拉拉维尔灯塔，如何检查查询深度，查询复杂度

Question

在生产服务器上部署灯塔之前，我检查安全性(https://www.howtographql.com/advanced/4-security/)。所以我决定检查查询的深度，查询的复杂性

在灯塔文件中，他们提到了config/lighthouse.php，

/*
|--------------------------------------------------------------------------
| Security
|--------------------------------------------------------------------------
|
| Control how Lighthouse handles security related query validation.
| Read more at https://webonyx.github.io/graphql-php/security/
|
*/
'security' => [
    'max_query_complexity' => \GraphQL\Validator\Rules\QueryComplexity::DISABLED,
    'max_query_depth' => \GraphQL\Validator\Rules\QueryDepth::DISABLED,
    'disable_introspection' => \GraphQL\Validator\Rules\DisableIntrospection::DISABLED,
],

并重新编写成https://webonyx.github.io/graphql-php/security/

在这个链接中，他们给出了一些例子，

use GraphQL\GraphQL;
use GraphQL\Validator\Rules\QueryComplexity;
use GraphQL\Validator\DocumentValidator;

$rule = new QueryComplexity($maxQueryComplexity = 100);
DocumentValidator::addRule($rule);

GraphQL::executeQuery(/*...*/);

use GraphQL\GraphQL;
use GraphQL\Validator\Rules\QueryDepth;
use GraphQL\Validator\DocumentValidator;

$rule = new QueryDepth($maxDepth = 10);
DocumentValidator::addRule($rule);

GraphQL::executeQuery(/*...*/);

但是如何将这些应用于灯塔呢？

第一次，我把这些代码写到ExampleQuery.php(php artisan lighthouse:query ExampleQuery)

final class ExampleQuery
{
    public function __invoke(_, array $args)
    {
        $rule = new QueryComplexity(2);
        DocumentValidator::addRule($rule);

        $rule2 = new QueryDepth(2);
        DocumentValidator::addRule($rule2);

        return [
            ...
        ];
    }
}

但这不可能解决任何问题。

我想灯塔是从vendor/nuwave/.../GraphQLController.php开始的，所以我不能执行GraphQL::executeQuery(/*...*/);

@complexity指令不起作用，@complexity(resolver: "App\\Security\\ComplexityAnalyzer@userPosts")不调用userPosts函数。

class ComplexityAnalyzer {

    public function userPosts(int $childrenComplexity, array $args): int  // not called
    {
        $postComplexity = $args['includeFullText']
            ? 3
            : 2;
        \Log::Debug($postComplexity); // not called
        return $childrenComplexity * $postComplexity;

    }
}

我错过了什么..？请帮我睡得舒服点。

Answer 1

它已经实现了，您只需设置值。

'security' => [
        'max_query_complexity' => 100,
        'max_query_depth' => 10,
    ],

使用@复杂性指令，可以对每个字段的复杂度分数计算进行修改。