graphql_devise 2.2.0 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8f126f974c5e4f4bcd57e9a9713dcb018e0abfba31c8896390224004c30aefec
-  data.tar.gz: f1a9bf4b8eca414586a4379d19b87318de2546920ac2fec45a274b996f276379
+  metadata.gz: a254ff0aef5cb9ce45ee53100dccecd33a2b0898afc1261d668be20b4cd8a739
+  data.tar.gz: d062d1b78f625585c0e613d99b5a252c76d1e16f58aa75711fb63197241d59b6
 SHA512:
-  metadata.gz: 760a06cc2d976db391b2df28422592b28f1e65fcdbd5e4f9973341158417839d99d05a2ea1bba2ef94fa481207bbb97baabd7c2ec7bb7011f3e516dc64c6c5bd
-  data.tar.gz: 32fb591a9b10c8c9d4f8f8990b7dd7943990c80d45eba355748d7780caa4704303b33623ef9b0ff340f30b2319c0a0473e7c775bb1cdb30e17c368a8f18c621e
+  metadata.gz: 826361a8cd110e817da03f60383513e02a06e7847543c9d183500ed86b381419fe44742607b6c5b5f4bb18afd985b80dc9f68c152ba99e10ca237f3c0442ab56
+  data.tar.gz: 49a8b2cec607525cc84682cf797d05456c6d462751ac5857dd1a157d72766b2a6654cc74ce40c8a9e34847ab66dd441d1d96d6c696ea526ac2f8c8ec7668bcca

data/.circleci/config.yml

@@ -13,6 +13,7 @@ jobs:
       - image: 'ruby:<< parameters.ruby-version >>'
     environment:
       BUNDLE_GEMFILE: << parameters.gemfile >>
+      BUNDLE_JOBS: '2'
       COVERALLS_PARALLEL: 'true'
       EAGER_LOAD: 'true'
       RUBYOPT: '-rostruct'

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [v2.3.0](https://github.com/graphql-devise/graphql_devise/tree/v2.3.0) (2026-07-20)
+
+[Full Changelog](https://github.com/graphql-devise/graphql_devise/compare/v2.2.0...v2.3.0)
+
+**Implemented enhancements:**
+
+- Disable introspection [\#255](https://github.com/graphql-devise/graphql_devise/issues/255)
+- Support public\_introspection option in mount\_graphql\_devise\_for [\#294](https://github.com/graphql-devise/graphql_devise/pull/294) ([mcelicalderon](https://github.com/mcelicalderon))
+
 ## [v2.2.0](https://github.com/graphql-devise/graphql_devise/tree/v2.2.0) (2026-05-13)
 
 [Full Changelog](https://github.com/graphql-devise/graphql_devise/compare/v2.1.1...v2.2.0)
@@ -463,10 +472,6 @@
 
 - mutation': Second definition of 'mutation\(...\)' \(GraphqlDevise::Types::MutationType\) is invalid [\#59](https://github.com/graphql-devise/graphql_devise/issues/59)
 
-**Merged pull requests:**
-
-- Add mailer locale doc [\#44](https://github.com/graphql-devise/graphql_devise/pull/44) ([aarona](https://github.com/aarona))
-
 ## [v0.9.1](https://github.com/graphql-devise/graphql_devise/tree/v0.9.1) (2019-12-26)
 
 [Full Changelog](https://github.com/graphql-devise/graphql_devise/compare/v0.9.0...v0.9.1)

data/README.md

@@ -287,6 +287,13 @@ You need to provide a hash to this option, and
 each key will be the name of the query on the schema. Also, the value provided must be a valid Resolver.
 This is also similar to what you can accomplish with
 [devise_scope](https://www.rubydoc.info/github/heartcombo/devise/master/ActionDispatch/Routing/Mapper%3Adevise_for).
+1. `public_introspection`: Defaults to `true`. When set to `false`, introspection fields (`__schema`, `__type`)
+will require authentication on the gem provided schema mounted on a separate route. Given that this schema never
+sets a `current_resource` in the GraphQL context, this effectively disables introspection on that route.
+Please note the gem provided schema is shared by all mounted resources, so setting this option to `false` on any
+mount will disable introspection for all of them. **This option only works if you are using the mount method.**
+If you are mounting the auth operations into your own schema, use the `public_introspection` option of the
+`SchemaPlugin` instead.
 
 Additional mutations and queries will be added to the schema regardless
 of other options you might have specified like `skip` or `only`.
@@ -575,6 +582,9 @@ standard Devise templates.
 `GraphqlDevise::Schema` extends from `GraphQL::Schema`, which allows it to utilize the `disable_introspection_entry_points` method. By calling this method, you can disable introspection entry points in your schema. You can read more about it
 [here](https://github.com/rmosolgo/graphql-ruby/blob/master/guides/schema/introspection.md#disabling-introspection).
 
