Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
function generateAndVisitComplexMethod(maximumComplexity: number): ValidationContext {
const query = /* graphql */ `
query {
sampleQuery {
complexResolverMethod
}
}
`;
const ast = parse(query);
const typeInfo = new TypeInfo(schema);
const context = new ValidationContext(schema, ast, typeInfo);
const visitor = new ComplexityVisitor(context, {
maximumComplexity,
estimators: [fieldExtensionsEstimator(), simpleEstimator({ defaultComplexity: 1 })],
});
visit(ast, visitWithTypeInfo(typeInfo, visitor));
return context;
}
import { ApolloServer } from 'apollo-server-express';
import { GraphQLError } from 'graphql';
import depthLimit from 'graphql-depth-limit';
import queryComplexity, {
simpleEstimator,
} from 'graphql-query-complexity';
import schema from './schema';
import { NODE_ENV, CUSTOM_ENV } from './config/config';
const queryComplexityRule = queryComplexity({
maximumComplexity: 1000,
variables: {},
// eslint-disable-next-line no-console
createError: (max: number, actual: number) => new GraphQLError(`Query is too complex: ${actual}. Maximum allowed complexity: ${max}`),
estimators: [
simpleEstimator({
defaultComplexity: 1,
}),
],
});
const apolloServer = new ApolloServer({
schema,
introspection: NODE_ENV !== 'production' && CUSTOM_ENV !== 'production',
validationRules: [depthLimit(7), queryComplexityRule],
didResolveOperation({ request, document }: any) {
const complexity = getComplexity({
schema,
query: request.operationName
? separateOperations(document)[request.operationName]
: document,
variables: request.variables,
estimators: [fieldConfigEstimator(), simpleEstimator({ defaultComplexity: 1 })],
})
if (complexity >= config.server.maxQueryComplexity) {
throw new Error(
`Query is too complex: ${complexity}. Maximum allowed complexity: ${config.server.maxQueryComplexity}`
)
}
// This condition will prevent our console from being spammed by apollo playground introspection queries
if (request.operationName !== 'IntrospectionQuery') {
didResolveOperation({ request, document }) {
/**
* This provides GraphQL query analysis to be able to react on complex queries to your GraphQL server.
* This can be used to protect your GraphQL servers against resource exhaustion and DoS attacks.
* More documentation can be found at https://github.com/ivome/graphql-query-complexity.
*/
const complexity = getComplexity({
// Our built schema
schema,
// To calculate query complexity properly,
// we have to check if the document contains multiple operations
// and eventually extract it operation from the whole query document.
query: request.operationName
? separateOperations(document)[request.operationName]
: document,
// The variables for our GraphQL query
variables: request.variables,
// Add any number of estimators. The estimators are invoked in order, the first
// numeric value that is being returned by an estimator is used as the field complexity.
// If no estimator returns a value, an exception is raised.
estimators: [
// Using fieldExtensionsEstimator is mandatory to make it work with type-graphql.
fieldExtensionsEstimator(),
didResolveOperation({ request, document }) {
const complexity = getComplexity({
schema,
query: request.operationName
? separateOperations(document)[request.operationName]
: document,
variables: request.variables,
estimators: [
(args) => {
if (args.field.complexity !== undefined) {
if (isFunction(args.field.complexity)) {
return args.field.complexity(args);
} else {
return args.field.complexity;
}
}
},
simpleEstimator({ defaultComplexity: 1 }),