graphql 16.8.1 → 16.9.0

package/utilities/getIntrospectionQuery.d.ts

@@ -26,6 +26,11 @@ export interface IntrospectionOptions {
    * Default: false
    */
   inputValueDeprecation?: boolean;
+  /**
+   * Whether target GraphQL server supports `@oneOf` input objects.
+   * Default: false
+   */
+  oneOf?: boolean;
 }
 /**
  * Produce the GraphQL query recommended for a full schema introspection.
@@ -112,6 +117,7 @@ export interface IntrospectionInputObjectType {
   readonly name: string;
   readonly description?: Maybe<string>;
   readonly inputFields: ReadonlyArray<IntrospectionInputValue>;
+  readonly isOneOf: boolean;
 }
 export interface IntrospectionListTypeRef<
   T extends IntrospectionTypeRef = IntrospectionTypeRef,

package/utilities/getIntrospectionQuery.js

@@ -16,6 +16,7 @@ function getIntrospectionQuery(options) {
     directiveIsRepeatable: false,
     schemaDescription: false,
     inputValueDeprecation: false,
+    oneOf: false,
     ...options,
   };
   const descriptions = optionsWithDefault.descriptions ? 'description' : '';
@@ -33,6 +34,7 @@ function getIntrospectionQuery(options) {
     return optionsWithDefault.inputValueDeprecation ? str : '';
   }
 
+  const oneOf = optionsWithDefault.oneOf ? 'isOneOf' : '';
   return `
     query IntrospectionQuery {
       __schema {
@@ -60,6 +62,7 @@ function getIntrospectionQuery(options) {
       name
       ${descriptions}
       ${specifiedByUrl}
+      ${oneOf}
       fields(includeDeprecated: true) {
         name
         ${descriptions}

package/utilities/getIntrospectionQuery.mjs

@@ -9,6 +9,7 @@ export function getIntrospectionQuery(options) {
     directiveIsRepeatable: false,
     schemaDescription: false,
     inputValueDeprecation: false,
+    oneOf: false,
     ...options,
   };
   const descriptions = optionsWithDefault.descriptions ? 'description' : '';
@@ -26,6 +27,7 @@ export function getIntrospectionQuery(options) {
     return optionsWithDefault.inputValueDeprecation ? str : '';
   }
 
+  const oneOf = optionsWithDefault.oneOf ? 'isOneOf' : '';
   return `
     query IntrospectionQuery {
       __schema {
@@ -53,6 +55,7 @@ export function getIntrospectionQuery(options) {
       name
       ${descriptions}
       ${specifiedByUrl}
+      ${oneOf}
       fields(includeDeprecated: true) {
         name
         ${descriptions}

package/utilities/introspectionFromSchema.js

@@ -28,6 +28,7 @@ function introspectionFromSchema(schema, options) {
     directiveIsRepeatable: true,
     schemaDescription: true,
     inputValueDeprecation: true,
+    oneOf: true,
     ...options,
   };
   const document = (0, _parser.parse)(

package/utilities/introspectionFromSchema.mjs

@@ -18,6 +18,7 @@ export function introspectionFromSchema(schema, options) {
     directiveIsRepeatable: true,
     schemaDescription: true,
     inputValueDeprecation: true,
+    oneOf: true,
     ...options,
   };
   const document = parse(getIntrospectionQuery(optionsWithDefaults));

package/utilities/printSchema.js

@@ -214,7 +214,12 @@ function printInputObject(type) {
   const fields = Object.values(type.getFields()).map(
     (f, i) => printDescription(f, '  ', !i) + '  ' + printInputValue(f),
   );
-  return printDescription(type) + `input ${type.name}` + printBlock(fields);
+  return (
+    printDescription(type) +
+    `input ${type.name}` +
+    (type.isOneOf ? ' @oneOf' : '') +
+    printBlock(fields)
+  );
 }
 
 function printFields(type) {

package/utilities/printSchema.mjs

@@ -193,7 +193,12 @@ function printInputObject(type) {
   const fields = Object.values(type.getFields()).map(
     (f, i) => printDescription(f, '  ', !i) + '  ' + printInputValue(f),
   );
-  return printDescription(type) + `input ${type.name}` + printBlock(fields);
+  return (
+    printDescription(type) +
+    `input ${type.name}` +
+    (type.isOneOf ? ' @oneOf' : '') +
+    printBlock(fields)
+  );
 }
 
 function printFields(type) {

package/utilities/valueFromAST.js

@@ -145,6 +145,18 @@ function valueFromAST(valueNode, type, variables) {
       coercedObj[field.name] = fieldValue;
     }
 
