@vantreeseba/drizzle-graphql 4.0.0 → 4.1.0

package/README.md

@@ -397,6 +397,52 @@ The build-wide `conflictDoNothing` option is deprecated in favour of this: it ap
 `create*` mutation with no way for a request to opt out. `onConflict: { action: NOTHING }` is
 the per-request replacement.
 
+## Query cost
+
+Generated fields carry a `complexity` hint in their GraphQL extensions, ready for
+[`graphql-query-complexity`](https://github.com/slicknode/graphql-query-complexity)'s
+`fieldExtensionsEstimator`. The generator knows which fields are paginated and which are
+aggregates, so the cost tracks the rows a query can actually pull rather than the number of
+fields it mentions:
+
+| Field | Cost |
+| --- | --- |
+| List query, to-many relation | `(limit ?? defaultListSize) * childComplexity` |
+| Aggregate query, `<relation>Aggregate` | `aggregateCost + childComplexity` |
+| Everything else | no hint — your estimator's default applies |
+
+So `users(limit: 20) { id posts(limit: 5) { id } }` costs `20 * (1 + 5 * 1)` = 120, while the
+same query without limits costs `10 * (1 + 10 * 1)` = 110.
+
+The hints do nothing until you install a complexity rule, so they are generated by default:
+
+```ts
+import { createComplexityRule, fieldExtensionsEstimator, simpleEstimator } from 'graphql-query-complexity';
+
+const rule = createComplexityRule({
+  maximumComplexity: 1000,
+  estimators: [fieldExtensionsEstimator(), simpleEstimator({ defaultComplexity: 1 })],
+});
+```
+
+Tune the two assumptions, or turn the hints off entirely:
+
+```ts
+buildSchema(db, {
+  complexity: { defaultListSize: 25, aggregateCost: 50 },
+});
+
+buildSchema(db, { complexity: false });
+```
+
+### Depth
+
+Cost is not a depth bound. A cyclic relation graph (`user -> posts -> author -> posts -> …`)
+lets a client nest as deep as it likes, and a deep query over cheap fields can stay under any
+complexity ceiling. Put a depth limit in front of a publicly exposed schema as well — e.g.
+[`graphql-depth-limit`](https://github.com/stems/graphql-depth-limit) — or set
+`relationsDepthLimit: 0` to generate no relation fields at all.
+
 ## Error handling
 
 Database drivers put a lot into an error message. Drizzle rethrows them with the full SQL

package/dist/README.md

@@ -397,6 +397,52 @@ The build-wide `conflictDoNothing` option is deprecated in favour of this: it ap
 `create*` mutation with no way for a request to opt out. `onConflict: { action: NOTHING }` is
 the per-request replacement.
 
+## Query cost
+
+Generated fields carry a `complexity` hint in their GraphQL extensions, ready for
+[`graphql-query-complexity`](https://github.com/slicknode/graphql-query-complexity)'s
+`fieldExtensionsEstimator`. The generator knows which fields are paginated and which are
+aggregates, so the cost tracks the rows a query can actually pull rather than the number of
+fields it mentions:
+
+| Field | Cost |
+| --- | --- |
+| List query, to-many relation | `(limit ?? defaultListSize) * childComplexity` |
+| Aggregate query, `<relation>Aggregate` | `aggregateCost + childComplexity` |
+| Everything else | no hint — your estimator's default applies |
+
+So `users(limit: 20) { id posts(limit: 5) { id } }` costs `20 * (1 + 5 * 1)` = 120, while the
+same query without limits costs `10 * (1 + 10 * 1)` = 110.
+
+The hints do nothing until you install a complexity rule, so they are generated by default:
+
+```ts
+import { createComplexityRule, fieldExtensionsEstimator, simpleEstimator } from 'graphql-query-complexity';
+
+const rule = createComplexityRule({
+  maximumComplexity: 1000,
+  estimators: [fieldExtensionsEstimator(), simpleEstimator({ defaultComplexity: 1 })],
+});
+```
+
+Tune the two assumptions, or turn the hints off entirely:
+
+```ts
+buildSchema(db, {
+  complexity: { defaultListSize: 25, aggregateCost: 50 },
+});
+
+buildSchema(db, { complexity: false });
+```
+
+### Depth
+
+Cost is not a depth bound. A cyclic relation graph (`user -> posts -> author -> posts -> …`)
+lets a client nest as deep as it likes, and a deep query over cheap fields can stay under any
+complexity ceiling. Put a depth limit in front of a publicly exposed schema as well — e.g.
+[`graphql-depth-limit`](https://github.com/stems/graphql-depth-limit) — or set
+`relationsDepthLimit: 0` to generate no relation fields at all.
+
 ## Error handling
 
