Part 8: Query Limits and Persisted Operations

import { useDepthLimit } from '@envelop/depth-limit';
import { useCostLimit } from './cost.ts';

// …

  plugins: [
    useDepthLimit({ maxDepth: 6 }),
    useCostLimit(5_000),

import { GraphQLError, getNullableType, isListType, type ExecutionArgs } from 'graphql';
import type { Plugin } from 'graphql-yoga';
import {
  getComplexity,
  simpleEstimator,
  type ComplexityEstimator,
} from 'graphql-query-complexity';

/** A list costs its size times one item: `first` where it is given, a guess of 10 elsewhere. */
const listEstimator: ComplexityEstimator = ({ field, args, childComplexity }) => {
  if (!isListType(getNullableType(field.type))) return undefined;
  const size = typeof args.first === 'number' ? args.first : 10;
  return size * (1 + childComplexity);
};

export function useCostLimit(maxCost: number): Plugin {
  /** An error result for an operation over the limit, and nothing for one within it. */
  function check(args: ExecutionArgs) {
    const cost = getComplexity({
      schema: args.schema,
      query: args.document,
      variables: args.variableValues as Record<string, unknown>,
      operationName: args.operationName ?? undefined,
      estimators: [listEstimator, simpleEstimator({ defaultComplexity: 1 })],
    });
    if (cost <= maxCost) return undefined;
    return {
      errors: [
        new GraphQLError(`This operation costs ${cost} points, the limit is ${maxCost}`, {
          extensions: { code: 'OPERATION_TOO_EXPENSIVE', cost, maxCost },
        }),
      ],
    };
  }

  return {
    onExecute({ args, setResultAndStopExecution }) {
      const rejected = check(args);
      if (rejected) setResultAndStopExecution(rejected);
    },
    onSubscribe({ args, setResultAndStopExecution }) {
      const rejected = check(args);
      if (rejected) setResultAndStopExecution(rejected);
    },
  };
}

query QuestBoard($status: QuestStatus) {
  quests(status: $status, first: 20) {
    id
    title
    reward
    status
    guild {
      name
    }
    assignee {
      name
    }
  }
}

mutation AcceptQuest($questId: ID!, $adventurerId: ID!) {
  acceptQuest(questId: $questId, adventurerId: $adventurerId) {
    id
    status
    assignee {
      name
    }
  }
}

import { createHash } from 'node:crypto';
import { readdirSync, readFileSync, writeFileSync } from 'node:fs';

const operations: Record<string, string> = {};

for (const file of readdirSync('operations')) {
  const document = readFileSync(`operations/${file}`, 'utf8');
  const hash = createHash('sha256').update(document).digest('hex');
  operations[hash] = document;
  console.log(`${hash.slice(0, 12)}…  ${file}`);
}

writeFileSync('persisted-operations.json', `${JSON.stringify(operations, null, 2)}\n`);

"persist": "node scripts/persist-operations.ts"

{
  "bde9c83149a07f4ca734c542eff70efe7895c7017185941b80ad368ce1a0817b": "mutation AcceptQuest($questId: ID!, $adventurerId: ID!) {\n  acceptQuest(questId: $questId, adventurerId: $adventurerId) {\n    id\n    status\n    assignee {\n      name\n    }\n  }\n}\n",
  …
}

import { readFileSync } from 'node:fs';
import Fastify, { LogController } from 'fastify';
import { createYoga } from 'graphql-yoga';
import { useExtendContextValuePerExecuteSubscriptionEvent } from '@envelop/execute-subscription-event';
import { useResponseCache } from '@graphql-yoga/plugin-response-cache';
import { useDepthLimit } from '@envelop/depth-limit';
import { usePersistedOperations } from '@graphql-yoga/plugin-persisted-operations';
import { Logger } from '@graphql-hive/logger';
import { PinoLogWriter } from '@graphql-hive/logger/writers/pino';
import { cache } from './cache.ts';
import { useCostLimit } from './cost.ts';
import { createContext, type Context, type ServerContext } from './context.ts';
import { db } from './db/index.ts';
import { createLoaders } from './loaders.ts';
import { schema } from './schema.ts';

const app = Fastify({
  logger: true,
  logController: new LogController({ disableRequestLogging: true }),
});

/** The operations our clients may send, by their SHA-256 hash. */
const persistedOperations: Record<string, string> = JSON.parse(
  readFileSync(new URL('../persisted-operations.json', import.meta.url), 'utf8'),
);

const yoga = createYoga<ServerContext>({
  schema,
  context: createContext,
  plugins: [
    usePersistedOperations({
      getPersistedOperation: (hash) => persistedOperations[hash] ?? null,
      allowArbitraryOperations: process.env.ALLOW_ARBITRARY_OPERATIONS === 'true',
    }),
    useDepthLimit({ maxDepth: 6 }),
    useCostLimit(5_000),
    // A subscription keeps its context for every event: give each event fresh loaders.
    useExtendContextValuePerExecuteSubscriptionEvent<Context>(() => ({
      contextPartial: { loaders: createLoaders(db) },
    })),
    useResponseCache({
      session: () => null,
      cache,
      ttl: 60_000,
      includeExtensionMetadata: process.env.NODE_ENV !== 'production',
    }),
  ],
  logging: new Logger({ writers: [new PinoLogWriter(app.log)] }),
});

app.route({
  url: yoga.graphqlEndpoint,
  method: ['GET', 'POST', 'OPTIONS'],
  handler: (req, reply) => yoga.handleNodeRequestAndResponse(req, reply, { req, reply }),
});

await app.listen({ port: Number(process.env.PORT) });

PORT=4000
DATABASE_URL=postgres://guild:guild@localhost:5432/guild
LOG_SQL=true
REDIS_URL=redis://localhost:6379
ALLOW_ARBITRARY_OPERATIONS=true

guild-api/
├── compose.yml                  PostgreSQL and Valkey
├── codegen.ts                   GraphQL Codegen: types for the resolvers
├── drizzle.config.ts            drizzle-kit: where the schema and migrations are
├── drizzle/                     the migrations
├── operations/                  the operations your clients send
├── persisted-operations.json    those operations by hash, written by pnpm persist
├── scripts/persist-operations.ts
└── src/
    ├── server.ts                Fastify, Yoga and the plugins
    ├── schema.graphql           the schema
    ├── schema.ts                schema file plus resolvers
    ├── resolvers.ts             queries, mutations, subscriptions, fields
    ├── context.ts               what every resolver gets
    ├── loaders.ts               the DataLoaders
    ├── pubsub.ts                events through Valkey
    ├── cache.ts                 the response cache in Valkey
    ├── cost.ts                  the cost limit
    ├── generated/graphql.ts     written by pnpm codegen
    └── db/                      Drizzle tables, connection and seed