+    if (type.isOneOf) {
+      const keys = Object.keys(coercedObj);
+
+      if (keys.length !== 1) {
+        return; // Invalid: not exactly one key, intentionally return no value.
+      }
+
+      if (coercedObj[keys[0]] === null) {
+        return; // Invalid: value not non-null, intentionally return no value.
+      }
+    }
+
     return coercedObj;
   }
 

package/utilities/valueFromAST.mjs

@@ -136,6 +136,18 @@ export function valueFromAST(valueNode, type, variables) {
       coercedObj[field.name] = fieldValue;
     }
 
+    if (type.isOneOf) {
+      const keys = Object.keys(coercedObj);
+
+      if (keys.length !== 1) {
+        return; // Invalid: not exactly one key, intentionally return no value.
+      }
+
+      if (coercedObj[keys[0]] === null) {
+        return; // Invalid: value not non-null, intentionally return no value.
+      }
+    }
+
     return coercedObj;
   }
 

package/validation/index.d.ts

@@ -1,7 +1,7 @@
 export { validate } from './validate';
 export { ValidationContext } from './ValidationContext';
 export type { ValidationRule } from './ValidationContext';
-export { specifiedRules } from './specifiedRules';
+export { specifiedRules, recommendedRules } from './specifiedRules';
 export { ExecutableDefinitionsRule } from './rules/ExecutableDefinitionsRule';
 export { FieldsOnCorrectTypeRule } from './rules/FieldsOnCorrectTypeRule';
 export { FragmentsOnCompositeTypesRule } from './rules/FragmentsOnCompositeTypesRule';
@@ -28,6 +28,7 @@ export { UniqueVariableNamesRule } from './rules/UniqueVariableNamesRule';
 export { ValuesOfCorrectTypeRule } from './rules/ValuesOfCorrectTypeRule';
 export { VariablesAreInputTypesRule } from './rules/VariablesAreInputTypesRule';
 export { VariablesInAllowedPositionRule } from './rules/VariablesInAllowedPositionRule';
+export { MaxIntrospectionDepthRule } from './rules/MaxIntrospectionDepthRule';
 export { LoneSchemaDefinitionRule } from './rules/LoneSchemaDefinitionRule';
 export { UniqueOperationTypesRule } from './rules/UniqueOperationTypesRule';
 export { UniqueTypeNamesRule } from './rules/UniqueTypeNamesRule';

package/validation/index.js

@@ -57,6 +57,12 @@ Object.defineProperty(exports, 'LoneSchemaDefinitionRule', {
     return _LoneSchemaDefinitionRule.LoneSchemaDefinitionRule;
   },
 });
+Object.defineProperty(exports, 'MaxIntrospectionDepthRule', {
+  enumerable: true,
+  get: function () {
+    return _MaxIntrospectionDepthRule.MaxIntrospectionDepthRule;
+  },
+});
 Object.defineProperty(exports, 'NoDeprecatedCustomRule', {
   enumerable: true,
   get: function () {
@@ -225,6 +231,12 @@ Object.defineProperty(exports, 'VariablesInAllowedPositionRule', {
     return _VariablesInAllowedPositionRule.VariablesInAllowedPositionRule;
   },
 });
+Object.defineProperty(exports, 'recommendedRules', {
+  enumerable: true,
+  get: function () {
+    return _specifiedRules.recommendedRules;
+  },
+});
 Object.defineProperty(exports, 'specifiedRules', {
   enumerable: true,
   get: function () {
@@ -296,6 +308,8 @@ var _VariablesAreInputTypesRule = require('./rules/VariablesAreInputTypesRule.js
 
 var _VariablesInAllowedPositionRule = require('./rules/VariablesInAllowedPositionRule.js');
 
+var _MaxIntrospectionDepthRule = require('./rules/MaxIntrospectionDepthRule.js');
+
 var _LoneSchemaDefinitionRule = require('./rules/LoneSchemaDefinitionRule.js');
 
 var _UniqueOperationTypesRule = require('./rules/UniqueOperationTypesRule.js');

package/validation/index.mjs

@@ -1,7 +1,7 @@
 export { validate } from './validate.mjs';
 export { ValidationContext } from './ValidationContext.mjs';
 // All validation rules in the GraphQL Specification.
-export { specifiedRules } from './specifiedRules.mjs'; // Spec Section: "Executable Definitions"
+export { specifiedRules, recommendedRules } from './specifiedRules.mjs'; // Spec Section: "Executable Definitions"
 
 export { ExecutableDefinitionsRule } from './rules/ExecutableDefinitionsRule.mjs'; // Spec Section: "Field Selections on Objects, Interfaces, and Unions Types"
 
