rmosolgo/graphql-ruby

Query complexity check causes wrong GraphQL error response

mgruner opened this issue · 0 comments

Describe the bug

In case of exceptions raised by input types, query complexity is calculated wrong, causing misleading error responses.

Versions

graphql version: 2.1.3
rails (or other framework): 7.0.8

GraphQL query

Example GraphQL query and response (if query execution is involved)

query {
  description: ticketArticles(
  ticket: {ticketId: "gid://zammad/Ticket/1"},
  first: 1
) {
  edges {
    node {
      ...
    }
  }
}

Expected behavior

We have a query with an input type referring to a DB entity (Ticket). This is validated for user permissions, an exception is raised in case of unauthorized access.

This query fetches only the first ticket article. In case of authorized access, the article should be returned, in case of unauthorized access a GraphQL error response about unauthorized access.

Actual behavior

Authorized access works, but in case of unauthorized access there is a GraphQL error response about exceeded max query complexity, instead of the expected authorization error.

Additional context

It seems that GraphQL::Schema::Field.calculate_complexity gets it wrong when calculating the complexity of the connection? type. The reason is probably that it does not receive any input arguments for the field (specifically also not the limit: argument), but instead only the GraphQL::ExecutionError object. This means the limit: 1 is no longer respected, so that the default page size is used to calculate the complexity instead, which leads to the exceeding of the configured max complexity.