rubocop-graphql 0.19.0 → 1.5.4

data/lib/rubocop/cop/graphql/not_authorized_node_type.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module GraphQL
+      # Detects types that implement Node interface and not have `.authorized?` check.
+      # Such types can be fetched by ID and therefore should have type level check to
+      # avoid accidental information exposure.
+      #
+      # If `.authorized?` is defined in a parent class, you can add parent to the "SafeBaseClasses"
+      # to avoid offenses in children.
+      #
+      # This cop also checks the `can_can_action` or `pundit_role` methods that
+      # can be used as part of the Ruby GraphQL Pro.
+      #
+      # @example
+      #   # good
+      #
+      #   class UserType < BaseType
+      #     implements GraphQL::Types::Relay::Node
+      #
+      #     field :uuid, ID, null: false
+      #
+      #     def self.authorized?(object, context)
+      #       super && object.owner == context[:viewer]
+      #     end
+      #   end
+      #
+      #   # good
+      #
+      #   class UserType < BaseType
+      #     implements GraphQL::Types::Relay::Node
+      #
+      #     field :uuid, ID, null: false
+      #
+      #     class << self
+      #       def authorized?(object, context)
+      #         super && object.owner == context[:viewer]
+      #       end
+      #     end
+      #   end
+      #
+      #   # good
+      #
+      #   class UserType < BaseType
+      #     implements GraphQL::Types::Relay::Node
+      #
+      #     pundit_role :staff
+      #
+      #     field :uuid, ID, null: false
+      #   end
+      #
+      #   # good
+      #
+      #   class UserType < BaseType
+      #     implements GraphQL::Types::Relay::Node
+      #
+      #     can_can_action :staff
+      #
+      #     field :uuid, ID, null: false
+      #   end
+      #
+      #   # bad
+      #
+      #   class UserType < BaseType
+      #     implements GraphQL::Types::Relay::Node
+      #
+      #     field :uuid, ID, null: false
+      #   end
+      #
+      class NotAuthorizedNodeType < Base
+        MSG = ".authorized? should be defined for types implementing Node interface."
+
+        # @!method implements_node_type?(node)
+        def_node_matcher :implements_node_type?, <<~PATTERN
+          `(send nil? :implements
+            (const
+              (const
+                (const
+                  (const nil? :GraphQL) :Types) :Relay) :Node))
+        PATTERN
+
+        # @!method has_can_can_action?(node)
+        def_node_matcher :has_can_can_action?, <<~PATTERN
+          `(send nil? :can_can_action {nil_type? sym_type?})
+        PATTERN
+
+        # @!method has_pundit_role?(node)
+        def_node_matcher :has_pundit_role?, <<~PATTERN
+          `(send nil? :pundit_role {nil_type? sym_type?})
+        PATTERN
+
+        # @!method has_authorized_method?(node)
+        def_node_matcher :has_authorized_method?, <<~PATTERN
+          {`(:defs (:self) :authorized? ...) | `(:sclass (:self) `(:def :authorized? ...))}
+        PATTERN
+
+        def on_module(node)
+          @parent_modules ||= []
+          @parent_modules << node.child_nodes[0].const_name
+        end
+
+        def on_class(node)
+          @parent_modules ||= []
+          return if possible_parent_classes(node).any? { |klass| ignored_class?(klass) }
+
+          @parent_modules << node.child_nodes[0].const_name
+
+          add_offense(node) if implements_node_type?(node) && !implements_authorization?(node)
+        end
+
+        private
+
+        def implements_authorization?(node)
+          has_authorized_method?(node) || has_can_can_action?(node) || has_pundit_role?(node)
+        end
+
+        def possible_parent_classes(node)
+          klass = node.child_nodes[1].const_name
+
+          return [] if klass.nil?
+          return [klass] if node.child_nodes[1].absolute?
+
+          parent_module = "#{@parent_modules.join('::')}::"
+          [klass, parent_module + klass]
+        end
+
+        def ignored_class?(klass)
+          cop_config["SafeBaseClasses"].include?(klass)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/graphql/ordered_arguments.rb

@@ -52,26 +52,25 @@ module RuboCop
         extend AutoCorrector
 
         include RuboCop::GraphQL::SwapRange
+        include RuboCop::GraphQL::CompareOrder
 
         MSG = "Arguments should be sorted in an alphabetical order within their section. " \
               "Field `%<current>s` should appear before `%<previous>s`."
 
