feat: native composition report (#7007)

Author: n1ru4l

codegen.mts

@@ -34,8 +34,8 @@ const config: CodegenConfig = {
           contextType: 'GraphQLModules.ModuleContext',
           enumValues: {
             ProjectType: '../shared/entities#ProjectType',
-            NativeFederationCompatibilityStatus:
-              '../shared/entities#NativeFederationCompatibilityStatus',
+            NativeFederationCompatibilityStatusType:
+              '../shared/entities#NativeFederationCompatibilityStatusType',
             TargetAccessScope: '../modules/auth/providers/scopes#TargetAccessScope',
             ProjectAccessScope: '../modules/auth/providers/scopes#ProjectAccessScope',
             OrganizationAccessScope: '../modules/auth/providers/scopes#OrganizationAccessScope',

packages/services/api/src/modules/auth/lib/authz.ts

@@ -281,19 +281,25 @@ function isActionMatch(actionContainingWildcard: string, action: string) {
   if (actionContainingWildcard === '*') {
     return true;
   }
+
   // exact match
   if (actionContainingWildcard === action) {
     return true;
   }
 
-  const [actionScope] = action.split(':');
+  const [actionScope, actionId] = action.split(':');
   const [userSpecifiedActionScope, userSpecifiedActionId] = actionContainingWildcard.split(':');
 
   // wildcard match "scope:*"
   if (actionScope === userSpecifiedActionScope && userSpecifiedActionId === '*') {
     return true;
   }
 
+  // wildcard match "*:scope"
+  if (userSpecifiedActionScope === '*' && userSpecifiedActionId === actionId) {
+    return true;
+  }
+
   return false;
 }
 
@@ -500,7 +506,7 @@ type ActionDefinitionMap = {
   [key: `${string}:${string}`]: (args: any) => Array<string>;
 };
 
-const actionDefinitions = {
+export const actionDefinitions = {
   ...objectFromEntries(permissionsByLevel['organization'].map(t => [t.value, defaultOrgIdentity])),
   ...objectFromEntries(permissionsByLevel['project'].map(t => [t.value, defaultProjectIdentity])),
   ...objectFromEntries(permissionsByLevel['target'].map(t => [t.value, defaultTargetIdentity])),
@@ -514,7 +520,7 @@ const actionDefinitions = {
 
 type Actions = keyof typeof actionDefinitions;
 
-type ActionStrings = Actions | '*';
+type ActionStrings = Actions | '*' | '*:describe';
 
 /** Unauthenticated session that is returned by default. */
 class UnauthenticatedSession extends Session {

packages/services/api/src/modules/auth/lib/supertokens-strategy.ts

@@ -67,6 +67,18 @@ export class SuperTokensCookieBasedSession extends Session {
         organizationId,
       );
 
+      // Allow admins to use all describe actions within foreign organizations
+      // This makes it much more pleasant to debug.
+      if (user.isAdmin) {
+        return [
+          {
+            action: '*:describe',
+            effect: 'allow',
+            resource: `hrn:${organizationId}:organization/${organizationId}`,
+          },
+        ];
+      }
+
       return [];
     }
 

packages/services/api/src/modules/project/providers/project-manager.ts

@@ -198,6 +198,7 @@ export class ProjectManager {
         projectId: selector.projectId,
       },
     });
+
     return this.storage.getProject(selector);
   }
 

packages/services/api/src/modules/schema/module.graphql.ts

@@ -114,14 +114,40 @@ export default gql`
     externalSchemaComposition: ExternalSchemaComposition
     schemaVersionsCount(period: DateRangeInput): Int!
     isNativeFederationEnabled: Boolean!
-    nativeFederationCompatibility: NativeFederationCompatibilityStatus!
+    """
+    Get the status of the native federation compatability for the project.
+    """
+    nativeFederationCompatibility: NativeCompositionCompatibility!
   }
 
