Validate the subscription root
All checks were successful
Build / audit (push) Successful in 17s
Build / test (push) Successful in 6m33s
Build / doc (push) Successful in 5m45s

…not to be an introspection field.
This commit is contained in:
Eugen Wissner 2024-12-01 21:47:29 +01:00
parent 2dcefff76a
commit 7ea76865e6
Signed by: belka
GPG Key ID: A27FDC1E8EE902C0
3 changed files with 26 additions and 21 deletions

View File

@ -9,6 +9,8 @@ and this project adheres to
## [Unreleased]
### Changed
- Remove deprecated 'gql' quasi quoter.
- Validate the subscription root not to be an introspection field
(`singleFieldSubscriptionsRule`).
## [1.4.0.0] - 2024-10-26
### Changed

View File

@ -137,25 +137,28 @@ singleFieldSubscriptionsRule :: forall m. Rule m
singleFieldSubscriptionsRule = OperationDefinitionRule $ \case
Full.OperationDefinition Full.Subscription name' _ _ rootFields location' -> do
groupedFieldSet <- evalStateT (collectFields rootFields) HashSet.empty
case HashSet.size groupedFieldSet of
1 -> lift mempty
_
| Just name <- name' -> pure $ Error
{ message = concat
[ "Subscription \""
, Text.unpack name
, "\" must select only one top level field."
]
, locations = [location']
}
| otherwise -> pure $ Error
{ message = errorMessage
, locations = [location']
}
case HashSet.toList groupedFieldSet of
[rootName]
| Text.isPrefixOf "__" rootName -> makeError location' name'
"exactly one top level field, which must not be an introspection field."
| otherwise -> lift mempty
[] -> makeError location' name' "exactly one top level field."
_ -> makeError location' name' "only one top level field."
_ -> lift mempty
where
errorMessage =
"Anonymous Subscription must select only one top level field."
makeError location' (Just operationName) errorLine = pure $ Error
{ message = concat
[ "Subscription \""
, Text.unpack operationName
, "\" must select "
, errorLine
]
, locations = [location']
}
makeError location' Nothing errorLine = pure $ Error
{ message = "Anonymous Subscription must select " <> errorLine
, locations = [location']
}
collectFields = foldM forEach HashSet.empty
forEach accumulator = \case
Full.FieldSelection fieldSelection -> forField accumulator fieldSelection

View File

@ -18,7 +18,7 @@ import qualified Language.GraphQL.AST.DirectiveLocation as DirectiveLocation
import qualified Language.GraphQL.Type.In as In
import qualified Language.GraphQL.Type.Out as Out
import Language.GraphQL.Validate
import Test.Hspec (Spec, context, describe, it, shouldBe, shouldContain, xit)
import Test.Hspec (Spec, context, describe, it, shouldBe, shouldContain)
import Text.Megaparsec (parse, errorBundlePretty)
petSchema :: Schema IO
@ -206,14 +206,14 @@ spec =
}
in validate queryString `shouldContain` [expected]
xit "rejects an introspection field as the subscription root" $
it "rejects an introspection field as the subscription root" $
let queryString = "subscription sub {\n\
\ __typename\n\
\}"
expected = Error
{ message =
"Subscription \"sub\" must select only one top \
\level field."
"Subscription \"sub\" must select exactly one top \
\level field, which must not be an introspection field."
, locations = [AST.Location 1 1]
}
in validate queryString `shouldContain` [expected]