rmosolgo / rmosolgo/graphql-ruby

[GraphQL::Schema::Visibility] Change in Static Validation of Variable Types

Open
#5,408 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Ruby
Stars
5.4k
Forks
1.4k
Avg merge
23h 19m
Merged PRs (30d)
28

Description

When using the GraphQL::Schema::Visibility plugin, the behavior of how static validation of variables changes. Consider the following example schema:

class MyInputType < GraphQL::Schema::InputObject
  argument :some_field, String, required: true
end

class MyInternalMutation < GraphQL::Schema::Mutation
  argument :input, MyInputType, required: true

  field :success, Boolean, null: false

  def self.visible?(ctx)
    ctx[:internal_client] == true
  end

  def resolve(input:)
    { success: true }
  end
end

class MutationRoot < GraphQL::Schema::Object
  field :my_mutation, mutation: MyInternalMutation
end

class MySchema < GraphQL::Schema
  use(GraphQL::Schema::Visibility)

  mutation(MutationRoot)
end
query = <<~GRAPHQL
  mutation MyMutation($input: MyInput!) {
    myMutation(input: $input) {
      success
    }
  }
GRAPHQL

result = MySchema.execute(
  query,
  context: { internal_client: false },
  variables: { "input" => { "someField" => "someValue" } },
)

When operating in GraphQL::Schema::Warden mode, the following expected error is returned:

{"errors":[{"message":"Field 'myMutation' doesn't exist on type 'MutationRoot'","locations":[{"line":2,"column":3}],"path":["mutation MyMutation","myMutation"],"extensions":{"code":"undefinedField","typeName":"MutationRoot","fieldName":"myMutation"}},{"message":"Variable $input is declared by MyMutation but not used","locations":[{"line":1,"column":1}],"path":["mutation MyMutation"],"extensions":{"code":"variableNotUsed","variableName":"input"}}]}

However, with visibility, we get a different error stating that the otherwise public input type does not exist:

{"errors":[{"message":"MyInput isn't a defined input type (on $input)","locations":[{"line":1,"column":21}],"path":["mutation MyMutation"],"extensions":{"code":"variableRequiresValidType","typeName":"MyInput","variableName":"input"}},{"message":"Field 'myMutation' doesn't exist on type 'MutationRoot'","locations":[{"line":2,"column":3}],"path":["mutation MyMutation","myMutation"],"extensions":{"code":"undefinedField","typeName":"MutationRoot","fieldName":"myMutation"}},{"message":"Variable $input is declared by MyMutation but not used","locations":[{"line":1,"column":1}],"path":["mutation MyMutation"],"extensions":{"code":"variableNotUsed","variableName":"input"}}]}

It is unclear whether this is a regression or just a change in behavior. I believe it is due to the fact that MyInput is unreachable by any public path, but this was not something enforced by warden.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the example with GraphQL::Schema::Visibility enabled and compare it with GraphQL::Schema::Warden mode. Trace how static variable-type validation handles the unreachable MyInput type, then add or update regression coverage so the intended validation behavior is explicit.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
api, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.