diff --git a/website/README b/website/README index 6702a98e28..e1ad431258 100644 --- a/website/README +++ b/website/README @@ -50,5 +50,5 @@ The [versioning section of the Docusaurus documentation](https://docusaurus.io/d ```bash $ docusaurus docs:version 1.1 ``` - *Be sure to include the X.X in the version, not just X.* + *Be sure to include the X.X.X in the version, not just X.* 3. Technically, you're done, just commit these changes and the CI workflow will deploy when merged into `master`. diff --git a/website/docs/CHANGELOG.md b/website/docs/CHANGELOG.md index bb83ceb4a0..30b292424f 100644 --- a/website/docs/CHANGELOG.md +++ b/website/docs/CHANGELOG.md @@ -4,6 +4,26 @@ title: Changelog sidebar_label: Changelog --- +## 8.0.0 + +### Breaking Changes + +- [#677 Drops support for Doctrine annotations](https://github.com/thecodingmachine/graphqlite/pull/677) @fogrye + +### Improvements + +- [#668 Adds working examples to docs](https://github.com/thecodingmachine/graphqlite/pull/668) @shish +- [#698 Performance optimizations and caching in development environments (`devMode()`)](https://github.com/thecodingmachine/graphqlite/pull/698) @oprypkhantc] + +### Bug Fixes + +- [#702 Fix prefetching for nested fields](https://github.com/thecodingmachine/graphqlite/pull/702) @sudevva + +### Minor Changes + +- [#695 Removes dependecy to unmaintained thecodingmachine/cache-utils dependency](https://github.com/thecodingmachine/graphqlite/pull/695) @xyng +- [#712 Caching improvements with use of multiple ClassFinders](https://github.com/thecodingmachine/graphqlite/pull/712) @andrew-demb + ## 7.1.0 ### Breaking Changes @@ -14,7 +34,7 @@ sidebar_label: Changelog - Removed `FactoryContext::get*TTL()` and `RootTypeMapperFactoryContext::get*TTL()` as GraphQLite no longer uses TTLs to invalidate caches - Removed `StaticClassListTypeMapper` in favor of `ClassFinderTypeMapper` used with `StaticClassFinder` - Renamed `GlobTypeMapper` to `ClassFinderTypeMapper` - - Renamed `SchemaFactory::setClassBoundCacheContractFactory()` to `SchemaFactory::setClassBoundCache()`, + - Renamed `SchemaFactory::setClassBoundCacheContractFactory()` to `SchemaFactory::setClassBoundCache()`, `FactoryContext::getClassBoundCacheContractFactory()` to `FactoryContext::getClassBoundCache()` and changed their signatures - Removed `RootTypeMapperFactoryContext::getTypeNamespaces()` in favor of `RootTypeMapperFactoryContext::getClassFinder()` diff --git a/website/versioned_docs/version-8.0.0/CHANGELOG.md b/website/versioned_docs/version-8.0.0/CHANGELOG.md new file mode 100644 index 0000000000..30b292424f --- /dev/null +++ b/website/versioned_docs/version-8.0.0/CHANGELOG.md @@ -0,0 +1,254 @@ +--- +id: changelog +title: Changelog +sidebar_label: Changelog +--- + +## 8.0.0 + +### Breaking Changes + +- [#677 Drops support for Doctrine annotations](https://github.com/thecodingmachine/graphqlite/pull/677) @fogrye + +### Improvements + +- [#668 Adds working examples to docs](https://github.com/thecodingmachine/graphqlite/pull/668) @shish +- [#698 Performance optimizations and caching in development environments (`devMode()`)](https://github.com/thecodingmachine/graphqlite/pull/698) @oprypkhantc] + +### Bug Fixes + +- [#702 Fix prefetching for nested fields](https://github.com/thecodingmachine/graphqlite/pull/702) @sudevva + +### Minor Changes + +- [#695 Removes dependecy to unmaintained thecodingmachine/cache-utils dependency](https://github.com/thecodingmachine/graphqlite/pull/695) @xyng +- [#712 Caching improvements with use of multiple ClassFinders](https://github.com/thecodingmachine/graphqlite/pull/712) @andrew-demb + +## 7.1.0 + +### Breaking Changes + +- #698 Removes some methods and classes, namely: + - Deprecated `SchemaFactory::addControllerNamespace()` and `SchemaFactory::addTypeNamespace()` in favor of `SchemaFactory::addNamespace()` + - Deprecated `SchemaFactory::setGlobTTL()` in favor of `SchemaFactory::devMode()` and `SchemaFactory::prodMode()` + - Removed `FactoryContext::get*TTL()` and `RootTypeMapperFactoryContext::get*TTL()` as GraphQLite no longer uses TTLs to invalidate caches + - Removed `StaticClassListTypeMapper` in favor of `ClassFinderTypeMapper` used with `StaticClassFinder` + - Renamed `GlobTypeMapper` to `ClassFinderTypeMapper` + - Renamed `SchemaFactory::setClassBoundCacheContractFactory()` to `SchemaFactory::setClassBoundCache()`, + `FactoryContext::getClassBoundCacheContractFactory()` to `FactoryContext::getClassBoundCache()` and changed their signatures + - Removed `RootTypeMapperFactoryContext::getTypeNamespaces()` in favor of `RootTypeMapperFactoryContext::getClassFinder()` + +### Improvements + +- #698 Performance optimizations and caching in development environments (`devMode()`). @oprypkhantc + +## 7.0.0 + +### Breaking Changes + +- #664 Replaces [thecodingmachine/class-explorer](https://github.com/thecodingmachine/class-explorer) with [kcs/class-finder](https://github.com/alekitto/class-finder) resulting in the `SchemaFactory::setClassNameMapper` being renamed to `SchemaFactory::setFinder`. This now expects an instance of `Kcs\ClassFinder\Finder` instead of `Kcs\ClassFinder\Finder\FinderInterface`. @fogrye + +### New Features + +- #649 Adds support for `subscription` operations. @oojacoboo +- #612 Automatic query complexity analysis. @oprypkhantc +- #611 Automatic persisted queries. @oprypkhantc + +### Improvements + +- #658 Improves on prefetching for nested fields. @grynchuk +- #646 Improves exception handling during schema parsing. @fogrye +- #636 Allows the use of middleware on construtor params/fields. @oprypkhantc +- #623 Improves support for description arguments on types/fields. @downace +- #628 Properly handles `@param` annotations for generics support on field annotated constructor arguments. @oojacoboo +- #584 Immutability improvements across the codebase. @oprypkhantc +- #588 Prefetch improvements. @oprpkhantc +- #606 Adds support for phpdoc descriptions and deprecation annotations on native enums. @mdoelker +- Thanks to @shish, @cvergne and @mshapovalov for updating the docs! + +### Minor Changes + +- #639 Added support for Symfony 7. @janatjak + + +## 6.2.3 + +Adds support for `Psr\Container` 1.1 with #601 + +## 6.2.2 + +This is a very simple release. We support Doctrine annotation 1.x and we've deprecated `SchemaFactory::setDoctrineAnnotationReader` in favor of native PHP attributes. + +## 6.2.1 + +- Added support for new `Void` return types, allowing use of `void` from operation resolvers. #574 +- Improvements with authorization middleware #571 +- Updated vendor dependencies: #580 #558 + +## 6.2.0 + +Lots of little nuggets in this release! We're now targeting PHP ^8.1 and have testing on 8.2. + +- Better support for union types and enums: #530, #535, #561, #570 +- Various bug and interface fixes: #532, #575, #564 +- GraphQL v15 required: #542 +- Lots of codebase improvements, more strict typing: #548 + +A special thanks to @rusted-love and @oprypkhantc for their contributions. + +## 6.1.0 + +A shoutout to @bladl for his work on this release, improving the code for better typing and PHP 8.0 syntax updates! + +### Breaking Changes + +- #518 PSR-11 support now requires version 2 +- #508 Due to some of the code improvements, additional typing has been added to some interfaces/classes. For instance, `RootTypeMapperInterface::toGraphQLOutputType` and `RootTypeMapperInterface::toGraphQLInputType` now have the following signatures: + +```php + /** + * @param (OutputType&GraphQLType)|null $subType + * + * @return OutputType&GraphQLType + */ + public function toGraphQLOutputType( + Type $type, + OutputType|null $subType, + ReflectionMethod|ReflectionProperty $reflector, + DocBlock $docBlockObj + ): OutputType; + + /** + * @param (InputType&GraphQLType)|null $subType + * + * @return InputType&GraphQLType + */ + public function toGraphQLInputType( + Type $type, + InputType|null $subType, + string $argumentName, + ReflectionMethod|ReflectionProperty $reflector, + DocBlock $docBlockObj + ): InputType; +``` + +### Improvements + +- #510 +- #508 + +## 5.0.0 + +### Dependencies + +- Upgraded to using version 14.9 of [webonyx/graphql-php](https://github.com/webonyx/graphql-php) + +## 4.3.0 + +### Breaking change + +- The method `setAnnotationCacheDir($directory)` has been removed from the `SchemaFactory`. The annotation + cache will use your `Psr\SimpleCache\CacheInterface` compliant cache handler set through the `SchemaFactory` + constructor. + +### Minor changes + +- Removed dependency for doctrine/cache and unified some of the cache layers following a PSR interface. +- Cleaned up some of the documentation in an attempt to get things accurate with versioned releases. + +## 4.2.0 + +### Breaking change + +The method signature for `toGraphQLOutputType` and `toGraphQLInputType` have been changed to the following: + +```php +/** + * @param \ReflectionMethod|\ReflectionProperty $reflector + */ +public function toGraphQLOutputType(Type $type, ?OutputType $subType, $reflector, DocBlock $docBlockObj): OutputType; + +/** + * @param \ReflectionMethod|\ReflectionProperty $reflector + */ +public function toGraphQLInputType(Type $type, ?InputType $subType, string $argumentName, $reflector, DocBlock $docBlockObj): InputType; +``` + +### New features + +- [@Input](annotations-reference.md#input-annotation) annotation is introduced as an alternative to `#[Factory]`. Now GraphQL input type can be created in the same manner as `#[Type]` in combination with `#[Field]` - [example](input-types.mdx#input-attribute). +- New attributes has been added to [@Field](annotations-reference.md#field-annotation) annotation: `for`, `inputType` and `description`. +- The following annotations now can be applied to class properties directly: `#[Field]`, `#[Logged]`, `#[Right]`, `@FailWith`, `@HideIfUnauthorized` and `#[Security]`. + +## 4.1.0 + +### Breaking change + +There is one breaking change introduced in the minor version (this was important to allow PHP 8 compatibility). + +- The **ecodev/graphql-upload** package (used to get support for file uploads in GraphQL input types) is now a "recommended" dependency only. + If you are using GraphQL file uploads, you need to add `ecodev/graphql-upload` to your `composer.json`. + +### New features + +- All annotations can now be accessed as PHP 8 attributes +- The `@deprecated` annotation in your PHP code translates into deprecated fields in your GraphQL schema +- You can now specify the GraphQL name of the Enum types you define +- Added the possibility to inject pure Webonyx objects in GraphQLite schema + +### Minor changes + +- Migrated from `zend/diactoros` to `laminas/diactoros` +- Making the annotation cache directory configurable + +### Miscellaneous + +- Migrated from Travis to Github actions + +## 4.0.0 + +This is a complete refactoring from 3.x. While existing annotations are kept compatible, the internals have completely +changed. + +### New features + +- You can directly [annotate a PHP interface with `#[Type]` to make it a GraphQL interface](inheritance-interfaces.mdx#mapping-interfaces) +- You can autowire services in resolvers, thanks to the new `@Autowire` annotation +- Added [user input validation](validation.mdx) (using the Symfony Validator or the Laravel validator or a custom `#[Assertion]` annotation +- Improved security handling: + - Unauthorized access to fields can now generate GraphQL errors (rather that schema errors in GraphQLite v3) + - Added fine-grained security using the `#[Security]` annotation. A field can now be [marked accessible or not depending on the context](fine-grained-security.mdx). + For instance, you can restrict access to the field "viewsCount" of the type `BlogPost` only for post that the current user wrote. + - You can now inject the current logged user in any query / mutation / field using the `#[InjectUser]` annotation +- Performance: + - You can inject the [Webonyx query plan in a parameter from a resolver](query-plan.mdx) + - You can use the [dataloader pattern to improve performance drastically via the "prefetchMethod" attribute](prefetch-method.mdx) +- Customizable error handling has been added: + - You can throw [many errors in one exception](error-handling.mdx#many-errors-for-one-exception) with `TheCodingMachine\GraphQLite\Exceptions\GraphQLAggregateException` +- You can force input types using `@UseInputType(for="$id", inputType="ID!")` +- You can extend an input types (just like you could extend an output type in v3) using [the new `#[Decorate]` annotation](extend-input-type.mdx) +- In a factory, you can [exclude some optional parameters from the GraphQL schema](input-types#ignoring-some-parameters) + +Many extension points have been added + +- Added a "root type mapper" (useful to map scalar types to PHP types or to add custom annotations related to resolvers) +- Added ["field middlewares"](field-middlewares.md) (useful to add middleware that modify the way GraphQL fields are handled) +- Added a ["parameter type mapper"](argument-resolving.md) (useful to add customize parameter resolution or add custom annotations related to parameters) + +New framework specific features: + +### Symfony + +- The Symfony bundle now provides a "login" and a "logout" mutation (and also a "me" query) + +### Laravel + +- [Native integration with the Laravel paginator](laravel-package-advanced.mdx#support-for-pagination) has been added + +### Internals + +- The `FieldsBuilder` class has been split in many different services (`FieldsBuilder`, `TypeHandler`, and a + chain of *root type mappers*) +- The `FieldsBuilderFactory` class has been completely removed. +- Overall, there is not much in common internally between 4.x and 3.x. 4.x is much more flexible with many more hook points + than 3.x. Try it out! diff --git a/website/versioned_docs/version-8.0.0/README.mdx b/website/versioned_docs/version-8.0.0/README.mdx new file mode 100644 index 0000000000..0df34daa98 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/README.mdx @@ -0,0 +1,60 @@ +--- +id: index +title: GraphQLite +slug: / +sidebar_label: GraphQLite +--- + +

