fix(composition): restrict usage of auth directives on interfaces#8826
fix(composition): restrict usage of auth directives on interfaces#8826dariuszkuc merged 5 commits intodevfrom
Conversation
✅ Docs preview has no changesThe preview was not built because there were no changes. Build ID: afaf59e8ce9704c4aac96c9a |
| self.directives.get(name).ok_or_else(|| { | ||
| internal_error!("Directive referencers unexpectedly missing directive `{name}`") | ||
| }) | ||
| pub(crate) fn get_directive(&self, name: &str) -> &DirectiveReferencers { |
There was a problem hiding this comment.
In Federation JS we generally use safe getPost20FederationDirective (link) that returns empty applications (aka referencers in RS) if not found. By changing this to return empty referencers we can avoid a number of potential exceptions when directive would be defined in the schema but not applied anywhere.
There was a problem hiding this comment.
I'm a big fan of removing as many unnecessary "failure" cases as possible.
| self.directives.get(name).ok_or_else(|| { | ||
| internal_error!("Directive referencers unexpectedly missing directive `{name}`") | ||
| }) | ||
| pub(crate) fn get_directive(&self, name: &str) -> &DirectiveReferencers { |
There was a problem hiding this comment.
I'm a big fan of removing as many unnecessary "failure" cases as possible.
| } | ||
| }; | ||
| .get_directive(JOIN_DIRECTIVE); | ||
| if join_directives.len() == 0 { |
There was a problem hiding this comment.
nit, but a lint that I'm surprised clippy isn't complaining about: This should be an is_empty call.
There was a problem hiding this comment.
I think it's because we're using a len() that we wrote/it's not a standard collection.
There was a problem hiding this comment.
Yeah its a custom len() method -> I've added new is_empty() and updated code accordingly
dariuszkuc
force-pushed
the
dnf_conjunction
branch
from
fed51f4 to
6af8335
Compare
Restricts usage of `@authenticated`, `@policy` and `@requiresScopes` from being applied on interfaces, interface objects and their fields. GraphQL spec currently does not define any interface inheritance rules and developers have to explicitly redefine all interface fields on their implementations. At runtime, GraphQL servers cannot return abstract types and always return concrete output types. Due to the above, applying auth directives on the interfaces may lead to unexpected runtime behavior as they won't have any effect at runtime. Backport of apollographql/federation@faea2d1
dariuszkuc
force-pushed
the
restrict_auth_on_interfaces
branch
from
36805d3 to
bf63d5b
Compare
|
@dariuszkuc, please consider creating a changeset entry in |
) Restricts usage of `@authenticated`, `@policy` and `@requiresScopes` from being applied on interfaces, interface objects and their fields. GraphQL spec currently does not define any interface inheritance rules and developers have to explicitly redefine all interface fields on their implementations. At runtime, GraphQL servers cannot return abstract types and always return concrete output types. Due to the above, applying auth directives on the interfaces may lead to unexpected runtime behavior as they won't have any effect at runtime. Backport of apollographql/federation@faea2d1
) Restricts usage of `@authenticated`, `@policy` and `@requiresScopes` from being applied on interfaces, interface objects and their fields. GraphQL spec currently does not define any interface inheritance rules and developers have to explicitly redefine all interface fields on their implementations. At runtime, GraphQL servers cannot return abstract types and always return concrete output types. Due to the above, applying auth directives on the interfaces may lead to unexpected runtime behavior as they won't have any effect at runtime. Backport of apollographql/federation@faea2d1
5 participants
Restricts usage of
@authenticated,@policyand@requiresScopesfrom being applied on interfaces, interface objects and their fields.GraphQL spec currently does not define any interface inheritance rules and developers have to explicitly redefine all interface fields on their implementations. At runtime, GraphQL servers cannot return abstract types and always return concrete output types. Due to the above, applying auth directives on the interfaces may lead to unexpected runtime behavior as they won't have any effect at runtime.
Backport of apollographql/federation@faea2d1