   extend type Target {
     schemaVersionsCount(period: DateRangeInput): Int!
   }
 
-  enum NativeFederationCompatibilityStatus {
+  type NativeCompositionVersionStatus {
+    """
+    The schema version we check against.
+    """
+    schemaVersion: SchemaVersion!
+    """
+    The native composition result. The supergraphSdl is sorted and normalized.
+    """
+    nativeCompositionResult: SchemaCompositionResult!
+    """
+    The supergraph of the latest valid schema version (sorted and normalized).
+    """
+    currentSupergraphSdl: String!
+  }
+
+  type NativeCompositionCompatibility {
+    """
+    Whether the schema version is compatible.
+    """
+    status: NativeFederationCompatibilityStatusType!
+    results: [NativeCompositionVersionStatus]!
+  }
+
+  enum NativeFederationCompatibilityStatusType {
     COMPATIBLE
     INCOMPATIBLE
     UNKNOWN

packages/services/api/src/modules/schema/providers/schema-manager.ts

@@ -16,7 +16,7 @@ import { SchemaChecksFilter } from '../../../__generated__/types';
 import * as GraphQLSchema from '../../../__generated__/types';
 import {
   DateRange,
-  NativeFederationCompatibilityStatus,
+  NativeFederationCompatibilityStatusType,
   Organization,
   Project,
   ProjectType,
@@ -1123,64 +1123,69 @@ export class SchemaManager {
     return true;
   }
 
-  async getNativeFederationCompatibilityStatus(project: Project) {
+  async getNativeFederationCompatibilityStatus(project: Project): Promise<{
+    status: NativeFederationCompatibilityStatusType;
+    results: Array<null | {
+      schemaVersion: SchemaVersion;
+      target: Target;
+      nativeCompositionResult: {
+        supergraphSdl: string | null;
+        errors: Array<{ message: string }> | null;
+      };
+      currentSupergraphSdl: string;
+    }>;
+  }> {
     this.logger.debug(
       'Get native Federation compatibility status (organization=%s, project=%s)',
       project.orgId,
       project.id,
     );
 
     if (project.type !== ProjectType.FEDERATION) {
-      return NativeFederationCompatibilityStatus.NOT_APPLICABLE;
+      return {
+        status: NativeFederationCompatibilityStatusType.NOT_APPLICABLE,
+        results: [],
+      };
     }
 
     const targets = await this.targetManager.getTargets({
       organizationId: project.orgId,
       projectId: project.id,
     });
 
-    const possibleVersions = await Promise.all(
-      targets.map(target => this.getMaybeLatestValidVersion(target)),
-    );
-
-    const versions = possibleVersions.filter((v): v is SchemaVersion => !!v);
-
-    this.logger.debug('Found %s targets and %s versions', targets.length, versions.length);
+    const results = await Promise.all(
+      targets.map(async target => {
+        const schemaVersion = await this.getMaybeLatestValidVersion(target);
 
-    // If there are no composable versions available, we can't determine the compatibility status.
-    if (
-      versions.length === 0 ||
-      !versions.every(
-        version => version && version.isComposable && typeof version.supergraphSDL === 'string',
-      )
-    ) {
-      this.logger.debug('No composable versions available (status: unknown)');
-      return NativeFederationCompatibilityStatus.UNKNOWN;
-    }
+        if (schemaVersion === null) {
+          return null;
+        }
 
-    const schemasPerVersion = await Promise.all(
-      versions.map(async version =>
-        this.getSchemasOfVersion({
-          organizationId: version.organizationId,
-          projectId: version.projectId,
-          targetId: version.targetId,
-          versionId: version.id,
-        }),
-      ),
-    );
+        const currentSupergraphSdl = print(
+          removeDescriptions(
+            sortSDL(
+              parseGraphQLSource(
+                schemaVersion.supergraphSDL!,
+                'parsing native supergraph in getNativeFederationCompatibilityStatus',
+              ),
+            ),
+          ),
+        );
 
-    this.logger.debug('Checking compatibility of %s versions', versions.length);
+        const schemas = await this.getSchemasOfVersion({
+          organizationId: target.orgId,
+          projectId: target.projectId,
+          targetId: target.id,
+          versionId: schemaVersion.id,
+        });
 