+If you are mounting the auth schema on a separate route, you can also pass `public_introspection: false` to the
+`mount_graphql_devise_for` method. Check the [available mount options](#available-mount-options) section for more information.
+
 If you are using the schema plugin and prefer to make introspection queries available only to authenticated users, you can do so by modifying the `public_introspection` option of the plugin. Check the [plugin config section](#mounting-operations-into-your-own-schema) for more information.
 
 ## Changelog

data/config/routes.rb

@@ -4,7 +4,7 @@ GraphqlDevise::Engine.routes.draw do
   # Required as Devise forces routes to reload on eager_load
   unless GraphqlDevise.schema_loaded?
     if GraphqlDevise::Types::QueryType.fields.blank?
-      GraphqlDevise::Types::QueryType.field(:dummy, resolver: GraphqlDevise::Resolvers::Dummy)
+      GraphqlDevise::Types::QueryType.field(:dummy, resolver: GraphqlDevise::Resolvers::Dummy, authenticate: false)
     end
 
     if GraphqlDevise::Types::MutationType.fields.present?

data/lib/graphql_devise/mount_method/option_sanitizers/boolean_checker.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module GraphqlDevise
+  module MountMethod
+    module OptionSanitizers
+      class BooleanChecker
+        def initialize(default_boolean = nil)
+          @default_boolean = default_boolean
+        end
+
+        def call!(value, key)
+          return @default_boolean if value.nil?
+
+          unless value.instance_of?(TrueClass) || value.instance_of?(FalseClass)
+            raise InvalidMountOptionsError, "`#{key}` option has an invalid value. `true` or `false` expected."
+          end
+
+          value
+        end
+      end
+    end
+  end
+end

data/lib/graphql_devise/mount_method/supported_options.rb

@@ -9,7 +9,8 @@ module GraphqlDevise
       skip:                 OptionSanitizers::ArrayChecker.new(Symbol),
       additional_queries:   OptionSanitizers::HashChecker.new(GraphQL::Schema::Resolver),
       additional_mutations: OptionSanitizers::HashChecker.new(GraphQL::Schema::Mutation),
-      authenticatable_type: OptionSanitizers::ClassChecker.new(GraphQL::Schema::Member)
+      authenticatable_type: OptionSanitizers::ClassChecker.new(GraphQL::Schema::Member),
+      public_introspection: OptionSanitizers::BooleanChecker.new(true)
     }.freeze
   end
 end

data/lib/graphql_devise/route_mounter.rb

@@ -1,23 +1,36 @@
 module GraphqlDevise
   module RouteMounter
     def mount_graphql_devise_for(resource, options = {})
-      routing = 'graphql_devise/graphql#auth'
-
-      if (base_controller = options.delete(:base_controller))
-        new_controller = GraphqlDevise.const_set("#{resource}AuthController", Class.new(base_controller))
-        new_controller.include(SetUserByToken)
-        new_controller.include(AuthControllerMethods)
-
-        routing = "#{new_controller.to_s.underscore.gsub('_controller','')}#auth"
-      end
+      routing = auth_routing(resource, options.delete(:base_controller))
 
       clean_options = ResourceLoader.new(resource, options, true).call(
         Types::QueryType,
         Types::MutationType
       )
 
+      require_introspection_auth(clean_options)
+
       post clean_options.at, to: routing
       get  clean_options.at, to: routing
     end
+
+    private
+
+    def auth_routing(resource, base_controller)
+      return 'graphql_devise/graphql#auth' if base_controller.blank?
+
+      new_controller = GraphqlDevise.const_set("#{resource}AuthController", Class.new(base_controller))
+      new_controller.include(SetUserByToken)
+      new_controller.include(AuthControllerMethods)
+
+      "#{new_controller.to_s.underscore.gsub('_controller', '')}#auth"
+    end
+
+    def require_introspection_auth(clean_options)
+      return if clean_options.public_introspection || GraphqlDevise.introspection_plugin_applied?
+
+      Schema.use(SchemaPlugin.new(authenticate_default: true, public_introspection: false))
+      GraphqlDevise.introspection_plugin_applied!
+    end
   end
 end

data/lib/graphql_devise/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module GraphqlDevise
-  VERSION = '2.2.0'
+  VERSION = '2.3.0'
 end

data/lib/graphql_devise.rb

@@ -27,8 +27,9 @@ module GraphqlDevise
 
   class InvalidMountOptionsError < ::GraphqlDevise::Error; end
 
-  @schema_loaded     = false
-  @mounted_resources = []
+  @schema_loaded                = false
+  @mounted_resources            = []
+  @introspection_plugin_applied = false
 
   def self.schema_loaded?
     @schema_loaded
@@ -38,6 +39,14 @@ module GraphqlDevise
     @schema_loaded = true
   end
 