+ GraphQLite logo +

+ + +A PHP library that allows you to write your GraphQL queries in simple-to-write controllers. + +## Features + +* Create a complete GraphQL API by simply annotating your PHP classes +* Framework agnostic, but Symfony, Laravel and PSR-15 bindings available! +* Comes with batteries included: queries, mutations, subscriptions, mapping of arrays / iterators, +file uploads, security, validation, extendable types and more! + +## Basic example + +First, declare a query in your controller: + +```php +class ProductController +{ + #[Query] + public function product(string $id): Product + { + // Some code that looks for a product and returns it. + } +} +``` + +Then, annotate the `Product` class to declare what fields are exposed to the GraphQL API: + +```php +#[Type] +class Product +{ + #[Field] + public function getName(): string + { + return $this->name; + } + // ... +} +``` + +That's it, you're good to go! Query and enjoy! + +```graphql +{ + product(id: 42) { + name + } +} +``` diff --git a/website/versioned_docs/version-8.0.0/annotations-reference.md b/website/versioned_docs/version-8.0.0/annotations-reference.md new file mode 100644 index 0000000000..485b1f561c --- /dev/null +++ b/website/versioned_docs/version-8.0.0/annotations-reference.md @@ -0,0 +1,320 @@ +--- +id: annotations-reference +title: Attributes reference +sidebar_label: Attributes reference +--- + +Note: all annotations are available in PHP 8 attribute format (`#[Query]`), support of Doctrine annotation format was dropped. +See [Doctrine annotations vs PHP 8 attributes](doctrine-annotations-attributes.mdx) for more details. + +## #[Query] + +The `#[Query]` attribute is used to declare a GraphQL query. + +**Applies on**: controller methods. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +name | *no* | string | The name of the query. If skipped, the name of the method is used instead. +[outputType](custom-types.mdx) | *no* | string | Forces the GraphQL output type of a query. + +## #[Mutation] + +The `#[Mutation]` attribute is used to declare a GraphQL mutation. + +**Applies on**: controller methods. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +name | *no* | string | The name of the mutation. If skipped, the name of the method is used instead. +[outputType](custom-types.mdx) | *no* | string | Forces the GraphQL output type of a query. + +## #[Subscription] + +The `#[Subscription]` attribute is used to declare a GraphQL subscription. + +**Applies on**: controller methods. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +name | *no* | string | The name of the subscription. If skipped, the name of the method is used instead. +[outputType](custom-types.mdx) | *no* | string | Defines the GraphQL output type that will be sent for the subscription. + +## #[Type] + +The `#[Type]` attribute is used to declare a GraphQL object type. This is used with standard output +types, as well as enum types. For input types, use the [#[Input] attribute](#input-annotation) directly on the input type or a [#[Factory] attribute](#factory-annotation) to make/return an input type. + +**Applies on**: classes. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +class | *no* | string | The targeted class/enum for the actual type. If no "class" attribute is passed, the type applies to the current class/enum. The current class/enum is assumed to be an entity (not service). If the "class" attribute *is passed*, [the class/enum annotated with `#[Type]` becomes a service](external-type-declaration.mdx). +name | *no* | string | The name of the GraphQL type generated. If not passed, the name of the class is used. If the class ends with "Type", the "Type" suffix is removed +default | *no* | bool | Defaults to *true*. Whether the targeted PHP class should be mapped by default to this type. +external | *no* | bool | Whether this is an [external type declaration](external-type-declaration.mdx) or not. You usually do not need to use this attribute since this value defaults to true if a "class" attribute is set. This is only useful if you are declaring a type with no PHP class mapping using the "name" attribute. + +## #[ExtendType] + +The `#[ExtendType]` attribute is used to add fields to an existing GraphQL object type. + +**Applies on**: classes. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +class | see below | string | The targeted class. [The class annotated with `#[ExtendType]` is a service](extend-type.mdx). +name | see below | string | The targeted GraphQL output type. + +One and only one of "class" and "name" parameter can be passed at the same time. + +## #[Input] + +The `#[Input]` attribute is used to declare a GraphQL input type. + +**Applies on**: classes. + +Attribute | Compulsory | Type | Definition +---------------|------------|--------|-------- +name | *no* | string | The name of the GraphQL input type generated. If not passed, the name of the class with suffix "Input" is used. If the class ends with "Input", the "Input" suffix is not added. +description | *no* | string | Description of the input type in the documentation. If not passed, PHP doc comment is used. +default | *no* | bool | Name of the input type represented in your GraphQL schema. Defaults to `true` *only if* the name is not specified. If `name` is specified, this will default to `false`, so must also be included for `true` when `name` is used. +update | *no* | bool | Determines if the the input represents a partial update. When set to `true` all input fields will become optional and won't have default values thus won't be set on resolve if they are not specified in the query/mutation/subscription. This primarily applies to nullable fields. + +## #[Field] + +The `#[Field]` attribute is used to declare a GraphQL field. + +**Applies on**: methods or properties of classes annotated with `#[Type]`, `#[ExtendType]` or `#[Input]`. +When it's applied on private or protected property, public getter or/and setter method is expected in the class accordingly +whether it's used for output type or input type. For example if property name is `foo` then getter should be `getFoo()` or setter should be `setFoo($foo)`. Setter can be omitted if property related to the field is present in the constructor with the same name. + +Attribute | Compulsory | Type | Definition +------------------------------|------------|---------------|-------- +name | *no* | string | The name of the field. If skipped, the name of the method is used instead. +for | *no* | string, array | Forces the field to be used only for specific output or input type(s). By default field is used for all possible declared types. +description | *no* | string | Field description displayed in the GraphQL docs. If it's empty PHP doc comment is used instead. +[outputType](custom-types.mdx) | *no* | string | Forces the GraphQL output type of a query. +[inputType](input-types.mdx) | *no* | string | Forces the GraphQL input type of a query. + +## #[SourceField] + +The `#[SourceField]` attribute is used to declare a GraphQL field. + +**Applies on**: classes annotated with `#[Type]` or `#[ExtendType]`. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +name | *yes* | string | The name of the field. +[outputType](custom-types.mdx) | *no* | string | Forces the GraphQL output type of the field. Otherwise, return type is used. +phpType | *no* | string | The PHP type of the field (as you would write it in a Docblock) +description | *no* | string | Field description displayed in the GraphQL docs. If it's empty PHP doc comment of the method in the source class is used instead. +sourceName | *no* | string | The name of the property in the source class. If not set, the `name` will be used to get property value. +annotations | *no* | array\ | A set of annotations that apply to this field. You would typically used a "#[Logged]" or "#[Right]" attribute as class here. + +**Note**: `outputType` and `phpType` are mutually exclusive. + +## #[MagicField] + +The `#[MagicField]` attribute is used to declare a GraphQL field that originates from a PHP magic property (using `__get` magic method). + +**Applies on**: classes annotated with `#[Type]` or `#[ExtendType]`. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +name | *yes* | string | The name of the field. +[outputType](custom-types.mdx) | *no*(*) | string | The GraphQL output type of the field. +phpType | *no*(*) | string | The PHP type of the field (as you would write it in a Docblock) +description | *no* | string | Field description displayed in the GraphQL docs. If not set, no description will be shown. +sourceName | *no* | string | The name of the property in the source class. If not set, the `name` will be used to get property value. +annotations | *no* | array\ | A set of annotations that apply to this field. You would typically used a "#[Logged]" or "#[Right]" attribute as class here. + +(*) **Note**: `outputType` and `phpType` are mutually exclusive. You MUST provide one of them. + +## #[Prefetch] + +Marks field parameter to be used for [prefetching](prefetch-method.mdx). + +**Applies on**: parameters of methods annotated with `#[Query]`, `#[Mutation]` or `#[Field]`. + +Attribute | Compulsory | Type | Definition +------------------------------|------------|----------|-------- +callable | *no* | callable | Name of the prefetch method (in same class) or a full callable, either a static method or regular service from the container + + +## #[Logged] + +The `#[Logged]` attribute is used to declare a Query/Mutation/Field is only visible to logged users. + +**Applies on**: methods or properties annotated with `#[Query]`, `#[Mutation]` or `#[Field]`. + +This attribute allows no arguments. + +## #[Right] + +The `#[Right]` attribute is used to declare a Query/Mutation/Field is only visible to users with a specific right. + +**Applies on**: methods or properties annotated with `#[Query]`, `#[Mutation]` or `#[Field]`. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +name | *yes* | string | The name of the right. + +## #[FailWith] + +The `#[FailWith]` attribute is used to declare a default value to return in the user is not authorized to see a specific +query/mutation/subscription/field (according to the `#[Logged]` and `#[Right]` attributes). + +**Applies on**: methods or properties annotated with `#[Query]`, `#[Mutation]` or `#[Field]` and one of `#[Logged]` or `#[Right]` attributes. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +value | *yes* | mixed | The value to return if the user is not authorized. + +## #[HideIfUnauthorized] + +
This attribute only works when a Schema is used to handle exactly one use request. +If you serve your GraphQL API from long-running standalone servers (like Laravel Octane, Swoole, RoadRunner etc) and +share the same Schema instance between multiple requests, please avoid using #[HideIfUnauthorized].