         def on_class(node)
-          declarations_with_blocks = argument_declarations_with_blocks(node)
-          declarations_without_blocks = argument_declarations_without_blocks(node)
-
-          argument_declarations = declarations_without_blocks.map do |node|
-            arg_name = argument_name(node)
-            same_arg_with_block_declaration = declarations_with_blocks.find do |dec|
-              argument_name(dec) == arg_name
+          # Do a single pass over descendants to get argument declarations
+          # with and without a block.
+          argument_declarations = argument_declaration(node).map do |declaration|
+            if argument_declaration_with_block?(declaration)
+              declaration.parent
+            else
+              declaration
             end
-
-            same_arg_with_block_declaration || node
           end
 
           argument_declarations.each_cons(2) do |previous, current|
             next unless consecutive_lines(previous, current)
-            next if argument_name(current) >= argument_name(previous)
+            next if correct_order?(argument_name(previous), argument_name(current))
 
             register_offense(previous, current)
           end
@@ -79,6 +78,10 @@ module RuboCop
 
         private
 
+        def argument_declaration_with_block?(node)
+          node.parent&.block_type? && node.parent.send_node == node
+        end
+
         def register_offense(previous, current)
           message = format(
             self.class::MSG,
@@ -101,19 +104,10 @@ module RuboCop
           previous.source_range.last_line == current.source_range.first_line - 1
         end
 
-        # @!method argument_declarations_without_blocks(node)
-        def_node_search :argument_declarations_without_blocks, <<~PATTERN
+        # @!method argument_declaration(node)
+        def_node_search :argument_declaration, <<~PATTERN
           (send nil? :argument (:sym _) ...)
         PATTERN
-
-        # @!method argument_declarations_with_blocks(node)
-        def_node_search :argument_declarations_with_blocks, <<~PATTERN
-          (block
-            (send nil? :argument
-              (:sym _)
-              ...)
-            ...)
-        PATTERN
       end
     end
   end

data/lib/rubocop/cop/graphql/ordered_fields.rb

@@ -34,15 +34,25 @@ module RuboCop
         extend AutoCorrector
 
         include RuboCop::GraphQL::SwapRange
+        include RuboCop::GraphQL::CompareOrder
 
         MSG = "Fields should be sorted in an alphabetical order within their "\
               "section. "\
               "Field `%<current>s` should appear before `%<previous>s`."
 
+        # @!method field_declarations(node)
+        def_node_search :field_declarations, <<~PATTERN
+          {
+            (send nil? :field (:sym _) ...)
+            (block
+              (send nil? :field (:sym _) ...) ...)
+          }
+        PATTERN
+
         def on_class(node)
           field_declarations(node).each_cons(2) do |previous, current|
-            next unless consecutive_lines(previous, current)
-            next if field_name(current) >= field_name(previous)
+            next unless consecutive_fields(previous, current)
+            next if correct_order?(field_name(previous), field_name(current))
 
             register_offense(previous, current)
           end
@@ -50,6 +60,14 @@ module RuboCop
 
         private
 
+        def consecutive_fields(previous, current)
+          return true if cop_config["Groups"] == false
+
+          (previous.source_range.last_line == current.source_range.first_line - 1) ||
+            (previous.parent.block_type? &&
+               previous.parent.last_line == current.source_range.first_line - 1)
+        end
+
         def register_offense(previous, current)
           message = format(
             self.class::MSG,
@@ -69,19 +87,6 @@ module RuboCop
             node.first_argument.value.to_s
           end
         end
-
-        def consecutive_lines(previous, current)
-          previous.source_range.last_line == current.source_range.first_line - 1
-        end
-
-        # @!method field_declarations(node)
-        def_node_search :field_declarations, <<~PATTERN
-          {
-            (send nil? :field (:sym _) ...)
-            (block
-              (send nil? :field (:sym _) ...) ...)
-          }
-        PATTERN
       end
     end
   end

