@graphoria/server 0.2.2 → 0.3.0

package/src/console/api.ts

@@ -1,14 +1,18 @@
+import type { TokenService } from "../authentication/types";
 import type { AnalyzedConfiguration } from "../configuration";
 import type { Configuration } from "../types/configuration";
 import type { Env } from "../types/env";
-import type { SQL } from "bun";
+import type { RateLimiter } from "../utils/rateLimit";
+import type { BunRequest, SQL } from "bun";
 import type { ConnectionPool } from "mssql";
 
+import { createConsoleSessions } from "./session";
 import { getTags } from "../configuration/rest/generateOpenAPI";
 import { getCronJobs } from "../singletons/cron";
 import { databasesConnections } from "../singletons/databases";
 import { queueManager } from "../singletons/queues";
-import { S200, S400, S404 } from "../utils/responses";
+import { resolveClientAddress } from "../utils/rateLimit";
+import { S200, S400, S401, S404, S429 } from "../utils/responses";
 
 type ConsoleRoutesFactoryOptions = {
   env: Env;
@@ -16,10 +20,16 @@ type ConsoleRoutesFactoryOptions = {
   prefixes: Record<string, string>;
   projectConfiguration: Configuration;
   analyzedConfiguration: AnalyzedConfiguration;
-  getRoleHandlers: (req: Request) => Promise<{ role: string }>;
+  tokenService: TokenService;
+  rateLimiter?: RateLimiter | undefined;
 };
 
-type ConsoleRouteHandler = (req: Request) => Response | Promise<Response>;
+// Bun hands a route handler the server as its second argument; the parameter is
+// optional only because the type is also used for handlers that ignore it.
+type ConsoleRouteHandler = (
+  req: BunRequest,
+  server?: Bun.Server<unknown>,
+) => Response | Promise<Response>;
 
 const PING_TIMEOUT_MS = 2000;
 
@@ -52,14 +62,16 @@ export const consoleRoutesFactory = ({
   prefixes,
   projectConfiguration,
   analyzedConfiguration,
-  getRoleHandlers,
+  tokenService,
+  rateLimiter,
 }: ConsoleRoutesFactoryOptions): Record<string, Record<string, ConsoleRouteHandler>> => {
+  const sessions = createConsoleSessions({ env, consolePath, tokenService });
+
   const guarded =
-    (handler: (req: Request) => object | Promise<object>): ConsoleRouteHandler =>
-    async (req: Request) => {
+    (handler: (req: BunRequest) => object | Promise<object>): ConsoleRouteHandler =>
+    async (req: BunRequest) => {
       try {
-        const { role } = await getRoleHandlers(req);
-        if (role !== env.superadmin.role) return new S404({ error: "Not Found" });
+        if (!(await sessions.authorize(req))) return new S404({ error: "Not Found" });
         return new S200(await handler(req));
       } catch (error) {
         return new S400({ errors: [{ message: (error as Error)?.message }] });
@@ -78,10 +90,39 @@ export const consoleRoutesFactory = ({
         new S200({
           name: projectConfiguration.name,
           version: projectConfiguration.version,
-          adminSecretHeader: env.admin.header,
         }),
     },
 
+    [`${base}/login`]: {
+      ...cors,
+      POST: async (req, server) => {
+        // Keyed by address against the anonymous ceiling: there is no session
+        // yet, and the attempt is charged before the secret is compared, so a
+        // guesser cannot spend attempts for free.
+        const limit = await rateLimiter?.check(
+          null,
+          resolveClientAddress(req, server, env.rateLimit.trustProxy),
+        );
+        if (limit && !limit.allowed) return new S429(limit.retryAfterMs);
+
+        try {
+          return new S200(await sessions.login(req));
+        } catch {
+          // One message for a bad secret and for a malformed body alike: the
+          // caller learns nothing about which it was.
+          return new S401({ errors: [{ message: "Invalid admin secret" }] });
+        }
+      },
+    },
+
+    [`${base}/logout`]: {
+      ...cors,
+      POST: async (req) => {
+        await sessions.logout(req);
+        return new S200({ ok: true });
+      },
+    },
+
     [`${base}/tables`]: {
       ...cors,
       GET: guarded(() => ({

