graphql-http 2.0.4__tar.gz → 2.0.6__tar.gz

{graphql_http-2.0.4 → graphql_http-2.0.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: graphql_http
-Version: 2.0.4
+Version: 2.0.6
 Summary: HTTP Server for GraphQL.
 Author-email: Robert Parker <rob@parob.com>
 License: MIT

graphql_http-2.0.6/VERSION

@@ -0,0 +1 @@
+2.0.6

{graphql_http-2.0.4 → graphql_http-2.0.6}/graphql_http/server.py

@@ -320,36 +320,280 @@ class GraphQLHTTP:
         return PlainTextResponse("OK", headers=response_headers)
 
     def _check_introspection_only(self, data: Union[Dict, List]) -> bool:
-        """Check if request contains only introspection queries.
+        """Check if request contains only introspection queries using GraphQL's built-in validation.
+
+        This approach uses GraphQL's execution preparation to determine if a query
+        is introspection-only by checking what fields would actually be resolved.
+
+        Args:
+            data: Request data (dict for single query, list for batched queries)
+
+        Returns:
+            True if all queries are introspection-only
+        """
+        try:
+            from graphql import parse, validate
+            from graphql.type.introspection import is_introspection_type
+            # Try to import execution context functions, fall back gracefully if not available
+            try:
+                from graphql.execution import build_execution_context
+                from graphql.execution.collect_fields import collect_fields
+                has_execution_context = True
+            except ImportError:
+                has_execution_context = False
+        except ImportError:
+            # Fallback to AST-based check if advanced GraphQL features not available
+            return self._check_introspection_only_ast(data)
+
+        # Handle batched queries
+        if isinstance(data, list):
+            return all(self._check_introspection_only(item) for item in data)
+
+        if not isinstance(data, dict) or 'query' not in data:
+            return False
+
+        query_str = data.get('query', '')
+        if not query_str or not isinstance(query_str, str):
+            return False
+
+        # Pre-validation security checks
+        query_stripped = query_str.strip()
+        if not query_stripped:
+            return False
+
+        # Basic syntax validation - ensure query looks structurally sound
+        if query_stripped.count('{') != query_stripped.count('}'):
+            return False
+        if query_stripped.count('(') != query_stripped.count(')'):
+            return False
+
+        try:
+            # Parse and validate the query - this will catch syntax errors
+            document = parse(query_str)
+            validation_errors = validate(self.schema, document)
+
+            # If query has validation errors, it's not a valid introspection query
+            if validation_errors:
+                return False
+
+            # If execution context is not available, fall back to AST method
+            if not has_execution_context:
+                return self._check_introspection_only_ast(data)
+
+            # Additional security checks before execution analysis
+            # Check if document contains only query operations (no mutations/subscriptions)
+            for definition in document.definitions:
+                if hasattr(definition, 'operation'):
+                    # Only allow query operations for introspection bypass
+                    if definition.operation != 'query':
+                        return False
+
+            # Build execution context to analyze what fields would be resolved
+            try:
+                context_value = {}
+                variable_values = data.get('variables') or {}
+                operation_name = data.get('operationName')
+
+                exe_context = build_execution_context(
+                    self.schema,
+                    document,
+                    context_value=context_value,
+                    variable_values=variable_values,
+                    operation_name=operation_name
+                )
+
+                # If execution context building fails, be conservative
+                if isinstance(exe_context, list):  # List of GraphQLError
+                    return False
+
+                # Get the operation
+                operation = exe_context.operation
+                if not operation or not operation.selection_set:
+                    return False
+
+                # Collect the fields that would be executed
+                fields = collect_fields(
+                    exe_context,
+                    exe_context.schema.query_type,
+                    operation.selection_set,
+                    set(),
+                    set()
+                )
+
+                # Strict validation: only allow official introspection fields
+                official_introspection_fields = {'__schema', '__type', '__typename'}
+
+                for field_name in fields.keys():
+                    # Must start with __ (introspection convention)
+                    if not field_name.startswith('__'):
+                        return False
+
+                    # Must be an official introspection field
+                    if field_name not in official_introspection_fields:
+                        return False
+
+                # Double-check by examining the field types being accessed
+                query_type = self.schema.query_type
+                for field_name in fields.keys():
+                    field_def = query_type.fields.get(field_name)
+                    if field_def:
+                        field_type = field_def.type
+                        # Unwrap non-null and list types to get the base type
+                        while hasattr(field_type, 'of_type'):
+                            field_type = field_type.of_type
+
+                        # Check if the field type is an introspection type
+                        if not is_introspection_type(field_type):
+                            return False
+                    else:
+                        # Field doesn't exist in schema - should not happen with validation
+                        return False
+
+                return True
+
+            except Exception:
+                # If execution context fails, fall back to AST method
+                return self._check_introspection_only_ast(data)
+
+        except Exception:
+            # If parsing fails, it's not a valid query - BLOCK IT
+            # Parse errors indicate malformed GraphQL which should never bypass auth
+            return False
+
+    def _check_introspection_only_ast(self, data: Union[Dict, List]) -> bool:
+        """AST-based fallback for introspection detection.
+
+        This is the previous implementation as a fallback when execution context
+        analysis is not available.
+        """
+        try:
+            from graphql import parse, FieldNode, visit, Visitor
+        except ImportError:
+            # Final fallback to string-based check
+            return self._check_introspection_only_fallback(data)
+
+        # Handle batched queries
+        if isinstance(data, list):
+            return all(self._check_introspection_only_ast(item) for item in data)
+
+        if not isinstance(data, dict) or 'query' not in data:
+            return False
+
+        query_str = data.get('query', '')
+        if not query_str or not isinstance(query_str, str):
+            return False
+
+        try:
+            # Parse the GraphQL query into an AST
+            document = parse(query_str)
+
+            # Extract only root-level field names from the query
+            root_field_names = set()
+
+            class RootFieldCollector(Visitor):
+                def __init__(self):
+                    super().__init__()
+                    self.depth = 0
+                    self.in_operation = False
+
+                def enter_operation_definition(self, node, *_):
+                    # We're now inside an operation (query/mutation/subscription)
+                    self.in_operation = True
+
+                def leave_operation_definition(self, node, *_):
+                    # Leaving the operation
+                    self.in_operation = False
+
+                def enter_fragment_definition(self, node, *_):
+                    # Skip fragment definitions - they're not part of the actual query execution
+                    return False
+
+                def enter_selection_set(self, node, *_):
+                    if self.in_operation:
+                        self.depth += 1
+
+                def leave_selection_set(self, node, *_):
+                    if self.in_operation:
+                        self.depth -= 1
+
+                def enter_field(self, node: FieldNode, *_):
+                    # Only collect fields at depth 1 within actual operations
+                    if self.in_operation and self.depth == 1 and hasattr(node, 'name') and hasattr(node.name, 'value'):
+                        root_field_names.add(node.name.value)
+
+            visit(document, RootFieldCollector())
+
+            # Check if all root fields are introspection fields
+            introspection_fields = {'__schema', '__type', '__typename'}
+
+            # If no fields found, it's not a valid query
+            if not root_field_names:
+                return False
+
+            # All root fields must be introspection fields
+            return root_field_names.issubset(introspection_fields)
+
+        except Exception:
+            # If AST parsing fails, it's not a valid query - BLOCK IT
+            return False
+
+    def _check_introspection_only_fallback(self, data: Union[Dict, List]) -> bool:
+        """Fallback string-based introspection check for when GraphQL parsing fails.
 
