@nxgt/graphql-validation 0.5.0 → 0.6.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   constraintTypeDefs2
-} from "./chunks/index-xcaf9kes.js";
+} from "./chunks/index-atwkcfg3.js";
 
 // src/typedefs-command.ts
 import { mkdir, writeFile } from "node:fs/promises";

package/dist/codegen.js

@@ -1,6 +1,6 @@
 import {
   applyRuleCode
-} from "./chunks/index-xcaf9kes.js";
+} from "./chunks/index-atwkcfg3.js";
 import {
   registryOf,
   constraintsOn2,
@@ -8,7 +8,7 @@ import {
   assertObjectTargets,
   baseCode,
   checkConstraints2
-} from "./chunks/index-twevz7yc.js";
+} from "./chunks/index-w9pw7fsk.js";
 // src/builder/input-code.ts
 import {
   getNamedType,

package/dist/index.d.ts

@@ -1,10 +1,12 @@
-export { type BadUserInputExtensions, badUserInput, type ValidationIssue, } from './bad-user-input.js';
+export { type BadUserInputExtensions, badUserInput, type ConstraintValue, type ValidationIssue, } from './bad-user-input.js';
 export { constraintTypeDefs } from './constraint-directive.js';
 export { FIELD_CODES, fieldIssueOf } from './field-issue-of.js';
 export type { FormatName } from './formats/index.js';
 export type { StringSchema } from './formats/format.js';
 export type { FormatSchemas, OwnFormats } from './formats/registry.js';
 export { type FieldError, type FieldIssue, type FieldsErrorOptions, fieldsError, INVALID_INPUT, type InvalidInputOptions, type IssueParams, inputPath, invalidInputError, type Translate, } from './invalid-input.js';
+export { type MaxDepthOptions, maxDepth } from './limits/max-depth.js';
+export { type MaxListCostOptions, maxListCost } from './limits/max-list-cost.js';
 export type { ConstraintArgument } from './rules/index.js';
 export { type ArgsSchema, type ArgsSchemaFor, type SchemaOf, validated, } from './validated.js';
 export { type WithValidationOptions, withValidation, } from './with-validation.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,sBAAsB,EAC3B,YAAY,EACZ,KAAK,eAAe,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EACN,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,WAAW,EACX,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,SAAS,EACT,iBAAiB,EACjB,KAAK,SAAS,GACd,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EACN,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,SAAS,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,KAAK,qBAAqB,EAC1B,cAAc,GACd,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,sBAAsB,EAC3B,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EACN,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,WAAW,EACX,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,SAAS,EACT,iBAAiB,EACjB,KAAK,SAAS,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,KAAK,kBAAkB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EACN,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,SAAS,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,KAAK,qBAAqB,EAC1B,cAAc,GACd,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -1,10 +1,10 @@
 import {
   constraintOf,
   constraintTypeDefs2
-} from "./chunks/index-xcaf9kes.js";
+} from "./chunks/index-atwkcfg3.js";
 import {
   checkConstraints2
-} from "./chunks/index-twevz7yc.js";
+} from "./chunks/index-w9pw7fsk.js";
 