data/lib/rubocop/cop/graphql/prepare_method.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+require "rubocop"
+
+module RuboCop
+  module Cop
+    module GraphQL
+      # Checks that GraphQL Argument definitions prepare arguments use String or constants
+      # instead of `prepare: CONST_REF`
+      # This allows better Sorbet typing.
+      #
+      # Preference is given to an input object declaring a `def prepare(...); end` method
+      #
+      # @example
+      #   # bad
+      #   PREPARE = ->(input, context) { ... }
+      #
+      #   argument :input, prepare: PREPARE
+      #
+      #   # good
+      #   def input_prepare(input); ...; end
+      #
+      #   argument :input, prepare: :input_prepare
+      #
+      class PrepareMethod < RuboCop::Cop::Base
+        extend AutoCorrector
+        GENERAL_MSG = "Avoid using prepare lambdas, use prepare: :method_name or "\
+          "prepare: \"method_name\" instead."
+        STRING_MSG = "Avoid using prepare lambdas, use prepare: \"method_name\" instead."
+        PREFER_STRING_MSG = "Avoid using prepare symbols, use prepare: \"%s\" instead."
+        SYMBOL_MSG = "Avoid using prepare lambdas, use prepare: :method_name instead."
+        PREFER_SYMBOL_MSG = "Avoid using prepare string, use prepare: :%s instead."
+
+        ARGUMENT_METHODS = Set[:argument, :public_argument].freeze
+
+        # @!method graphql_argument_with_prepare_block?(node)
+        def_node_matcher :graphql_argument_with_prepare_block?, <<~PATTERN
+          (send nil? ARGUMENT_METHODS ... (hash ... (pair (sym :prepare) $({ const | block } ...) )))
+        PATTERN
+
+        # @!method prepare_method_string_name?(node)
+        def_node_matcher :prepare_method_string_name?, <<~PATTERN
+          (send nil? ARGUMENT_METHODS ... (hash ... (pair (sym :prepare) $(str ...) )))
+        PATTERN
+
+        # @!method prepare_method_symbol_name?(node)
+        def_node_matcher :prepare_method_symbol_name?, <<~PATTERN
+          (send nil? ARGUMENT_METHODS ... (hash ... (pair (sym :prepare) $(sym ...) )))
+        PATTERN
+
+        def on_send(node)
+          type = cop_config["EnforcedStyle"]
+
+          message = case type
+                    when "symbol"
+                      SYMBOL_MSG
+                    when "string"
+                      STRING_MSG
+                    else
+                      GENERAL_MSG
+                    end
+          graphql_argument_with_prepare_block?(node) do |prepare_definition|
+            add_offense(prepare_definition, message: message)
+          end
+
+          if type == "symbol"
+            prepare_method_string_name?(node) do |prepare_definition|
+              method_name = prepare_definition.value
+              add_offense(prepare_definition,
+                          message: format(PREFER_SYMBOL_MSG, method_name)) do |corrector|
+                autocorrect(corrector, node, "\"#{method_name}\"", ":#{method_name}")
+              end
+            end
+          elsif type == "string"
+            prepare_method_symbol_name?(node) do |prepare_definition|
+              method_name = prepare_definition.value
+              add_offense(prepare_definition,
+                          message: format(PREFER_STRING_MSG, method_name)) do |corrector|
+                autocorrect(corrector, node, ":#{method_name}", "\"#{method_name}\"")
+              end
+            end
+          end
+        end
+
+        private
+
+        def autocorrect(corrector, node, original_method_name, new_method_name)
+          new_source = node.source.sub("prepare: #{original_method_name}",
+                                       "prepare: #{new_method_name}")
+          corrector.replace(node, new_source)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/graphql/resolver_method_length.rb

@@ -8,7 +8,6 @@ module RuboCop
       #
       # The maximum allowed length is configurable using the Max option.
       class ResolverMethodLength < Base
-        include RuboCop::Cop::ConfigurableMax
         include RuboCop::Cop::CodeLength
 
         MSG = "ResolverMethod has too many lines. [%<total>d/%<max>d]"
@@ -23,9 +22,11 @@ module RuboCop
           return if excluded_methods.include?(String(node.method_name))
 
           if field_is_defined?(node)
-            length = code_length(node)
+            return if node.line_count <= max_length
 
-            return unless length > max_length
+            calculator = build_code_length_calculator(node)
+            length = calculator.calculate
+            return if length <= max_length
 
             add_offense(node, message: message(length))
           end
@@ -34,10 +35,6 @@ module RuboCop
 
         private
 
-        def code_length(node)
-          node.source.lines[1..-2].count { |line| !irrelevant_line(line) }
-        end
-
         def field_is_defined?(node)
           node.parent
               .children