+  def self.introspection_plugin_applied?
+    @introspection_plugin_applied
+  end
+
+  def self.introspection_plugin_applied!
+    @introspection_plugin_applied = true
+  end
+
   def self.resource_mounted?(model)
     @mounted_resources.include?(model)
   end

data/spec/dummy/config/routes.rb

@@ -32,6 +32,12 @@ Rails.application.routes.draw do
     at:   '/api/v1/user_customer/graphql_auth'
   )
 
+  mount_graphql_devise_for(
+    User,
+    at:                   '/api/v1/no_introspection',
+    public_introspection: false
+  )
+
   get '/api/v1/graphql', to: 'api/v1/graphql#graphql'
   post '/api/v1/graphql', to: 'api/v1/graphql#graphql'
   post '/api/v1/interpreter', to: 'api/v1/graphql#interpreter'

data/spec/requests/queries/introspection_query_spec.rb

@@ -152,4 +152,42 @@ RSpec.describe 'Login Requests' do
       end
     end
   end
+
+  context 'when using the gem provided schema mounted on a route with public_introspection: false' do
+    it 'return an error' do
+      post_request('/api/v1/no_introspection')
+
+      expect(json_response[:data]).to be_nil
+      expect(json_response[:errors]).to contain_exactly(
+        hash_including(
+          message:    '__schema field requires authentication',
+          extensions: { code: 'AUTHENTICATION_ERROR' }
+        )
+      )
+    end
+
+    context 'when executing a regular operation on the same route' do
+      let(:password) { '12345678' }
+      let(:user)     { create(:user, :confirmed, password: password) }
+      let(:query) do
+        <<-GRAPHQL
+          mutation {
+            userLogin(
+              email: "#{user.email}",
+              password: "#{password}"
+            ) {
+              user { email }
+            }
+          }
+        GRAPHQL
+      end
+
+      it 'executes the operation successfully' do
+        post_request('/api/v1/no_introspection')
+
+        expect(json_response[:errors]).to be_nil
+        expect(json_response[:data][:userLogin][:user][:email]).to eq(user.email)
+      end
+    end
+  end
 end

data/spec/services/mount_method/option_sanitizers/boolean_checker_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe GraphqlDevise::MountMethod::OptionSanitizers::BooleanChecker do
+  describe '#call!' do
+    subject(:clean_value) { described_class.new(default_boolean).call!(value, key) }
+
+    let(:key)             { :any_option }
+    let(:default_boolean) { true }
+
+    context 'when no value is provided' do
+      let(:value) { nil }
+
+      it { is_expected.to eq(default_boolean) }
+    end
+
+    context 'when provided value is false' do
+      let(:value) { false }
+
+      it 'preserves the explicit false value instead of falling back to the default' do
+        expect(clean_value).to eq(false)
+      end
+    end
+
+    context 'when provided value is true' do
+      let(:value) { true }
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'when provided value is not a boolean' do
+      let(:value) { 'true' }
+
+      it 'raises an error' do
+        expect { clean_value }.to raise_error(GraphqlDevise::InvalidMountOptionsError, "`#{key}` option has an invalid value. `true` or `false` expected.")
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: graphql_devise
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.3.0
 platform: ruby
 authors:
 - Mario Celi
@@ -358,6 +358,7 @@ files:
 - lib/graphql_devise/mount_method/operation_sanitizer.rb
 - lib/graphql_devise/mount_method/option_sanitizer.rb
 - lib/graphql_devise/mount_method/option_sanitizers/array_checker.rb
+- lib/graphql_devise/mount_method/option_sanitizers/boolean_checker.rb
 - lib/graphql_devise/mount_method/option_sanitizers/class_checker.rb
 - lib/graphql_devise/mount_method/option_sanitizers/hash_checker.rb
 - lib/graphql_devise/mount_method/option_sanitizers/string_checker.rb
@@ -492,6 +493,7 @@ files:
 - spec/services/mount_method/operation_sanitizer_spec.rb
 - spec/services/mount_method/option_sanitizer_spec.rb
 - spec/services/mount_method/option_sanitizers/array_checker_spec.rb
+- spec/services/mount_method/option_sanitizers/boolean_checker_spec.rb
 - spec/services/mount_method/option_sanitizers/class_checker_spec.rb
 - spec/services/mount_method/option_sanitizers/hash_checker_spec.rb
 - spec/services/mount_method/option_sanitizers/string_checker_spec.rb
@@ -638,6 +640,7 @@ test_files:
 - spec/services/mount_method/operation_sanitizer_spec.rb
 - spec/services/mount_method/option_sanitizer_spec.rb
 - spec/services/mount_method/option_sanitizers/array_checker_spec.rb
+- spec/services/mount_method/option_sanitizers/boolean_checker_spec.rb
 - spec/services/mount_method/option_sanitizers/class_checker_spec.rb
 - spec/services/mount_method/option_sanitizers/hash_checker_spec.rb
 - spec/services/mount_method/option_sanitizers/string_checker_spec.rb