 // src/bad-user-input.ts
 import { GraphQLError } from "graphql";
@@ -12,7 +12,13 @@ function issuesOf(error, constraintOf) {
   return error.issues.map((issue) => {
     const path = issue.path.map((key) => typeof key === "number" ? key : String(key));
     const constraint = constraintOf?.(issue);
-    return constraint ? { path, message: issue.message, code: issue.code, constraint } : { path, message: issue.message, code: issue.code };
+    return constraint ? {
+      path,
+      message: issue.message,
+      code: issue.code,
+      constraint: constraint.argument,
+      value: constraint.value
+    } : { path, message: issue.message, code: issue.code };
   });
 }
 function errorOf(where, issues) {
@@ -125,6 +131,361 @@ function codeOf(issue) {
       return FIELD_CODES.invalid;
   }
 }
+// src/limits/max-depth.ts
+import {
+  GraphQLError as GraphQLError3
+} from "graphql";
+
+// src/limits/describe.ts
+function operationLabel(operation) {
+  return operation.name ? `Operation "${operation.name.value}"` : "Operation";
+}
+function assertInteger(option, value, min, max = Number.MAX_SAFE_INTEGER) {
+  if (!Number.isInteger(value) || value < min || value >= max) {
+    throw new RangeError(`${option} must be an integer from ${min} to ${max - 1}.`);
+  }
+}
+
+// src/limits/introspection.ts
+import {
+  isEnumType,
+  isInputObjectType,
+  isInterfaceType,
+  isObjectType,
+  isUnionType,
+  SchemaMetaFieldDef,
+  TypeMetaFieldDef
+} from "graphql";
+function isIntrospectionRoot(name) {
+  return name === "__schema" || name === "__type";
+}
+function introspectionRoot(name) {
+  if (name === "__schema")
+    return SchemaMetaFieldDef;
+  if (name === "__type")
+    return TypeMetaFieldDef;
+  return;
+}
+var largest = new WeakMap;
+var typeCounts = new WeakMap;
+function typeCount(schema) {
+  let count = typeCounts.get(schema);
+  if (count === undefined) {
+    count = Object.keys(schema.getTypeMap()).length;
+    typeCounts.set(schema, count);
+  }
+  return count;
+}
+function largestCount(schema) {
+  const known = largest.get(schema);
+  if (known !== undefined)
+    return known;
+  let max = schema.getDirectives().length;
+  for (const directive of schema.getDirectives()) {
+    max = Math.max(max, directive.args.length, directive.locations.length);
+  }
+  for (const type of Object.values(schema.getTypeMap())) {
+    max = Math.max(max, countsOf(schema, type));
+  }
+  largest.set(schema, max);
+  return max;
+}
+function countsOf(schema, type) {
+  if (isObjectType(type) || isInterfaceType(type)) {
+    const fields = Object.values(type.getFields());
+    return Math.max(fields.length, type.getInterfaces().length, isInterfaceType(type) ? schema.getPossibleTypes(type).length : 0, ...fields.map((field) => field.args.length));
+  }
+  if (isInputObjectType(type))
+    return Object.keys(type.getFields()).length;
+  if (isEnumType(type))
+    return type.getValues().length;
+  if (isUnionType(type))
+    return type.getTypes().length;
+  return 0;
+}
+function introspectionSize(schema, field) {
+  return field === "types" ? typeCount(schema) : largestCount(schema);
+}
+
+// src/limits/max-depth.ts
+function depthOf(depth, selectionSet) {
+  let deepest = 0;
+  for (const selection of selectionSet.selections) {
+    let here = 0;
+    if (selection.kind === "Field") {
+      const name = selection.name.value;
+      if (name === "__typename")
+        continue;
+      if (depth.ignoreIntrospection && isIntrospectionRoot(name))
+        continue;
+      here = 1 + (selection.selectionSet ? depthOf(depth, selection.selectionSet) : 0);
+    } else if (selection.kind === "InlineFragment") {
+      here = depthOf(depth, selection.selectionSet);
+    } else {
+      here = fragmentDepth(depth, selection.name.value);
+    }
+    if (here > deepest)
+      deepest = here;
+  }
+  return deepest;
+}
+function fragmentDepth(depth, name) {
+  const known = depth.fragmentDepths.get(name);
+  if (known !== undefined)
+    return known;
+  const fragment = depth.getFragment(name);
+  if (!fragment || depth.measuring.has(name))
+    return 0;
+  depth.measuring.add(name);
+  const result = depthOf(depth, fragment.selectionSet);
+  depth.measuring.delete(name);
+  depth.fragmentDepths.set(name, result);
+  return result;
+}
+function maxDepth(options) {
+  const limit = options.depth;
+  assertInteger("maxDepth: depth", limit, 1);
+  return (context) => {
+    const walk = {
+      getFragment: (name) => context.getFragment(name),
+      fragmentDepths: new Map,
+      measuring: new Set,
+      ignoreIntrospection: options.ignoreIntrospection ?? false
+    };
+    return {
+      OperationDefinition(operation) {
+        const depth = depthOf(walk, operation.selectionSet);
+        if (depth > limit) {
+          context.reportError(new GraphQLError3(`${operationLabel(operation)} is ${depth} levels deep, more than the ${limit} allowed`, {
+            nodes: [operation],
+            extensions: { code: "QUERY_TOO_DEEP", depth, limit }
+          }));
+        }
+        return false;
+      }
