) }
+        else
+          true
+        end
+      end
+
+      def required_input_fields_are_present(type, ast_node)
+        # TODO - would be nice to use these to create an error message so the caller knows
+        # that required fields are missing
+        required_field_names = @warden.arguments(type)
+          .select { |argument| argument.type.kind.non_null? && @warden.get_argument(type, argument.name) }
+          .map(&:name)
+
+        present_field_names = ast_node.arguments.map(&:name)
+        missing_required_field_names = required_field_names - present_field_names
+        if @context.schema.error_bubbling
+          missing_required_field_names.empty? ? @valid_response : @invalid_response
+        else
+          results = missing_required_field_names.map do |name|
+            arg_type = @warden.get_argument(type, name).type
+            recursively_validate(GraphQL::Language::Nodes::NullValue.new(name: name), arg_type)
+          end
+          merge_results(results)
+        end
+      end
+
+      def present_input_field_values_are_valid(type, ast_node)
+        results = ast_node.arguments.map do |value|
+          field = @warden.get_argument(type, value.name)
+          # we want to call validate on an argument even if it's an invalid one
+          # so that our raise exception is on it instead of the entire InputObject
+          field_type = field && field.type
+          recursively_validate(value.value, field_type)
+        end
+        merge_results(results)
+      end
+
+      def ensure_array(value)
+        value.is_a?(Array) ? value : [value]
+      end
+
+      def merge_results(results_list)
+        merged_result = Query::InputValidationResult.new
+        results_list.each do |inner_result|
+          merged_result.merge_result!([], inner_result)
+        end
+        merged_result
+      end
+    end
+  end
+end

data/lib/graphql/static_validation/no_validate_visitor.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+module GraphQL
+  module StaticValidation
+    class NoValidateVisitor < StaticValidation::BaseVisitor
+      include(GraphQL::InternalRepresentation::Rewrite)
+      include(GraphQL::StaticValidation::DefinitionDependencies)
+      include(ContextMethods)
+    end
+  end
+end