chore: enable graphql protection - maxDepth, blockFieldSuggestions, maxCost

[sabineschaller]

Changes proposed in this pull request

• adds graphql armor to enable
  • maxDepth
  • blockFieldSuggestion
  • maxCost

To test maxDepth, run the following query

{
  __schema {
    types {
      name 
      fields {
        name
        type {
          name
          fields {
            name
            type {
              name
              fields {
                name
                type {
                  name
                  fields {
                    name
                    ...
                }
              } 
            }
          }
        }
      }
    }
  }
}

To test blockFieldSuggestion just misspell something slightly in an graphql query.

For the maxCost protection, I enabled it with default values.

Context

• fixes Enforce maximum depth limit on Graphql queries #2417

Checklist

• Related issues linked using fixes #number
• Tests added/updated
• Documentation added
• Make sure that all checks pass
• Bruno collection updated

[netlify]

❌ Deploy Preview for brilliant-pasca-3e80ec failed.

Name	Link
🔨 Latest commit	8a05b4c
🔍 Latest deploy log	https://app.netlify.com/sites/brilliant-pasca-3e80ec/deploys/65f2d80b67332000082e6927

[mkurapov]

Depth test works for me.

To confirm, for the blockFieldSuggestion, should I be seeing

{
  "errors": [
    {
      "message": "Cannot query field \"receivdeAmount\" on type \"OutgoingPayment\". [Suggestion hidden]?",
      "locations": [
        {
          "line": 11,
          "column": 5
        }
      ],
      "extensions": {
        "code": "GRAPHQL_VALIDATION_FAILED"
      }
    }
  ]
}

[mkurapov]

how do we get the cost of a graphql query? is there a way for testing this?

[sabineschaller]

That's why I said I used default/"recommended" settings

[sabineschaller]

https://escape.tech/graphql-armor/docs/plugins/cost-limit

[sabineschaller]

To confirm, for the blockFieldSuggestion, should I be seeing

That's it. the suggestion:hidden part. Otherwise it would say something like "did you mean...?"

[BlairCurrey]

I realize this is merged but wanted to comment here. We can add new issues for this.

The addition of ...protection breaks introspection. That is, you can't see the queries and mutations in apollo server as http://localhost:3001/graphql. It's working on main (before this was merged) but not here. Commenting out ...protection fixes it.

Maybe this one is a nit, and I know how the docs show it this way, but destructuring protection is probably not the best way to add it IMO because it has a plugins array. If we were to change the order of ...protection and plugins on this object then the plugin array we are forming ourslves would get overridden:

const apolloServer = new ApolloServer({
      schema: schemaWithResolvers,
      plugins: [
        ...protection.plugins,
        ApolloServerPluginDrainHttpServer({ httpServer })
      ],
      ...protection, // overrides the above plugins
      introspection: this.config.env !== 'production'
    })

Again, it's techniaclly fine as-is but it's not obvious how close it is to not fine. I think something like this would be safer:

    const { plugins: protectionPlugins, ...protectionRest } = protection

    this.apolloServer = new ApolloServer({
      schema: schemaWithMiddleware,
      ...protectionRest,
      plugins: [
        ...protectionPlugins,
        ApolloServerPluginDrainHttpServer({ httpServer })
      ],
      introspection: this.config.env !== 'production'
    })

[BlairCurrey]

it's the maxDepth.ignoreIntrospection breaking it. Although I see that's intentionally set that way to resolve an issue with max depth being ignored. Maybe it can also be controlled by NODE_ENV (not disabled in not prod)?