@@ -53,7 +53,8 @@ export { ValuesOfCorrectTypeRule } from './rules/ValuesOfCorrectTypeRule.mjs'; /
 
 export { VariablesAreInputTypesRule } from './rules/VariablesAreInputTypesRule.mjs'; // Spec Section: "All Variable Usages Are Allowed"
 
-export { VariablesInAllowedPositionRule } from './rules/VariablesInAllowedPositionRule.mjs'; // SDL-specific validation rules
+export { VariablesInAllowedPositionRule } from './rules/VariablesInAllowedPositionRule.mjs';
+export { MaxIntrospectionDepthRule } from './rules/MaxIntrospectionDepthRule.mjs'; // SDL-specific validation rules
 
 export { LoneSchemaDefinitionRule } from './rules/LoneSchemaDefinitionRule.mjs';
 export { UniqueOperationTypesRule } from './rules/UniqueOperationTypesRule.mjs';

package/validation/rules/MaxIntrospectionDepthRule.d.ts

@@ -0,0 +1,5 @@
+import type { ASTVisitor } from '../../language/visitor';
+import type { ASTValidationContext } from '../ValidationContext';
+export declare function MaxIntrospectionDepthRule(
+  context: ASTValidationContext,
+): ASTVisitor;

package/validation/rules/MaxIntrospectionDepthRule.js

@@ -0,0 +1,90 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', {
+  value: true,
+});
+exports.MaxIntrospectionDepthRule = MaxIntrospectionDepthRule;
+
+var _GraphQLError = require('../../error/GraphQLError.js');
+
+var _kinds = require('../../language/kinds.js');
+
+const MAX_LISTS_DEPTH = 3;
+
+function MaxIntrospectionDepthRule(context) {
+  /**
+   * Counts the depth of list fields in "__Type" recursively and
+   * returns `true` if the limit has been reached.
+   */
+  function checkDepth(node, visitedFragments = Object.create(null), depth = 0) {
+    if (node.kind === _kinds.Kind.FRAGMENT_SPREAD) {
+      const fragmentName = node.name.value;
+
+      if (visitedFragments[fragmentName] === true) {
+        // Fragment cycles are handled by `NoFragmentCyclesRule`.
+        return false;
+      }
+
+      const fragment = context.getFragment(fragmentName);
+
+      if (!fragment) {
+        // Missing fragments checks are handled by `KnownFragmentNamesRule`.
+        return false;
+      } // Rather than following an immutable programming pattern which has
+      // significant memory and garbage collection overhead, we've opted to
+      // take a mutable approach for efficiency's sake. Importantly visiting a
+      // fragment twice is fine, so long as you don't do one visit inside the
+      // other.
+
+      try {
+        visitedFragments[fragmentName] = true;
+        return checkDepth(fragment, visitedFragments, depth);
+      } finally {
+        visitedFragments[fragmentName] = undefined;
+      }
+    }
+
+    if (
+      node.kind === _kinds.Kind.FIELD && // check all introspection lists
+      (node.name.value === 'fields' ||
+        node.name.value === 'interfaces' ||
+        node.name.value === 'possibleTypes' ||
+        node.name.value === 'inputFields')
+    ) {
+      // eslint-disable-next-line no-param-reassign
+      depth++;
+
+      if (depth >= MAX_LISTS_DEPTH) {
+        return true;
+      }
+    } // handles fields and inline fragments
+
+    if ('selectionSet' in node && node.selectionSet) {
+      for (const child of node.selectionSet.selections) {
+        if (checkDepth(child, visitedFragments, depth)) {
+          return true;
+        }
+      }
+    }
+
+    return false;
+  }
+
+  return {
+    Field(node) {
+      if (node.name.value === '__schema' || node.name.value === '__type') {
+        if (checkDepth(node)) {
+          context.reportError(
+            new _GraphQLError.GraphQLError(
+              'Maximum introspection depth exceeded',
+              {
+                nodes: [node],
+              },
+            ),
+          );
+          return false;
+        }
+      }
+    },
+  };
+}

