Skip to content

[TT-12153]: Fix/complexity checker and granular access checker v3-preview#6293

Merged
kofoworola merged 2 commits into
masterfrom
fix/complexity-checker
May 22, 2024
Merged

[TT-12153]: Fix/complexity checker and granular access checker v3-preview#6293
kofoworola merged 2 commits into
masterfrom
fix/complexity-checker

Conversation

@kofoworola

@kofoworola kofoworola commented May 20, 2024

Copy link
Copy Markdown
Contributor

User description

Description

TT-12153

Related Issue

Motivation and Context

How This Has Been Tested

Screenshots (if appropriate)

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Refactoring or add test (improvements in base code or adds test coverage to functionality)

Checklist

  • I ensured that the documentation is up to date
  • I explained why this PR updates go.mod in detail with reasoning why it's required
  • I would like a code coverage CI quality gate exception and have explained why

PR Type

Enhancement


Description

  • Integrated complexityCheckerV2 and granularAccessCheckerV2 into EngineV3.
  • Implemented complexity and granular access processing in the reverse proxy.
  • Added new checker classes with methods for depth limit and field allowance validation.

Changes walkthrough 📝

Relevant files
Enhancement
engine_v3.go
Integrate new complexity and granular access checkers in EngineV3

internal/graphengine/engine_v3.go

  • Added complexityCheckerV2 and granularAccessCheckerV2 initialization.
  • Integrated new checkers into the EngineV3 structure.
  • Removed commented-out code for previous checker versions.
  • +14/-12 
    engine_v3_reverse_proxy.go
    Implement complexity and granular access processing in reverse proxy

    internal/graphengine/engine_v3_reverse_proxy.go

  • Implemented ProcessGraphQLComplexity using complexityCheckerV2.
  • Implemented ProcessGraphQLGranularAccess using
    granularAccessCheckerV2.
  • Removed error logging for unsupported features.
  • +3/-4     
    graphql_go_tools_v2.go
    Add complexity and granular access checkers with validation methods

    internal/graphengine/graphql_go_tools_v2.go

  • Added complexityCheckerV2 with depth limit checking.
  • Added granularAccessCheckerV2 with field allowance checking.
  • Implemented methods for complexity and granular access validation.
  • +193/-0 

    💡 PR-Agent usage:
    Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

    @github-actions

    Copy link
    Copy Markdown
    Contributor

    PR Description updated to latest commit (87046f2)

    @github-actions

    github-actions Bot commented May 20, 2024

    Copy link
    Copy Markdown
    Contributor

    API Changes

    no api changes detected

    @github-actions

    Copy link
    Copy Markdown
    Contributor

    PR Review 🔍

    ⏱️ Estimated effort to review [1-5]

    3, because the PR involves changes in complex systems like GraphQL complexity and granular access checkers, which require a good understanding of both the existing system and the changes to effectively review.

    🧪 Relevant tests

    No

    ⚡ Possible issues

    Possible Bug: The DepthLimitExceeded method in complexityCheckerV2 might incorrectly handle the depth check when both global and per-field limits are defined. The method currently does not account for the scenario where the global limit might be less restrictive than the per-field limits, potentially allowing deeper queries than intended.

    Error Handling: In granularAccessCheckerV2, the method validateFieldRestrictions might not handle GraphQL validation errors properly. It checks if result.Valid is false or if there are errors, but it does not differentiate actions based on the type of validation error, which could lead to generic error responses instead of specific actionable messages.

    🔒 Security concerns

    No

    Code feedback:
    relevant fileinternal/graphengine/graphql_go_tools_v2.go
    suggestion      

    Consider implementing a more robust error handling strategy in the DepthLimitExceeded method. Specifically, when both global and per-field limits are defined, ensure that the stricter limit is enforced to prevent deeper queries than intended. This change will enhance the security and integrity of the GraphQL query handling. [important]

    relevant lineif greaterThanIntConsideringUnlimited(queryDepth, accessDefinition.Limit.MaxQueryDepth) {

    @github-actions

    Copy link
    Copy Markdown
    Contributor

    PR Code Suggestions ✨

    CategorySuggestion                                                                                                                                    Score
    Possible bug
    Add nil check before dereferencing to prevent potential runtime panic

    Consider checking for nil before dereferencing options.Injections to avoid potential nil
    pointer dereference.

    internal/graphengine/engine_v3.go [101]

    -ctxRetrieveRequest: options.Injections.ContextRetrieveRequest,
    +ctxRetrieveRequest: nil,
    +if options.Injections != nil {
    +    ctxRetrieveRequest: options.Injections.ContextRetrieveRequest,
    +}
     
    Suggestion importance[1-10]: 9

    Why: This suggestion addresses a potential runtime panic due to nil pointer dereference, which is a significant issue. Adding a nil check improves the robustness of the code.

