@constructive-io/graphql-server 5.25.1 → 5.25.2

package/esm/protection/document-gate.js

@@ -17,12 +17,15 @@
  * have to be followed (a document can hide its depth entirely inside
  * fragments) and the visitor does not follow them.
  *
- * Schema introspection (`__schema` / `__type`) is governed only by
- * `enableIntrospection`. Its selections are not walked: the introspection types
- * carry no connections, so there is nothing to cost, and the standard
- * introspection document nests a fixed `ofType` chain deeper than a sensible
- * tenant depth budget, so charging depth would make the budget decide whether
- * clients can introspect at all — a decision the dedicated switch already owns.
+ * Schema introspection (`__schema` / `__type`) is switched by
+ * `enableIntrospection` and bounded by its own fixed depth ceiling rather than
+ * the tenant's `maxQueryDepth`. The standard introspection document nests a
+ * fixed `ofType` chain deeper than a sensible tenant depth budget, so charging
+ * it against that budget would let the budget decide whether clients can
+ * introspect at all. It still needs a bound of its own, though: the
+ * introspection schema is recursive (`__Type.fields → __Field.type → __Type`),
+ * so an unbounded walk would let a client nest it arbitrarily. Introspection
+ * types carry no connections, so cost is naturally zero.
  */
 import { errors } from '@constructive-io/errors';
 import { ASSUMED_PAGE_SIZE } from '@constructive-io/express-context';
@@ -43,6 +46,14 @@ const reject = (error) => {
         statusCode: error.http
     });
 };
+/**
+ * Depth allowed inside a `__schema` / `__type` subtree, counted from the
+ * introspection field itself. graphql-js's `getIntrospectionQuery` with every
+ * option enabled reaches 13 (`types → fields → args → type → ofType×9`), so
+ * this leaves headroom for tooling without permitting the recursive
+ * `fields { type { fields { type … } } }` shape to run away.
+ */
+export const INTROSPECTION_MAX_DEPTH = 16;
 /** Arguments a connection field uses to size its page. */
 const PAGE_SIZE_ARGS = ['first', 'last'];
 /** A connection is any object type that carries Relay's `pageInfo`. */
@@ -78,20 +89,28 @@ const requestedPageSize = (args, variableValues) => {
  *   the walk only stops charging cost rather than raising its own error)
  * @param depth - nesting level of these selections
  * @param multiplier - rows the enclosing connections can return
+ * @param bound - which depth limit applies to these selections
  */
-function walkSelectionSet(walk, selectionSet, parentType, depth, multiplier) {
-    if (depth > walk.maxDepth)
-        walk.maxDepth = depth;
-    if (depth > walk.protection.maxQueryDepth) {
-        reject(errors.QUERY_TOO_DEEP({ depth, limit: walk.protection.maxQueryDepth }));
+function walkSelectionSet(walk, selectionSet, parentType, depth, multiplier, bound) {
+    if (bound.kind === 'query') {
+        if (depth > walk.maxDepth)
+            walk.maxDepth = depth;
+        if (depth > walk.protection.maxQueryDepth) {
+            reject(errors.QUERY_TOO_DEEP({ depth, limit: walk.protection.maxQueryDepth }));
+        }
+    }
+    else if (depth - bound.base > INTROSPECTION_MAX_DEPTH) {
+        reject(errors.QUERY_TOO_DEEP({ depth: depth - bound.base, limit: INTROSPECTION_MAX_DEPTH }));
     }
     for (const selection of selectionSet.selections) {
         if (selection.kind === Kind.FIELD) {
+            let childBound = bound;
             if (selection.name.value === '__schema' || selection.name.value === '__type') {
                 if (!walk.protection.enableIntrospection) {
                     reject(errors.INTROSPECTION_DISABLED());
                 }
-                continue;
+                if (bound.kind === 'query')
+                    childBound = { kind: 'introspection', base: depth };
             }
             const field = parentType && isObjectType(parentType)
                 ? parentType.getFields()[selection.name.value]
@@ -118,7 +137,7 @@ function walkSelectionSet(walk, selectionSet, parentType, depth, multiplier) {
                 }
             }
             if (selection.selectionSet) {
-                walkSelectionSet(walk, selection.selectionSet, fieldType, depth + 1, childMultiplier);
+                walkSelectionSet(walk, selection.selectionSet, fieldType, depth + 1, childMultiplier, childBound);
             }
             continue;
         }
@@ -127,7 +146,7 @@ function walkSelectionSet(walk, selectionSet, parentType, depth, multiplier) {
                 ? typeFromAST(walk.schema, selection.typeCondition)
                 : parentType;
             // An inline fragment is not a level of nesting of its own.