package/validation/rules/MaxIntrospectionDepthRule.mjs

@@ -0,0 +1,77 @@
+import { GraphQLError } from '../../error/GraphQLError.mjs';
+import { Kind } from '../../language/kinds.mjs';
+const MAX_LISTS_DEPTH = 3;
+export function MaxIntrospectionDepthRule(context) {
+  /**
+   * Counts the depth of list fields in "__Type" recursively and
+   * returns `true` if the limit has been reached.
+   */
+  function checkDepth(node, visitedFragments = Object.create(null), depth = 0) {
+    if (node.kind === Kind.FRAGMENT_SPREAD) {
+      const fragmentName = node.name.value;
+
+      if (visitedFragments[fragmentName] === true) {
+        // Fragment cycles are handled by `NoFragmentCyclesRule`.
+        return false;
+      }
+
+      const fragment = context.getFragment(fragmentName);
+
+      if (!fragment) {
+        // Missing fragments checks are handled by `KnownFragmentNamesRule`.
+        return false;
+      } // Rather than following an immutable programming pattern which has
+      // significant memory and garbage collection overhead, we've opted to
+      // take a mutable approach for efficiency's sake. Importantly visiting a
+      // fragment twice is fine, so long as you don't do one visit inside the
+      // other.
+
+      try {
+        visitedFragments[fragmentName] = true;
+        return checkDepth(fragment, visitedFragments, depth);
+      } finally {
+        visitedFragments[fragmentName] = undefined;
+      }
+    }
+
+    if (
+      node.kind === Kind.FIELD && // check all introspection lists
+      (node.name.value === 'fields' ||
+        node.name.value === 'interfaces' ||
+        node.name.value === 'possibleTypes' ||
+        node.name.value === 'inputFields')
+    ) {
+      // eslint-disable-next-line no-param-reassign
+      depth++;
+
+      if (depth >= MAX_LISTS_DEPTH) {
+        return true;
+      }
+    } // handles fields and inline fragments
+
+    if ('selectionSet' in node && node.selectionSet) {
+      for (const child of node.selectionSet.selections) {
+        if (checkDepth(child, visitedFragments, depth)) {
+          return true;
+        }
+      }
+    }
+
+    return false;
+  }
+
+  return {
+    Field(node) {
+      if (node.name.value === '__schema' || node.name.value === '__type') {
+        if (checkDepth(node)) {
+          context.reportError(
+            new GraphQLError('Maximum introspection depth exceeded', {
+              nodes: [node],
+            }),
+          );
+          return false;
+        }
+      }
+    },
+  };
+}

package/validation/rules/ValuesOfCorrectTypeRule.js

@@ -15,6 +15,8 @@ var _suggestionList = require('../../jsutils/suggestionList.js');
 
 var _GraphQLError = require('../../error/GraphQLError.js');
 
+var _kinds = require('../../language/kinds.js');
+
 var _printer = require('../../language/printer.js');
 
 var _definition = require('../../type/definition.js');
@@ -28,7 +30,18 @@ var _definition = require('../../type/definition.js');
  * See https://spec.graphql.org/draft/#sec-Values-of-Correct-Type
  */
 function ValuesOfCorrectTypeRule(context) {
+  let variableDefinitions = {};
   return {
+    OperationDefinition: {
+      enter() {
+        variableDefinitions = {};
+      },
+    },
+
+    VariableDefinition(definition) {
+      variableDefinitions[definition.variable.name.value] = definition;
+    },
+
     ListValue(node) {
       // Note: TypeInfo will traverse into a list's item type, so look to the
       // parent input type to check if it is a list.
@@ -70,6 +83,16 @@ function ValuesOfCorrectTypeRule(context) {
           );
         }
       }
+
+      if (type.isOneOf) {
+        validateOneOfInputObject(
+          context,
+          node,
+          type,
+          fieldNodeMap,
+          variableDefinitions,
+        );
+      }
     },
 
     ObjectField(node) {
@@ -190,3 +213,68 @@ function isValidValueNode(context, node) {
     }
   }
 }
+
+function validateOneOfInputObject(
+  context,
+  node,
+  type,
+  fieldNodeMap,
+  variableDefinitions,
+) {
+  var _fieldNodeMap$keys$;
+
+  const keys = Object.keys(fieldNodeMap);
+  const isNotExactlyOneField = keys.length !== 1;
+
+  if (isNotExactlyOneField) {
+    context.reportError(
+      new _GraphQLError.GraphQLError(
+        `OneOf Input Object "${type.name}" must specify exactly one key.`,
+        {
+          nodes: [node],
+        },
+      ),
+    );
+    return;
+  }
+
+  const value =
+    (_fieldNodeMap$keys$ = fieldNodeMap[keys[0]]) === null ||
+    _fieldNodeMap$keys$ === void 0
+      ? void 0
+      : _fieldNodeMap$keys$.value;
+  const isNullLiteral = !value || value.kind === _kinds.Kind.NULL;
+  const isVariable =
+    (value === null || value === void 0 ? void 0 : value.kind) ===
+    _kinds.Kind.VARIABLE;
+
+  if (isNullLiteral) {
+    context.reportError(
+      new _GraphQLError.GraphQLError(
+        `Field "${type.name}.${keys[0]}" must be non-null.`,
+        {
+          nodes: [node],
+        },
+      ),
+    );
+    return;
+  }
+
+  if (isVariable) {
+    const variableName = value.name.value;
+    const definition = variableDefinitions[variableName];
+    const isNullableVariable =
+      definition.type.kind !== _kinds.Kind.NON_NULL_TYPE;
+
+    if (isNullableVariable) {
+      context.reportError(
+        new _GraphQLError.GraphQLError(
+          `Variable "${variableName}" must be non-nullable to be used for OneOf Input Object "${type.name}".`,
+          {
+            nodes: [node],
+          },
+        ),
+      );
+    }
+  }
+}