package/src/console/session.ts

@@ -0,0 +1,125 @@
+import { timingSafeEqual } from "crypto";
+
+import type { BunRequest } from "bun";
+import type { TokenService } from "../authentication/types";
+import type { Env } from "../types/env";
+
+import { parseDurationToMs, parseDurationToSeconds } from "../authentication/duration";
+import { logger } from "../logging";
+
+export const CONSOLE_SESSION_COOKIE = "graphoria_console_session";
+
+// Separates a console session from an access or refresh token signed with the
+// same key: neither can be presented where the other is expected.
+const CONSOLE_AUDIENCE = "console";
+const CONSOLE_SUBJECT = "console";
+
+const safeCompare = (a: string, b: string): boolean => {
+  try {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length) return false;
+    return timingSafeEqual(bufA, bufB);
+  } catch {
+    return false;
+  }
+};
+
+export type ConsoleSessions = {
+  /** Exchange the admin secret for a session cookie. Throws if it does not match. */
+  login(req: BunRequest): Promise<{ expiresIn: number }>;
+  /** True when the request carries a live, unrevoked console session cookie. */
+  authorize(req: BunRequest): Promise<boolean>;
+  logout(req: BunRequest): Promise<void>;
+};
+
+type ConsoleSessionsOptions = {
+  env: Env;
+  consolePath: string;
+  tokenService: TokenService;
+};
+
+export const createConsoleSessions = ({
+  env,
+  consolePath,
+  tokenService,
+}: ConsoleSessionsOptions): ConsoleSessions => {
+  const log = logger("console");
+  const expiresIn = env.console.sessionExpiresIn;
+  const sessionMs = parseDurationToMs(expiresIn);
+
+  // Revoked JTIs, held in this process only: the console mints its own tokens
+  // and never writes to the Redis JTI store, so a logout is honoured by the
+  // worker that served it and by no other. An entry is dropped once the token
+  // it revokes would have expired on its own.
+  const revoked = new Map<string, number>();
+
+  const prune = () => {
+    const now = Date.now();
+    for (const [jti, expiresAt] of revoked) if (expiresAt <= now) revoked.delete(jti);
+  };
+
+  const cookieOptions = {
+    httpOnly: true,
+    secure: true,
+    sameSite: "strict",
+    path: consolePath,
+  } as const;
+
+  const readSession = async (req: BunRequest) => {
+    const cookie = req.cookies?.get(CONSOLE_SESSION_COOKIE);
+    if (!cookie) return null;
+
+    try {
+      const payload = await tokenService.verifyToken(cookie, { audience: CONSOLE_AUDIENCE });
+      if (payload.role !== env.superadmin.role) return null;
+      return payload;
+    } catch {
+      return null;
+    }
+  };
+
+  return {
+    login: async (req) => {
+      const { secret: submitted } = (await req.json()) as { secret?: string };
+
+      if (!env.admin.secret || !submitted || !safeCompare(submitted, env.admin.secret)) {
+        throw new Error("Invalid admin secret");
+      }
+
+      const token = await tokenService.createToken(
+        { sub: CONSOLE_SUBJECT, role: env.superadmin.role },
+        { audience: CONSOLE_AUDIENCE, expiresIn },
+      );
+
+      req.cookies.set(CONSOLE_SESSION_COOKIE, token, {
+        ...cookieOptions,
+        maxAge: parseDurationToSeconds(expiresIn),
+      });
+
+      log.info("console session issued");
+
+      return { expiresIn: parseDurationToSeconds(expiresIn) };
+    },
+
+    authorize: async (req) => {
+      const payload = await readSession(req);
+      if (!payload) return false;
+
+      prune();
+      return !revoked.has(payload.jti);
+    },
+
+    logout: async (req) => {
+      const payload = await readSession(req);
+      if (payload) {
+        // The token stays valid until it expires, so the revocation record has
+        // to outlive it: one full session lifetime is the upper bound.
+        revoked.set(payload.jti, Date.now() + sessionMs);
+        log.info("console session revoked");
+      }
+
+      req.cookies.delete({ name: CONSOLE_SESSION_COOKIE, path: consolePath });
+    },
+  };
+};

package/src/cron/index.ts

@@ -13,7 +13,7 @@ import { logger } from "../logging";
  */
 export interface ScheduledCronJob {
   name: string;
-  job: Cron;
+  job: Cron<NonNullable<CronJob["context"]>>;
   config: CronJob;
   executionCount: number;
   pause: () => boolean;
@@ -106,7 +106,11 @@ const createScheduledJob = (config: CronJob, gqlQuery: GqlQueryFn<true>): Schedu
     name: config.name,
     job,
     config,
-    executionCount,
+    // Getter, not a copy: the counter lives in the tick closure and callers
+    // (console status, getSummary) read it after ticks have happened.
+    get executionCount() {
+      return executionCount;
+    },
     pause: () => {
       job.pause();
       log.info("paused");

package/src/databases/common.ts

@@ -826,37 +826,82 @@ const toPositionalPlaceholder = (
   return null;
 };
 