-            walkSelectionSet(walk, selection.selectionSet, onType ?? null, depth, multiplier);
+            walkSelectionSet(walk, selection.selectionSet, onType ?? null, depth, multiplier, bound);
             continue;
         }
         if (selection.kind === Kind.FRAGMENT_SPREAD) {
@@ -143,7 +162,7 @@ function walkSelectionSet(walk, selectionSet, parentType, depth, multiplier) {
             const onType = typeFromAST(walk.schema, fragment.typeCondition);
             walk.activeFragments.add(name);
             try {
-                walkSelectionSet(walk, fragment.selectionSet, onType ?? null, depth, multiplier);
+                walkSelectionSet(walk, fragment.selectionSet, onType ?? null, depth, multiplier, bound);
             }
             finally {
                 walk.activeFragments.delete(name);
@@ -185,6 +204,6 @@ export function enforceDocumentProtection(schema, document, variableValues, prot
         maxDepth: 0,
         cost: 0
     };
-    walkSelectionSet(walk, operation.selectionSet, rootType ?? null, 1, 1);
+    walkSelectionSet(walk, operation.selectionSet, rootType ?? null, 1, 1, { kind: 'query' });
     return { depth: walk.maxDepth, cost: walk.cost };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.25.1",
+  "version": "5.25.2",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -43,19 +43,19 @@
   "dependencies": {
     "@agentic-kit/ollama": "2.14.0",
     "@constructive-io/csrf": "^0.29.1",
-    "@constructive-io/errors": "^0.14.0",
-    "@constructive-io/express-context": "^0.31.0",
-    "@constructive-io/graphql-env": "^3.32.1",
-    "@constructive-io/graphql-types": "^3.31.1",
+    "@constructive-io/errors": "^0.16.1",
+    "@constructive-io/express-context": "^0.31.1",
+    "@constructive-io/graphql-env": "^3.32.2",
+    "@constructive-io/graphql-types": "^3.31.2",
     "@constructive-io/llm-env": "^0.14.1",
-    "@constructive-io/query-builder": "^3.13.6",
-    "@constructive-io/s3-utils": "^2.33.0",
+    "@constructive-io/query-builder": "^3.13.7",
+    "@constructive-io/s3-utils": "^2.33.1",
     "@constructive-io/url-domains": "^2.30.1",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
-    "@pgpmjs/env": "^2.43.5",
+    "@pgpmjs/env": "^2.43.6",
     "@pgpmjs/logger": "^2.25.1",
-    "@pgpmjs/server-utils": "^3.27.5",
-    "@pgpmjs/types": "^2.53.3",
+    "@pgpmjs/server-utils": "^3.27.6",
+    "@pgpmjs/types": "^2.53.4",
     "cors": "^2.8.6",
     "deepmerge": "^4.3.1",
     "express": "^5.2.1",
@@ -64,16 +64,16 @@
     "grafserv": "1.0.1",
     "graphile-build": "5.1.1",
     "graphile-build-pg": "5.1.3",
-    "graphile-cache": "^4.12.5",
+    "graphile-cache": "^4.12.6",
     "graphile-config": "1.1.0",
-    "graphile-function-bindings": "^1.14.6",
-    "graphile-settings": "^6.21.8",
+    "graphile-function-bindings": "^1.14.7",
+    "graphile-settings": "^6.21.9",
     "graphile-utils": "5.0.3",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
     "lru-cache": "^11.2.7",
     "pg": "^8.21.0",
-    "pg-cache": "^3.27.5",
+    "pg-cache": "^3.27.6",
     "pg-env": "^1.31.1",
     "pg-query-context": "^2.30.1",
     "pg-sql2": "5.0.1",
@@ -90,11 +90,11 @@
     "@types/request-ip": "^0.0.41",
     "@types/supertest": "^7.2.1",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "5.14.6",
+    "graphile-test": "5.14.7",
     "makage": "^0.8.0",
     "nodemon": "^3.1.14",
     "supertest": "^7.2.2",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "164f6e481961196e681eb3dee9e5f9ebcb8fb834"
+  "gitHead": "9bba983b38395277e0400294aaa380e586b049d4"
 }

package/protection/document-gate.d.ts

@@ -17,15 +17,26 @@
  * have to be followed (a document can hide its depth entirely inside
  * fragments) and the visitor does not follow them.