package/validation/rules/ValuesOfCorrectTypeRule.mjs

@@ -3,6 +3,7 @@ import { inspect } from '../../jsutils/inspect.mjs';
 import { keyMap } from '../../jsutils/keyMap.mjs';
 import { suggestionList } from '../../jsutils/suggestionList.mjs';
 import { GraphQLError } from '../../error/GraphQLError.mjs';
+import { Kind } from '../../language/kinds.mjs';
 import { print } from '../../language/printer.mjs';
 import {
   getNamedType,
@@ -23,7 +24,18 @@ import {
  * See https://spec.graphql.org/draft/#sec-Values-of-Correct-Type
  */
 export function ValuesOfCorrectTypeRule(context) {
+  let variableDefinitions = {};
   return {
+    OperationDefinition: {
+      enter() {
+        variableDefinitions = {};
+      },
+    },
+
+    VariableDefinition(definition) {
+      variableDefinitions[definition.variable.name.value] = definition;
+    },
+
     ListValue(node) {
       // Note: TypeInfo will traverse into a list's item type, so look to the
       // parent input type to check if it is a list.
@@ -60,6 +72,16 @@ export function ValuesOfCorrectTypeRule(context) {
           );
         }
       }
+
+      if (type.isOneOf) {
+        validateOneOfInputObject(
+          context,
+          node,
+          type,
+          fieldNodeMap,
+          variableDefinitions,
+        );
+      }
     },
 
     ObjectField(node) {
@@ -171,3 +193,64 @@ function isValidValueNode(context, node) {
     }
   }
 }
+
+function validateOneOfInputObject(
+  context,
+  node,
+  type,
+  fieldNodeMap,
+  variableDefinitions,
+) {
+  var _fieldNodeMap$keys$;
+
+  const keys = Object.keys(fieldNodeMap);
+  const isNotExactlyOneField = keys.length !== 1;
+
+  if (isNotExactlyOneField) {
+    context.reportError(
+      new GraphQLError(
+        `OneOf Input Object "${type.name}" must specify exactly one key.`,
+        {
+          nodes: [node],
+        },
+      ),
+    );
+    return;
+  }
+
+  const value =
+    (_fieldNodeMap$keys$ = fieldNodeMap[keys[0]]) === null ||
+    _fieldNodeMap$keys$ === void 0
+      ? void 0
+      : _fieldNodeMap$keys$.value;
+  const isNullLiteral = !value || value.kind === Kind.NULL;
+  const isVariable =
+    (value === null || value === void 0 ? void 0 : value.kind) ===
+    Kind.VARIABLE;
+
+  if (isNullLiteral) {
+    context.reportError(
+      new GraphQLError(`Field "${type.name}.${keys[0]}" must be non-null.`, {
+        nodes: [node],
+      }),
+    );
+    return;
+  }
+
+  if (isVariable) {
+    const variableName = value.name.value;
+    const definition = variableDefinitions[variableName];
+    const isNullableVariable = definition.type.kind !== Kind.NON_NULL_TYPE;
+
+    if (isNullableVariable) {
+      context.reportError(
+        new GraphQLError(
+          `Variable "${variableName}" must be non-nullable to be used for OneOf Input Object "${type.name}".`,
+          {
+            nodes: [node],
+          },
+        ),
+      );
+    }
+  }
+}

package/validation/specifiedRules.d.ts

@@ -1,4 +1,10 @@
+import { MaxIntrospectionDepthRule } from './rules/MaxIntrospectionDepthRule';
 import type { SDLValidationRule, ValidationRule } from './ValidationContext';
+/**
+ * Technically these aren't part of the spec but they are strongly encouraged
+ * validation rules.
+ */
+export declare const recommendedRules: readonly typeof MaxIntrospectionDepthRule[];
 /**
  * This set includes all validation rules defined by the GraphQL spec.
  *