@loradb/lora-graphql 0.21.0 → 0.22.0

package/dist/analyze/access.d.ts

@@ -1,4 +1,4 @@
-import { GraphQLSchema } from 'graphql';
+import { FragmentDefinitionNode, GraphQLSchema, OperationDefinitionNode } from 'graphql';
 import { AuthOperation, GraphModel, ModelWarning } from '../model/types.js';
 export type AccessVerdict = 
 /** Every row, for this caller. */
@@ -17,12 +17,55 @@ export interface AccessEntry {
     type: string;
     /** The field, for field-level and relationship rules. */
     field?: string;
-    operation: AuthOperation;
+    /** `EXECUTE`: running a Mutation @cypher field. */
+    operation: AuthOperation | "EXECUTE";
     principal: string;
     verdict: AccessVerdict;
     /** What decides it: `filter[0]`, `validate[1]`, `@authentication`, `bypass`, … */
     by: string[];
 }
+/** One root field of an operation, as each kind of caller. */
+export interface RootFieldAccess {
+    /** The root field. */
+    field: string;
+    /** Its response key, when aliased. */
+    alias?: string;
+    /**
+     * What the field acts on: a node type, an interface or union, `Node`
+     * (for `node` / `nodes`), or `Query` / `Mutation` for a `@cypher` field.
+     */
+    type: string;
+    /** The operations it needs: `READ`, `CREATE`, `UPDATE` …, `EXECUTE`. */
+    operations: Array<AuthOperation | "EXECUTE">;
+    /**
+     * Per principal (`anonymous`, `authenticated`, `roles:admin` …). A
+     * field over several operations or types (an upsert, `node`, a union)
+     * reports the most restrictive of them, `by` naming each part.
+     */
+    access: Record<string, {
+        verdict: AccessVerdict;
+        by: string[];
+    }>;
+}
+export interface OperationAccess {
+    operation: "query" | "mutation" | "subscription";
+    name: string | undefined;
+    /** The principals, in the order the matrix lists them. */
+    principals: string[];
+    /** Root fields in document order (fragments followed); `__typename` left out. */
+    fields: RootFieldAccess[];
+    /**
+     * Per principal, the most restrictive verdict over the root fields:
+     * `denied` or `unauthenticated` means the operation cannot succeed.
+     */
+    verdicts: Record<string, AccessVerdict>;
+}
+/**
+ * Who may run `operation`: each root field's verdict per principal, read
+ * off the same rules as `accessMatrix`. Root fields only: nested
+ * selections answer to their own types' READ rules (see the matrix).
+ */
+export declare function operationAccess(model: GraphModel, schema: GraphQLSchema, operation: OperationDefinitionNode, fragments: ReadonlyMap<string, FragmentDefinitionNode>): OperationAccess;
 /** The access matrix of `model`, in a stable order. */
 export declare function accessMatrix(model: GraphModel, schema: GraphQLSchema): AccessEntry[];
 /**

package/dist/analyze/statistics.d.ts

@@ -5,6 +5,7 @@ export interface DegreeStats {
     mean: number;
     median: number;
     p99: number;
+    /** The largest degree of any node, not only of the sample. */
     max: number;
 }
 export interface Statistics {