@constructive-io/graphql-server 5.20.6 → 5.20.8

package/protection/document-gate.js

@@ -0,0 +1,185 @@
+"use strict";
+/**
+ * Document gate — depth, cost, page size and introspection limits.
+ *
+ * A statement timeout stops a slow query; it does not stop a cheap-looking one
+ * that asks for a million rows across nested connections, because that request
+ * spends its budget in output size and memory rather than in a single statement.
+ * These bounds are therefore checked against the *document*, before any plan is
+ * executed.
+ *
+ * Cost is measured as the number of rows the operation can pull: a connection
+ * contributes its page size multiplied by the page sizes of every connection
+ * above it, so `users(first: 100) { posts(first: 100) }` costs 100 + 10,000
+ * rather than the 4 fields it looks like. A connection with no `first`/`last`
+ * is charged `ASSUMED_PAGE_SIZE`, since it is unbounded in principle.
+ *
+ * The walk is manual rather than `visitWithTypeInfo` because fragment spreads
+ * have to be followed (a document can hide its depth entirely inside
+ * fragments) and the visitor does not follow them.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enforceDocumentProtection = enforceDocumentProtection;
+const errors_1 = require("@constructive-io/errors");
+const express_context_1 = require("@constructive-io/express-context");
+const grafast_1 = require("grafast");
+const graphql_1 = require("graphql");
+/**
+ * Reject the request with an error the client can act on.
+ *
+ * The gate runs inside grafast's `prepareArgs`, before execution, where a
+ * plain throw is reported as an unknown handler failure: HTTP 500 with the
+ * `extensions` dropped. `SafeError` is grafserv's contract for "this message
+ * and these extensions are meant for the client", so the registered code,
+ * class and HTTP status survive the trip.
+ */
+const reject = (error) => {
+    throw new grafast_1.SafeError(error.message, {
+        ...error.toExtensions(),
+        statusCode: error.http
+    });
+};
+/** Arguments a connection field uses to size its page. */
+const PAGE_SIZE_ARGS = ['first', 'last'];
+/** A connection is any object type that carries Relay's `pageInfo`. */
+const isConnectionType = (type) => Boolean(type && (0, graphql_1.isObjectType)(type) && 'pageInfo' in type.getFields());
+/**
+ * Resolve a `first`/`last` argument to a number, whether it arrived as a
+ * literal or through a variable. Returns null when the field does not page.
+ */
+const requestedPageSize = (args, variableValues) => {
+    if (!args)
+        return null;
+    let size = null;
+    for (const arg of args) {
+        if (!PAGE_SIZE_ARGS.includes(arg.name.value))
+            continue;
+        const value = arg.value;
+        const resolved = value.kind === graphql_1.Kind.INT
+            ? Number(value.value)
+            : value.kind === graphql_1.Kind.VARIABLE
+                ? Number(variableValues[value.name.value])
+                : null;
+        if (resolved !== null && Number.isFinite(resolved)) {
+            size = size === null ? resolved : Math.max(size, resolved);
+        }
+    }
+    return size;
+};
+/**
+ * Walk one selection set, accumulating depth and cost.
+ *
+ * @param parentType - the type the selections are read from, or null when the
+ *   schema cannot resolve it (an invalid document; validation reports that, so
+ *   the walk only stops charging cost rather than raising its own error)
+ * @param depth - nesting level of these selections
+ * @param multiplier - rows the enclosing connections can return
+ */
+function walkSelectionSet(walk, selectionSet, parentType, depth, multiplier) {
+    if (depth > walk.maxDepth)
+        walk.maxDepth = depth;
+    if (depth > walk.protection.maxQueryDepth) {
+        reject(errors_1.errors.QUERY_TOO_DEEP({ depth, limit: walk.protection.maxQueryDepth }));
+    }
+    for (const selection of selectionSet.selections) {
+        if (selection.kind === graphql_1.Kind.FIELD) {
+            if (selection.name.value === '__schema' || selection.name.value === '__type') {
+                if (!walk.protection.enableIntrospection) {
+                    reject(errors_1.errors.INTROSPECTION_DISABLED());
+                }
+            }
+            const field = parentType && (0, graphql_1.isObjectType)(parentType)
+                ? parentType.getFields()[selection.name.value]
+                : undefined;
+            const fieldType = field ? (0, graphql_1.getNamedType)(field.type) : null;
+            const pageSize = requestedPageSize(selection.arguments, walk.variableValues);
+            if (pageSize !== null && pageSize > walk.protection.maxPageSize) {
+                reject(errors_1.errors.PAGE_SIZE_TOO_LARGE({
+                    requested: pageSize,
+                    limit: walk.protection.maxPageSize
