How to use it with NestJS?

[kasir-barati]

I would love to know if you know how I can integrate this with my NestJS app. I have written a dummy NestJS app using graphql-query-complexity. You can see my Dev.to post here: https://dev.to/kasir-barati/graphql-query-complexity-nestjs-dataloader-2p2m.

But now I thought oh, this lib is solving two of my main concerns, query depth, and complexity in one go. So I would love to also see if we could add a section in the docs for NestJS integration since NestJS is pretty much a very solid choice for many devs out there to kickstart their Backend project.

Any comment?

Oh, BTW here is the app I wrote in NestJS: https://github.com/kasir-barati/graphql-js-ts/tree/main/apps/complexity. Right now in NestJS's docs you can see that we're suggesting devs to use graphql-query-complexity. So I am also hoping to change that if this lib can be fairly straight forward to configure and use: https://docs.nestjs.com/graphql/complexity.

[kasir-barati]

And another question that I did not get an answer from your docs was this issue, discussed in graphql-depth-limit-ts: sonofmagic/graphql-depth-limit-ts#14

Long story short it is trying to take into account the Relay Connection Pagination Spec and flatten them (not really flatten them, but rather giving a one point to each set of them. In practice it will give 1 point to {edges: { nodes: { id } }}).

[kasir-barati]

Side note: the doc is really short and it does not provide any sort of explanation. Like for example here it just says go and implement your workaround but the least you could do was to point out some issues, or posts on how to do that: https://escape.tech/graphql-armor/docs/configuration/apollo/#graphql-armor-event-are-fired-once-for-multiple-queries.

Or about the config object there is little to no explanation: https://escape.tech/graphql-armor/docs/api/types/#config

Am I missing something or is this how it should be? I am used to figure stuff out by reading docs but this lib does not have one to begin with IMO (Do not take it personally, I am just trying to communicate the issues I am facing right now as clearly as possible).

[kasir-barati]

I watched this YouTube video and surprisingly it gives you more info about the config object than the docs 😮. But still is not enough. I mean I am still trying to understand whether this lib:

1. Is taking into account Relay Connection or not?
2. How it is calculating the cost of a query when we have specified the depthCostFactor, scalarCost, and objectCost. Are they multiplied by each other and then added to give us the total complexity of a query, or something else?
3. What if I wanna give different numbers to each field? I can have one scalar type field that is costly to be fetched (assume I have some custom computations before returning it).

I know this might sound like "common sense" to you but right now I am not sure what is what.

[kasir-barati]

Answering Question Number 1: NO

graphql-armor/packages/plugins/max-depth/src/index.ts

Lines 84 to 95 in 3824fe0

	if ('selectionSet' in node && node.selectionSet) {
	for (const child of node.selectionSet.selections) {
	if (
	this.config.flattenFragments &&
	(child.kind === Kind.INLINE_FRAGMENT || child.kind === Kind.FRAGMENT_SPREAD)
	) {
	depth = Math.max(depth, this.countDepth(child, parentDepth));
	} else {
	depth = Math.max(depth, this.countDepth(child, parentDepth + 1));
	}
	}
	} else if (node.kind == Kind.FRAGMENT_SPREAD) {

Note

I am doing a pretty shallow quick code review. Therefore it is quite possible that I might have missed something 🙂.

For the time being I've created issue #755, you can find more details there.

[kasir-barati]

Answering Question Number 2: It Depends

If it is a fragment and you've said to flatten them it will just add them together (pay attention to the last line):

graphql-armor/packages/plugins/cost-limit/src/index.ts

Lines 96 to 104 in 3824fe0

	let cost = this.config.scalarCost;
	if ('selectionSet' in node && node.selectionSet) {
	cost = this.config.objectCost;
	for (const child of node.selectionSet.selections) {
	if (
	this.config.flattenFragments &&
	(child.kind === Kind.INLINE_FRAGMENT || child.kind === Kind.FRAGMENT_SPREAD)
	) {
	cost += this.computeComplexity(child, depth);

But if it is not a fragment (a normal object) or you have not configured to flatten fragments it will multiply the depthCostFactor to the calculated cost for that nested object and then add it to the objectCost.

graphql-armor/packages/plugins/cost-limit/src/index.ts

Line 106 in 3824fe0

cost += this.config.depthCostFactor * this.computeComplexity(child, depth + 1);

Note

I am doing a pretty shallow quick code review. Therefore it is quite possible that I might have missed something 🙂.

[kasir-barati]

Just for those who wanted to see an example, check my repo:

• A short intro to what I did: https://github.com/kasir-barati/graphql-js-ts/blob/main/docs/best-practices/query-depth-and-complexity.md.
• Then the implementation: https://github.com/kasir-barati/graphql-js-ts/tree/main/apps/depth.
• And e2e tests: https://github.com/kasir-barati/graphql-js-ts/tree/main/apps/depth-e2e.

Love to learn from your expertise.