@graphoria/server 0.2.2 → 0.3.0

package/src/configuration/crossReferences.ts

@@ -0,0 +1,340 @@
+import { isString } from "es-toolkit/compat";
+
+import type { Configuration } from "../types/configuration";
+import type { ProcedureResolver, TableResolver } from "../types/db";
+
+import { FILTER_OPERATORS } from "../config/types/auth";
+import { columnFieldName } from "../databases/transformers/graphqlName";
+
+/**
+ * Everything the configuration is allowed to point at that only exists once the
+ * databases have been introspected.
+ */
+export type KnownEntities = {
+  tables: TableResolver[];
+  storedProcedures: ProcedureResolver[];
+  /**
+   * Every table name a database reported, keyed by database name and recorded
+   * *before* exclusions are applied. `excludedTables` names are absent from
+   * `tables` by construction, so they cannot be resolved against it.
+   */
+  tableNamesByDatabase: Record<string, string[]>;
+};
+
+const OPERATORS = new Set<string>(FILTER_OPERATORS);
+
+const isOperatorObject = (value: object): boolean =>
+  Object.keys(value).some((key) => OPERATORS.has(key));
+
+const editDistance = (a: string, b: string): number => {
+  if (a === b) return 0;
+  if (!a.length) return b.length;
+  if (!b.length) return a.length;
+
+  let previous = Array.from({ length: b.length + 1 }, (_, i) => i);
+
+  for (let i = 1; i <= a.length; i++) {
+    const current = [i];
+
+    for (let j = 1; j <= b.length; j++) {
+      current[j] = Math.min(
+        previous[j]! + 1,
+        current[j - 1]! + 1,
+        previous[j - 1]! + (a[i - 1] === b[j - 1] ? 0 : 1),
+      );
+    }
+
+    previous = current;
+  }
+
+  return previous[b.length]!;
+};
+
+/**
+ * Closest candidate, or nothing when none is close enough. The budget — half the
+ * misspelling's length, never more than three edits — is what keeps the hint
+ * honest: without it every unresolved name draws a confident suggestion picked
+ * from whatever happened to be shortest.
+ */
+const nearest = (value: string, candidates: readonly string[]): string | undefined => {
+  const needle = value.toLowerCase();
+
+  let best: string | undefined;
+  let bestDistance = Number.POSITIVE_INFINITY;
+
+  for (const candidate of candidates) {
+    const distance = editDistance(needle, candidate.toLowerCase());
+
+    if (distance < bestDistance) {
+      bestDistance = distance;
+      best = candidate;
+    }
+  }
+
+  const budget = Math.min(3, Math.max(1, Math.floor(needle.length / 2)));
+
+  return best !== undefined && bestDistance <= budget ? best : undefined;
+};
+
+const segment = (key: string): string =>
+  /^[A-Za-z_][A-Za-z0-9_]*$/.test(key) ? `.${key}` : `[${JSON.stringify(key)}]`;
+
+const unresolved = (
+  path: string,
+  kind: string,
+  value: string,
+  candidates: readonly string[],
+): string => {
+  const suggestion = nearest(value, candidates);
+
+  return `${path} — no ${kind} named ${JSON.stringify(value)}${
+    suggestion ? ` (did you mean ${JSON.stringify(suggestion)}?)` : ""
+  }`;
+};
+
+/**
+ * Column references are matched case-insensitively against both the GraphQL
+ * field name and the raw SQL name. That is looser than the query builder, which
+ * compares field names exactly — deliberately so. A boot-blocking check that is
+ * stricter than the runtime would refuse configurations that work today; one
+ * that is slightly looser still catches every genuine typo.
+ */
+const columnNames = (table: TableResolver): string[] =>
+  table.columns.flatMap((column) => {
+    const field = columnFieldName(column);
+
+    return field === column.name ? [field] : [field, column.name];
+  });
+
+const hasColumn = (table: TableResolver, name: string): boolean =>
+  columnNames(table).some((candidate) => candidate.toLowerCase() === name.toLowerCase());
+
+/** Table names reachable from `table` through a relation, in either direction. */
+const relatedTableNames = (table: TableResolver): string[] => [
+  ...table.relationships.map((fk) => fk.toResolverName),
+  ...table.relationshipsReversed.map((fk) => fk.fromResolverName),
+];
+
+const collectListErrors = (
+  path: string,
+  kind: string,
+  permission: "ALL" | string[] | undefined,
+  candidates: readonly string[],
+): string[] => {
+  if (!Array.isArray(permission)) return [];
+
+  const known = new Set(candidates.map((name) => name.toLowerCase()));
+
+  return permission
+    .filter((name) => !known.has(name.toLowerCase()))
+    .map((name) => unresolved(`${path}[${JSON.stringify(name)}]`, kind, name, candidates));
+};
+
+/**
+ * Every name a configuration points at that resolves to nothing, with the config
+ * path that carries it. Returns them all rather than throwing on the first, so a
+ * misconfigured deployment is fixed in one pass.
+ *
+ * A permission naming something that does not exist fails closed — the role
+ * simply loses the entity — which is why these never surfaced on their own: the
+ * rule the operator wrote silently does not apply.
+ */
+export const collectCrossReferenceErrors = (
+  configuration: Configuration,
+  known: KnownEntities,
+): string[] => {
+  const errors: string[] = [];
+
+  const tableNames = known.tables.map((table) => table.resolverName);
+  const tablesByName = new Map(
+    known.tables.map((table) => [table.resolverName.toLowerCase(), table]),
+  );
+  const procedureNames = known.storedProcedures.map((procedure) => procedure.name);
+  const queueNames = configuration.queues.map((queue) => queue.name);
+  const operationNames = Object.keys(configuration.operations);
+  const remoteSchemaNames = (configuration.remoteSchemas ?? []).map((remote) => remote.name);
