@zuplo/graphql 6.52.4 → 6.52.6

package/out/types/index.d.ts

@@ -1,20 +1,79 @@
 import { InboundPolicyHandler } from '@zuplo/runtime';
 
 /**
- * Limits the complexity of a GraphQL query
+ * Policy that limits the complexity and depth of GraphQL queries to prevent abuse.
+ * Protects your GraphQL API from expensive queries that could cause performance issues
+ * or denial of service attacks.
  *
  * @title GraphQL Complexity Limit
  * @public
- * @param request - The ZuploRequest
+ *
+ * @param request - The incoming ZuploRequest containing the GraphQL query
  * @param context - The ZuploContext
- * @param options - The policy options set in policies.json
- * @param policyName - The name of the policy as set in policies.json
- * @returns A Request or a Response
+ * @param options - Configuration for complexity and depth limits
+ * @param policyName - The name of the policy instance
+ * @returns The request if within limits, or a 400 response if limits exceeded
+ *
+ * @example
+ * ```json
+ * // policies.json - Limit query complexity
+ * {
+ *   "name": "graphql-complexity",
+ *   "policyType": "graphql-complexity-limit-inbound",
+ *   "handler": {
+ *     "export": "GraphQLComplexityLimitInboundPolicy",
+ *     "module": "$import(@zuplo/graphql)",
+ *     "options": {
+ *       "useComplexityLimit": {
+ *         "complexityLimit": 1000,
+ *         "endpointUrl": "https://api.example.com/graphql"
+ *       }
+ *     }
+ *   }
+ * }
+ * ```
+ *
+ * @example
+ * ```json
+ * // Limit query depth to prevent deeply nested queries
+ * {
+ *   "handler": {
+ *     "export": "GraphQLComplexityLimitInboundPolicy",
+ *     "module": "$import(@zuplo/graphql)",
+ *     "options": {
+ *       "useDepthLimit": {
+ *         "depthLimit": 10
+ *       }
+ *     }
+ *   }
+ * }
+ * ```
+ *
+ * @example
+ * ```json
+ * // Use both complexity and depth limits
+ * {
+ *   "handler": {
+ *     "export": "GraphQLComplexityLimitInboundPolicy",
+ *     "module": "$import(@zuplo/graphql)",
+ *     "options": {
+ *       "useComplexityLimit": {
+ *         "complexityLimit": 500,
+ *         "endpointUrl": "$env(GRAPHQL_ENDPOINT)"
+ *       },
+ *       "useDepthLimit": {
+ *         "depthLimit": 7
+ *       }
+ *     }
+ *   }
+ * }
+ * ```
  */
 export declare const GraphQLComplexityLimitInboundPolicy: InboundPolicyHandler<GraphQLComplexityLimitInboundPolicyOptions>;
 
 /**
  * The options for this policy.
+ * @public
  */
 export declare interface GraphQLComplexityLimitInboundPolicyOptions {
     useComplexityLimit: {
@@ -40,20 +99,65 @@ export declare interface GraphQLComplexityLimitInboundPolicyOptions {
 }
 
 /**
- * Disables introspection queries on your API.
+ * Policy that disables GraphQL introspection queries in production.
+ * Introspection allows clients to discover the schema, which can be a security
+ * risk as it exposes your entire API structure.
  *
  * @title GraphQL Disable Introspection
  * @public
- * @param request - The ZuploRequest
+ *
+ * @param request - The incoming ZuploRequest containing the GraphQL query
  * @param context - The ZuploContext
- * @param options - The policy options set in policies.json
- * @param policyName - The name of the policy as set in policies.json
- * @returns A Request or a Response
+ * @param options - Policy configuration options
+ * @param policyName - The name of the policy instance
+ * @returns The request if not an introspection query, or a 403 response if introspection is attempted
+ *
+ * @example
+ * ```json
+ * // policies.json - Disable introspection in production
+ * {
+ *   "name": "disable-introspection",
+ *   "policyType": "graphql-disable-introspection-inbound",
+ *   "handler": {
+ *     "export": "GraphQLDisableIntrospectionInboundPolicy",
+ *     "module": "$import(@zuplo/graphql)"
+ *   }
+ * }
+ * ```
+ *
+ * @example
+ * ```json
+ * // Apply to specific routes
+ * {
+ *   "paths": {
+ *     "/graphql": {
+ *       "post": {
+ *         "x-zuplo-route": {
+ *           "policies": {
+ *             "inbound": ["disable-introspection", "rate-limit"]
+ *           },
+ *           "handler": {
+ *             "export": "graphqlHandler",
+ *             "module": "$import(./handlers/graphql)"
+ *           }
+ *         }
+ *       }
+ *     }
+ *   }
+ * }
+ * ```
+ *
+ * @remarks
+ * This policy blocks queries containing __schema or __type fields,
+ * which are used by GraphQL introspection. It's recommended to disable
+ * introspection in production environments while keeping it enabled
+ * in development for tooling support.
  */
 export declare const GraphQLDisableIntrospectionInboundPolicy: InboundPolicyHandler<GraphqlDisableIntrospectionInboundPolicyOptions>;
 
 /**
  * The options for this policy.
+ * @public
  */
 export declare interface GraphqlDisableIntrospectionInboundPolicyOptions {
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/graphql",
   "type": "module",
-  "version": "6.52.4",
+  "version": "6.52.6",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {
@@ -31,6 +31,6 @@
     "graphql": "^16.8.1"
   },
   "peerDependencies": {
-    "@zuplo/runtime": "6.52.4"
+    "@zuplo/runtime": "6.52.6"
   }
 }