Type with array property triggers error

[dargmuesli]

Summary

Custom types seem to result in an error when they contain an array property.

Steps to reproduce

Define a type like this:

CREATE TYPE public.jwt AS (
  ids UUID[]
);

Use it as column of some table:

CREATE TABLE public.token (
  token    public.jwt,
);

Query it like:

{
  allTokens {
    nodes {
      token
    }
  }
}

Expected results

No error in the console.

Actual results

Error: Internal graphile-build-pg error: should not attempt to tweak an array, please process array before tweaking (type: "pg_catalog._uuid")
    at Object.pgTweakFragmentForTypeAndModifier (/postgraphile/node_modules/graphile-build-pg/node8plus/plugins/PgTypesPlugin.js:300:23)
    at /postgraphile/node_modules/graphile-build-pg/node8plus/plugins/PgJWTPlugin.js:108:184
    at Array.map (<anonymous>)
    at pgTweaksByTypeId.<computed> (/postgraphile/node_modules/graphile-build-pg/node8plus/plugins/PgJWTPlugin.js:108:124)
    at Object.pgTweakFragmentForTypeAndModifier (/postgraphile/node_modules/graphile-build-pg/node8plus/plugins/PgTypesPlugin.js:257:16)
    at /postgraphile/node_modules/graphile-build-pg/node8plus/plugins/makeProcField.js:398:38
    at Object.<anonymous> (/postgraphile/node_modules/graphile-build-pg/node8plus/queryFromResolveDataFactory.js:90:5)
    at makeQuery (/postgraphile/node_modules/graphile-build-pg/node8plus/plugins/makeProcField.js:384:21)
    at resolve (/postgraphile/node_modules/graphile-build-pg/node8plus/plugins/makeProcField.js:567:25)
    at resolveField (/postgraphile/node_modules/graphql/execution/execute.js:464:18)

Error: Internal graphile-build-pg error: should not attempt to tweak an array, please process array before tweaking (type: "pg_catalog._uuid")
    at Object.pgTweakFragmentForTypeAndModifier (/postgraphile/node_modules/graphile-build-pg/node8plus/plugins/PgTypesPlugin.js:300:23)
    at /postgraphile/node_modules/graphile-build-pg/node8plus/plugins/PgJWTPlugin.js:108:184
    at Array.map (<anonymous>)
    at pgTweaksByTypeId.<computed> (/postgraphile/node_modules/graphile-build-pg/node8plus/plugins/PgJWTPlugin.js:108:124)
    at Object.pgTweakFragmentForTypeAndModifier (/postgraphile/node_modules/graphile-build-pg/node8plus/plugins/PgTypesPlugin.js:257:16)
    at /postgraphile/node_modules/graphile-build-pg/node8plus/plugins/pgField.js:44:143
    at callIfNecessary (/postgraphile/node_modules/graphile-build-pg/node8plus/QueryBuilder.js:24:12)
    at QueryBuilder.lock (/postgraphile/node_modules/graphile-build-pg/node8plus/QueryBuilder.js:740:22)
    at QueryBuilder.lockEverything (/postgraphile/node_modules/graphile-build-pg/node8plus/QueryBuilder.js:812:10)
    at QueryBuilder.build (/postgraphile/node_modules/graphile-build-pg/node8plus/QueryBuilder.js:617:10)

Additional context

Very similar issue: #669

Possible Solution

Something similar to #672 maybe

[benjie]

Reproduction script:

drop table if exists token cascade;
drop type if exists jwt cascade;
CREATE TYPE jwt AS (
  ids UUID[]
);

CREATE TABLE token (
  token    jwt
);

insert into token (token) values
  (row(array['1c0d897e-5936-4e27-a677-87ac92d81729', '49e9b3a5-f148-477c-af92-bb322eac954a', '2d8cfc0b-04d4-4484-b11b-a474fecd1004']::uuid[])::jwt),
  (row(array['eb1c3401-bd5a-40c4-b498-ec63460dd973']::uuid[])::jwt),
  (row(array[]::uuid[])::jwt);

V5 works perfectly fine:

V4 also works perfectly fine:

[benjie]

Oh wait! You might actually be using --jwt-secret to produce a JWT token from your composite type? If so, we only support string-string JWTs because PostgreSQL settings are strings.

[dargmuesli]

Interesting, thank you very much for the insight!
Do you think it could be possible to add this information to the error message? For that it would of course need to be possible to detect if the error occurred when generating a jwt, which I'm not sure if that's possible.

[benjie]

Possible: definitely. Worth the effort required: questionable. So far, one person has reported this issue over the last 5 years 😉

[dargmuesli]

Fair! Is there a pointer to the types allowed in the documentation maybe? I haven't found it, maybe that would be enough already.

[benjie]

I couldn't find one from a quick scan; if you fancy raising a PR please do!

(Important: if you try and add it in the options lists which are auto-generated (see the comments in the markdown around those blocks), it'll be overwritten. You may need to change it at source in the postgraphile repository.)

[dargmuesli]

I'm currently on vacation. I may do it when I'm back in 2 weeks.

[dargmuesli]

Now I'm back :) Looking at it I have one or two more questions. If you say

we only support string-string JWTs because PostgreSQL settings are strings

Why are numbers supported, as in https://www.graphile.org/postgraphile/jwt-guide/#example?

Also, I'm using a custom JWT type with an array property for a few years already without problems, expect for the warning. Why do they work, as in your example given above, if arrays are not supported? 🤔

[benjie]

Why are numbers supported, as in graphile.org/postgraphile/jwt-guide/#example?

They're (implicitly) cast to strings; in the database you have to cast them back again. I think we might allow booleans also, but not sure off-hand. It should be string-string though, anything else working is just a happy accident.

Also, I'm using a custom JWT type with an array property for a few years already without problems, expect for the warning.

I believe I tightened up validation on JWTs at one point because people were getting hard to understand issues like [object Object] in the database. You may have been relying on the fact that casting an array to a string works implicitly if it's an array of strings, it just joins them with commas. Still, an array of objects would cause issues and we never intended to support arrays/objects.

Why do they work, as in your #836 (comment), if arrays are not supported? 🤔

The example above shows them as a standard composite type. When converting to a JWT things are different.

[dargmuesli]

I just see that under usage-library#pgsettings-function it says

Everything returned by pgSettings is applied to the current session with set_config($key, $value, true); note that set_config only supports string values so it is best to only feed pgSettings string values (we'll convert other values using the String constructor function, which may not have the effect you intend.

So I consider this as already documented.