+/**
+ * Page bounds applied to a list field. `null` at a call site means the query is
+ * operator-authored and exempt; `0` on either field opts that half out.
+ */
+export type PageLimits = {
+  defaultPageSize: number;
+  maxPageSize: number;
+};
+
+// Resolve the requested limit to a number, following a $ref into the runtime
+// values. Returns undefined when there is no limit or it cannot be resolved.
+const resolveLimitValue = (
+  value: unknown,
+  variables: Record<string, unknown>,
+): number | undefined => {
+  const resolved = isString(value) && value.startsWith("$") ? variables[value.substring(1)] : value;
+
+  return typeof resolved === "number" ? resolved : undefined;
+};
+
 // Factory function for pagination clause builders
 export const buildPaginationClauseFp =
   (dbType: DatabaseType = "pg") =>
-  (field: SelectionAnalysis, variablesDefinition: VariableDefinition[] = []): string => {
+  (
+    field: SelectionAnalysis,
+    variablesDefinition: VariableDefinition[] = [],
+    variables: Record<string, unknown> = {},
+    pageLimits: PageLimits | null = null,
+  ): string => {
     const args = field.arguments;
 
-    if (!args || args["limit"] === undefined) {
-      return "";
+    const requested = resolveLimitValue(args?.["limit"], variables);
+
+    if (pageLimits && pageLimits.maxPageSize > 0 && requested !== undefined) {
+      if (requested > pageLimits.maxPageSize) {
+        throw new Error(
+          `Requested page size of ${requested} exceeds the maximum allowed page size of ${pageLimits.maxPageSize} (field: "${field.alias || field.name}"). Raise MAX_PAGE_SIZE to allow larger pages.`,
+        );
+      }
     }
 
     // Convert limit variable reference to positional placeholder
-    const limitPlaceholder = toPositionalPlaceholder(args["limit"], variablesDefinition, dbType);
-    if (!limitPlaceholder) {
-      return ""; // Limit must be a variable reference
+    const limitPlaceholder =
+      args?.["limit"] === undefined
+        ? null
+        : toPositionalPlaceholder(args["limit"], variablesDefinition, dbType);
+
+    // An unbounded list field reads the whole table. Supply the default page
+    // size as a literal: minting a variable here would have to push onto the
+    // same definition list the driver binds positionally from, and that order
+    // is load-bearing. The value is an env-validated integer, never caller text.
+    const limitClause =
+      limitPlaceholder ??
+      (field.isArray && pageLimits && pageLimits.defaultPageSize > 0
+        ? String(pageLimits.defaultPageSize)
+        : null);
+
+    if (!limitClause) {
+      return "";
     }
 
     // Convert offset variable reference to positional placeholder (default to 0 if not provided)
-    const offsetPlaceholder = args["offset"]
+    const offsetPlaceholder = args?.["offset"]
       ? toPositionalPlaceholder(args["offset"], variablesDefinition, dbType)
       : "0";
 
     if (dbType !== "mssql") {
-      return `LIMIT ${limitPlaceholder} OFFSET ${offsetPlaceholder}`;
+      return `LIMIT ${limitClause} OFFSET ${offsetPlaceholder}`;
     }
 
     // T-SQL only accepts OFFSET/FETCH after an ORDER BY. Dropping the limit when
     // the query has none returned the whole table instead, so supply the
     // order-agnostic ORDER BY that T-SQL accepts for exactly this case.
-    const orderByFallback = args["orderBy"] === undefined ? "ORDER BY (SELECT NULL) " : "";
+    const orderByFallback = args?.["orderBy"] === undefined ? "ORDER BY (SELECT NULL) " : "";
 
