HarperFast / HarperFast/harper

GraphQL silently ignores per-level filter/limit args on nested relationship fields (over-broad results)

Open
#1,327 0 comments 0 reactions 0 assignees View on GitHub
area:GraphQL bug
Dominant language
JavaScript
Stars
89
Forks
10
Avg merge
2d 6h
Merged PRs (30d)
200

Description

## Summary
Filter/limit arguments on a NESTED relationship field in a GraphQL query are silently dropped — the query returns over-broad data with HTTP 200 and no error/diagnostic, so a client trusts wrong results.

Example: `customer { orders(status:"open", limit:2) { lineItems(qty:3) { … } } }` returns ALL orders (incl. closed) and ALL line-items — the nested `status`/`limit`/`qty` args are ignored (not mis-scoped, not applied globally, just dropped).

## Root cause
`server/graphqlQuerying.ts` `buildSelectQuery` (~L286-295) builds nested selections as `{name, select}` and never reads `fieldNode.arguments`; arguments are only processed at the top level (`processFieldNode`→`buildConditionsQuery`).

## Related (sibling, top-level surface)
At the TOP level, non-equality args fare differently: a top-level `Type(limit:N)`/`sort`/operator arg is mis-coerced to an equality condition on a non-existent attribute → HTTP 500 ("limit is not a defined attribute"), and one bad arg poisons the whole query. So GraphQL has no real pagination/sort/operator arg surface at all: nested args are silently ignored, top-level non-equality args loudly error. (The 500 there should be a 4xx — ties the GraphQL-error-status issue #1299.)

## Suggested fix
Either honor nested-relationship-field args (filter/limit/sort) in `buildSelectQuery`, or reject unsupported nested args with a clear error rather than silently dropping them; and add top-level `limit`/`offset`/`sort` support (or a clear 400). Document the supported GraphQL arg surface.

## Repro
`integrationTests/qa-scratch/graphql-chained.test.ts` (nested, silent-ignore); `integrationTests/qa-scratch/graphql-toplevel-args.test.ts` (top-level error).

---
_Found via the exploratory QA campaign (qa-explorer), scenarios QA-093/098. Harper `001bf7b9c` (v5.1.0, main)._

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.