data/lib/rubocop/cop/graphql/unnecessary_argument_camelize.rb

@@ -10,27 +10,33 @@ module RuboCop
       #
       #   class UserType < BaseType
       #     field :name, String, "Name of the user", null: true do
-      #       argument :filter, String, required: false, camelize: false
+      #       argument :filter, String, required: false
       #     end
       #   end
       #
       #   # good
       #
       #   class UserType < BaseType
-      #     argument :filter, String, required: false, camelize: false
+      #     argument :filter, String, required: false
+      #   end
+      #
+      #   # good
+      #
+      #   class UserType < BaseType
+      #     argument :email_filter, String, required: false, camelize: true
       #   end
       #
       #  # bad
       #
       #   class UserType < BaseType
-      #     argument :filter, String, required: false
+      #     argument :filter, String, required: false, camelize: false
       #   end
       #
       #  # bad
       #
       #   class UserType < BaseType
       #     field :name, String, "Name of the user", null: true do
-      #       argument :filter, String, required: false
+      #       argument :filter, String, required: false, camelize: false
       #     end
       #   end
       #
@@ -38,6 +44,7 @@ module RuboCop
         include RuboCop::GraphQL::NodePattern
 
         MSG = "Unnecessary argument camelize"
+        RESTRICT_ON_SEND = %i[argument].freeze
 
         def on_send(node)
           return unless argument?(node)

data/lib/rubocop/cop/graphql/unnecessary_field_alias.rb

@@ -3,32 +3,56 @@
 module RuboCop
   module Cop
     module GraphQL
-      #  This cop checks if a field has an unnecessary alias.
+      #  This cop prevents defining an unnecessary alias, method, or resolver_method.
       #
       # @example
       #   # good
       #
-      #   class UserType < BaseType
-      #     field :name, String, "Name of the user", null: true, alias: :real_name
-      #   end
+      #   field :name, String, "Name of the user", null: true, alias: :real_name
+      #   field :name, String, "Name of the user", null: true, method: :real_name
+      #   field :name, String, "Name of the user", null: true, resolver_method: :real_name
+      #   field :name, String, "Name of the user", null: true, hash_key: :real_name
       #
       #   # bad
       #
-      #   class UserType < BaseType
-      #     field :name, "Name of the user" String, null: true, alias: :name
-      #   end
+      #   field :name, "Name of the user" String, null: true, alias: :name
+      #   field :name, String, "Name of the user", null: true, method: :name
+      #   field :name, String, "Name of the user", null: true, resolver_method: :name
+      #   field :name, String, "Name of the user", null: true, hash_key: :name
       #
       class UnnecessaryFieldAlias < Base
+        extend AutoCorrector
         include RuboCop::GraphQL::NodePattern
 
-        MSG = "Unnecessary field alias"
+        MSG = "Unnecessary :%<kwarg>s configured"
+        RESTRICT_ON_SEND = %i[field].freeze
 
         def on_send(node)
           return unless field_definition?(node)
 
           field = RuboCop::GraphQL::Field.new(node)
 
-          add_offense(node) if field.name == field.kwargs.alias
+          if (unnecessary_kwarg = validate_kwargs(field))
+            message = format(self.class::MSG, kwarg: unnecessary_kwarg)
+            add_offense(node, message: message) do |corrector|
+              kwarg_node = node.last_argument.pairs.find do |pair|
+                pair.key.value == unnecessary_kwarg.to_sym
+              end
+              corrector.remove_preceding(kwarg_node, 2)
+              corrector.remove(kwarg_node)
+            end
+          end
+        end
+
+        private
+
+        def validate_kwargs(field) # rubocop:disable Metrics/CyclomaticComplexity
+          case field.name
+          when field.kwargs.alias then "alias"
+          when field.kwargs.method&.value&.value then "method"
+          when field.kwargs.resolver_method_name then "resolver_method"
+          when field.kwargs.hash_key&.value&.value then "hash_key"
+          end
         end
       end
     end

data/lib/rubocop/cop/graphql/unnecessary_field_camelize.rb

@@ -22,6 +22,7 @@ module RuboCop
         include RuboCop::GraphQL::NodePattern
 
         MSG = "Unnecessary field camelize"
+        RESTRICT_ON_SEND = %i[field].freeze
 
         def on_send(node)
           return unless field_definition?(node)

data/lib/rubocop/cop/graphql/unused_argument.rb

@@ -132,7 +132,7 @@ module RuboCop
 
           add_offense(node, message: message) do |corrector|
             if node.arguments?
-              corrector.insert_after(arg_end(node.arguments.last), ", #{unresolved_args_source}")
+              corrector.insert_after(arg_end(node.last_argument), ", #{unresolved_args_source}")
             else
               corrector.insert_after(method_name(node), "(#{unresolved_args_source})")
             end
@@ -144,7 +144,7 @@ module RuboCop
         end
 
         def arg_end(node)
-          node.loc.expression.end
+          node.source_range.end
         end
 
         def inferred_arg_name(name_as_string)
@@ -156,7 +156,7 @@ module RuboCop
                           .sub(/([^s])$/, "\\1s")
                           .to_sym
           else
-            name
+            name_as_string.to_sym
           end
         end
 