-    return `${orderByFallback}OFFSET ${offsetPlaceholder} ROWS FETCH NEXT ${limitPlaceholder} ROWS ONLY`;
+    return `${orderByFallback}OFFSET ${offsetPlaceholder} ROWS FETCH NEXT ${limitClause} ROWS ONLY`;
   };
 
 export const buildPaginationClausePG = buildPaginationClauseFp("pg");

package/src/databases/core/executor.ts

@@ -14,6 +14,8 @@ export const executeQuery = async <T>(
   db: Database,
   variablesDefinition: VariableDefinition[],
   variables: Record<string, unknown>,
+  /** Per-operation override. `undefined` leaves the engine on its own default. */
+  timeoutMs?: number,
 ) => {
   const adapter = databaseAdapters[db?.type];
   if (!adapter) {
@@ -24,7 +26,7 @@ export const executeQuery = async <T>(
   const startTime = Bun.nanoseconds();
 
   try {
-    const result = await adapter.execute<T>(query, db, variablesDefinition, variables);
+    const result = await adapter.execute<T>(query, db, variablesDefinition, variables, timeoutMs);
     log.debug(
       { durationMs: (Bun.nanoseconds() - startTime) / 1e6, queryLength: query.length },
       "query executed",
@@ -41,6 +43,8 @@ export const executeQueryJSON = async <T>(
   db: Database,
   variablesDefinition: VariableDefinition[],
   variables: Record<string, unknown>,
+  /** Per-operation override. `undefined` leaves the engine on its own default. */
+  timeoutMs?: number,
 ) => {
   const adapter = databaseAdapters[db.type];
   if (!adapter) {
@@ -51,7 +55,13 @@ export const executeQueryJSON = async <T>(
   const startTime = Bun.nanoseconds();
 
   try {
-    const result = await adapter.executeJson<T>(query, db, variablesDefinition, variables);
+    const result = await adapter.executeJson<T>(
+      query,
+      db,
+      variablesDefinition,
+      variables,
+      timeoutMs,
+    );
     log.debug(
       { durationMs: (Bun.nanoseconds() - startTime) / 1e6, queryLength: query.length },
       "query executed (json)",

package/src/databases/core/function-mapping.ts

@@ -3,6 +3,7 @@ import type { MergedEntities } from "../../configuration/getSchemas/mergeEntitie
 import type { Auth, Database, DatabaseType } from "../../types/configuration";
 import type { DatabaseStructure, ProcedureResolver, TableResolver, View } from "../../types/db";
 import type { GenerateCreateTableSQLParameters } from "../schemaBuilder/generateCreateTable";
+import type { PageLimits } from "../common";
 
 import {
   checkUserCredentials as checkUserCredentialsMSSQL,
@@ -85,18 +86,22 @@ type DatabaseFunctions = {
     operation: OperationAnalysis,
     variables: Record<string, unknown>,
     forHashMethod: boolean,
+    pageLimits: PageLimits | null,
+    timeoutMs: number | undefined,
   ) => string;
   execute: <T>(
     query: string,
     db: Database,
     variablesDefinition: VariableDefinition[],
     values: Record<string, unknown>,
+    timeoutMs: number | undefined,
   ) => Promise<T[]>;
   executeJson: <T>(
     query: string,
     db: Database,
     variablesDefinition: VariableDefinition[],
     values: Record<string, unknown>,
+    timeoutMs: number | undefined,
   ) => Promise<T>;
   callStoredProcedure: (
     sp: ProcedureResolver,

package/src/databases/core/query-builder.ts

@@ -1,6 +1,7 @@
 import type { AnalysisResult, SelectionAnalysis } from "../../analyzeQuery/types";
 import type { MergedEntities } from "../../configuration/getSchemas/mergeEntities";
 import type { Database } from "../../types/configuration";
+import type { PageLimits } from "../common";
 
 import { databaseAdapters } from "./function-mapping";
 
@@ -9,6 +10,10 @@ export const generateSQL = (
   analysisResult: AnalysisResult,
   variables: Record<string, unknown> = {},
   forHashMethod: boolean = false,
+  /** `null` exempts the query — operator-authored queries are configuration, not caller input. */
+  pageLimits: PageLimits | null = null,
+  /** Per-operation override. `undefined` leaves the engine on its own default. */
+  timeoutMs?: number,
 ) => {
   const operation = analysisResult.operations[0];
 
@@ -40,6 +45,8 @@ export const generateSQL = (
         },
         variables,
         forHashMethod,
+        pageLimits,
+        timeoutMs,
       );
 
       return [db, query] as const;

package/src/databases/engines/mssql/connection.ts

@@ -6,32 +6,78 @@ import type { VariableDefinition } from "../../../analyzeQuery/types";
 import type { Database } from "../../../types/configuration";
 import type { ProcedureResolver } from "../../../types/db";
 