+                }));
+            }
+            // A connection charges rows; every other field is free, so a wide but
+            // flat selection is not penalized for being wide.
+            let childMultiplier = multiplier;
+            if (isConnectionType(fieldType)) {
+                childMultiplier = multiplier * (pageSize ?? express_context_1.ASSUMED_PAGE_SIZE);
+                walk.cost += childMultiplier;
+                if (walk.cost > walk.protection.maxQueryCost) {
+                    reject(errors_1.errors.QUERY_TOO_COSTLY({
+                        cost: walk.cost,
+                        limit: walk.protection.maxQueryCost
+                    }));
+                }
+            }
+            if (selection.selectionSet) {
+                walkSelectionSet(walk, selection.selectionSet, fieldType, depth + 1, childMultiplier);
+            }
+            continue;
+        }
+        if (selection.kind === graphql_1.Kind.INLINE_FRAGMENT) {
+            const onType = selection.typeCondition
+                ? (0, graphql_1.typeFromAST)(walk.schema, selection.typeCondition)
+                : parentType;
+            // An inline fragment is not a level of nesting of its own.
+            walkSelectionSet(walk, selection.selectionSet, onType ?? null, depth, multiplier);
+            continue;
+        }
+        if (selection.kind === graphql_1.Kind.FRAGMENT_SPREAD) {
+            const name = selection.name.value;
+            // A document may spread the same fragment in sibling positions; only a
+            // cycle (a fragment reachable from itself) is refused, and the GraphQL
+            // validation rules already reject those with a proper error.
+            if (walk.activeFragments.has(name))
+                continue;
+            const fragment = walk.fragments[name];
+            if (!fragment)
+                continue;
+            const onType = (0, graphql_1.typeFromAST)(walk.schema, fragment.typeCondition);
+            walk.activeFragments.add(name);
+            try {
+                walkSelectionSet(walk, fragment.selectionSet, onType ?? null, depth, multiplier);
+            }
+            finally {
+                walk.activeFragments.delete(name);
+            }
+        }
+    }
+}
+/**
+ * Enforce the document-level bounds for one operation.
+ *
+ * Throws the matching public error on the first bound exceeded; returns what it
+ * measured otherwise, so a caller can log or expose it.
+ */
+function enforceDocumentProtection(schema, document, variableValues, protection, operationName) {
+    const fragments = {};
+    const operations = [];
+    for (const definition of document.definitions) {
+        if (definition.kind === graphql_1.Kind.FRAGMENT_DEFINITION)
+            fragments[definition.name.value] = definition;
+        else if (definition.kind === graphql_1.Kind.OPERATION_DEFINITION)
+            operations.push(definition);
+    }
+    const operation = operationName
+        ? operations.find((op) => op.name?.value === operationName)
+        : operations[0];
+    if (!operation)
+        return { depth: 0, cost: 0 };
+    const rootType = operation.operation === 'query'
+        ? schema.getQueryType()
+        : operation.operation === 'mutation'
+            ? schema.getMutationType()
+            : schema.getSubscriptionType();
+    const walk = {
+        schema,
+        fragments,
+        variableValues: variableValues ?? {},
+        protection,
+        activeFragments: new Set(),
+        maxDepth: 0,
+        cost: 0
+    };
+    walkSelectionSet(walk, operation.selectionSet, rootType ?? null, 1, 1);
+    return { depth: walk.maxDepth, cost: walk.cost };
+}

package/server.js

@@ -36,6 +36,7 @@ const debug_db_1 = require("./middleware/observability/debug-db");
 const debug_memory_1 = require("./middleware/observability/debug-memory");
 const guard_1 = require("./middleware/observability/guard");
 const request_logger_1 = require("./middleware/observability/request-logger");
+const request_protection_1 = require("./middleware/request-protection");
 const routing_1 = require("./middleware/routing");
 const log = new logger_1.Logger('server');
 /**
@@ -149,6 +150,9 @@ class Server {
             loaders: (0, express_context_1.createDefaultRegistry)(),
             routingSchema: (0, routing_1.getRoutingSchema)(effectiveOpts)
         }));
+        // Resolve the tenant's protection bounds before anything can spend budget
+        // on the request (and before the GraphQL handler reads them for pgSettings).
+        app.use((0, request_protection_1.createRequestProtectionMiddleware)());
         app.use((0, captcha_1.createCaptchaMiddleware)());
         // CSRF protection for cookie-authenticated requests
         // Skip CSRF for Bearer token auth (not vulnerable to CSRF) and anonymous requests