+    };
+  };
+}
+// src/limits/max-list-cost.ts
+import {
+  GraphQLError as GraphQLError4,
+  getNamedType,
+  getNullableType,
+  isInterfaceType as isInterfaceType2,
+  isListType,
+  isObjectType as isObjectType2
+} from "graphql";
+
+// src/limits/list-size.ts
+import {
+  isAbstractType
+} from "graphql";
+var CEILING = Number.MAX_SAFE_INTEGER;
+var CANONICAL_INTEGER = /^(0|[1-9]\d*)$/;
+function sizeOf(value) {
+  if (typeof value === "string") {
+    return CANONICAL_INTEGER.test(value) ? Math.min(Number(value), CEILING) : undefined;
+  }
+  if (typeof value === "bigint") {
+    return value >= 0n ? Math.min(Number(value), CEILING) : undefined;
+  }
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 ? Math.min(value, CEILING) : undefined;
+}
+function literalSize(value) {
+  if (value.kind === "IntValue" || value.kind === "FloatValue") {
+    return sizeOf(Number(value.value));
+  }
+  return value.kind === "StringValue" ? sizeOf(value.value) : undefined;
+}
+function defaultSizeOf(argument) {
+  if (!argument)
+    return;
+  if ("defaultValue" in argument) {
+    const size = sizeOf(argument.defaultValue);
+    if (size !== undefined)
+      return size;
+  }
+  if (!("default" in argument))
+    return;
+  const fallback = argument.default;
+  if (typeof fallback !== "object" || fallback === null)
+    return;
+  if ("value" in fallback)
+    return sizeOf(fallback.value);
+  if ("literal" in fallback && typeof fallback.literal === "object") {
+    const literal = fallback.literal;
+    return literal !== null && "kind" in literal ? literalSize(literal) : undefined;
+  }
+  return;
+}
+var profiles = new WeakMap;
+function profileOf(cost, parent, definition) {
+  let bySizes = profiles.get(cost.schema);
+  if (!bySizes) {
+    bySizes = new WeakMap;
+    profiles.set(cost.schema, bySizes);
+  }
+  let byField = bySizes.get(cost.sizeArguments);
+  if (!byField) {
+    byField = new Map;
+    bySizes.set(cost.sizeArguments, byField);
+  }
+  const key = `${parent?.name}.${definition.name}`;
+  const known = byField.get(key);
+  if (known)
+    return known;
+  const definitions = [definition];
+  if (isAbstractType(parent)) {
+    for (const type of cost.schema.getPossibleTypes(parent)) {
+      const implemented = type.getFields()[definition.name];
+      if (implemented)
+        definitions.push(implemented);
+    }
+  }
+  const profile = {
+    largest: cost.sizeArguments.map(() => {
+      return;
+    }),
+    someLack: cost.sizeArguments.map(() => false),
+    someBare: false
+  };
+  for (const field of definitions) {
+    let any = false;
+    cost.sizeArguments.forEach((name, index) => {
+      const size = defaultSizeOf(field.args.find((arg) => arg.name === name));
+      if (size === undefined) {
+        profile.someLack[index] = true;
+        return;
+      }
+      any = true;
+      profile.largest[index] = Math.max(profile.largest[index] ?? 0, size);
+    });
+    if (!any)
+      profile.someBare = true;
+  }
+  byField.set(key, profile);
+  return profile;
+}
+function argumentSize(cost, profile, index, node) {
+  const largest = profile.largest[index];
+  if (!node)
+    return largest;
+  const literal = literalSize(node.value);
+  if (literal !== undefined)
+    return literal;
+  return profile.someLack[index] ? Math.max(largest ?? 0, cost.defaultFirst) : largest;
+}
+function listSize(cost, parent, definition, args) {
+  const profile = profileOf(cost, parent, definition);
+  let size;
+  let given = false;
+  cost.sizeArguments.forEach((name, index) => {
+    const node = args?.find((arg) => arg.name.value === name);
+    if (node)
+      given = true;
+    const said = argumentSize(cost, profile, index, node);
+    if (said !== undefined)
+      size = Math.max(size ?? 0, said);
+  });
+  if (!given && profile.someBare)
+    size = Math.max(size ?? 0, cost.defaultFirst);
+  return size ?? cost.defaultFirst;
+}
+
+// src/limits/max-list-cost.ts
+var DEFAULT_SIZE_ARGUMENTS = ["first", "last", "limit"];
+var CEILING2 = Number.MAX_SAFE_INTEGER;
+var add = (a, b) => Math.min(CEILING2, a + b);
+var multiply = (a, b) => Math.min(CEILING2, a * b);
+function fieldOf(cost, parent, name) {
+  if (parent === cost.schema.getQueryType() && isIntrospectionRoot(name)) {
+    return introspectionRoot(name);
+  }
+  return isObjectType2(parent) || isInterfaceType2(parent) ? parent.getFields()[name] : undefined;
+}
+function costOf(cost, selectionSet, parent) {
+  let total = 0;
+  for (const selection of selectionSet.selections) {
+    if (selection.kind === "Field") {
+      const name = selection.name.value;
+      if (name === "__typename")
+        continue;
+      if (isIntrospectionRoot(name) && cost.ignoreIntrospection)
+        continue;
+      const definition = fieldOf(cost, parent, name);
+      if (!definition)
+        continue;
+      let inner = 0;
+      if (selection.selectionSet) {
+        inner = costOf(cost, selection.selectionSet, getNamedType(definition.type));
+        if (isListType(getNullableType(definition.type))) {