+  const remoteRESTNames = (configuration.remoteREST ?? []).map((remote) => remote.name);
+
+  const collectFilterErrors = (
+    filter: object,
+    table: TableResolver,
+    path: string,
+    visited: ReadonlySet<string>,
+  ): void => {
+    for (const [key, value] of Object.entries(filter) as [string, unknown][]) {
+      const keyPath = `${path}${segment(key)}`;
+
+      // Mirrors buildConditions: an object carrying a known operator is a column
+      // filter, anything else is a nested relation.
+      if (typeof value !== "object" || value === null || isOperatorObject(value)) {
+        if (!hasColumn(table, key)) {
+          errors.push(
+            unresolved(keyPath, `column on table ${JSON.stringify(table.resolverName)}`, key, [
+              ...columnNames(table),
+              ...relatedTableNames(table),
+            ]),
+          );
+        }
+
+        continue;
+      }
+
+      const related = relatedTableNames(table);
+      const nested = related.includes(key) ? tablesByName.get(key.toLowerCase()) : undefined;
+
+      if (!nested) {
+        errors.push(
+          unresolved(
+            keyPath,
+            `column or relation on table ${JSON.stringify(table.resolverName)}`,
+            key,
+            [...columnNames(table), ...related],
+          ),
+        );
+
+        continue;
+      }
+
+      // A filter that walks back into a table already on the path would recurse
+      // forever; the runtime would too, so stop rather than report it here.
+      if (visited.has(nested.resolverName)) continue;
+
+      collectFilterErrors(value, nested, keyPath, new Set([...visited, nested.resolverName]));
+    }
+  };
+
+  for (const [role, permissions] of Object.entries(configuration.auth.permissions ?? {})) {
+    const base = `auth.permissions${segment(role)}`;
+
+    errors.push(
+      ...collectListErrors(
+        `${base}.storedProcedures`,
+        "stored procedure",
+        permissions.storedProcedures,
+        procedureNames,
+      ),
+      ...collectListErrors(`${base}.queues`, "queue", permissions.queues, queueNames),
+      ...collectListErrors(
+        `${base}.operations`,
+        "operation",
+        permissions.operations,
+        operationNames,
+      ),
+      ...collectListErrors(
+        `${base}.remoteSchemas`,
+        "remote schema",
+        permissions.remoteSchemas,
+        remoteSchemaNames,
+      ),
+      ...collectListErrors(
+        `${base}.remoteREST`,
+        "remote REST API",
+        permissions.remoteREST,
+        remoteRESTNames,
+      ),
+    );
+
+    if (isString(permissions.tables)) continue;
+
+    for (const [tableKey, tablePermission] of Object.entries(permissions.tables)) {
+      const tablePath = `${base}.tables${segment(tableKey)}`;
+      const table = tablesByName.get(tableKey.toLowerCase());
+
+      if (!table) {
+        errors.push(unresolved(tablePath, "table or view", tableKey, tableNames));
+
+        continue;
+      }
+
+      if (!isString(tablePermission.columns)) {
+        for (const column of tablePermission.columns) {
+          if (!hasColumn(table, column)) {
+            errors.push(
+              unresolved(
+                `${tablePath}.columns[${JSON.stringify(column)}]`,
+                "column",
+                column,
+                columnNames(table),
+              ),
+            );
+          }
+        }
+      }
+
+      for (const [index, orderBy] of (tablePermission.orderBy ?? []).entries()) {
+        if (!hasColumn(table, orderBy.column)) {
+          errors.push(
+            unresolved(
+              `${tablePath}.orderBy[${index}].column`,
+              "column",
+              orderBy.column,
+              columnNames(table),
+            ),
+          );
+        }
+      }
+
+      if (tablePermission.filter) {
+        collectFilterErrors(
+          tablePermission.filter,
+          table,
+          `${tablePath}.filter`,
+          new Set([table.resolverName]),
+        );
+      }
+    }
+  }
+
+  for (const [index, queue] of configuration.queues.entries()) {
+    const topicNames = Object.keys(queue.topics);
+    const base = `queues[${index}]`;
+
+    for (const [group, entries] of [
+      ["publishers", queue.publishers],
+      ["subscribers", queue.subscribers],
+    ] as const) {
+      for (const [key, entry] of Object.entries(entries)) {
+        if (!topicNames.includes(entry.topic)) {
+          errors.push(
+            unresolved(`${base}.${group}${segment(key)}.topic`, "topic", entry.topic, topicNames),
+          );
+        }
+      }
+    }
+  }
+
+  for (const [index, database] of configuration.enabledDatabases.entries()) {
+    if (!database.schema) continue;
+
+    const introspected = known.tableNamesByDatabase[database.name] ?? [];
+    const base = `databases[${index}].schema`;
+
+    errors.push(
+      ...collectListErrors(
+        `${base}.excludedTables`,
+        "table or view",
+        database.schema.excludedTables,
+        introspected,
+      ),
+    );
+
+    // Exact, unlike every other name here, because the override lookup itself is
+    // exact — two tables can differ only in case, and picking one of them for a
+    // key that matches both would be a guess. A mis-cased key is reported rather
+    // than quietly resolved.
+    for (const tableKey of Object.keys(database.schema.database)) {
+      if (!introspected.includes(tableKey)) {
+        errors.push(
+          unresolved(
+            `${base}.database${segment(tableKey)}`,
+            "table or view",
+            tableKey,
+            introspected,
+          ),
+        );
+      }
+    }
+  }
+
+  return errors;
+};