         Args:
             data: Request data
 
         Returns:
-            True if request is introspection-only
+            True if request appears to be introspection-only (conservative check)
         """
+        # Handle batched queries
+        if isinstance(data, list):
+            return all(self._check_introspection_only_fallback(item) for item in data)
 
-        # Simple heuristic: if it contains introspection fields AND no regular fields
-        query_data_lower = str(data).lower()
+        if not isinstance(data, dict) or 'query' not in data:
+            return False
+
+        query_str = data.get('query', '')
+        if not query_str or not isinstance(query_str, str):
+            return False
+
+        query_lower = query_str.lower()
 
         # Check for introspection fields
-        introspection_fields = ["__schema", "__type", "__typename"]
-        has_introspection = any(
-            f in query_data_lower for f in introspection_fields)
+        introspection_fields = ['__schema', '__type', '__typename']
+        has_introspection = any(field in query_lower for field in introspection_fields)
 
         if not has_introspection:
             return False
 
-        # Check for regular fields (non-introspection)
-        # This is a simple heuristic - in a mixed query, we require auth
-        regular_field_patterns = [
-            "hello", "users", "posts", "data", "mutation"]
-        has_regular_fields = any(
-            pattern in query_data_lower for pattern in regular_field_patterns
-        )
+        # Conservative approach: check for common non-introspection patterns
+        # Remove comments and strings to avoid false positives
+        import re
+        clean_query = re.sub(r'#.*', '', query_str)  # Remove comments
+        clean_query = re.sub(r'"[^"]*"', '', clean_query)  # Remove string literals
+        clean_query = re.sub(r"'[^']*'", '', clean_query)  # Remove string literals
+        clean_query = clean_query.lower()
+
+        # Look for non-introspection field patterns in clean query
+        # Use word boundaries to avoid matching substrings
+        suspicious_patterns = [
+            r'\b(query|mutation|subscription)\s+\w+',  # Named operations
+            r'\{[^}]*[a-z_][a-z0-9_]*\s*[({]',  # Regular field selections
+        ]
+
+        # If we find suspicious patterns, be conservative and require auth
+        for pattern in suspicious_patterns:
+            if re.search(pattern, clean_query):
+                # Double-check it's not just introspection
+                remaining = clean_query
+                for intro_field in introspection_fields:
+                    remaining = remaining.replace(intro_field, '')
+
+                # If there's still substantial content, likely has regular fields
+                if len(re.findall(r'\w+', remaining)) > 3:  # Threshold for field names
+                    return False
 
-        # Only allow introspection-only queries to bypass auth
-        return has_introspection and not has_regular_fields
+        return True
 
     def _authenticate_request(self, request: Request) -> Optional[Response]:
         """Authenticate JWT token from request.