-    const compatibilityResults = await Promise.all(
-      versions.map(async (version, i) => {
-        if (schemasPerVersion[i].length === 0) {
-          this.logger.debug('No schemas (version=%s)', version.id);
-          return NativeFederationCompatibilityStatus.UNKNOWN;
+        if (schemas.length === 0) {
+          return null;
         }
 
         const compositionResult = await this.compositionOrchestrator.composeAndValidate(
           'federation',
-          ensureCompositeSchemas(schemasPerVersion[i]).map(s =>
+          ensureCompositeSchemas(schemas).map(s =>
             this.schemaHelper.createSchemaObject({
               sdl: s.sdl,
               service_name: s.service_name,
@@ -1196,53 +1201,52 @@ export class SchemaManager {
           },
         );
 
-        if (compositionResult.supergraph) {
-          const sortedExistingSupergraph = print(
-            removeDescriptions(
-              sortSDL(
-                parseGraphQLSource(
-                  compositionResult.supergraph,
-                  'parsing existing supergraph in getNativeFederationCompatibilityStatus',
-                ),
-              ),
-            ),
-          );
-          const sortedNativeSupergraph = print(
-            removeDescriptions(
-              sortSDL(
-                parseGraphQLSource(
-                  version.supergraphSDL!,
-                  'parsing native supergraph in getNativeFederationCompatibilityStatus',
+        const supergraphSdl = compositionResult.supergraph
+          ? print(
+              removeDescriptions(
+                sortSDL(
+                  parseGraphQLSource(
+                    compositionResult.supergraph,
+                    'parsing native supergraph in getNativeFederationCompatibilityStatus',
+                  ),
                 ),
               ),
-            ),
-          );
-
-          if (sortedNativeSupergraph === sortedExistingSupergraph) {
-            return NativeFederationCompatibilityStatus.COMPATIBLE;
-          }
-
-          this.logger.debug('Produced different supergraph (version=%s)', version.id);
-        } else {
-          this.logger.debug('Failed to produce supergraph (version=%s)', version.id);
-        }
+            )
+          : null;
 
-        return NativeFederationCompatibilityStatus.INCOMPATIBLE;
+        return {
+          target,
+          schemaVersion,
+          currentSupergraphSdl,
+          nativeCompositionResult: {
+            supergraphSdl,
+            errors: compositionResult.errors,
+          },
+        };
       }),
     );
 
-    if (compatibilityResults.includes(NativeFederationCompatibilityStatus.UNKNOWN)) {
-      this.logger.debug('One of the versions seems empty (status: unknown)');
-      return NativeFederationCompatibilityStatus.UNKNOWN;
-    }
+    let status = NativeFederationCompatibilityStatusType.INCOMPATIBLE;
 
-    if (compatibilityResults.every(r => r === NativeFederationCompatibilityStatus.COMPATIBLE)) {
+    if (results.every(result => result === null)) {
+      this.logger.debug('No composable versions available (status: unknown)');
+      status = NativeFederationCompatibilityStatusType.UNKNOWN;
+    } else if (
+      results.every(
+        result =>
+          result === null ||
+          (result.nativeCompositionResult &&
+            result.currentSupergraphSdl === result.nativeCompositionResult.supergraphSdl),
+      )
+    ) {
       this.logger.debug('All versions are compatible (status: compatible)');
-      return NativeFederationCompatibilityStatus.COMPATIBLE;
+      status = NativeFederationCompatibilityStatusType.COMPATIBLE;
     }
 
-    this.logger.debug('Some versions are incompatible (status: incompatible)');
-    return NativeFederationCompatibilityStatus.INCOMPATIBLE;
+    return {
+      status,
+      results,
+    };
   }
 
   async getGitHubMetadata(schemaVersion: SchemaVersion): Promise<null | {

packages/services/api/src/shared/entities.ts

@@ -145,7 +145,7 @@ export enum ProjectType {
   SINGLE = 'SINGLE',
 }
 
-export enum NativeFederationCompatibilityStatus {
+export enum NativeFederationCompatibilityStatusType {
   COMPATIBLE = 'COMPATIBLE',
   INCOMPATIBLE = 'INCOMPATIBLE',
   UNKNOWN = 'UNKNOWN',