    9
    Check for nil before using parsedSchema to avoid nil pointer dereference

    Ensure that parsedSchema is not nil before using it to initialize complexityChecker and
    granularAccessChecker to prevent runtime errors.

    internal/graphengine/engine_v3.go [100]

    -schema: parsedSchema,
    +schema: nil,
    +if parsedSchema != nil {
    +    schema: parsedSchema,
    +}
     
    Suggestion importance[1-10]: 9

    Why: Ensuring parsedSchema is not nil before using it prevents potential runtime errors. This is crucial for maintaining the stability and reliability of the application.

    9
    Enhancement
    Implement structured logging for better traceability and log management

    Use structured logging for consistency and better log management. Replace logger.Error and
    logger.Debug with structured logging methods.

    internal/graphengine/engine_v3.go [99]

    -logger: logger,
    +logger: logger.WithFields(log.Fields{"component": "complexityCheckerV2"}),
     
    Suggestion importance[1-10]: 7

    Why: Structured logging enhances log management and traceability, which is beneficial for debugging and monitoring. However, it is more of an enhancement than a critical fix.

    7
    Maintainability
    Refactor object initialization into separate functions for better code organization

    Refactor the initialization of complexityChecker and granularAccessChecker into separate
    functions to improve code readability and maintainability.

    internal/graphengine/engine_v3.go [98-108]

    -complexityChecker := &complexityCheckerV2{
    -    logger:             logger,
    -    schema:             parsedSchema,
    -    ctxRetrieveRequest: options.Injections.ContextRetrieveRequest,
    -}
    -granularAccessChecker := &granularAccessCheckerV2{
    -    logger:                    logger,
    -    schema:                    parsedSchema,
    -    ctxRetrieveGraphQLRequest: options.Injections.ContextRetrieveRequest,
    -}
    +complexityChecker := newComplexityCheckerV2(logger, parsedSchema, options)
    +granularAccessChecker := newGranularAccessCheckerV2(logger, parsedSchema, options)
     
    Suggestion importance[1-10]: 6

    Why: Refactoring the initialization into separate functions improves code readability and maintainability. While this is a good practice, it is not as critical as fixing potential runtime errors.

    6

    @kofoworola
    kofoworola force-pushed the fix/complexity-checker branch from 87046f2 to 89ebdf0 Compare May 21, 2024 08:41
    @sonarqubecloud

    Copy link
    Copy Markdown

    Quality Gate Failed Quality Gate failed

    Failed conditions
    0.0% Coverage on New Code (required ≥ 80%)
    C Reliability Rating on New Code (required ≥ A)

    See analysis details on SonarCloud

    Catch issues before they fail your Quality Gate with our IDE extension SonarLint

    @kofoworola
    kofoworola merged commit 7cca61a into master May 22, 2024
    @kofoworola
    kofoworola deleted the fix/complexity-checker branch May 22, 2024 08:45
    nerdydread pushed a commit that referenced this pull request Sep 6, 2024
    …view (#6293)
    
    ### **User description**
    <!-- Provide a general summary of your changes in the Title above -->
    
    ## Description
    
    <!-- Describe your changes in detail -->
    [TT-12153](https://tyktech.atlassian.net/browse/TT-12153)
    
    ## Related Issue
    
    <!-- This project only accepts pull requests related to open issues. -->
    <!-- If suggesting a new feature or change, please discuss it in an
    issue first. -->
    <!-- If fixing a bug, there should be an issue describing it with steps
    to reproduce. -->
    <!-- OSS: Please link to the issue here. Tyk: please create/link the
    JIRA ticket. -->
    
    ## Motivation and Context
    
    <!-- Why is this change required? What problem does it solve? -->
    
    ## How This Has Been Tested
    
    <!-- Please describe in detail how you tested your changes -->
    <!-- Include details of your testing environment, and the tests -->
    <!-- you ran to see how your change affects other areas of the code,
    etc. -->
    <!-- This information is helpful for reviewers and QA. -->
    