+          const size = parent?.name.startsWith("__") ? introspectionSize(cost.schema, name) : listSize(cost, parent, definition, selection.arguments);
+          inner = multiply(inner, size);
+        }
+      }
+      total = add(total, add(1, inner));
+    } else if (selection.kind === "InlineFragment") {
+      const condition = selection.typeCondition ? cost.schema.getType(selection.typeCondition.name.value) : parent;
+      total = add(total, costOf(cost, selection.selectionSet, condition));
+    } else {
+      total = add(total, fragmentCost(cost, selection.name.value));
+    }
+  }
+  return total;
+}
+function fragmentCost(cost, name) {
+  const known = cost.fragmentCosts.get(name);
+  if (known !== undefined)
+    return known;
+  const fragment = cost.getFragment(name);
+  if (!fragment || cost.costing.has(name))
+    return 0;
+  cost.costing.add(name);
+  const result = costOf(cost, fragment.selectionSet, cost.schema.getType(fragment.typeCondition.name.value));
+  cost.costing.delete(name);
+  cost.fragmentCosts.set(name, result);
+  return result;
+}
+function rootType(schema, operation) {
+  const type = operation.operation === "query" ? schema.getQueryType() : operation.operation === "mutation" ? schema.getMutationType() : schema.getSubscriptionType();
+  return type ?? undefined;
+}
+function maxListCost(options) {
+  const { budget, defaultFirst } = options;
+  const sizeArguments = Object.freeze([
+    ...options.sizeArguments ?? DEFAULT_SIZE_ARGUMENTS
+  ]);
+  assertInteger("maxListCost: budget", budget, 0);
+  assertInteger("maxListCost: defaultFirst", defaultFirst, 0);
+  return (context) => {
+    const schema = context.getSchema();
+    const cost = {
+      schema,
+      sizeArguments,
+      defaultFirst,
+      ignoreIntrospection: options.ignoreIntrospection ?? false,
+      getFragment: (name) => context.getFragment(name),
+      fragmentCosts: new Map,
+      costing: new Set
+    };
+    return {
+      OperationDefinition(operation) {
+        const total = costOf(cost, operation.selectionSet, rootType(schema, operation));
+        if (total > budget) {
+          context.reportError(new GraphQLError4(`${operationLabel(operation)} costs ${total}, more than the ${budget} allowed`, {
+            nodes: [operation],
+            extensions: {
+              code: "QUERY_TOO_COSTLY",
+              cost: total,
+              limit: budget
+            }
+          }));
+        }
+        return false;
+      }
+    };
+  };
+}
 // src/validated.ts
 import { z } from "zod";
 function validated(schema, resolve) {
@@ -145,21 +506,21 @@ import {
 } from "graphql";
 var wrapped = Symbol.for("@nxgt/graphql-validation/wrapped");
 var wrappedWith = Symbol.for("@nxgt/graphql-validation/formats");
-function checking(schema, where, resolve) {
+function checking(schema, where, resolve, constraintOf) {
   const check = async (source, args, context, info) => await resolve(source, await parseArgs(schema, args, where, constraintOf), context, info);
   check[wrapped] = true;
   return check;
 }
-function wrap(field, args, where, subscription) {
+function wrap(field, args, where, subscription, constraintOf) {
   const subscribe = field.subscribe ?? (subscription ? defaultFieldResolver : undefined);
   if (subscribe) {
     if (!subscribe[wrapped])
-      field.subscribe = checking(args, where, subscribe);
+      field.subscribe = checking(args, where, subscribe, constraintOf);
     return;
   }
   const resolve = field.resolve ?? defaultFieldResolver;
   if (!resolve[wrapped])
-    field.resolve = checking(args, where, resolve);
+    field.resolve = checking(args, where, resolve, constraintOf);
 }
 function withValidation(schema, options = {}) {
   const formats = options.formats ?? {};
@@ -168,9 +529,16 @@ function withValidation(schema, options = {}) {
   if (before && !sameFormats(before, formats)) {
     throw new Error("withValidation: this schema is already wrapped with other formats. Call withValidation once, with every format.");
   }
-  const directive = checkConstraints2(schema, (type, field, args) => {
+  const directive = checkConstraints2(schema, (type, field, args, declared) => {
     const subscription = type === schema.getSubscriptionType();
-    wrap(field, args, `${type.name}.${field.name}`, subscription);
+    const named = (issue) => {
+      const argument = constraintOf(issue);
+      if (!argument)
+        return;
+      const found = declared(issue.path).find(({ rule }) => rule.argument === argument);
+      return found && { argument, value: found.value };
+    };
+    wrap(field, args, `${type.name}.${field.name}`, subscription, named);
   }, formats);
   if (!directive) {
     throw new Error("withValidation: this schema declares no @constraint directive. Add constraintTypeDefs to its type definitions.");
@@ -192,9 +560,11 @@ export {
   fieldsError,
   inputPath,
   invalidInputError,
+  maxDepth,
+  maxListCost,
   validated,
   withValidation
 };
 
-//# debugId=DE46FB4511D84A4364756E2164756E21
+//# debugId=E43868C11AE8F6A464756E2164756E21
 //# sourceMappingURL=index.js.map