 Database drivers put a lot into an error message. Drizzle rethrows them with the full SQL

package/dist/index.cjs

@@ -650,6 +650,12 @@ var createRelationResolverFactory = (db, tables, filterCtx) => ({ tableName, rel
     return loader.load(localValue);
   };
 };
+var listFieldComplexity = (options) => ({ args, childComplexity }) => {
+  const limit = args["limit"];
+  const rows = typeof limit === "number" && limit > 0 ? limit : options.defaultListSize;
+  return rows * Math.max(childComplexity, 1);
+};
+var aggregateFieldComplexity = (options) => ({ childComplexity }) => options.aggregateCost + childComplexity;
 var AGGREGATE_FIELD_SUFFIX = "Aggregate";
 var relationAggregateJoinColumns = (tree, table, selectionCtx) => {
   const relations = selectionCtx?.relationMap[selectionCtx.tableName];
@@ -1071,7 +1077,8 @@ var generateSelectFields = (tables, tableName, relationMap, fromTableName, fromR
             offset: { type: import_graphql4.GraphQLInt },
             limit: { type: import_graphql4.GraphQLInt }
           },
-          resolve
+          resolve,
+          ...cacheCtx.complexity ? { extensions: { complexity: listFieldComplexity(cacheCtx.complexity) } } : {}
         }
       ]);
       const aggregateFieldName = `${relationName}Aggregate`;
@@ -1089,7 +1096,8 @@ var generateSelectFields = (tables, tableName, relationMap, fromTableName, fromR
               args: {
                 where: { type: relSelectData.filters }
               },
-              resolve: relationAggregate.resolve
+              resolve: relationAggregate.resolve,
+              ...cacheCtx.complexity ? { extensions: { complexity: aggregateFieldComplexity(cacheCtx.complexity) } } : {}
             }
           ]);
         }
@@ -2366,7 +2374,7 @@ var generateDelete = (db, tableName, table, filterArgs, fieldName, filterCtx) =>
 };
 var mysqlPrimaryKeyPropNames = (table) => getPrimaryKeyPropNamesFromConfig(table, import_mysql_core2.getTableConfig);
 var generateSchemaData = (db, schema, relations, options) => {
-  const { relationsDepthLimit, prefixes, suffixes, typeNameMapper, shouldEagerLoad, features } = options;
+  const { relationsDepthLimit, prefixes, suffixes, typeNameMapper, shouldEagerLoad, features, complexity } = options;
   const rawSchema = schema;
   const schemaEntries = Object.entries(rawSchema);
   const tableEntries = schemaEntries.filter(([_key, value]) => (0, import_drizzle_orm5.is)(value, import_mysql_core2.MySqlTable));
@@ -2390,7 +2398,8 @@ var generateSchemaData = (db, schema, relations, options) => {
     orderTypeCache: /* @__PURE__ */ new WeakMap(),
     filterTypeCache: /* @__PURE__ */ new WeakMap(),
     listRelationFilterCache: /* @__PURE__ */ new Map(),
-    aggregateTypeCache: /* @__PURE__ */ new Map()
+    aggregateTypeCache: /* @__PURE__ */ new Map(),
+    complexity
   };
   const relationAggregateFactory = features.relationAggregates ? createRelationAggregateFactory(db, tables, cacheCtx, typeNameMapper, filterCtx) : void 0;
   const queries = {};
@@ -2500,7 +2509,8 @@ var generateSchemaData = (db, schema, relations, options) => {
     queries[selectArrGenerated.name] = {
       type: selectArrOutput,
       args: selectArrGenerated.args,
-      resolve: selectArrGenerated.resolver
+      resolve: selectArrGenerated.resolver,
+      ...complexity ? { extensions: { complexity: listFieldComplexity(complexity) } } : {}
     };
     queries[selectSingleGenerated.name] = {
       type: selectSingleOutput,
@@ -2511,7 +2521,8 @@ var generateSchemaData = (db, schema, relations, options) => {
       queries[aggregateGenerated.name] = {
         type: new import_graphql6.GraphQLNonNull(aggregateType),
         args: aggregateGenerated.args,
-        resolve: aggregateGenerated.resolver
+        resolve: aggregateGenerated.resolver,
+        ...complexity ? { extensions: { complexity: aggregateFieldComplexity(complexity) } } : {}
       };
     }
     for (const generated of [
@@ -2938,7 +2949,16 @@ var generateDelete2 = (db, tableName, table, filterArgs, fieldName, typeName, fi
   };
 };
 function generateSchemaData2(db, schema, relations, options) {
-  const { relationsDepthLimit, prefixes, suffixes, conflictDoNothing, typeNameMapper, shouldEagerLoad, features } = options;
+  const {
+    relationsDepthLimit,
+    prefixes,
+    suffixes,
+    conflictDoNothing,
+    typeNameMapper,
+    shouldEagerLoad,
+    features,
+    complexity
+  } = options;
   const schemaEntries = Object.entries(schema);
   const tableEntries = schemaEntries.filter(([_key, value]) => (0, import_drizzle_orm6.is)(value, import_pg_core2.PgTable));
   const tables = Object.fromEntries(tableEntries);