{graphql_http-2.0.4 → graphql_http-2.0.6}/graphql_http.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: graphql_http
-Version: 2.0.4
+Version: 2.0.6
 Summary: HTTP Server for GraphQL.
 Author-email: Robert Parker <rob@parob.com>
 License: MIT

{graphql_http-2.0.4 → graphql_http-2.0.6}/tests/test_auth.py

@@ -162,7 +162,7 @@ class TestGraphQLHTTPAuthentication:
         assert "errors" in result
         assert "Invalid token" in result["errors"][0]["message"]
 
-    def test_introspection_without_auth_when_disabled(self, schema):
+    def test_introspection_without_auth_bypass(self, schema):
         """Test introspection queries work without auth when auth_introspection_bypass=False."""
         server = GraphQLHTTP(
             schema=schema,
@@ -184,7 +184,7 @@ class TestGraphQLHTTPAuthentication:
         assert "errors" in result
         assert "Authorization header is missing" in result["errors"][0]["message"]
 
-    def test_introspection_with_auth_when_enabled(self, schema):
+    def test_introspection_with_auth_bypass(self, schema):
         """Test introspection queries require auth when auth_introspection_bypass=True."""
 
         server = GraphQLHTTP(
@@ -197,7 +197,7 @@ class TestGraphQLHTTPAuthentication:
         )
         client = server.client()
 
-        # Introspection query should require auth
+        # Introspection query not require auth
         response = client.post(
             "/graphql",
             json={"query": "{ __schema { queryType { name } } }"}
@@ -205,7 +205,7 @@ class TestGraphQLHTTPAuthentication:
         assert response.status_code == 200
         # Should get a valid introspection response, not an auth error
 
-    def test_regular_query_requires_auth(self, schema):
+    def test_regular_query_without_auth_bypass(self, schema):
         """Test that regular queries always require auth when auth is enabled."""
         server = GraphQLHTTP(
             schema=schema,
@@ -227,6 +227,28 @@ class TestGraphQLHTTPAuthentication:
         assert "errors" in result
         assert "Authorization header is missing" in result["errors"][0]["message"]
 
+    def test_regular_query_with_auth_bypass(self, schema):
+        """Test that regular queries always require auth when auth is enabled."""
+        server = GraphQLHTTP(
+            schema=schema,
+            auth_enabled=True,
+            auth_bypass_during_introspection=True,  # Only introspection is exempt
+            auth_jwks_uri="https://example.com/.well-known/jwks.json",
+            auth_issuer="https://example.com/",
+            auth_audience="test-audience"
+        )
+        client = server.client()
+
+        # Regular query should require auth
+        response = client.post(
+            "/graphql",
+            json={"query": "{ hello }"}
+        )
+        assert response.status_code == 401
+        result = response.json()
+        assert "errors" in result
+        assert "Authorization header is missing" in result["errors"][0]["message"]
+
     def test_jwks_client_initialization_failure(self, schema):
         """Test server initialization when JWKS URI is not provided."""
         # This should raise a ValueError during initialization now due to validation
@@ -288,3 +310,44 @@ class TestGraphQLHTTPAuthentication:
         result = response.json()
         assert "errors" in result
         assert "Authorization header is missing" in result["errors"][0]["message"]
+
+    def test_full_introspection_query_with_auth_bypass(self, schema):
+        """Test that the standard full introspection query works with auth bypass.
+
+        This tests the large introspection query that GraphiQL and other tools use
+        to fetch the complete schema information.
+        """
+        from graphql import get_introspection_query
+
+        server = GraphQLHTTP(
+            schema=schema,
+            auth_enabled=True,
+            auth_bypass_during_introspection=True,
+            auth_jwks_uri="https://example.com/.well-known/jwks.json",
+            auth_issuer="https://example.com/",
+            auth_audience="test-audience"
+        )
+        client = server.client()
+
+        # Get the standard introspection query
+        introspection_query = get_introspection_query()
+
+        # This should work without authentication
+        response = client.post(
+            "/graphql",
+            json={"query": introspection_query}
+        )
+
+        assert response.status_code == 200
+        result = response.json()
+
+        # Should get valid introspection data, not an auth error
+        assert "errors" not in result or len(result["errors"]) == 0
+        assert "data" in result
+        assert "__schema" in result["data"]
+
+        # Verify we get expected introspection structure
+        schema_data = result["data"]["__schema"]
+        assert "queryType" in schema_data
+        assert "types" in schema_data
+        assert "directives" in schema_data

graphql_http-2.0.4/VERSION

@@ -1 +0,0 @@
-2.0.4