+import { MSSQLConnectionOptionsZod } from "../../../config/types/db";
 import { databasesConnections } from "../../../singletons/databases";
+import { getQueryTimeoutMs } from "../../../singletons/queryTimeout";
 import { logger } from "../../../logging";
 
-export const getPool = async (db: Database) => {
+// Every pool bound comes from the schema, which is the only place they are
+// declared and documented. Repeating them here as `?? n` fallbacks let the
+// documented default and the applied one drift apart, differently per engine.
+//
+// Defaults are overlaid rather than re-parsed: `connectionOptions` is an
+// undiscriminated union of the two engine shapes, and an object carrying
+// nothing MSSQL-specific — `{}` included — validates against the Bun SQL shape
+// even on an MSSQL database. A strict re-parse of one of those would reject the
+// Bun SQL keys and take the server down at boot.
+export const poolOptions = (db: Database, timeoutMs: number = getQueryTimeoutMs()) => {
   const ci = db.connection;
-  const opts = db.connectionOptions as MSSQLConnectionOptions | undefined;
-  const pool = new ConnectionPool({
+  const raw = db.connectionOptions as MSSQLConnectionOptions | undefined;
+
+  const defaults = MSSQLConnectionOptionsZod.parse({});
+  const opts = { ...defaults, ...raw, pool: { ...defaults.pool, ...raw?.pool } };
+
+  return {
     server: ci.host,
     port: ci.port,
     user: ci.user,
     password: ci.password,
     database: ci.database,
-    connectionTimeout: opts?.connectionTimeout ? opts.connectionTimeout * 1000 : undefined,
-    requestTimeout: opts?.requestTimeout ? opts.requestTimeout * 1000 : undefined,
+    connectionTimeout: opts.connectionTimeout * 1000,
+    // Only an omitted key falls through to the resolved timeout: reading it off
+    // `opts` cannot tell an operator who set 30 from Zod defaulting to 30, and
+    // silently overriding the first would break the slow report it was raised
+    // for. Seconds there, milliseconds here.
+    requestTimeout: raw?.requestTimeout !== undefined ? raw.requestTimeout * 1000 : timeoutMs,
+    // These three keep their code fallbacks rather than the schema's. Two of
+    // them default the opposite way there, so taking the schema value would
+    // turn certificate validation on and trusted connections off for every
+    // deployment that omits `connectionOptions` — a change to how a connection
+    // is secured, not to how the pool is sized.
     options: {
-      encrypt: opts?.encrypt ?? false,
-      trustServerCertificate: opts?.trustServerCertificate ?? true,
-      trustedConnection: opts?.trustedConnection ?? true,
+      encrypt: raw?.encrypt ?? false,
+      trustServerCertificate: raw?.trustServerCertificate ?? true,
+      trustedConnection: raw?.trustedConnection ?? true,
     },
     pool: {
-      max: opts?.pool?.max ?? 50,
-      min: opts?.pool?.min ?? 1,
-      idleTimeoutMillis: (opts?.pool?.idleTimeout ?? 30) * 1000,
+      max: opts.pool.max,
+      min: opts.pool.min,
+      idleTimeoutMillis: opts.pool.idleTimeout * 1000,
+      acquireTimeoutMillis: opts.pool.acquireTimeout * 1000,
     },
-    parseJSON: opts?.parseJSON ?? true,
-  });
+    parseJSON: opts.parseJSON,
+  };
+};
+
+/** The bound the pool already applies, so the executor can tell an override from the default. */
+export const poolRequestTimeoutMs = (db: Database) => poolOptions(db).requestTimeout;
+
+// `ConnectionPool.request` takes per-request overrides from mssql 12.7.0, which
+// is what the workspace pins, but `@types/mssql@12.3.0` still declares it with
+// no parameter. Narrowed to the one key used rather than cast wholesale, so the
+// day the types catch up this stops compiling and can be deleted.
+//
+// Not interchangeable with assigning `request.timeout`: that property does not
+// exist, and the pool default is used instead.
+type PoolWithRequestOverrides = {
+  request(overrides: { requestTimeout: number }): ReturnType<ConnectionPool["request"]>;
+};
+
+const requestWithTimeout = (pool: ConnectionPool, timeoutMs: number) =>
+  (pool as unknown as PoolWithRequestOverrides).request({ requestTimeout: timeoutMs });
+
+export const getPool = async (db: Database) => {
+  const pool = new ConnectionPool(poolOptions(db));
 
   await pool.connect(); // Connect to the database
 
@@ -52,6 +98,7 @@ export const executeQueryFactory =
     db: Database,
     variablesDefinition: VariableDefinition[] = [],
     params: Record<string, unknown> = {},
+    timeoutMs?: number,
   ) => {
     const pool = singleQuery ? await getPool(db) : await getPoolSingleton(db);
 
