11#nullable enable
22
33using System . Collections . Generic ;
4- using System . Linq ;
54using System . Security . Claims ;
5+ using System . Threading ;
66using System . Threading . Tasks ;
7- using GraphQL . Language . AST ;
87using GraphQL . Types ;
98using GraphQL . Validation ;
9+ using GraphQLParser ;
10+ using GraphQLParser . AST ;
11+ using GraphQLParser . Visitors ;
1012using Microsoft . AspNetCore . Authorization ;
1113
1214namespace GraphQL . Server . Authorization . AspNetCore
@@ -37,9 +39,9 @@ public AuthorizationValidationRule(
3739 _messageBuilder = messageBuilder ;
3840 }
3941
40- private bool ShouldBeSkipped ( Operation ? actualOperation , ValidationContext context )
42+ private bool ShouldBeSkipped ( GraphQLOperationDefinition actualOperation , ValidationContext context )
4143 {
42- if ( context . Document . Operations . Count <= 1 )
44+ if ( context . Document . OperationsCount ( ) <= 1 )
4345 {
4446 return false ;
4547 }
@@ -59,76 +61,85 @@ private bool ShouldBeSkipped(Operation? actualOperation, ValidationContext conte
5961 return true ;
6062 }
6163
62- if ( ancestor is FragmentDefinition fragment )
64+ if ( ancestor is GraphQLFragmentDefinition fragment )
6365 {
64- return ! FragmentBelongsToOperation ( fragment , actualOperation ) ;
66+ //TODO: may be rewritten completely later
67+ var c = new FragmentBelongsToOperationVisitorContext ( fragment ) ;
68+ _visitor . VisitAsync ( actualOperation , c ) . GetAwaiter ( ) . GetResult ( ) ; // TODO: need to think of something to avoid this
69+ return ! c . Found ;
6570 }
6671 } while ( true ) ;
6772 }
6873
69- private bool FragmentBelongsToOperation ( FragmentDefinition fragment , Operation ? operation )
74+ private sealed class FragmentBelongsToOperationVisitorContext : IASTVisitorContext
7075 {
71- bool belongs = false ;
72- void Visit ( INode ? node , int _ )
76+ public FragmentBelongsToOperationVisitorContext ( GraphQLFragmentDefinition fragment )
7377 {
74- if ( belongs )
75- {
76- return ;
77- }
78+ Fragment = fragment ;
79+ }
7880
79- belongs = node is FragmentSpread fragmentSpread && fragmentSpread . Name == fragment . Name ;
81+ public GraphQLFragmentDefinition Fragment { get ; }
8082
81- if ( node != null )
82- {
83- node . Visit ( Visit , 0 ) ;
84- }
85- }
83+ public bool Found { get ; set ; }
84+
85+ public CancellationToken CancellationToken => default ;
86+ }
8687
87- operation ? . Visit ( Visit , 0 ) ;
88+ private static readonly FragmentBelongsToOperationVisitor _visitor = new ( ) ;
8889
89- return belongs ;
90+ private sealed class FragmentBelongsToOperationVisitor : ASTVisitor < FragmentBelongsToOperationVisitorContext >
91+ {
92+ protected override ValueTask VisitFragmentSpreadAsync ( GraphQLFragmentSpread fragmentSpread , FragmentBelongsToOperationVisitorContext context )
93+ {
94+ context . Found = context . Fragment . FragmentName . Name == fragmentSpread . FragmentName . Name ;
95+ return default ;
96+ }
97+
98+ public override ValueTask VisitAsync ( ASTNode ? node , FragmentBelongsToOperationVisitorContext context )
99+ {
100+ return context . Found ? default : base . VisitAsync ( node , context ) ;
101+ }
90102 }
91103
92104 /// <inheritdoc />
93105 public async ValueTask < INodeVisitor ? > ValidateAsync ( ValidationContext context )
94106 {
95107 await AuthorizeAsync ( null , context . Schema , context , null ) ;
96108 var operationType = OperationType . Query ;
97- var actualOperation = context . Document . Operations . FirstOrDefault ( x => x . Name == context . OperationName ) ?? context . Document . Operations . FirstOrDefault ( ) ;
98109
99110 // this could leak info about hidden fields or types in error messages
100111 // it would be better to implement a filter on the Schema so it
101112 // acts as if they just don't exist vs. an auth denied error
102113 // - filtering the Schema is not currently supported
103114 // TODO: apply ISchemaFilter - context.Schema.Filter.AllowXXX
104115 return new NodeVisitors (
105- new MatchingNodeVisitor < Operation > ( ( astType , context ) =>
116+ new MatchingNodeVisitor < GraphQLOperationDefinition > ( ( astType , context ) =>
106117 {
107- if ( context . Document . Operations . Count > 1 && astType . Name != context . OperationName )
118+ if ( context . Document . OperationsCount ( ) > 1 && astType . Name != context . Operation . Name )