+ +The `#[HideIfUnauthorized]` attribute is used to completely hide the query/mutation/subscription/field if the user is not authorized +to access it (according to the `#[Logged]` and `#[Right]` attributes). + +**Applies on**: methods or properties annotated with `#[Query]`, `#[Mutation]` or `#[Field]` and one of `#[Logged]` or `#[Right]` attributes. + +`#[HideIfUnauthorized]` and `#[FailWith]` are mutually exclusive. + +## #[InjectUser] + +Use the `#[InjectUser]` attribute to inject an instance of the current user logged in into a parameter of your +query/mutation/subscription/field. + +See [the authentication and authorization page](authentication-authorization.mdx) for more details. + +**Applies on**: methods annotated with `#[Query]`, `#[Mutation]` or `#[Field]`. + +Attribute | Compulsory | Type | Definition +---------------|------------|--------|-------- +*for* | *yes* | string | The name of the PHP parameter + +## #[Security] + +The `#[Security]` attribute can be used to check fin-grained access rights. +It is very flexible: it allows you to pass an expression that can contains custom logic. + +See [the fine grained security page](fine-grained-security.mdx) for more details. + +**Applies on**: methods or properties annotated with `#[Query]`, `#[Mutation]` or `#[Field]`. + +Attribute | Compulsory | Type | Definition +---------------|------------|--------|-------- +*default* | *yes* | string | The security expression + +## #[Factory] + +The `#[Factory]` attribute is used to declare a factory that turns GraphQL input types into objects. + +**Applies on**: methods from classes in the "types" namespace. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +name | *no* | string | The name of the input type. If skipped, the name of class returned by the factory is used instead. +default | *no* | bool | If `true`, this factory will be used by default for its PHP return type. If set to `false`, you must explicitly [reference this factory using the `#[Parameter]` attribute](input-types.mdx#declaring-several-input-types-for-the-same-php-class). + +## #[UseInputType] + +Used to override the GraphQL input type of a PHP parameter. + +**Applies on**: methods annotated with `#[Query]`, `#[Mutation]` or `#[Field]` attribute. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +*for* | *yes* | string | The name of the PHP parameter +*inputType* | *yes* | string | The GraphQL input type to force for this input field + +## #[Decorate] + +The `#[Decorate]` attribute is used [to extend/modify/decorate an input type declared with the `#[Factory]` attribute](extend-input-type.mdx). + +**Applies on**: methods from classes in the "types" namespace. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +name | *yes* | string | The GraphQL input type name extended by this decorator. + +## #[Autowire] + +[Resolves a PHP parameter from the container](autowiring.mdx). + +Useful to inject services directly into `#[Field]` method arguments. + +**Applies on**: methods annotated with `#[Query]`, `#[Mutation]` or `#[Field]` attribute. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +*for* | *yes* | string | The name of the PHP parameter +*identifier* | *no* | string | The identifier of the service to fetch. This is optional. Please avoid using this attribute as this leads to a "service locator" anti-pattern. + +## #[HideParameter] + +Removes [an argument from the GraphQL schema](input-types.mdx#ignoring-some-parameters). + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +*for* | *yes* | string | The name of the PHP parameter to hide + +## #[Cost] + +Sets complexity and multipliers on fields for [automatic query complexity](operation-complexity.md#static-request-analysis). + +Attribute | Compulsory | Type | Definition +--------------------|------------|-----------------|----------------------------------------------------------------- +*complexity* | *no* | int | Complexity for that field +*multipliers* | *no* | array\ | Names of fields by value of which complexity will be multiplied +*defaultMultiplier* | *no* | int | Default multiplier value if all multipliers are missing/null + +## #[Validate] + +
This attribute is only available in the GraphQLite Laravel package
+ +[Validates a user input in Laravel](laravel-package-advanced.mdx). + +**Applies on**: methods annotated with `#[Query]`, `#[Mutation]`, `#[Field]`, `#[Factory]` or `#[Decorator]` attribute. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +*for* | *yes* | string | The name of the PHP parameter +*rule* | *yes | string | Laravel validation rules + +Sample: + +```php +#[Validate(for: "$email", rule: "email|unique:users")] +``` + +## #[Assertion] + +[Validates a user input](validation.mdx). + +The `#[Assertion]` attribute is available in the *thecodingmachine/graphqlite-symfony-validator-bridge* third party package. +It is available out of the box if you use the Symfony bundle. + +**Applies on**: methods annotated with `#[Query]`, `#[Mutation]`, `#[Field]`, `#[Factory]` or `#[Decorator]` attribute. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +*for* | *yes* | string | The name of the PHP parameter +*constraint* | *yes | annotation | One (or many) Symfony validation attributes. + +## ~~@EnumType~~ + +*Deprecated: Use [PHP 8.1's native Enums](https://www.php.net/manual/en/language.types.enumerations.php) instead with a [#[Type]](#type-annotation).* + +The `@EnumType` annotation is used to change the name of a "Enum" type. +Note that if you do not want to change the name, the annotation is optionnal. Any object extending `MyCLabs\Enum\Enum` +is automatically mapped to a GraphQL enum type. + +**Applies on**: classes extending the `MyCLabs\Enum\Enum` base class. + +Attribute | Compulsory | Type | Definition +---------------|------------|------|-------- +name | *no* | string | The name of the enum type (in the GraphQL schema) diff --git a/website/versioned_docs/version-8.0.0/argument-resolving.md b/website/versioned_docs/version-8.0.0/argument-resolving.md new file mode 100644 index 0000000000..8125964dae --- /dev/null +++ b/website/versioned_docs/version-8.0.0/argument-resolving.md @@ -0,0 +1,163 @@ +--- +id: argument-resolving +title: Extending argument resolving +sidebar_label: Custom argument resolving +--- +Available in GraphQLite 4.0+ + +Using a **parameter middleware**, you can hook into the argument resolution of field/query/mutation/factory. + +
Use a parameter middleware if you want to alter the way arguments are injected in a method +or if you want to alter the way input types are imported (for instance if you want to add a validation step)
+ +As an example, GraphQLite uses *parameter middlewares* internally to: + +- Inject the Webonyx GraphQL resolution object when you type-hint on the `ResolveInfo` object. For instance: + + ```php + /** + * @return Product[] + */ + #[Query] + public function products(ResolveInfo $info): array + ``` + + In the query above, the `$info` argument is filled with the Webonyx `ResolveInfo` class thanks to the + [`ResolveInfoParameterHandler parameter middleware`](https://github.com/thecodingmachine/graphqlite/blob/master/src/Mappers/Parameters/ResolveInfoParameterHandler.php) +- Inject a service from the container when you use the `#[Autowire]` attribute +- Perform validation with the `#[Validate]` attribute (in Laravel package) + + + +**Parameter middlewares** + + + +Each middleware is passed number of objects describing the parameter: + +- a PHP `ReflectionParameter` object representing the parameter being manipulated +- a `phpDocumentor\Reflection\DocBlock` instance (useful to analyze the `@param` comment if any) +- a `phpDocumentor\Reflection\Type` instance (useful to analyze the type if the argument) +- a `TheCodingMachine\GraphQLite\Annotations\ParameterAnnotations` instance. This is a collection of all custom annotations that apply to this specific argument (more on that later) +- a `$next` handler to pass the argument resolving to the next middleware. + +Parameter resolution is done in 2 passes. + +On the first pass, middlewares are traversed. They must return a `TheCodingMachine\GraphQLite\Parameters\ParameterInterface` (an object that does the actual resolving). + +```php +interface ParameterMiddlewareInterface +{ + public function mapParameter(ReflectionParameter $parameter, DocBlock $docBlock, ?Type $paramTagType, ParameterAnnotations $parameterAnnotations, ParameterHandlerInterface $next): ParameterInterface; +} +``` + +Then, resolution actually happen by executing the resolver (this is the second pass). + +## Attributes parsing + +If you plan to use attributes while resolving arguments, your attribute class should extend the [`ParameterAnnotationInterface`](https://github.com/thecodingmachine/graphqlite/blob/master/src/Annotations/ParameterAnnotationInterface.php) + +For instance, if we want GraphQLite to inject a service in an argument, we can use `#[Autowire]`. + +We only need to put declare the annotation can target parameters: `#[Attribute(Attribute::TARGET_PARAMETER)]`. + +The class looks like this: + +```php +use Attribute; + +/** + * Use this attribute to autowire a service from the container into a given parameter of a field/query/mutation. + * + */ +#[Attribute(Attribute::TARGET_PARAMETER)] +class Autowire implements ParameterAnnotationInterface +{ + /** + * @var string + */ + public $for; + + /** + * The getTarget method must return the name of the argument + */ + public function getTarget(): string + { + return $this->for; + } +} +``` + +## Writing the parameter middleware + +The middleware purpose is to analyze a parameter and decide whether or not it can handle it. + +```php title="Parameter middleware class" +class ContainerParameterHandler implements ParameterMiddlewareInterface +{ + /** @var ContainerInterface */ + private $container; + + public function __construct(ContainerInterface $container) + { + $this->container = $container; + } + + public function mapParameter(ReflectionParameter $parameter, DocBlock $docBlock, ?Type $paramTagType, ParameterAnnotations $parameterAnnotations, ParameterHandlerInterface $next): ParameterInterface + { + // The $parameterAnnotations object can be used to fetch any annotation implementing ParameterAnnotationInterface + $autowire = $parameterAnnotations->getAnnotationByType(Autowire::class); + + if ($autowire === null) { + // If there are no annotation, this middleware cannot handle the parameter. Let's ask + // the next middleware in the chain (using the $next object) + return $next->mapParameter($parameter, $docBlock, $paramTagType, $parameterAnnotations); + } + + // We found a @Autowire annotation, let's return a parameter resolver. + return new ContainerParameter($this->container, $parameter->getType()); + } +} +``` + +The last step is to write the actual parameter resolver. + +```php title="Parameter resolver class" +/** + * A parameter filled from the container. + */ +class ContainerParameter implements ParameterInterface +{ + /** @var ContainerInterface */ + private $container; + /** @var string */ + private $identifier; + + public function __construct(ContainerInterface $container, string $identifier) + { + $this->container = $container; + $this->identifier = $identifier; + } + + /** + * The "resolver" returns the actual value that will be fed to the function. + */ + public function resolve(?object $source, array $args, $context, ResolveInfo $info) + { + return $this->container->get($this->identifier); + } +} +``` + +## Registering a parameter middleware + +The last step is to register the parameter middleware we just wrote: + +You can register your own parameter middlewares using the `SchemaFactory::addParameterMiddleware()` method. + +```php +$schemaFactory->addParameterMiddleware(new ContainerParameterHandler($container)); +``` + +If you are using the Symfony bundle, you can tag the service as "graphql.parameter_middleware". diff --git a/website/versioned_docs/version-8.0.0/authentication-authorization.mdx b/website/versioned_docs/version-8.0.0/authentication-authorization.mdx new file mode 100644 index 0000000000..9842e2a3d3 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/authentication-authorization.mdx @@ -0,0 +1,159 @@ +--- +id: authentication-authorization +title: Authentication and authorization +sidebar_label: Authentication and authorization +--- + +You might not want to expose your GraphQL API to anyone. Or you might want to keep some +queries/mutations/subscriptions or fields reserved to some users. + +GraphQLite offers some control over what a user can do with your API. You can restrict access to +resources: + +- based on authentication using the [`#[Logged]` attribute](#logged-and-right-annotations) (restrict access to logged users) +- based on authorization using the [`#[Right]` attribute](#logged-and-right-annotations) (restrict access to logged users with certain rights). +- based on fine-grained authorization using the [`#[Security]` attribute](fine-grained-security.mdx) (restrict access for some given resources to some users). + +
+ GraphQLite does not have its own security mechanism. + Unless you're using our Symfony Bundle or our Laravel package, it is up to you to connect this feature to your framework's security mechanism.