@@ -186,8 +186,7 @@ module RuboCop
 
         # @!method resolve_method_definition(node)
         def_node_search :resolve_method_definition, <<~PATTERN
-          (def {:resolve | :authorized?}
-            (args ...) ...)
+          (def {:resolve | :authorized?} (args ...) ...)
         PATTERN
       end
     end

data/lib/rubocop/cop/graphql_cops.rb

@@ -11,12 +11,17 @@ require_relative "graphql/field_hash_key"
 require_relative "graphql/field_method"
 require_relative "graphql/field_name"
 require_relative "graphql/field_uniqueness"
+require_relative "graphql/graphql_name"
 require_relative "graphql/legacy_dsl"
+require_relative "graphql/max_complexity_schema"
+require_relative "graphql/max_depth_schema"
 require_relative "graphql/multiple_field_definitions"
+require_relative "graphql/not_authorized_node_type"
 require_relative "graphql/resolver_method_length"
 require_relative "graphql/object_description"
 require_relative "graphql/ordered_arguments"
 require_relative "graphql/ordered_fields"
+require_relative "graphql/prepare_method"
 require_relative "graphql/unused_argument"
 require_relative "graphql/unnecessary_argument_camelize"
 require_relative "graphql/unnecessary_field_alias"

data/lib/rubocop/graphql/argument/block.rb

@@ -12,7 +12,7 @@ module RuboCop
           (block
             (send nil? :argument ...)
             (args ...)
-            $...
+            {(begin $...)|$...}
           )
         PATTERN
 

data/lib/rubocop/graphql/compare_order.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module GraphQL
+    module CompareOrder
+      def correct_order?(previous, current)
+        # If Order config is provided, we should use it to determine the order
+        # Else, we should use alphabetical order
+        # e.g. "Order" => [
+        #   "id",
+        #   "/^id_.*$/",
+        #   "/^.*_id$/",
+        #   "everything-else",
+        #   "/^(created|updated)_at$/"
+        # ]
+        if (order = cop_config["Order"])
+          # For each of previous and current, we should find the first matching order,
+          # checking 'everything-else' last
+          # If the order is the same, we should use alphabetical order
+          # If the order is different, we should use the order
+          previous_order = order_index(previous, order)
+          current_order = order_index(current, order)
+
+          if previous_order == current_order
+            previous <= current
+          else
+            previous_order < current_order
+          end
+        else
+          previous <= current
+        end
+      end
+
+      def order_index(field, order)
+        everything_else_index = order.length
+
+        order.each_with_index do |order_item, index|
+          if order_item == "everything-else"
+            everything_else_index = index
+          elsif order_item.start_with?("/") && order_item.end_with?("/") # is regex-like?
+            return index if field.match?(order_item[1..-2])
+          elsif field == order_item
+            return index
+          end
+        end
+
+        everything_else_index
+      end
+    end
+  end
+end

data/lib/rubocop/graphql/ext/snake_case.rb

@@ -4,7 +4,7 @@ module RuboCop
   module GraphQL
     module Ext
       module SnakeCase
-        SNAKE_CASE = /^[\da-z_]+[!?=]?$/.freeze
+        SNAKE_CASE = /^[\da-z_]+[!?=]?$/
 
         refine Symbol do
           def snake_case?

data/lib/rubocop/graphql/field.rb

@@ -33,7 +33,7 @@ module RuboCop
 
       # @!method field_description(node)
       def_node_matcher :field_description, <<~PATTERN
-        (send nil? :field _ _ (:str $_) ...)
+        (send nil? :field _ _ {(:str $_)|(:dstr $...)} ...)
       PATTERN
 
       attr_reader :node
@@ -84,7 +84,10 @@ module RuboCop
       end
 
       def root_node?(node)
-        node.parent.nil? || node.parent.module_type? || root_with_siblings?(node.parent)
+        node.parent.nil? ||
+          node.module_type? && node.children.none?(&:module_type?) ||
+          node.class_type? ||
+          root_with_siblings?(node.parent)
       end
 
       def root_with_siblings?(node)