laravel lighthouse, how to check query depth, query complexity

Viewed 44

I check the security(https://www.howtographql.com/advanced/4-security/) before deploying the lighthouse on the production server. so i decided to check query depth, query complexity

In the lighthouse documentation, they mentioned config/lighthouse.php,

/*
|--------------------------------------------------------------------------
| Security
|--------------------------------------------------------------------------
|
| Control how Lighthouse handles security related query validation.
| Read more at https://webonyx.github.io/graphql-php/security/
|
*/
'security' => [
    'max_query_complexity' => \GraphQL\Validator\Rules\QueryComplexity::DISABLED,
    'max_query_depth' => \GraphQL\Validator\Rules\QueryDepth::DISABLED,
    'disable_introspection' => \GraphQL\Validator\Rules\DisableIntrospection::DISABLED,
],

and recommeded to read https://webonyx.github.io/graphql-php/security/

in this link, they give some examples,

use GraphQL\GraphQL;
use GraphQL\Validator\Rules\QueryComplexity;
use GraphQL\Validator\DocumentValidator;

$rule = new QueryComplexity($maxQueryComplexity = 100);
DocumentValidator::addRule($rule);

GraphQL::executeQuery(/*...*/);
use GraphQL\GraphQL;
use GraphQL\Validator\Rules\QueryDepth;
use GraphQL\Validator\DocumentValidator;

$rule = new QueryDepth($maxDepth = 10);
DocumentValidator::addRule($rule);

GraphQL::executeQuery(/*...*/);

but how to apply these in lighthouse?

in first time, i wrote those code to ExampleQuery.php(php artisan lighthouse:query ExampleQuery)

final class ExampleQuery
{
    public function __invoke(_, array $args)
    {
        $rule = new QueryComplexity(2);
        DocumentValidator::addRule($rule);

        $rule2 = new QueryDepth(2);
        DocumentValidator::addRule($rule2);

        return [
            ...
        ];
    }
}

but that can`t catch any problems.

I think lighthouse start in vendor/nuwave/.../GraphQLController.php So i can't execute GraphQL::executeQuery(/*...*/);

and @complexity directive not working, @complexity(resolver: "App\\Security\\ComplexityAnalyzer@userPosts") doesn`t call userPosts function.

class ComplexityAnalyzer {

    public function userPosts(int $childrenComplexity, array $args): int  // not called
    {
        $postComplexity = $args['includeFullText']
            ? 3
            : 2;
        \Log::Debug($postComplexity); // not called
        return $childrenComplexity * $postComplexity;

    }
}

what am i missing..? please help make me sleep comfortable.

1 Answers

It is already implemented, you have to only set the values.

'security' => [
        'max_query_complexity' => 100,
        'max_query_depth' => 10,
    ],

The complexity score calculation can be modified for each field with @complexity directive.

Related