package/src/configuration/getSchemas/type-definition-generator/index.ts

@@ -103,7 +103,7 @@ export const generateTableType = (mergedEntities: MergedEntities) =>
           lj(
             relationshipsReversed,
             ({ fromResolverName, fromInternalName }) =>
-              `${fromResolverName}(where: ${fromInternalName}WhereInput, orderBy: [${fromInternalName}OrderByInput]): [${fromInternalName}]`,
+              `${fromResolverName}(where: ${fromInternalName}WhereInput, orderBy: [${fromInternalName}OrderByInput], limit: Int, offset: Int): [${fromInternalName}]`,
           ),
         ])}
       }

package/src/configuration/gql/buildExecute.ts

@@ -36,7 +36,7 @@ export const buildExecute = (roles: RolesWithGqlHandler, defaultRole: string) =>
     if (gql.isIntrospectionQuery(query)) return gql.introspectionResult;
     if (gql.isNoDataQuery(query)) return gql.noDataResult;
 
-    const { hasErrors, validationErrors } = gql.hasErrors(query);
+    const { hasErrors, validationErrors } = gql.hasErrors(query, { variables });
 
     if (hasErrors) {
       return {

package/src/configuration/gql/handleGraphQLRequestFactory.ts

@@ -11,6 +11,7 @@ import type { Auth } from "../../types/configuration";
 import type { SessionContext } from "../../utils/sessionVariables";
 
 import { analyzeQuery } from "../../analyzeQuery";
+import { checkQueryCost } from "../../analyzeQuery/costLimit";
 import { depthLimitRule } from "../../analyzeQuery/depthLimit";
 import { resolveVariableRef, resolveVariables } from "../../analyzeQuery/resolveVariables";
 import { callStoredProcedure, executeQueryJSON, generateSQL } from "../../databases";
@@ -82,7 +83,7 @@ export const handleGraphQLRequestFactory = (
       const result = await operation.handler(
         {
           databases: databasesConnections,
-          gqlQuery: gql.handler,
+          gqlQuery: operatorQuery,
           queues: queueManager,
           repository: repositoryMap,
         },
@@ -162,6 +163,8 @@ export const handleGraphQLRequestFactory = (
 
   const queryCache = new LRUCache<string, CachedQuery>({ max: 1000 });
 