+ See Connecting GraphQLite to your framework's security module. +
+ +## `#[Logged]` and `#[Right]` attributes + +GraphQLite exposes two attributes (`#[Logged]` and `#[Right]`) that you can use to restrict access to a resource. + +```php +namespace App\Controller; + +use TheCodingMachine\GraphQLite\Annotations\Query; +use TheCodingMachine\GraphQLite\Annotations\Logged; +use TheCodingMachine\GraphQLite\Annotations\Right; + +class UserController +{ + /** + * @return User[] + */ + #[Query] + #[Logged] + #[Right("CAN_VIEW_USER_LIST")] + public function users(int $limit, int $offset): array + { + // ... + } +} +``` + +In the example above, the query `users` will only be available if the user making the query is logged AND if he +has the `CAN_VIEW_USER_LIST` right. + +`#[Logged]` and `#[Right]` attributes can be used next to: + +* `#[Query]` attributes +* `#[Mutation]` attributes +* `#[Field]` attributes + +
+ By default, if a user tries to access an unauthorized query/mutation/subscription/field, an error is + raised and the query fails. +
+ +## Not throwing errors + +If you do not want an error to be thrown when a user attempts to query a field/query/mutation/subscription +they have no access to, you can use the `#[FailWith]` attribute. + +The `#[FailWith]` attribute contains the value that will be returned for users with insufficient rights. + +```php +class UserController +{ + /** + * If a user is not logged or if the user has not the right "CAN_VIEW_USER_LIST", + * the value returned will be "null". + * + * @return User[] + */ + #[Query] + #[Logged] + #[Right("CAN_VIEW_USER_LIST")] + #[FailWith(value: null)] + public function users(int $limit, int $offset): array + { + // ... + } +} +``` + +## Injecting the current user as a parameter + +Use the `#[InjectUser]` attribute to get an instance of the current user logged in. + +```php +namespace App\Controller; + +use TheCodingMachine\GraphQLite\Annotations\Query; +use TheCodingMachine\GraphQLite\Annotations\InjectUser; + +class ProductController +{ + /** + * @return Product + */ + #[Query] + public function product( + int $id, + #[InjectUser] + User $user + ): Product + { + // ... + } +} +``` + +The `#[InjectUser]` attribute can be used next to: + +* `#[Query]` attributes +* `#[Mutation]` attributes +* `#[Field]` attributes + +The object injected as the current user depends on your framework. It is in fact the object returned by the +["authentication service" configured in GraphQLite](implementing-security.md). If user is not authenticated and +parameter's type is not nullable, an authorization exception is thrown, similar to `#[Logged]` attribute. + +## Hiding fields / queries / mutations / subscriptions + +By default, a user analysing the GraphQL schema can see all queries/mutations/subscriptions/types available. +Some will be available to him and some won't. + +If you want to add an extra level of security (or if you want your schema to be kept secret to unauthorized users), +you can use the `#[HideIfUnauthorized]` attribute. Beware of [it's limitations](annotations-reference.md). + +```php +class UserController +{ + /** + * If a user is not logged or if the user has not the right "CAN_VIEW_USER_LIST", + * the schema will NOT contain the "users" query at all (so trying to call the + * "users" query will result in a GraphQL "query not found" error. + * + * @return User[] + */ + #[Query] + #[Logged] + #[Right("CAN_VIEW_USER_LIST")] + #[HideIfUnauthorized] + public function users(int $limit, int $offset): array + { + // ... + } +} +``` + +While this is the most secured mode, it can have drawbacks when working with development tools +(you need to be logged as admin to fetch the complete schema). + +
The "HideIfUnauthorized" mode was the default mode in GraphQLite 3 and is optional from GraphQLite 4+.
diff --git a/website/versioned_docs/version-8.0.0/automatic-persisted-queries.mdx b/website/versioned_docs/version-8.0.0/automatic-persisted-queries.mdx new file mode 100644 index 0000000000..f505a869f4 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/automatic-persisted-queries.mdx @@ -0,0 +1,61 @@ +--- +id: automatic-persisted-queries +title: Automatic persisted queries +sidebar_label: Automatic persisted queries +--- + +## The problem + +Clients send queries to GraphQLite as HTTP requests that include the GraphQL string of the query to execute. +Depending on your graph's schema, the size of a valid query string might be arbitrarily large. +As query strings become larger, increased latency and network usage can noticeably degrade client performance. + +To combat this, GraphQL servers use a technique called "persisted queries". The basic idea is instead of +sending the whole query string, clients only send it's unique identifier. The server then finds the actual +query string by given identifier and use that as if the client sent the whole query in the first place. +That helps improve GraphQL network performance with zero build-time configuration by sending smaller GraphQL HTTP requests. +A smaller request payload reduces bandwidth utilization and speeds up GraphQL Client loading times. + +## Apollo APQ + +[Automatic persisted queries (APQ) is technique created by Apollo](https://www.apollographql.com/docs/apollo-server/performance/apq/) +and is aimed to implement a simple automatic way of persisting queries. Queries are cached on the server side, +along with its unique identifier (always its SHA-256 hash). Clients can send this identifier instead of the +corresponding query string, thus reducing request sizes dramatically (response sizes are unaffected). + +To persist a query string, GraphQLite server must first receive it from a requesting client. +Consequently, each unique query string must be sent to Apollo Server at least once. +After any client sends a query string to persist, every client that executes that query can then benefit from APQ. + +```mermaid +sequenceDiagram; + Client app->>GraphQL Server: Sends SHA-256 hash of query string to execute + Note over GraphQL Server: Fails to find persisted query string + GraphQL Server->>Client app: Responds with error + Client app->>GraphQL Server: Sends both query string AND hash + Note over GraphQL Server: Persists query string and hash + GraphQL Server->>Client app: Executes query and returns result + Note over Client app: Time passes + Client app->>GraphQL Server: Sends SHA-256 hash of query string to execute + Note over GraphQL Server: Finds persisted query string + GraphQL Server->>Client app: Executes query and returns result +``` + +Persisted queries are especially effective when clients send queries as GET requests. +This enables clients to take advantage of the browser cache and integrate with a CDN. + +Because query identifiers are deterministic hashes, clients can generate them at runtime. No additional build steps are required. + +## Setup + +To use Automatic persisted queries with GraphQLite, you may use +`useAutomaticPersistedQueries` method when building your PSR-15 middleware: + +```php +$builder = new Psr15GraphQLMiddlewareBuilder($schema); + +// You need to provide a PSR compatible cache and a TTL for queries. The best cache would be some kind +// of in-memory cache with a limit on number of entries to make sure your cache can't be maliciously spammed with queries. +$builder->useAutomaticPersistedQueries($cache, new DateInterval('PT1H')); +``` + diff --git a/website/versioned_docs/version-8.0.0/autowiring.mdx b/website/versioned_docs/version-8.0.0/autowiring.mdx new file mode 100644 index 0000000000..825241afe0 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/autowiring.mdx @@ -0,0 +1,107 @@ +--- +id: autowiring +title: Autowiring services +sidebar_label: Autowiring services +--- + +GraphQLite can automatically inject services in your fields/queries/mutations signatures. + +Some of your fields may be computed. In order to compute these fields, you might need to call a service. + +Most of the time, your `#[Type]` attribute will be put on a model. And models do not have access to services. +Hopefully, if you add a type-hinted service in your field's declaration, GraphQLite will automatically fill it with +the service instance. + +## Sample + +Let's assume you are running an international store. You have a `Product` class. Each product has many names (depending +on the language of the user). + +```php +namespace App\Entities; + +use TheCodingMachine\GraphQLite\Annotations\Autowire; +use TheCodingMachine\GraphQLite\Annotations\Field; +use TheCodingMachine\GraphQLite\Annotations\Type; + +use Symfony\Component\Translation\TranslatorInterface; + +#[Type] +class Product +{ + // ... + + #[Field] + public function getName( + #[Autowire] + TranslatorInterface $translator + ): string + { + return $translator->trans('product_name_'.$this->id); + } +} +``` + +When GraphQLite queries the name, it will automatically fetch the translator service. + +
As with most autowiring solutions, GraphQLite assumes that the service identifier +in the container is the fully qualified class name of the type-hint. So in the example above, GraphQLite will +look for a service whose name is Symfony\Component\Translation\TranslatorInterface.
+ +## Best practices + +It is a good idea to refrain from type-hinting on concrete implementations. +Most often, your field declaration will be in your model. If you add a type-hint on a service, you are binding your domain +with a particular service implementation. This makes your code tightly coupled and less testable. + +
+Please don't do that: + +

+    #[Field]
+    public function getName(#[Autowire] MyTranslator $translator): string
+    {
+        // Your domain is suddenly tightly coupled to the MyTranslator class.
+    }
+
+
+ +Instead, be sure to type-hint against an interface. + +
+Do this instead: + +

+    #[Field]
+    public function getName(#[Autowire] TranslatorInterface $translator): string
+    {
+        // Good. You can switch translator implementation any time.
+    }
+
+
+ +By type-hinting against an interface, your code remains testable and is decoupled from the service implementation. + +## Fetching a service by name (discouraged!) + +Optionally, you can specify the identifier of the service you want to fetch from the controller: + +```php +#[Autowire(identifier: "translator")] +``` + +
While GraphQLite offers the possibility to specify the name of the service to be +autowired, we would like to emphasize that this is highly discouraged. Hard-coding a container +identifier in the code of your class is akin to using the "service locator" pattern, which is known to be an +anti-pattern. Please refrain from doing this as much as possible.
