feat: Add configurable validation rules

config/schema/graphql.schema.yml

@@ -23,6 +23,18 @@ graphql.graphql_servers.*:
  batching:
  type: boolean
  label: 'Batching'
+ disable_introspection:
+ type: boolean
+ label: 'Disable Introspection'
+ depth:
+ type: number
+ label: 'Max query depth'
+ complexity:
+ type: number
+ label: 'Max query complexity'
+ bypass_validation_token:
+ type: string
+ label: 'Bypass validation token'
  schema_configuration:
  type: 'graphql.schema.[%parent.schema]'
  persisted_queries_settings:

graphql.services.yml

@@ -108,6 +108,12 @@ services:
  tags:
  - { name: event_subscriber }
 
+ # Reset the current language during operations.
+ graphql.explorer_subscriber:
+ class: Drupal\graphql\EventSubscriber\ExplorerEventSubscriber
+ tags:
+ - { name: event_subscriber }
+
  # Plugin manager for schemas
  plugin.manager.graphql.schema:
  class: Drupal\graphql\Plugin\SchemaPluginManager

src/Entity/Server.php

@@ -25,6 +25,9 @@
 use GraphQL\Server\Helper;
 use GraphQL\Type\Definition\ResolveInfo;
 use GraphQL\Validator\DocumentValidator;
+use GraphQL\Validator\Rules\DisableIntrospection;
+use GraphQL\Validator\Rules\QueryComplexity;
+use GraphQL\Validator\Rules\QueryDepth;
 
 /**
  * The main GraphQL configuration and request entry point.
@@ -59,7 +62,11 @@
  * "endpoint",
  * "debug_flag",
  * "caching",
- * "batching"
+ * "batching",
+ * "disable_introspection",
+ * "depth",
+ * "complexity",
+ * "bypass_validation_token"
  * },
  * links = {
  * "collection" = "/admin/config/graphql/servers",
@@ -498,7 +505,21 @@ protected function getValidationRules() {
  return [];
  }
 
- return array_values(DocumentValidator::defaultRules());
+ $rules = array_values(DocumentValidator::defaultRules());
+
+ if (\Drupal::request()->get('bypass_validation') !== $this->get('bypass_validation_token')) {
+ if ($this->get('disable_introspection')) {
+ $rules[DisableIntrospection::class] = new DisableIntrospection();
+ }
+ if ($this->get('depth')) {
+ $rules[QueryDepth::class] = new QueryDepth($this->get('depth'));
+ }
+ if ($this->get('complexity')) {
+ $rules[QueryComplexity::class] = new QueryComplexity($this->get('complexity'));
+ }
+ }
+
+ return $rules;
  };
  }
 

src/EventSubscriber/ExplorerEventSubscriber.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace Drupal\graphql\EventSubscriber;
+
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+class ExplorerEventSubscriber implements EventSubscriberInterface {
+
+ /**
+ * {@inheritdoc}
+ */
+ public static function getSubscribedEvents() {
+ $events[KernelEvents::REQUEST][] = ['bypassValidation'];
+ return $events;
+ }
+
+ /**
+ * Add the bypass_validation url parameter to graphql admin routes.
+ *
+ * @param RequestEvent $event
+ */
+ public function bypassValidation(RequestEvent $event) {
+ $route = \Drupal::routeMatch()->getRouteName();
+
+ // If a bypass_validation param is already set, skip.
+ if ($event->getRequest()->get('bypass_validation')) {
+ return;
+ }
+
+ // Only bypass validation for these two routes.
+ if ($route === 'graphql.explorer' || $route === 'graphql.voyager') {
+ /** @var \Drupal\graphql\Entity\Server $server */
+ $server = $event->getRequest()->get('graphql_server');
+
+ $url = $event->getRequest()->getUri();
+
+ // Get the bypass_validation_token from the server settings.
+ $bypass_validation_token = $server->get('bypass_validation_token');
+
+ // Add the bypass_validation parameter to the current url.
+ $url .= (parse_url($url, PHP_URL_QUERY) ? '&' : '?') . 'bypass_validation=' . $bypass_validation_token;
+
+ // Redirect to the new url.
+ $event->setResponse(new RedirectResponse($url));
+ }
+ }
+}

src/Form/ServerForm.php

@@ -186,6 +186,39 @@ public function form(array $form, FormStateInterface $formState): array {
  '#description' => $this->t('Whether caching of queries and partial results is enabled.'),
  ];
 
+ $form['validation'] = [
+ '#title' => $this->t('Validation rules'),
+ '#type' => 'fieldset',
+ ];
+
+ $form['validation']['disable_introspection'] = [
+ '#title' => $this->t('Disable introspection'),
+ '#type' => 'checkbox',
+ '#default_value' => !!$server->get('disable_introspection'),
+ '#description' => $this->t('Whether introspection should be disabled.'),
+ ];
+
+ $form['validation']['depth'] = [
+ '#title' => $this->t('Max query depth'),
+ '#type' => 'number',
+ '#default_value' => $server->get('depth'),
+ '#description' => $this->t('The maximum allowed depth of nested queries. Leave empty to set unlimited.'),
+ ];
+
+ $form['validation']['complexity'] = [
+ '#title' => $this->t('Max query complexity'),
+ '#default_value' => $server->get('complexity'),
+ '#type' => 'number',
+ '#description' => $this->t('The maximum allowed complexity of a query. Leave empty to set unlimited.'),
+ ];
+
+ $form['validation']['bypass_validation_token'] = [
+ '#title' => $this->t('Bypass validation token'),
+ '#default_value' => $server->get('bypass_validation_token'),
+ '#type' => 'textfield',
+ '#description' => $this->t('A string token that can be used as the "bypass_validation" parameter when doing a GraphQL request. This bypasses the above validation rules. Could be used when generating types for front-end applications.'),
+ ];
+
  $debug_flags = $server->get('debug_flag') ?? 0;
  $form['debug_flag'] = [
  '#title' => $this->t('Debug settings'),