  *
- * Schema introspection (`__schema` / `__type`) is governed only by
- * `enableIntrospection`. Its selections are not walked: the introspection types
- * carry no connections, so there is nothing to cost, and the standard
- * introspection document nests a fixed `ofType` chain deeper than a sensible
- * tenant depth budget, so charging depth would make the budget decide whether
- * clients can introspect at all — a decision the dedicated switch already owns.
+ * Schema introspection (`__schema` / `__type`) is switched by
+ * `enableIntrospection` and bounded by its own fixed depth ceiling rather than
+ * the tenant's `maxQueryDepth`. The standard introspection document nests a
+ * fixed `ofType` chain deeper than a sensible tenant depth budget, so charging
+ * it against that budget would let the budget decide whether clients can
+ * introspect at all. It still needs a bound of its own, though: the
+ * introspection schema is recursive (`__Type.fields → __Field.type → __Type`),
+ * so an unbounded walk would let a client nest it arbitrarily. Introspection
+ * types carry no connections, so cost is naturally zero.
  */
 import { type RequestProtection } from '@constructive-io/express-context';
 import type { DocumentNode, GraphQLSchema } from 'graphql';
+/**
+ * Depth allowed inside a `__schema` / `__type` subtree, counted from the
+ * introspection field itself. graphql-js's `getIntrospectionQuery` with every
+ * option enabled reaches 13 (`types → fields → args → type → ofType×9`), so
+ * this leaves headroom for tooling without permitting the recursive
+ * `fields { type { fields { type … } } }` shape to run away.
+ */
+export declare const INTROSPECTION_MAX_DEPTH = 16;
 export interface DocumentAnalysis {
     /** Deepest field nesting in the operation. */
     depth: number;

package/protection/document-gate.js

@@ -18,14 +18,18 @@
  * have to be followed (a document can hide its depth entirely inside
  * fragments) and the visitor does not follow them.
  *
- * Schema introspection (`__schema` / `__type`) is governed only by
- * `enableIntrospection`. Its selections are not walked: the introspection types
- * carry no connections, so there is nothing to cost, and the standard
- * introspection document nests a fixed `ofType` chain deeper than a sensible
- * tenant depth budget, so charging depth would make the budget decide whether
- * clients can introspect at all — a decision the dedicated switch already owns.
+ * Schema introspection (`__schema` / `__type`) is switched by
+ * `enableIntrospection` and bounded by its own fixed depth ceiling rather than
+ * the tenant's `maxQueryDepth`. The standard introspection document nests a
+ * fixed `ofType` chain deeper than a sensible tenant depth budget, so charging
+ * it against that budget would let the budget decide whether clients can
+ * introspect at all. It still needs a bound of its own, though: the
+ * introspection schema is recursive (`__Type.fields → __Field.type → __Type`),
+ * so an unbounded walk would let a client nest it arbitrarily. Introspection
+ * types carry no connections, so cost is naturally zero.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTROSPECTION_MAX_DEPTH = void 0;
 exports.enforceDocumentProtection = enforceDocumentProtection;
 const errors_1 = require("@constructive-io/errors");
 const express_context_1 = require("@constructive-io/express-context");
@@ -46,6 +50,14 @@ const reject = (error) => {
         statusCode: error.http
     });
 };
+/**
+ * Depth allowed inside a `__schema` / `__type` subtree, counted from the
+ * introspection field itself. graphql-js's `getIntrospectionQuery` with every
+ * option enabled reaches 13 (`types → fields → args → type → ofType×9`), so
+ * this leaves headroom for tooling without permitting the recursive
+ * `fields { type { fields { type … } } }` shape to run away.