+ +## Alternative solution + +You may find yourself uncomfortable with the autowiring mechanism of GraphQLite. For instance maybe: + +- Your service identifier in the container is not the fully qualified class name of the service (this is often true if you are not using a container supporting autowiring) +- You do not want to inject a service in a domain object +- You simply do not like the magic of injecting services in a method signature + +If you do not want to use autowiring and if you still need to access services to compute a field, please read on +the next chapter to learn [how to extend a type](extend-type). diff --git a/website/versioned_docs/version-8.0.0/custom-types.mdx b/website/versioned_docs/version-8.0.0/custom-types.mdx new file mode 100644 index 0000000000..3db2bec5bd --- /dev/null +++ b/website/versioned_docs/version-8.0.0/custom-types.mdx @@ -0,0 +1,219 @@ +--- +id: custom-types +title: Custom types +sidebar_label: Custom types +--- + +In some special cases, you want to override the GraphQL return type that is attributed by default by GraphQLite. + +For instance: + +```php +#[Type(class: Product::class)] +class ProductType +{ + #[Field] + public function getId(Product $source): string + { + return $source->getId(); + } +} +``` + +In the example above, GraphQLite will generate a GraphQL schema with a field `id` of type `string`: + +```graphql +type Product { + id: String! +} +``` + +GraphQL comes with an `ID` scalar type. But PHP has no such type. So GraphQLite does not know when a variable +is an `ID` or not. + +You can help GraphQLite by manually specifying the output type to use: + +```php + #[Field(outputType: "ID")] +``` + +## Usage + +The `outputType` attribute will map the return value of the method to the output type passed in parameter. + +You can use the `outputType` attribute in the following annotations: + +* `#[Query]` +* `#[Mutation]` +* `#[Subscription]` +* `#[Field]` +* `#[SourceField]` +* `#[MagicField]` + +## Registering a custom output type (advanced) + +In order to create a custom output type, you need to: + +1. Design a class that extends `GraphQL\Type\Definition\ObjectType`. +2. Register this class in the GraphQL schema. + +You'll find more details on the [Webonyx documentation](https://webonyx.github.io/graphql-php/type-definitions/object-types/). + +--- + +In order to find existing types, the schema is using *type mappers* (classes implementing the `TypeMapperInterface` interface). + +You need to make sure that one of these type mappers can return an instance of your type. The way you do this will depend on the framework +you use. + +### Symfony users + +Any class extending `GraphQL\Type\Definition\ObjectType` (and available in the container) will be automatically detected +by Symfony and added to the schema. + +If you want to automatically map the output type to a given PHP class, you will have to explicitly declare the output type +as a service and use the `graphql.output_type` tag: + +```yaml +# config/services.yaml +services: + App\MyOutputType: + tags: + - { name: 'graphql.output_type', class: 'App\MyPhpClass' } +``` + +### Other frameworks + +The easiest way is to use a `StaticTypeMapper`. Use this class to register custom output types. + +```php +// Sample code: +$staticTypeMapper = new StaticTypeMapper( + // Let's register a type that maps by default to the "MyClass" PHP class + types: [ + MyClass::class => new MyCustomOutputType() + ], + + // If you don't want your output type to map to any PHP class by default, use: + notMappedTypes: [ + new MyCustomOutputType() + ], +); + +// Register the static type mapper in your application using the SchemaFactory instance +$schemaFactory->addTypeMapper($staticTypeMapper); +``` + +## Registering a custom scalar type (advanced) + +If you need to add custom scalar types, first, check the [GraphQLite Misc. Types library](https://github.com/thecodingmachine/graphqlite-misc-types). +It contains a number of "out-of-the-box" scalar types ready to use and you might find what you need there. + +You still need to develop your custom scalar type? Ok, let's get started. + +In order to add a scalar type in GraphQLite, you need to: + +- create a [Webonyx custom scalar type](https://webonyx.github.io/graphql-php/type-system/scalar-types/#writing-custom-scalar-types). + You do this by creating a class that extends `GraphQL\Type\Definition\ScalarType`. +- create a "type mapper" that will map PHP types to the GraphQL scalar type. You do this by writing a class implementing the `RootTypeMapperInterface`. +- create a "type mapper factory" that will be in charge of creating your "type mapper". + +```php +interface RootTypeMapperInterface +{ + /** + * @param \ReflectionMethod|\ReflectionProperty $reflector + */ + public function toGraphQLOutputType(Type $type, ?OutputType $subType, $reflector, DocBlock $docBlockObj): OutputType; + + /** + * @param \ReflectionMethod|\ReflectionProperty $reflector + */ + public function toGraphQLInputType(Type $type, ?InputType $subType, string $argumentName, $reflector, DocBlock $docBlockObj): InputType; + + public function mapNameToType(string $typeName): NamedType; +} +``` + +The `toGraphQLOutputType` and `toGraphQLInputType` are meant to map a return type (for output types) or a parameter type (for input types) +to your GraphQL scalar type. Return your scalar type if there is a match or `null` if there no match. + +The `mapNameToType` should return your GraphQL scalar type if `$typeName` is the name of your scalar type. + +RootTypeMapper are organized **in a chain** (they are actually middlewares). +Each instance of a `RootTypeMapper` holds a reference on the next root type mapper to be called in the chain. + +For instance: + +```php +class AnyScalarTypeMapper implements RootTypeMapperInterface +{ + /** @var RootTypeMapperInterface */ + private $next; + + public function __construct(RootTypeMapperInterface $next) + { + $this->next = $next; + } + + public function toGraphQLOutputType(Type $type, ?OutputType $subType, ReflectionMethod $refMethod, DocBlock $docBlockObj): ?OutputType + { + if ($type instanceof Scalar) { + // AnyScalarType is a class implementing the Webonyx ScalarType type. + return AnyScalarType::getInstance(); + } + // If the PHPDoc type is not "Scalar", let's pass the control to the next type mapper in the chain + return $this->next->toGraphQLOutputType($type, $subType, $refMethod, $docBlockObj); + } + + public function toGraphQLInputType(Type $type, ?InputType $subType, string $argumentName, ReflectionMethod $refMethod, DocBlock $docBlockObj): ?InputType + { + if ($type instanceof Scalar) { + // AnyScalarType is a class implementing the Webonyx ScalarType type. + return AnyScalarType::getInstance(); + } + // If the PHPDoc type is not "Scalar", let's pass the control to the next type mapper in the chain + return $this->next->toGraphQLInputType($type, $subType, $argumentName, $refMethod, $docBlockObj); + } + + /** + * Returns a GraphQL type by name. + * If this root type mapper can return this type in "toGraphQLOutputType" or "toGraphQLInputType", it should + * also map these types by name in the "mapNameToType" method. + * + * @param string $typeName The name of the GraphQL type + * @return NamedType|null + */ + public function mapNameToType(string $typeName): ?NamedType + { + if ($typeName === AnyScalarType::NAME) { + return AnyScalarType::getInstance(); + } + return null; + } +} +``` + +Now, in order to create an instance of your `AnyScalarTypeMapper` class, you need an instance of the `$next` type mapper in the chain. +How do you get the `$next` type mapper? Through a factory: + +```php +class AnyScalarTypeMapperFactory implements RootTypeMapperFactoryInterface +{ + public function create(RootTypeMapperInterface $next, RootTypeMapperFactoryContext $context): RootTypeMapperInterface + { + return new AnyScalarTypeMapper($next); + } +} +``` + +Now, you need to register this factory in your application, and we are done. + +You can register your own root mapper factories using the `SchemaFactory::addRootTypeMapperFactory()` method. + +```php +$schemaFactory->addRootTypeMapperFactory(new AnyScalarTypeMapperFactory()); +``` + +If you are using the Symfony bundle, the factory will be automatically registered, you have nothing to do (the service +is automatically tagged with the "graphql.root_type_mapper_factory" tag). diff --git a/website/versioned_docs/version-8.0.0/doctrine-annotations-attributes.mdx b/website/versioned_docs/version-8.0.0/doctrine-annotations-attributes.mdx new file mode 100644 index 0000000000..058c276a95 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/doctrine-annotations-attributes.mdx @@ -0,0 +1,102 @@ +--- +id: doctrine-annotations-attributes +title: Doctrine annotations VS PHP8 attributes +sidebar_label: Annotations VS Attributes +--- + +GraphQLite is heavily relying on the concept of annotations (also called attributes in PHP 8+). + +## Doctrine annotations + +
+ Unsupported! Doctrine annotations are replaced in favor of native PHP 8 attributes. +
+ +## PHP 8 attributes + +Starting with PHP 8, PHP got native annotations support. They are actually called "attributes" in the PHP world. + +The same code can be written this way: + +```php +use TheCodingMachine\GraphQLite\Annotations\Type; + +#[Type] +class MyType +{ +} +``` + +GraphQLite v4.1+ has support for PHP 8 attributes. + +The Doctrine annotation class and the PHP 8 attribute class is **the same** (so you will be using the same `use` statement at the top of your file). + +They support the same attributes too. + +A few notable differences: + +- PHP 8 attributes can be written at the parameter level. Any attribute targeting a "parameter" must be written at the parameter level. + +Let's take an example with the [`#Autowire` attribute](autowiring.mdx): + +```php +#[Field] +public function getProduct(#[Autowire] ProductRepository $productRepository) : Product { + //... +} +``` + +## Migrating from Doctrine annotations to PHP 8 attributes + +The good news is that you can easily migrate from Doctrine annotations to PHP 8 attributes using the amazing, [Rector library](https://github.com/rectorphp/rector). To do so, you'll want to use the following rector configuration: + +```php title="rector.php" +import(SetList::CODE_QUALITY); + + // Set parameters + $parameters = $containerConfigurator->parameters(); + $parameters->set(Option::PATHS, [ + __DIR__ . '/src', + __DIR__ . '/tests', + ]); + + $services = $containerConfigurator->services(); + + // @Validate and @Assertion are part of other libraries, include if necessary + $services->set(AnnotationToAttributeRector::class) + ->configure([ + new AnnotationToAttribute(GraphQLite\Query::class), + new AnnotationToAttribute(GraphQLite\Mutation::class), + new AnnotationToAttribute(GraphQLite\Type::class), + new AnnotationToAttribute(GraphQLite\ExtendType::class), + new AnnotationToAttribute(GraphQLite\Input::class), + new AnnotationToAttribute(GraphQLite\Field::class), + new AnnotationToAttribute(GraphQLite\SourceField::class), + new AnnotationToAttribute(GraphQLite\MagicField::class), + new AnnotationToAttribute(GraphQLite\Logged::class), + new AnnotationToAttribute(GraphQLite\Right::class), + new AnnotationToAttribute(GraphQLite\FailWith::class), + new AnnotationToAttribute(GraphQLite\HideIfUnauthorized::class), + new AnnotationToAttribute(GraphQLite\InjectUser::class), + new AnnotationToAttribute(GraphQLite\Security::class), + new AnnotationToAttribute(GraphQLite\Factory::class), + new AnnotationToAttribute(GraphQLite\UseInputType::class), + new AnnotationToAttribute(GraphQLite\Decorate::class), + new AnnotationToAttribute(GraphQLite\Autowire::class), + new AnnotationToAttribute(GraphQLite\HideParameter::class), + new AnnotationToAttribute(GraphQLite\EnumType::class), + ]); +}; +``` diff --git a/website/versioned_docs/version-8.0.0/error-handling.mdx b/website/versioned_docs/version-8.0.0/error-handling.mdx new file mode 100644 index 0000000000..1fe32a54de --- /dev/null +++ b/website/versioned_docs/version-8.0.0/error-handling.mdx @@ -0,0 +1,144 @@ +--- +id: error-handling +title: Error handling +sidebar_label: Error handling +--- + +In GraphQL, when an error occurs, the server must add an "error" entry in the response. + +```json +{ + "errors": [ + { + "message": "Name for character with ID 1002 could not be fetched.", + "locations": [ { "line": 6, "column": 7 } ], + "path": [ "hero", "heroFriends", 1, "name" ] + } + ] +} +``` + +You can generate such errors with GraphQLite by throwing a `GraphQLException`. + +```php +use TheCodingMachine\GraphQLite\Exceptions\GraphQLException; + +throw new GraphQLException("Exception message"); +``` + +## HTTP response code + +By default, when you throw a `GraphQLException`, the HTTP status code will be 500. + +If your exception code is in the 4xx - 5xx range, the exception code will be used as an HTTP status code. + +```php +// This exception will generate a HTTP 404 status code +throw new GraphQLException("Not found", 404); +``` + +
GraphQL allows to have several errors for one request. If you have several +GraphQLException thrown for the same request, the HTTP status code used will be the highest one.