@@ -2961,7 +2981,8 @@ function generateSchemaData2(db, schema, relations, options) {
     orderTypeCache: /* @__PURE__ */ new WeakMap(),
     filterTypeCache: /* @__PURE__ */ new WeakMap(),
     listRelationFilterCache: /* @__PURE__ */ new Map(),
-    aggregateTypeCache: /* @__PURE__ */ new Map()
+    aggregateTypeCache: /* @__PURE__ */ new Map(),
+    complexity
   };
   const relationAggregateFactory = features.relationAggregates ? createRelationAggregateFactory(db, tables, cacheCtx, typeNameMapper, filterCtx) : void 0;
   const queries = {};
@@ -3124,7 +3145,8 @@ function generateSchemaData2(db, schema, relations, options) {
     queries[selectArrGenerated.name] = {
       type: selectArrOutput,
       args: selectArrGenerated.args,
-      resolve: selectArrGenerated.resolver
+      resolve: selectArrGenerated.resolver,
+      ...complexity ? { extensions: { complexity: listFieldComplexity(complexity) } } : {}
     };
     queries[selectSingleGenerated.name] = {
       type: selectSingleOutput,
@@ -3135,7 +3157,8 @@ function generateSchemaData2(db, schema, relations, options) {
       queries[aggregateGenerated.name] = {
         type: new import_graphql7.GraphQLNonNull(aggregateType),
         args: aggregateGenerated.args,
-        resolve: aggregateGenerated.resolver
+        resolve: aggregateGenerated.resolver,
+        ...complexity ? { extensions: { complexity: aggregateFieldComplexity(complexity) } } : {}
       };
     }
     if (insertArrGenerated) {
@@ -3527,7 +3550,16 @@ var generateDelete3 = (db, tableName, table, filterArgs, fieldName, typeName, fi
   };
 };
 var generateSchemaData3 = (db, schema, relations, options) => {
-  const { relationsDepthLimit, prefixes, suffixes, conflictDoNothing, typeNameMapper, shouldEagerLoad, features } = options;
+  const {
+    relationsDepthLimit,
+    prefixes,
+    suffixes,
+    conflictDoNothing,
+    typeNameMapper,
+    shouldEagerLoad,
+    features,
+    complexity
+  } = options;
   const rawSchema = schema;
   const schemaEntries = Object.entries(rawSchema);
   const tableEntries = schemaEntries.filter(([_key, value]) => (0, import_drizzle_orm7.is)(value, import_sqlite_core2.SQLiteTable));
@@ -3551,7 +3583,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
     orderTypeCache: /* @__PURE__ */ new WeakMap(),
     filterTypeCache: /* @__PURE__ */ new WeakMap(),
     listRelationFilterCache: /* @__PURE__ */ new Map(),
-    aggregateTypeCache: /* @__PURE__ */ new Map()
+    aggregateTypeCache: /* @__PURE__ */ new Map(),
+    complexity
   };
   const relationAggregateFactory = features.relationAggregates ? createRelationAggregateFactory(db, tables, cacheCtx, typeNameMapper, filterCtx) : void 0;
   const queries = {};
@@ -3714,7 +3747,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
     queries[selectArrGenerated.name] = {
       type: selectArrOutput,
       args: selectArrGenerated.args,
-      resolve: selectArrGenerated.resolver
+      resolve: selectArrGenerated.resolver,
+      ...complexity ? { extensions: { complexity: listFieldComplexity(complexity) } } : {}
     };
     queries[selectSingleGenerated.name] = {
       type: selectSingleOutput,
@@ -3725,7 +3759,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       queries[aggregateGenerated.name] = {
         type: new import_graphql8.GraphQLNonNull(aggregateType),
         args: aggregateGenerated.args,
-        resolve: aggregateGenerated.resolver
+        resolve: aggregateGenerated.resolver,
+        ...complexity ? { extensions: { complexity: aggregateFieldComplexity(complexity) } } : {}
       };
     }
     if (insertArrGenerated) {
@@ -3835,6 +3870,11 @@ var buildSchema = (db, config) => {
     delete: config?.features?.delete ?? true,
     upsert: config?.features?.upsert ?? false
   };
+  const complexityConfig = config?.complexity ?? true;
+  const complexity = complexityConfig === false ? void 0 : {
+    defaultListSize: (complexityConfig === true ? void 0 : complexityConfig.defaultListSize) ?? 10,
+    aggregateCost: (complexityConfig === true ? void 0 : complexityConfig.aggregateCost) ?? 10
+  };
   const eagerOpt = config?.eagerLoadRelations;
   const shouldEagerLoad = eagerOpt === void 0 || eagerOpt === true ? () => true : eagerOpt === false ? () => false : eagerOpt;
   if (!typeNameMapper && suffixes.list === suffixes.single) {
@@ -3861,7 +3901,8 @@ var buildSchema = (db, config) => {
     conflictDoNothing: config?.conflictDoNothing ?? false,
     typeNameMapper,
     shouldEagerLoad,
-    features
+    features,
+    complexity
   };
   let generatorOutput;
   if ((0, import_drizzle_orm8.is)(db, import_mysql_core3.MySqlDatabase)) {