@@ -59,7 +106,10 @@ export const executeQueryFactory =
       await new Promise((resolve) => setTimeout(resolve, 1000));
     }
 
-    const request = pool!.request();
+    const request =
+      timeoutMs !== undefined && timeoutMs !== poolRequestTimeoutMs(db)
+        ? requestWithTimeout(pool!, timeoutMs)
+        : pool!.request();
 
     variablesDefinition.forEach((v, i) => {
       const varName = (i + 1).toString();
@@ -93,12 +143,14 @@ export const executeQueryJSONFactory =
     db: Database,
     variablesDefinition: VariableDefinition[] = [],
     params: Record<string, unknown> = {},
+    timeoutMs?: number,
   ): Promise<T> => {
     const result = await (singleQuery ? executeQuerySingle : executeQuery)(
       query,
       db,
       variablesDefinition,
       params,
+      timeoutMs,
     );
 
     return result[0] as T;

package/src/databases/engines/mssql/format.ts

@@ -2,6 +2,7 @@ import { format as sqlFormatter } from "sql-formatter";
 
 import type { AnalysisResult } from "../../../analyzeQuery/types";
 import type { MergedEntities } from "../../../configuration/getSchemas/mergeEntities";
+import type { PageLimits } from "../../common";
 
 import { generateSQL } from "../../core/query-builder";
 
@@ -16,8 +17,9 @@ export const genSql = (
   query: AnalysisResult,
   variables: Record<string, unknown> = {},
   hash = false,
+  pageLimits: PageLimits | null = null,
 ) => {
-  const [[, sql]] = generateSQL(entitites, query, variables, hash);
+  const [[, sql]] = generateSQL(entitites, query, variables, hash, pageLimits);
 
   return format(sql);
 };

package/src/databases/engines/mssql/query/index.ts

@@ -4,7 +4,7 @@ import type {
   VariableDefinition,
 } from "../../../../analyzeQuery/types";
 import type { MergedEntities } from "../../../../configuration/getSchemas/mergeEntities";
-import type { GroupByInfo } from "../../../common";
+import type { GroupByInfo, PageLimits } from "../../../common";
 
 import {
   buildOrderByClauseMSSQL,
@@ -164,6 +164,7 @@ export const generateSQL = (
   operation: OperationAnalysis,
   variables: Record<string, unknown> = {},
   forHashMethod: boolean = false,
+  pageLimits: PageLimits | null = null,
 ): string => {
   if (forHashMethod) {
     return `SELECT HASHBYTES('MD5', (
@@ -176,6 +177,7 @@ export const generateSQL = (
           null,
           1,
           {},
+          pageLimits,
         )})
     ) AS ResultHash`;
   }
@@ -238,6 +240,7 @@ export const generateSQL = (
       null,
       index + 1,
       {},
+      pageLimits,
     );
 
     fieldQueries.push(`(${fieldSQL}) as ${wrapIdentifierMSSQL(field.alias || field.name)}`);
@@ -261,6 +264,7 @@ export const buildSQLForField = (
   parentTableAlias: string | null,
   level: number,
   aliasMap: { [alias: string]: string },
+  pageLimits: PageLimits | null,
 ): string => {
   const tableAlias = generateTableAlias(level);
 
@@ -325,6 +329,7 @@ export const buildSQLForField = (
         tableAlias,
         level,
         aliasMap,
+        pageLimits,
       ),
     ([name, selector]) => `${selector} AS ${wrapIdentifierMSSQL(name)}`,
   );
@@ -332,7 +337,12 @@ export const buildSQLForField = (
   const fromClause = `FROM ${dottedQuotedName} ${tableAlias}`;
 
   const orderByClause = buildOrderByClauseMSSQL(entities, field, tableAlias);
-  const paginationClause = buildPaginationClauseMSSQL(field, variablesDefinition);
+  const paginationClause = buildPaginationClauseMSSQL(
+    field,
+    variablesDefinition,
+    variables,
+    pageLimits,
+  );
 
   const isArray = field.isArray;
   const forJson =