+ */
+exports.INTROSPECTION_MAX_DEPTH = 16;
 /** Arguments a connection field uses to size its page. */
 const PAGE_SIZE_ARGS = ['first', 'last'];
 /** A connection is any object type that carries Relay's `pageInfo`. */
@@ -81,20 +93,28 @@ const requestedPageSize = (args, variableValues) => {
  *   the walk only stops charging cost rather than raising its own error)
  * @param depth - nesting level of these selections
  * @param multiplier - rows the enclosing connections can return
+ * @param bound - which depth limit applies to these selections
  */
-function walkSelectionSet(walk, selectionSet, parentType, depth, multiplier) {
-    if (depth > walk.maxDepth)
-        walk.maxDepth = depth;
-    if (depth > walk.protection.maxQueryDepth) {
-        reject(errors_1.errors.QUERY_TOO_DEEP({ depth, limit: walk.protection.maxQueryDepth }));
+function walkSelectionSet(walk, selectionSet, parentType, depth, multiplier, bound) {
+    if (bound.kind === 'query') {
+        if (depth > walk.maxDepth)
+            walk.maxDepth = depth;
+        if (depth > walk.protection.maxQueryDepth) {
+            reject(errors_1.errors.QUERY_TOO_DEEP({ depth, limit: walk.protection.maxQueryDepth }));
+        }
+    }
+    else if (depth - bound.base > exports.INTROSPECTION_MAX_DEPTH) {
+        reject(errors_1.errors.QUERY_TOO_DEEP({ depth: depth - bound.base, limit: exports.INTROSPECTION_MAX_DEPTH }));
     }
     for (const selection of selectionSet.selections) {
         if (selection.kind === graphql_1.Kind.FIELD) {
+            let childBound = bound;
             if (selection.name.value === '__schema' || selection.name.value === '__type') {
                 if (!walk.protection.enableIntrospection) {
                     reject(errors_1.errors.INTROSPECTION_DISABLED());
                 }
-                continue;
+                if (bound.kind === 'query')
+                    childBound = { kind: 'introspection', base: depth };
             }
             const field = parentType && (0, graphql_1.isObjectType)(parentType)
                 ? parentType.getFields()[selection.name.value]
@@ -121,7 +141,7 @@ function walkSelectionSet(walk, selectionSet, parentType, depth, multiplier) {
                 }
             }
             if (selection.selectionSet) {
-                walkSelectionSet(walk, selection.selectionSet, fieldType, depth + 1, childMultiplier);
+                walkSelectionSet(walk, selection.selectionSet, fieldType, depth + 1, childMultiplier, childBound);
             }
             continue;
         }
@@ -130,7 +150,7 @@ function walkSelectionSet(walk, selectionSet, parentType, depth, multiplier) {
                 ? (0, graphql_1.typeFromAST)(walk.schema, selection.typeCondition)
                 : parentType;
             // An inline fragment is not a level of nesting of its own.
-            walkSelectionSet(walk, selection.selectionSet, onType ?? null, depth, multiplier);
+            walkSelectionSet(walk, selection.selectionSet, onType ?? null, depth, multiplier, bound);
             continue;
         }
         if (selection.kind === graphql_1.Kind.FRAGMENT_SPREAD) {
@@ -146,7 +166,7 @@ function walkSelectionSet(walk, selectionSet, parentType, depth, multiplier) {
             const onType = (0, graphql_1.typeFromAST)(walk.schema, fragment.typeCondition);
             walk.activeFragments.add(name);
             try {
-                walkSelectionSet(walk, fragment.selectionSet, onType ?? null, depth, multiplier);
+                walkSelectionSet(walk, fragment.selectionSet, onType ?? null, depth, multiplier, bound);
             }
             finally {
                 walk.activeFragments.delete(name);
@@ -188,6 +208,6 @@ function enforceDocumentProtection(schema, document, variableValues, protection,
         maxDepth: 0,
         cost: 0
     };
-    walkSelectionSet(walk, operation.selectionSet, rootType ?? null, 1, 1);
+    walkSelectionSet(walk, operation.selectionSet, rootType ?? null, 1, 1, { kind: 'query' });
     return { depth: walk.maxDepth, cost: walk.cost };
 }