+  const pageLimits = { defaultPageSize: env.defaultPageSize, maxPageSize: env.maxPageSize };
+
   // undefined = unparseable query (never cached)
   const getCacheEntry = (query: string): CachedQuery | undefined => {
     const hit = queryCache.get(query);
@@ -207,20 +210,54 @@ export const handleGraphQLRequestFactory = (
     // Return the introspection result for clients like GraphiQL or Apollo Client
     introspectionResult: { data: gqlEntities.introspection },
     noDataResult: { data: { _no_data: "No data available" } },
-    hasErrors: (query: string) => {
+    // `enforceDepthLimit: false` and `enforceCostLimit: false` are for
+    // operator-authored queries (REST operations), which are config, not
+    // attacker input. The depth verdict is never cached under them: the cache is
+    // keyed on query text alone, so storing a depth-free verdict would serve a
+    // caller sending the same text over the wire.
+    //
+    // Two flags rather than one because they are exempted for the same reason
+    // but enforced in different places — the depth rule inside the memoised
+    // `validate`, the cost check after it. Overloading one flag would leave the
+    // REST call sites reading as if they only exempted depth.
+    hasErrors: (
+      query: string,
+      options?: {
+        enforceDepthLimit?: boolean;
+        enforceCostLimit?: boolean;
+        variables?: Record<string, unknown>;
+      },
+    ) => {
+      const enforceDepthLimit = options?.enforceDepthLimit ?? true;
+      const enforceCostLimit = options?.enforceCostLimit ?? true;
       const entry = getCacheEntry(query);
       // Unparseable queries aren't cached; let parse surface the syntax error
       const document = entry?.document ?? parse(query);
 
-      let validationErrors = entry?.validationErrors;
+      let validationErrors = enforceDepthLimit ? entry?.validationErrors : undefined;
       if (!validationErrors) {
-        const rules =
-          env.maxQueryDepth > 0
-            ? [...specifiedRules, depthLimitRule(env.maxQueryDepth)]
-            : undefined; // undefined = use default specifiedRules
+        const maxDepth = enforceDepthLimit ? env.maxQueryDepth : 0;
+        const rules = maxDepth > 0 ? [...specifiedRules, depthLimitRule(maxDepth)] : undefined; // undefined = use default specifiedRules
 
         validationErrors = validate(gqlEntities.schema, document, rules);
-        if (entry) entry.validationErrors = validationErrors;
+        if (entry && enforceDepthLimit) entry.validationErrors = validationErrors;
+      }
+
+      // Outside the block above, and never cached: the estimate depends on the
+      // request's variable values, so the same query text has different verdicts
+      // for different callers. Only for a query that already typechecks — an
+      // estimate drawn from a document that does not resolve against the schema
+      // would bury the error that actually explains the rejection.
+      if (enforceCostLimit && env.maxQueryCost > 0 && validationErrors.length === 0) {
+        const costError = checkQueryCost(
+          document,
+          gqlEntities.schema,
+          options?.variables ?? {},
+          pageLimits,
+          env.maxQueryCost,
+        );
+
+        if (costError) validationErrors = [costError];
       }
 
       return {
@@ -234,6 +271,18 @@ export const handleGraphQLRequestFactory = (
       variables: Record<string, unknown> = {},
       req?: BunRequest,
       session?: SessionContext,
+      // `enforcePageLimits: false` is for operator-authored queries (REST
+      // operations, cron jobs, the `gqlQuery` handed to operation hooks). They
+      // are configuration, not caller input, so a page cap could only reject
+      // the operator's own intent. Use `gql.operatorQuery` rather than passing
+      // this by hand.
+      //
+      // `timeoutMs` is the per-operation override only. Left undefined, each
+      // engine stays on its own default — the pool's on Postgres and SQL
+      // Server, QUERY_TIMEOUT_MS on MySQL, which has no pool-level route — so
+      // an ordinary caller query is bounded without the factory resolving
+      // anything.
+      options?: { enforcePageLimits?: boolean; timeoutMs?: number },
       // oxlint-disable-next-line typescript/no-explicit-any
     ): Promise<{ data: any }> => {
       const log = logger("graphql").child({ role: session?.role });
@@ -339,7 +388,14 @@ export const handleGraphQLRequestFactory = (
           ],
         };
 