+ +## Customizing the extensions section + +You can customize the whole "extensions" section with the 5th parameter of the constructor: + +```php +throw new GraphQLException("Field required", 400, null, "VALIDATION", ['field' => 'name']); +``` + +will generate: + +```json +{ + "errors": [ + { + "message": "Field required", + "extensions": { + "field": "name" + } + } + ] +} +``` + +## Writing your own exceptions + +Rather that throwing the base `GraphQLException`, you should consider writing your own exception. + +Any exception that implements interface `TheCodingMachine\GraphQLite\Exceptions\GraphQLExceptionInterface` will be displayed +in the GraphQL "errors" section. + +```php +class ValidationException extends Exception implements GraphQLExceptionInterface +{ + /** + * Returns true when exception message is safe to be displayed to a client. + */ + public function isClientSafe(): bool + { + return true; + } + + /** + * Returns the "extensions" object attached to the GraphQL error. + * + * @return array + */ + public function getExtensions(): array + { + return []; + } +} +``` + +## Many errors for one exception + +Sometimes, you need to display several errors in the response. But of course, at any given point in your code, you can +throw only one exception. + +If you want to display several exceptions, you can bundle these exceptions in a `GraphQLAggregateException` that you can +throw. + +```php +use TheCodingMachine\GraphQLite\Exceptions\GraphQLAggregateException; + +#[Query] +public function createProduct(string $name, float $price): Product +{ + $exceptions = new GraphQLAggregateException(); + + if ($name === '') { + $exceptions->add(new GraphQLException('Name cannot be empty', 400, null, 'VALIDATION')); + } + if ($price <= 0) { + $exceptions->add(new GraphQLException('Price must be positive', 400, null, 'VALIDATION')); + } + + if ($exceptions->hasExceptions()) { + throw $exceptions; + } +} +``` + +## Webonyx exceptions + +GraphQLite is based on the wonderful webonyx/GraphQL-PHP library. Therefore, the Webonyx exception mechanism can +also be used in GraphQLite. This means you can throw a `GraphQL\Error\Error` exception or any exception implementing +[`GraphQL\Error\ClientAware` interface](http://webonyx.github.io/graphql-php/error-handling/#errors-in-graphql) + +Actually, the `TheCodingMachine\GraphQLite\Exceptions\GraphQLExceptionInterface` extends Webonyx's `ClientAware` interface. + +## Behaviour of exceptions that do not implement ClientAware + +If an exception that does not implement `ClientAware` is thrown, by default, GraphQLite will not catch it. + +The exception will propagate to your framework error handler/middleware that is in charge of displaying the classical error page. + +You can [change the underlying behaviour of Webonyx to catch any exception and turn them into GraphQL errors](http://webonyx.github.io/graphql-php/error-handling/#debugging-tools). +The way you adjust the error settings depends on the framework you are using ([Symfony](symfony-bundle.md), [Laravel](laravel-package.md)). + +
To be clear: we strongly discourage changing this setting. We strongly believe that the +default "RETHROW_UNSAFE_EXCEPTIONS" setting of Webonyx is the only sane setting (only putting in "errors" section exceptions +designed for GraphQL).
diff --git a/website/versioned_docs/version-8.0.0/extend-input-type.mdx b/website/versioned_docs/version-8.0.0/extend-input-type.mdx new file mode 100644 index 0000000000..abe2818dd9 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/extend-input-type.mdx @@ -0,0 +1,75 @@ +--- +id: extend-input-type +title: Extending an input type +sidebar_label: Extending an input type +--- + +Available in GraphQLite 4.0+ + +
If you are not familiar with the #[Factory] tag, read first the "input types" guide.
+ +Fields exposed in a GraphQL input type do not need to be all part of the factory method. + +Just like with output type (that can be [extended using the `ExtendType` attribute](extend-type.mdx)), you can extend/modify +an input type using the `#[Decorate]` attribute. + +Use the `#[Decorate]` attribute to add additional fields to an input type that is already declared by a `#[Factory]` attribute, +or to modify the returned object. + +
+ The #[Decorate] attribute is very useful in scenarios where you cannot touch the #[Factory] method. + This can happen if the #[Factory] method is defined in a third-party library or if the #[Factory] method is part + of auto-generated code. +
+ +Let's assume you have a `Filter` class used as an input type. You most certainly have a `#[Factory]` to create the input type. + +```php +class MyFactory +{ + #[Factory] + public function createFilter(string $name): Filter + { + // Let's assume you have a flexible 'Filter' class that can accept any kind of filter + $filter = new Filter(); + $filter->addFilter('name', $name); + return $filter; + } +} +``` + +Assuming you **cannot** modify the code of this factory, you can still modify the GraphQL input type generated by +adding a "decorator" around the factory. + +```php +class MyDecorator +{ + #[Decorate(inputTypeName: "FilterInput")] + public function addTypeFilter(Filter $filter, string $type): Filter + { + $filter->addFilter('type', $type); + return $filter; + } +} +``` + +In the example above, the "Filter" input type is modified. We add an additional "type" field to the input type. + +A few things to notice: + +- The decorator takes the object generated by the factory as first argument +- The decorator MUST return an object of the same type (or a sub-type) +- The decorator CAN contain additional parameters. They will be added to the fields of the GraphQL input type. +- The `#[Decorate]` attribute must contain a `inputTypeName` attribute that contains the name of the GraphQL input type + that is decorated. If you did not specify this name in the `#[Factory]` attribute, this is by default the name of the + PHP class + "Input" (for instance: "Filter" => "FilterInput") + + +
+ Heads up! The MyDecorator class must exist in the container of your + application and the container identifier MUST be the fully qualified class name. +

+ If you are using the Symfony bundle (or a framework with autowiring like Laravel), this is usually + not an issue as the container will automatically create the controller entry if you do not explicitly + declare it. +
diff --git a/website/versioned_docs/version-8.0.0/extend-type.mdx b/website/versioned_docs/version-8.0.0/extend-type.mdx new file mode 100644 index 0000000000..44d5ac9327 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/extend-type.mdx @@ -0,0 +1,135 @@ +--- +id: extend-type +title: Extending a type +sidebar_label: Extending a type +--- + + +Fields exposed in a GraphQL type do not need to be all part of the same class. + +Use the `#[ExtendType]` attribute to add additional fields to a type that is already declared. + +
+ Extending a type has nothing to do with type inheritance. + If you are looking for a way to expose a class and its children classes, have a look at + the Inheritance section +
+ +Let's assume you have a `Product` class. In order to get the name of a product, there is no `getName()` method in +the product because the name needs to be translated in the correct language. You have a `TranslationService` to do that. + +```php +namespace App\Entities; + +use TheCodingMachine\GraphQLite\Annotations\Field; +use TheCodingMachine\GraphQLite\Annotations\Type; + +#[Type] +class Product +{ + // ... + + #[Field] + public function getId(): string + { + return $this->id; + } + + #[Field] + public function getPrice(): ?float + { + return $this->price; + } +} +``` + +```php +// You need to use a service to get the name of the product in the correct language. +$name = $translationService->getProductName($productId, $language); +``` + +Using `#[ExtendType]`, you can add an additional `name` field to your product: + +```php +namespace App\Types; + +use TheCodingMachine\GraphQLite\Annotations\ExtendType; +use TheCodingMachine\GraphQLite\Annotations\Field; +use App\Entities\Product; + +#[ExtendType(class: Product::class)] +class ProductType +{ + private $translationService; + + public function __construct(TranslationServiceInterface $translationService) + { + $this->translationService = $translationService; + } + + #[Field] + public function getName(Product $product, string $language): string + { + return $this->translationService->getProductName($product->getId(), $language); + } +} +``` + +Let's break this sample: + +```php +#[ExtendType(class: Product::class)] +``` + +With the `#[ExtendType]` attribute, we tell GraphQLite that we want to add fields in the GraphQL type mapped to +the `Product` PHP class. + +```php +class ProductType +{ + private $translationService; + + public function __construct(TranslationServiceInterface $translationService) + { + $this->translationService = $translationService; + } + + // ... +} +``` + + +- The `ProductType` class must be in the types namespace. You configured this namespace when you installed GraphQLite. +- The `ProductType` class is actually a **service**. You can therefore inject dependencies in it (like the `$translationService` in this example) + +
Heads up! The ProductType class must exist in the container of your +application and the container identifier MUST be the fully qualified class name.

+If you are using the Symfony bundle (or a framework with autowiring like Laravel), this +is usually not an issue as the container will automatically create the controller entry if you do not explicitly +declare it.
+ +```php +#[Field] +public function getName(Product $product, string $language): string +{ + return $this->translationService->getProductName($product->getId(), $language); +} +``` + +The `#[Field]` attribute is used to add the "name" field to the `Product` type. + +Take a close look at the signature. The first parameter is the "resolved object" we are working on. +Any additional parameters are used as arguments. + +Using the "[Type language](https://graphql.org/learn/schema/#type-language)" notation, we defined a type extension for +the GraphQL "Product" type: + +```graphql +Extend type Product { + name(language: !String): String! +} +``` + +
Type extension is a very powerful tool. Use it to add fields that needs to be +computed from services not available in the entity. +
diff --git a/website/versioned_docs/version-8.0.0/external-type-declaration.mdx b/website/versioned_docs/version-8.0.0/external-type-declaration.mdx new file mode 100644 index 0000000000..428fad7f8e --- /dev/null +++ b/website/versioned_docs/version-8.0.0/external-type-declaration.mdx @@ -0,0 +1,149 @@ +--- +id: external-type-declaration +title: External type declaration +sidebar_label: External type declaration +--- + +In some cases, you cannot or do not want to put an attribute on a domain class. + +For instance: + +* The class you want to annotate is part of a third party library and you cannot modify it +* You are doing domain-driven design and don't want to clutter your domain object with attributes from the view layer +* etc. + +## `#[Type]` attribute with the `class` attribute + +GraphQLite allows you to use a *proxy* class thanks to the `#[Type]` attribute with the `class` attribute: + +```php +namespace App\Types; + +use TheCodingMachine\GraphQLite\Annotations\Type; +use TheCodingMachine\GraphQLite\Annotations\Field; +use App\Entities\Product; + +#[Type(class: Product::class)] +class ProductType +{ + #[Field] + public function getId(Product $product): string + { + return $product->getId(); + } +} +``` + +The `ProductType` class must be in the *types* namespace. You configured this namespace when you installed GraphQLite. + +The `ProductType` class is actually a **service**. You can therefore inject dependencies in it. + +
Heads up! The ProductType class must exist in the container of your application and the container identifier MUST be the fully qualified class name.

+If you are using the Symfony bundle (or a framework with autowiring like Laravel), this +is usually not an issue as the container will automatically create the controller entry if you do not explicitly +declare it.