108119 {
109120 return ;
110121 }
111122
112- operationType = astType . OperationType ;
123+ operationType = astType . Operation ;
113124
114125 var type = context . TypeInfo . GetLastType ( ) ;
115126 AuthorizeAsync ( astType , type , context , operationType ) . GetAwaiter ( ) . GetResult ( ) ; // TODO: need to think of something to avoid this
116127 } ) ,
117128
118- new MatchingNodeVisitor < ObjectField > ( ( objectFieldAst , context ) =>
129+ new MatchingNodeVisitor < GraphQLObjectField > ( ( objectFieldAst , context ) =>
119130 {
120- if ( context . TypeInfo . GetArgument ( ) ? . ResolvedType ? . GetNamedType ( ) is IComplexGraphType argumentType && ! ShouldBeSkipped ( actualOperation , context ) )
131+ if ( context . TypeInfo . GetArgument ( ) ? . ResolvedType ? . GetNamedType ( ) is IComplexGraphType argumentType && ! ShouldBeSkipped ( context . Operation , context ) )
121132 {
122133 var fieldType = argumentType . GetField ( objectFieldAst . Name ) ;
123134 AuthorizeAsync ( objectFieldAst , fieldType , context , operationType ) . GetAwaiter ( ) . GetResult ( ) ; // TODO: need to think of something to avoid this
124135 }
125136 } ) ,
126137
127- new MatchingNodeVisitor < Field > ( ( fieldAst , context ) =>
138+ new MatchingNodeVisitor < GraphQLField > ( ( fieldAst , context ) =>
128139 {
129140 var fieldDef = context . TypeInfo . GetFieldDef ( ) ;
130141
131- if ( fieldDef == null || ShouldBeSkipped ( actualOperation , context ) )
142+ if ( fieldDef == null || ShouldBeSkipped ( context . Operation , context ) )
132143 return ;
133144
134145 // check target field
@@ -137,9 +148,9 @@ void Visit(INode? node, int _)
137148 AuthorizeAsync ( fieldAst , fieldDef . ResolvedType ? . GetNamedType ( ) , context , operationType ) . GetAwaiter ( ) . GetResult ( ) ; // TODO: need to think of something to avoid this
138149 } ) ,
139150
140- new MatchingNodeVisitor < VariableReference > ( ( variableRef , context ) =>
151+ new MatchingNodeVisitor < GraphQLVariable > ( ( variableRef , context ) =>
141152 {
142- if ( context . TypeInfo . GetArgument ( ) ? . ResolvedType ? . GetNamedType ( ) is not IComplexGraphType variableType || ShouldBeSkipped ( actualOperation , context ) )
153+ if ( context . TypeInfo . GetArgument ( ) ? . ResolvedType ? . GetNamedType ( ) is not IComplexGraphType variableType || ShouldBeSkipped ( context . Operation , context ) )
143154 return ;
144155
145156 AuthorizeAsync ( variableRef , variableType , context , operationType ) . GetAwaiter ( ) . GetResult ( ) ; // TODO: need to think of something to avoid this;
@@ -149,7 +160,7 @@ void Visit(INode? node, int _)
149160 // validation rule should check that but here we should just ignore that
150161 // "unknown" field.
151162 if ( context . Variables != null &&
152- context . Variables . TryGetValue ( variableRef . Name , out object ? input ) &&
163+ context . Variables . TryGetValue ( variableRef . Name . StringValue , out object ? input ) && //ISSUE:allocation
153164 input is Dictionary < string , object > fieldsValues )
154165 {
155166 foreach ( var field in variableType . Fields )
@@ -164,7 +175,7 @@ void Visit(INode? node, int _)
164175 ) ;
165176 }
166177
167- private async Task AuthorizeAsync ( INode ? node , IProvideMetadata ? provider , ValidationContext context , OperationType ? operationType )
178+ private async Task AuthorizeAsync ( ASTNode ? node , IProvideMetadata ? provider , ValidationContext context , OperationType ? operationType )
168179 {
169180 var policyNames = provider ? . GetPolicies ( ) ;
170181
@@ -198,7 +209,7 @@ private async Task AuthorizeAsync(INode? node, IProvideMetadata? provider, Valid
198209 /// <summary>
199210 /// Adds an authorization failure error to the document response
200211 /// </summary>
201- protected virtual void AddValidationError ( INode ? node , ValidationContext context , OperationType ? operationType , AuthorizationResult result )
212+ protected virtual void AddValidationError ( ASTNode ? node , ValidationContext context , OperationType ? operationType , AuthorizationResult result )
202213 {
203214 string message = _messageBuilder . GenerateMessage ( operationType , result ) ;
204215 context . ReportError ( new AuthorizationError ( node , context , message , result , operationType ) ) ;
0 commit comments