Allow introspection by default in production mode

[pmclain]

Description (*)

Adds env.php parameter for disabling introspection:

...
    'graphql' => [
        'disable_introspection' => true,
    ],
...

Fixed Issues (if relevant)

1. GraphQL tools cannot perform "standard introspection query" in production mode #232: GraphQL tools cannot perform "standard introspection query" in production mode

Manual testing scenarios (*)

Validate disabled

1. Enable production mode
2. Add the following to env.php:

...
    'graphql' => [
        'disable_introspection' => true,
    ],
...

3. Query:

{
  __schema {
    types {
      name
      interfaces {
        name
        description
      }
    }
  }
}

4. Expect error message GraphQL introspection is not allowed, but the query contained __schema or __type

Validate enabled

1. Enable production mode
2. Add the following to env.php, or ensure path graphql/disable_introspection is not set:

...
    'graphql' => [
        'disable_introspection' => false,
    ],
...

3. Query:

{
  __schema {
    types {
      name
      interfaces {
        name
        description
      }
    }
  }
}

4. Expect valid response

Contribution checklist (*)

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• All automated tests passed successfully (all builds on Travis CI are green)

[pmclain]

@naydav I updated this line casting the bool to int after this change way pushed yesterday b6fe3ff Passing anything other than int 0 here disables introspection https://github.com/webonyx/graphql-php/blob/v0.12.6/src/Validator/Rules/DisableIntrospection.php#L31

[ghost]

Hi @pmclain, thank you for your contribution!
Please, complete Contribution Survey, it will take less than a minute.
Your feedback will help us to improve contribution process.