+ +In methods with a `#[Field]` attribute, the first parameter is the *resolved object* we are working on. Any additional parameters are used as arguments. + +## `#[SourceField]` attribute + +If you don't want to rewrite all *getters* of your base class, you may use the `#[SourceField]` attribute: + +```php +use TheCodingMachine\GraphQLite\Annotations\Type; +use TheCodingMachine\GraphQLite\Annotations\SourceField; +use App\Entities\Product; + +#[Type(class: Product::class)] +#[SourceField(name: "name")] +#[SourceField(name: "price")] +class ProductType +{ +} +``` + +By doing so, you let GraphQLite know that the type exposes the `getName` method of the underlying `Product` object. + +Internally, GraphQLite will look for methods named `name()`, `getName()` and `isName()`). +You can set different name to look for with `sourceName` attribute. + +## `#[MagicField]` attribute + +If your object has no getters, but instead uses magic properties (using the magic `__get` method), you should use the `#[MagicField]` attribute: + +```php +use TheCodingMachine\GraphQLite\Annotations\Type; +use TheCodingMachine\GraphQLite\Annotations\SourceField; +use App\Entities\Product; + +#[Type] +#[MagicField(name: "name", outputType: "String!")] +#[MagicField(name: "price", outputType: "Float")] +class ProductType +{ + public function __get(string $property) { + // return some magic property + } +} +``` + +By doing so, you let GraphQLite know that the type exposes "name" and the "price" magic properties of the underlying `Product` object. +You can set different name to look for with `sourceName` attribute. + +This is particularly useful in frameworks like Laravel, where Eloquent is making a very wide use of such properties. + +Please note that GraphQLite has no way to know the type of a magic property. Therefore, you have specify the GraphQL type +of each property manually. + +### Authentication and authorization + +You may also check for logged users or users with a specific right using the "annotations" argument. + +```php +use TheCodingMachine\GraphQLite\Annotations\Type; +use TheCodingMachine\GraphQLite\Annotations\SourceField; +use TheCodingMachine\GraphQLite\Annotations\Logged; +use TheCodingMachine\GraphQLite\Annotations\Right; +use TheCodingMachine\GraphQLite\Annotations\FailWith; +use App\Entities\Product; + +#[Type(class: Product::class)] +#[SourceField(name: "name")] +#[SourceField(name: "price", annotations: [new Logged(), new Right("CAN_ACCESS_Price"), new FailWith(null)])] +class ProductType extends AbstractAnnotatedObjectType +{ +} +``` + +Any attributes described in the [Authentication and authorization page](authentication-authorization.mdx), or any attribute this is actually a ["field middleware"](field-middlewares.md) can be used in the `#[SourceField]` "annotations" argument. + +## Declaring fields dynamically (without attributes) + +In some very particular cases, you might not know exactly the list of `#[SourceField]` attributes at development time. +If you need to decide the list of `#[SourceField]` at runtime, you can implement the `FromSourceFieldsInterface`: + +```php +use TheCodingMachine\GraphQLite\FromSourceFieldsInterface; + +#[Type(class: Product::class)] +class ProductType implements FromSourceFieldsInterface +{ + /** + * Dynamically returns the array of source fields + * to be fetched from the original object. + * + * @return SourceFieldInterface[] + */ + public function getSourceFields(): array + { + // You may want to enable fields conditionally based on feature flags... + if (ENABLE_STATUS_GLOBALLY) { + return [ + new SourceField(['name'=>'status', 'annotations'=>[new Logged()]]), + ]; + } else { + return []; + } + } +} +``` diff --git a/website/versioned_docs/version-8.0.0/field-middlewares.md b/website/versioned_docs/version-8.0.0/field-middlewares.md new file mode 100644 index 0000000000..df7b2bfaee --- /dev/null +++ b/website/versioned_docs/version-8.0.0/field-middlewares.md @@ -0,0 +1,135 @@ +--- +id: field-middlewares +title: Adding custom attributes with Field middlewares +sidebar_label: Custom attributes +--- + +Available in GraphQLite 4.0+ + +Just like the `#[Logged]` or `#[Right]` attribute, you can develop your own attribute that extends/modifies the behaviour of a field/query/mutation. + +
+ If you want to create an attribute that targets a single argument (like #[AutoWire]), you should rather check the documentation about custom argument resolving +
+ +## Field middlewares + +GraphQLite is based on the Webonyx/Graphql-PHP library. In Webonyx, fields are represented by the `FieldDefinition` class. +In order to create a `FieldDefinition` instance for your field, GraphQLite goes through a series of "middlewares". + +![](/img/field_middleware.svg) + +Each middleware is passed a `TheCodingMachine\GraphQLite\QueryFieldDescriptor` instance. This object contains all the +parameters used to initialize the field (like the return type, the list of arguments, the resolver to be used, etc...) + +Each middleware must return a `GraphQL\Type\Definition\FieldDefinition` (the object representing a field in Webonyx/GraphQL-PHP). + +```php +/** + * Your middleware must implement this interface. + */ +interface FieldMiddlewareInterface +{ + public function process(QueryFieldDescriptor $queryFieldDescriptor, FieldHandlerInterface $fieldHandler): ?FieldDefinition; +} +``` + +```php +class QueryFieldDescriptor +{ + public function getName() { /* ... */ } + public function withName(string $name): self { /* ... */ } + public function getType() { /* ... */ } + public function withType($type): self { /* ... */ } + public function getParameters(): array { /* ... */ } + public function withParameters(array $parameters): self { /* ... */ } + public function withCallable(callable $callable): self { /* ... */ } + public function withTargetMethodOnSource(?string $targetMethodOnSource): self { /* ... */ } + public function isInjectSource(): bool { /* ... */ } + public function withInjectSource(bool $injectSource): self { /* ... */ } + public function getComment(): ?string { /* ... */ } + public function withComment(?string $comment): self { /* ... */ } + public function getMiddlewareAnnotations(): MiddlewareAnnotations { /* ... */ } + public function withMiddlewareAnnotations(MiddlewareAnnotations $middlewareAnnotations): self { /* ... */ } + public function getOriginalResolver(): ResolverInterface { /* ... */ } + public function getResolver(): callable { /* ... */ } + public function withResolver(callable $resolver): self { /* ... */ } +} +``` + +The role of a middleware is to analyze the `QueryFieldDescriptor` and modify it (or to directly return a `FieldDefinition`). + +If you want the field to purely disappear, your middleware can return `null`, although this should be used with caution: +field middlewares only get called once per Schema instance. If you use a long-running server (like Laravel Octane, Swoole, RoadRunner etc) +and share the same Schema instance across requests, you will not be able to hide fields based on request data. + +## Attributes parsing + +Take a look at the `QueryFieldDescriptor::getMiddlewareAnnotations()`. + +It returns the list of attributes applied to your field that implements the `MiddlewareAnnotationInterface`. + +Let's imagine you want to add a `#[OnlyDebug]` attribute that displays a field/query/mutation only in debug mode (and +hides the field in production). That could be useful, right? + +First, we have to define the attribute. + +```php title="OnlyDebug.php" +namespace App\Annotations; + +use Attribute; +use TheCodingMachine\GraphQLite\Annotations\MiddlewareAnnotationInterface; + +#[Attribute(Attribute::TARGET_METHOD)] +class OnlyDebug implements MiddlewareAnnotationInterface +{ +} +``` + +Apart from being a classical attribute, this class implements the `MiddlewareAnnotationInterface`. This interface is a "marker" interface. It does not have any methods. It is just used to tell GraphQLite that this attribute is to be used by middlewares. + +Now, we can write a middleware that will act upon this attribute. + +```php +namespace App\Middlewares; + +use App\Annotations\OnlyDebug; +use TheCodingMachine\GraphQLite\Middlewares\FieldMiddlewareInterface; +use GraphQL\Type\Definition\FieldDefinition; +use TheCodingMachine\GraphQLite\QueryFieldDescriptor; + +/** + * Middleware in charge of hiding a field if it is annotated with #[OnlyDebug] and the DEBUG constant is not set + */ +class OnlyDebugFieldMiddleware implements FieldMiddlewareInterface +{ + public function process(QueryFieldDescriptor $queryFieldDescriptor, FieldHandlerInterface $fieldHandler): ?FieldDefinition + { + $annotations = $queryFieldDescriptor->getMiddlewareAnnotations(); + + /** + * @var OnlyDebug $onlyDebug + */ + $onlyDebug = $annotations->getAnnotationByType(OnlyDebug::class); + + if ($onlyDebug !== null && !DEBUG) { + // If the onlyDebug attribute is present, returns null. + // Returning null will hide the field. + return null; + } + + // Otherwise, let's continue the middleware pipe without touching anything. + return $fieldHandler->handle($queryFieldDescriptor); + } +} +``` + +The final thing we have to do is to register the middleware. + +- Assuming you are using the `SchemaFactory` to initialize GraphQLite, you can register the field middleware using: + + ```php + $schemaFactory->addFieldMiddleware(new OnlyDebugFieldMiddleware()); + ``` + +- If you are using the Symfony bundle, you can register your field middleware services by tagging them with the `graphql.field_middleware` tag. diff --git a/website/versioned_docs/version-8.0.0/file-uploads.mdx b/website/versioned_docs/version-8.0.0/file-uploads.mdx new file mode 100644 index 0000000000..487a413948 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/file-uploads.mdx @@ -0,0 +1,60 @@ +--- +id: file-uploads +title: File uploads +sidebar_label: File uploads +--- + +GraphQL does not support natively the notion of file uploads, but an extension to the GraphQL protocol was proposed +to add support for [multipart requests](https://github.com/jaydenseric/graphql-multipart-request-spec). + +## Installation + +GraphQLite supports this extension through the use of the [Ecodev/graphql-upload](https://github.com/Ecodev/graphql-upload) library. + +You must start by installing this package: + +```console +$ composer require ecodev/graphql-upload +``` + +### If you are using the Symfony bundle + +If you are using our Symfony bundle, the file upload middleware is managed by the bundle. You have nothing to do +and can start using it right away. + +### If you are using a PSR-15 compatible framework + +In order to use this, you must first be sure that the `ecodev/graphql-upload` PSR-15 middleware is part of your middleware pipe. + +Simply add `GraphQL\Upload\UploadMiddleware` to your middleware pipe. + +### If you are using another framework not compatible with PSR-15 + +Please check the Ecodev/graphql-upload library [documentation](https://github.com/Ecodev/graphql-upload) +for more information on how to integrate it in your framework. + +## Usage + +To handle an uploaded file, you type-hint against the PSR-7 `UploadedFileInterface`: + +```php +class MyController +{ + #[Mutation] + public function saveDocument(string $name, UploadedFileInterface $file): Document + { + // Some code that saves the document. + $file->moveTo($someDir); + } +} +``` + +Of course, you need to use a GraphQL client that is compatible with multipart requests. See [jaydenseric/graphql-multipart-request-spec](https://github.com/jaydenseric/graphql-multipart-request-spec#client) for a list of compatible clients. + +The GraphQL client must send the file using the Upload type. + +```graphql +mutation upload($file: Upload!) { + upload(file: $file) +} +``` diff --git a/website/versioned_docs/version-8.0.0/fine-grained-security.mdx b/website/versioned_docs/version-8.0.0/fine-grained-security.mdx new file mode 100644 index 0000000000..3fac998ff4 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/fine-grained-security.mdx @@ -0,0 +1,179 @@ +--- +id: fine-grained-security +title: Fine grained security +sidebar_label: Fine grained security +--- + + +If the [`#[Logged]` and `#[Right]` attributes](authentication-authorization.mdx#logged-and-right-annotations) are not +granular enough for your needs, you can use the advanced `#[Security]` attribute. + +Using the `#[Security]` attribute, you can write an *expression* that can contain custom logic. For instance: + +- Check that a user can access a given resource +- Check that a user has one right or another right +- ... + +## Using the #[Security] attribute + +The `#[Security]` attribute is very flexible: it allows you to pass an expression that can contains custom logic: + +```php +use TheCodingMachine\GraphQLite\Annotations\Security; + +// ... + +#[Query] +#[Security("is_granted('ROLE_ADMIN') or is_granted('POST_SHOW', post)")] +public function getPost(Post $post): array +{ + // ... +} +``` + +The *expression* defined in the `#[Security]` attribute must conform to [Symfony's Expression Language syntax](https://symfony.com/doc/4.4/components/expression_language/syntax.html) + +
+ If you are a Symfony user, you might already be used to the #[Security] attribute. Most of the inspiration + of this attribute comes from Symfony. Warning though! GraphQLite's #[Security] attribute and + Symfony's #[Security] attribute are slightly different. Especially, the two attributes do not live + in the same namespace! +