-        const sqlQueries = generateSQL(entities, tableQueryAnalysis, resolved.allVariables);
+        const sqlQueries = generateSQL(
+          entities,
+          tableQueryAnalysis,
+          resolved.allVariables,
+          false,
+          (options?.enforcePageLimits ?? true) ? pageLimits : null,
+          options?.timeoutMs,
+        );
 
         const data = await Promise.all<object>(
           sqlQueries.map(([db, query]) =>
@@ -348,6 +404,7 @@ export const handleGraphQLRequestFactory = (
               db,
               resolved.variables,
               resolved.allVariables as Record<string, string | number | boolean | null>,
+              options?.timeoutMs,
             ),
           ),
         );
@@ -409,7 +466,20 @@ export const handleGraphQLRequestFactory = (
     },
   };
 
-  return gql;
+  /**
+   * `handler` for operator-authored queries — REST operations, cron jobs, and
+   * the `gqlQuery` handed to operation hooks and handlers. Their text comes from
+   * configuration, never from a caller, so page limits do not apply.
+   */
+  const operatorQuery = (
+    query: Parameters<typeof gql.handler>[0],
+    variables?: Parameters<typeof gql.handler>[1],
+    req?: Parameters<typeof gql.handler>[2],
+    session?: Parameters<typeof gql.handler>[3],
+    timeoutMs?: number,
+  ) => gql.handler(query, variables, req, session, { enforcePageLimits: false, timeoutMs });
+
+  return { ...gql, operatorQuery };
 };
 
 export type HandleGraphQLRequest = ReturnType<typeof handleGraphQLRequestFactory>;

package/src/configuration/gql/handleGraphQLSubscriptionFactory.ts

@@ -1,4 +1,5 @@
 import type { ServerWebSocket, WebSocketHandler } from "bun";
+import type { AnalysisResult } from "../../analyzeQuery/types";
 import type { AnalyzedConfiguration } from "../../configuration";
 import type { SubscriptionContext } from "../../subscriptions";
 import type { SessionContext } from "../../utils/sessionVariables";
@@ -96,7 +97,9 @@ const handleGraphQLSubscriptionFactory = (
         const schemaEntity = roles[session.role!];
 
         // Validate query
-        const { hasErrors, validationErrors } = schemaEntity.handlers.gql.hasErrors(query);
+        const { hasErrors, validationErrors } = schemaEntity.handlers.gql.hasErrors(query, {
+          variables,
+        });
 
         if (hasErrors) {
           queryEventEmitter.sendErrorToSingleClient(ws, id, validationErrors);
@@ -146,15 +149,32 @@ const handleGraphQLSubscriptionFactory = (
           return;
         }
 
+        // The SQL builders read `$n` from a definition's index in the
+        // operation's own variable list, so the analysis handed to them has to
+        // be the resolved one — the raw analysis knows nothing of the statics
+        // that binding a role filter mints. Same construction as the HTTP path.
+        const resolvedAnalysis: AnalysisResult = {
+          ...analysis,
+          operations: [
+            {
+              ...operation,
+              fields: resolved.fields,
+              variables: resolved.variables,
+            },
+            ...analysis.operations.slice(1),
+          ],
+        };
+
         // Build context for the strategy
         const context: SubscriptionContext = {
           ws,
           subscriptionId: id,
-          analysis,
+          analysis: resolvedAnalysis,
           field: resolved.fields[0],
           variableDefinitions: resolved.variables,
           variables: resolved.allVariables,
           schemaEntity,
+          session,
           eventEmitter: queryEventEmitter,
         };
 

package/src/configuration/index.ts

@@ -19,6 +19,7 @@ import {
   virtualColumnExpression,
   virtualColumnFunction,
 } from "../types/configuration";
+import { collectCrossReferenceErrors } from "./crossReferences";
 import { getSchema, getSchemas } from "./getSchemas";
 import { generateOpenAPI } from "./rest/generateOpenAPI";
 
@@ -60,12 +61,29 @@ export const analyzeConfiguration = async (configuration: Configuration, options
   // Use pre-calculated enabledDatabases from configuration parsing
   const enabledDatabases = configuration.enabledDatabases;
 