    ## Screenshots (if appropriate)
    
    ## Types of changes
    
    <!-- What types of changes does your code introduce? Put an `x` in all
    the boxes that apply: -->
    
    - [ ] Bug fix (non-breaking change which fixes an issue)
    - [ ] New feature (non-breaking change which adds functionality)
    - [ ] Breaking change (fix or feature that would cause existing
    functionality to change)
    - [ ] Refactoring or add test (improvements in base code or adds test
    coverage to functionality)
    
    ## Checklist
    
    <!-- Go over all the following points, and put an `x` in all the boxes
    that apply -->
    <!-- If there are no documentation updates required, mark the item as
    checked. -->
    <!-- Raise up any additional concerns not covered by the checklist. -->
    
    - [ ] I ensured that the documentation is up to date
    - [ ] I explained why this PR updates go.mod in detail with reasoning
    why it's required
    - [ ] I would like a code coverage CI quality gate exception and have
    explained why
    
    
    [TT-12153]:
    https://tyktech.atlassian.net/browse/TT-12153?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
    
    
    ___
    
    ### **PR Type**
    Enhancement
    
    
    ___
    
    ### **Description**
    - Integrated `complexityCheckerV2` and `granularAccessCheckerV2` into
    `EngineV3`.
    - Implemented complexity and granular access processing in the reverse
    proxy.
    - Added new checker classes with methods for depth limit and field
    allowance validation.
    
    
    ___
    
    
    
    ### **Changes walkthrough** 📝
    <table><thead><tr><th></th><th align="left">Relevant
    files</th></tr></thead><tbody><tr><td><strong>Enhancement
    </strong></td><td><table>
    <tr>
      <td>
        <details>
    <summary><strong>engine_v3.go</strong><dd><code>Integrate new complexity
    and granular access checkers in EngineV3</code></dd></summary>
    <hr>
    
    internal/graphengine/engine_v3.go
    <li>Added <code>complexityCheckerV2</code> and
    <code>granularAccessCheckerV2</code> initialization.<br> <li> Integrated
    new checkers into the <code>EngineV3</code> structure.<br> <li> Removed
    commented-out code for previous checker versions.<br>
    
    
    </details>
        
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6293/files#diff-4ba23e43847b67a031cd5f4db82b27640f10ae9b291dc389bb8137bf1b4c7831">+14/-12</a>&nbsp;
    </td>
    </tr>                    
    
    <tr>
      <td>
        <details>
    <summary><strong>engine_v3_reverse_proxy.go</strong><dd><code>Implement
    complexity and granular access processing in reverse
    proxy</code></dd></summary>
    <hr>
    
    internal/graphengine/engine_v3_reverse_proxy.go
    <li>Implemented <code>ProcessGraphQLComplexity</code> using
    <code>complexityCheckerV2</code>.<br> <li> Implemented
    <code>ProcessGraphQLGranularAccess</code> using
    <br><code>granularAccessCheckerV2</code>.<br> <li> Removed error logging
    for unsupported features.<br>
    
    
    </details>
        
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6293/files#diff-911310643ffcc0a9349642a40b3237a59c044dc9ea2ab98248e5e4c3a641b703">+3/-4</a>&nbsp;
    &nbsp; &nbsp; </td>
    </tr>                    
    
    <tr>
      <td>
        <details>
    <summary><strong>graphql_go_tools_v2.go</strong><dd><code>Add complexity
    and granular access checkers with validation
    methods</code></dd></summary>
    <hr>
    
    internal/graphengine/graphql_go_tools_v2.go
    <li>Added <code>complexityCheckerV2</code> with depth limit
    checking.<br> <li> Added <code>granularAccessCheckerV2</code> with field
    allowance checking.<br> <li> Implemented methods for complexity and
    granular access validation.<br>
    
    
    </details>
        
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6293/files#diff-2e41b60f046c2947fbedb8fb841b5c3c962798e3ba8211c7144f326436ffabe3">+193/-0</a>&nbsp;
    </td>
    </tr>                    
    </table></td></tr></tr></tbody></table>
    
    ___
    
    > 💡 **PR-Agent usage**:
    >Comment `/help` on the PR to get a list of all available PR-Agent tools
    and their descriptions
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Projects

    None yet

    Development

    Successfully merging this pull request may close these issues.

    2 participants