-  const [{ tables, storedProcedures }, resolvedRemoteSchemas, resolvedRemoteREST] =
-    await Promise.all([
-      getDatabasesStructure(enabledDatabases, configuration.auth),
-      resolveRemoteSchemas(configuration.remoteSchemas ?? []),
-      resolveRemoteRESTApis(configuration.remoteREST ?? []),
-    ]);
+  const [
+    { tables, storedProcedures, tableNamesByDatabase },
+    resolvedRemoteSchemas,
+    resolvedRemoteREST,
+  ] = await Promise.all([
+    getDatabasesStructure(enabledDatabases, configuration.auth),
+    resolveRemoteSchemas(configuration.remoteSchemas ?? []),
+    resolveRemoteRESTApis(configuration.remoteREST ?? []),
+  ]);
+
+  const crossReferenceErrors = collectCrossReferenceErrors(configuration, {
+    tables,
+    storedProcedures,
+    tableNamesByDatabase,
+  });
+
+  if (crossReferenceErrors.length) {
+    throw new Error(
+      `Configuration references ${crossReferenceErrors.length} name${
+        crossReferenceErrors.length === 1 ? "" : "s"
+      } that do not exist:\n${crossReferenceErrors.map((error) => `  - ${error}`).join("\n")}`,
+    );
+  }
 
   const operationsWithRestEndpoints = Object.fromEntries(
     Object.entries(configuration.operations).filter(([, operationConfig]) => operationConfig.rest),

package/src/configuration/rest/handleRESTRequestFactory.ts

@@ -108,7 +108,7 @@ export const handleRESTRequestFactory = (
 
       if (routesInitDataPromises[route.routeKey] === undefined) {
         routesInitDataPromises[route.routeKey] = await route.hooks?.init?.({
-          gqlQuery: gqlSuperadminHandler?.handler ?? gql.handler,
+          gqlQuery: gqlSuperadminHandler?.operatorQuery ?? gql.operatorQuery,
           databases: databasesConnections,
           queues: queueManager,
           repository: repositoryMap,
@@ -269,7 +269,7 @@ export const handleRESTRequestFactory = (
         try {
           const result = await route.handler(
             {
-              gqlQuery: gqlSuperadminHandler?.handler ?? gql.handler,
+              gqlQuery: gqlSuperadminHandler?.operatorQuery ?? gql.operatorQuery,
               databases: databasesConnections,
               queues: queueManager,
               repository: repositoryMap,
@@ -330,7 +330,7 @@ export const handleRESTRequestFactory = (
           // Execute the GraphQL request, then transform via afterRequest before
           // caching so hits and misses return the same shape.
           const result = await applyAfterRequest(
-            await gql.handler(queryAnalysis!, variables, req, session),
+            await gql.operatorQuery(queryAnalysis!, variables, req, session, route.timeout),
           );
 
           // Cache the (already transformed) result
@@ -344,7 +344,9 @@ export const handleRESTRequestFactory = (
       } else if (queryAnalysis) {
         // No caching for this route, execute normally
         return new S200(
-          await applyAfterRequest(await gql.handler(queryAnalysis, variables, req, session)),
+          await applyAfterRequest(
+            await gql.operatorQuery(queryAnalysis, variables, req, session, route.timeout),
+          ),
         );
       }
 

package/src/configuration/rest/index.ts

@@ -42,11 +42,20 @@ export const buildApiRoutes = (
     let hasError = false;
 
     if (routeConfig.query) {
-      const validationErrors = gql.hasErrors(routeConfig.query);
+      // Operation queries come from the configuration, not from a caller, so the
+      // depth and cost limits do not apply to them — they would turn an
+      // operator's own deep or wide query into a dead route.
+      const validationErrors = gql.hasErrors(routeConfig.query, {
+        enforceDepthLimit: false,
+        enforceCostLimit: false,
+      });
 
       if (validationErrors.hasErrors && gqlSuperadminHandler) {
         // Re-validate with superadmin handler if available
-        const superadminErrors = gqlSuperadminHandler.hasErrors(routeConfig.query);
+        const superadminErrors = gqlSuperadminHandler.hasErrors(routeConfig.query, {
+          enforceDepthLimit: false,
+          enforceCostLimit: false,
+        });
 
         if (superadminErrors.hasErrors) {
           throw new Error(`Endpoint ${routeKey} has invalid query.`);