+ +## The `is_granted` function + +Use the `is_granted` function to check if a user has a special right. + +```php +#[Security("is_granted('ROLE_ADMIN')")] +``` + +is similar to + +```php +#[Right("ROLE_ADMIN")] +``` + +In addition, the `is_granted` function accepts a second optional parameter: the "scope" of the right. + +```php +#[Query] +#[Security("is_granted('POST_SHOW', post)")] +public function getPost(Post $post): array +{ + // ... +} +``` + +In the example above, the `getPost` method can be called only if the logged user has the 'POST_SHOW' permission on the +`$post` object. You can notice that the `$post` object comes from the parameters. + +## Accessing method parameters + +All parameters passed to the method can be accessed in the `#[Security]` expression. + +```php +#[Query] +#[Security(expression: "startDate < endDate", statusCode: 400, message: "End date must be after start date")] +public function getPosts(DateTimeImmutable $startDate, DateTimeImmutable $endDate): array +{ + // ... +} +``` + +In the example above, we tweak a bit the Security attribute purpose to do simple input validation. + +## Setting HTTP code and error message + +You can use the `statusCode` and `message` attributes to set the HTTP code and GraphQL error message. + +```php +#[Query] +#[Security(expression: "is_granted('POST_SHOW', post)", statusCode: 404, message: "Post not found (let's pretend the post does not exists!)")] +public function getPost(Post $post): array +{ + // ... +} +``` + +Note: since a single GraphQL call contain many errors, 2 errors might have conflicting HTTP status code. +The resulting status code is up to the GraphQL middleware you use. Most of the time, the status code with the +higher error code will be returned. + +## Setting a default value + +If you do not want an error to be thrown when the security condition is not met, you can use the `failWith` attribute +to set a default value. + +```php +#[Query] +#[Security(expression: "is_granted('CAN_SEE_MARGIN', this)", failWith: null)] +public function getMargin(): float +{ + // ... +} +``` + +The `failWith` attribute behaves just like the [`#[FailWith]` attribute](authentication-authorization.mdx#not-throwing-errors) +but for a given `#[Security]` attribute. + +You cannot use the `failWith` attribute along `statusCode` or `message` attributes. + +## Accessing the user + +You can use the `user` variable to access the currently logged user. +You can use the `is_logged()` function to check if a user is logged or not. + + +```php +#[Query] +#[Security("is_logged() && user.age > 18")] +public function getNSFWImages(): array +{ + // ... +} +``` + +## Accessing the current object + +You can use the `this` variable to access any (public) property / method of the current class. + +```php +class Post { + #[Field] + #[Security("this.canAccessBody(user)")] + public function getBody(): array + { + // ... + } + + public function canAccessBody(User $user): bool + { + // Some custom logic here + } +} +``` + +## Available scope + +The `#[Security]` attribute can be used in any query, mutation or field, so anywhere you have a `#[Query]`, `#[Mutation]` +or `#[Field]` attribute. + +## How to restrict access to a given resource + +The `is_granted` method can be used to restrict access to a specific resource. + +```php +#[Security("is_granted('POST_SHOW', post)")] +``` + +If you are wondering how to configure these fine-grained permissions, this is not something that GraphQLite handles +itself. Instead, this depends on the framework you are using. + +If you are using Symfony, you will [create a custom voter](https://symfony.com/doc/current/security/voters.html). + +If you are using Laravel, you will [create a Gate or a Policy](https://laravel.com/docs/6.x/authorization). + +If you are using another framework, you need to know that the `is_granted` function simply forwards the call to +the `isAllowed` method of the configured `AuthorizationSerice`. See [Connecting GraphQLite to your framework's security module +](implementing-security.md) for more details diff --git a/website/versioned_docs/version-8.0.0/getting-started.md b/website/versioned_docs/version-8.0.0/getting-started.md new file mode 100644 index 0000000000..4eadcfa3fe --- /dev/null +++ b/website/versioned_docs/version-8.0.0/getting-started.md @@ -0,0 +1,16 @@ +--- +id: getting-started +title: Getting started +sidebar_label: Getting Started +--- + +GraphQLite is a framework agnostic library. You can use it in any PHP project as long as you know how to +inject services in your favorite framework's container. + +Currently, we provide bundle/packages to help you get started with Symfony, Laravel and any framework compatible +with container-interop/service-provider. + +- [Get started with Symfony](symfony-bundle.md) +- [Get started with Laravel](laravel-package.md) +- [Get started with a framework compatible with container-interop/service-provider](universal-service-providers.md) +- [Get started with another framework (or no framework)](other-frameworks.mdx) diff --git a/website/versioned_docs/version-8.0.0/implementing-security.md b/website/versioned_docs/version-8.0.0/implementing-security.md new file mode 100644 index 0000000000..88bbd8f7f2 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/implementing-security.md @@ -0,0 +1,57 @@ +--- +id: implementing-security +title: Connecting GraphQLite to your framework's security module +sidebar_label: Connecting security to your framework +--- + +
+ At the time of writing, the Symfony Bundle and the Laravel package handle this implementation. For the latest documentation, please see their respective Github repositories. +
+ +GraphQLite needs to know if a user is logged or not, and what rights it has. +But this is specific of the framework you use. + +To plug GraphQLite to your framework's security mechanism, you will have to provide two classes implementing: + +* `TheCodingMachine\GraphQLite\Security\AuthenticationServiceInterface` +* `TheCodingMachine\GraphQLite\Security\AuthorizationServiceInterface` + +Those two interfaces act as adapters between GraphQLite and your framework: + +```php +interface AuthenticationServiceInterface +{ + /** + * Returns true if the "current" user is logged + */ + public function isLogged(): bool; + + /** + * Returns an object representing the current logged user. + * Can return null if the user is not logged. + */ + public function getUser(): ?object; +} +``` + +```php +interface AuthorizationServiceInterface +{ + /** + * Returns true if the "current" user has access to the right "$right" + * + * @param mixed $subject The scope this right applies on. $subject is typically an object or a FQCN. Set $subject to "null" if the right is global. + */ + public function isAllowed(string $right, $subject = null): bool; +} +``` + +You need to write classes that implement these interfaces. Then, you must register those classes with GraphQLite. +It you are [using the `SchemaFactory`](other-frameworks.mdx), you can register your classes using: + +```php +// Configure an authentication service (to resolve the #[Logged] attribute). +$schemaFactory->setAuthenticationService($myAuthenticationService); +// Configure an authorization service (to resolve the #[Right] attribute). +$schemaFactory->setAuthorizationService($myAuthorizationService); +``` diff --git a/website/versioned_docs/version-8.0.0/inheritance-interfaces.mdx b/website/versioned_docs/version-8.0.0/inheritance-interfaces.mdx new file mode 100644 index 0000000000..5467492c52 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/inheritance-interfaces.mdx @@ -0,0 +1,162 @@ +--- +id: inheritance-interfaces +title: Inheritance and interfaces +sidebar_label: Inheritance and interfaces +--- + +## Modeling inheritance + +Some of your entities may extend other entities. GraphQLite will do its best to represent this hierarchy of objects in GraphQL using interfaces. + +Let's say you have two classes, `Contact` and `User` (which extends `Contact`): + +```php +#[Type] +class Contact +{ + // ... +} + +#[Type] +class User extends Contact +{ + // ... +} +``` + +Now, let's assume you have a query that returns a contact: + +```php +class ContactController +{ + #[Query] + public function getContact(): Contact + { + // ... + } +} +``` + +When writing your GraphQL query, you are able to use fragments to retrieve fields from the `User` type: + +```graphql +contact { + name + ... User { + email + } +} +``` + +Written in [GraphQL type language](https://graphql.org/learn/schema/#type-language), the representation of types +would look like this: + +```graphql +interface ContactInterface { + // List of fields declared in Contact class +} + +type Contact implements ContactInterface { + // List of fields declared in Contact class +} + +type User implements ContactInterface { + // List of fields declared in Contact and User classes +} +``` + +Behind the scene, GraphQLite will detect that the `Contact` class is extended by the `User` class. +Because the class is extended, a GraphQL `ContactInterface` interface is created dynamically. + +The GraphQL `User` type will also automatically implement this `ContactInterface`. The interface contains all the fields +available in the `Contact` type. + +## Mapping interfaces + +If you want to create a pure GraphQL interface, you can also add a `#[Type]` attribute on a PHP interface. + +```php +#[Type] +interface UserInterface +{ + #[Field] + public function getUserName(): string; +} +``` + +This will automatically create a GraphQL interface whose description is: + +```graphql +interface UserInterface { + userName: String! +} +``` + +### Implementing interfaces + +You don't have to do anything special to implement an interface in your GraphQL types. +Simply "implement" the interface in PHP and you are done! + +```php +#[Type] +class User implements UserInterface +{ + public function getUserName(): string; +} +``` + +This will translate in GraphQL schema as: + +```graphql +interface UserInterface { + userName: String! +} + +type User implements UserInterface { + userName: String! +} +``` + +Please note that you do not need to put the `#[Field]` attribute again in the implementing class. + +### Interfaces without an explicit implementing type + +You don't have to explicitly put a `#[Type]` attribute on the class implementing the interface (though this +is usually a good idea). + +```php +/** + * Look, this class has no #Type attribute + */ +class User implements UserInterface +{ + public function getUserName(): string; +} +``` + +```php +class UserController +{ + #[Query] + public function getUser(): UserInterface // This will work! + { + // ... + } +} +``` + +
If GraphQLite cannot find a proper GraphQL Object type implementing an interface, it +will create an object type "on the fly".
+ +In the example above, because the `User` class has no `#[Type]` attribute, GraphQLite will +create a `UserImpl` type that implements `UserInterface`. + +```graphql +interface UserInterface { + userName: String! +} + +type UserImpl implements UserInterface { + userName: String! +} +``` diff --git a/website/versioned_docs/version-8.0.0/input-types.mdx b/website/versioned_docs/version-8.0.0/input-types.mdx new file mode 100644 index 0000000000..9b5be40278 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/input-types.mdx @@ -0,0 +1,333 @@ +--- +id: input-types +title: Input types +sidebar_label: Input types +--- + +Let's assume you are developing an API that returns a list of cities around a location. + +Your GraphQL query might look like this: + +```php +class MyController +{ + /** + * @return City[] + */ + #[Query] + public function getCities(Location $location, float $radius): array + { + // Some code that returns an array of cities. + } +} + +// Class Location is a simple value-object. +class Location +{ + private $latitude; + private $longitude; + + public function __construct(float $latitude, float $longitude) + { + $this->latitude = $latitude; + $this->longitude = $longitude; + } + + public function getLatitude(): float + { + return $this->latitude; + } + + public function getLongitude(): float + { + return $this->longitude; + } +} +``` + +If you try to run this code, you will get the following error: + +``` +CannotMapTypeException: cannot map class "Location" to a known GraphQL input type. Check your TypeMapper configuration. +``` + +You are running into this error because GraphQLite does not know how to handle the `Location` object. + +In GraphQL, an object passed in parameter of a query or mutation (or any field) is called an **Input Type**. + +There are two ways for declaring that type, in GraphQLite: using the [`#[Input]` attribute](#input-attribute) or a [Factory method](#factory). + +## #\[Input\] Attribute + +Using the `#[Input]` attribute, we can transform the `Location` class, in the example above, into an input type. Just add the `#[Field]` attribute to the corresponding properties: + +```php +#[Input] +class Location +{ + + #[Field] + private ?string $name = null; + + #[Field] + private float $latitude; + + #[Field] + private float $longitude; + + public function __construct(float $latitude, float $longitude) + { + $this->latitude = $latitude; + $this->longitude = $longitude; + } + + public function setName(string $name): void + { + $this->name = $name; + } + + public function getLatitude(): float + { + return $this->latitude; + } + + public function getLongitude(): float + { + return $this->longitude; + } +} +``` + +Now if you call the `getCities` query, from the controller in the first example, the `Location` object will be automatically instantiated with the user provided, `latitude` / `longitude` properties, and passed to the controller as a parameter. + +There are some important things to notice: + +- The `#[Field]` attribute is recognized on properties for Input Type, as well as setters. +- There are 3 ways for fields to be resolved: + - Via constructor if corresponding properties are mentioned as parameters with the same names - exactly as in the example above. + - If properties are public, they will be just set without any additional effort - no constructor required. + - For private or protected properties implemented, a public setter is required (if they are not set via the constructor). For example `setLatitude(float $latitude)`. You can also put the `#[Field]` attribute on the setter, instead of the property, allowing you to have use many other attributes (`Security`, `Right`, `Autowire`, etc.). +- For validation of these Input Types, see the [Custom InputType Validation section](validation#custom-inputtype-validation). +- It's advised to use the `#[Input]` attribute on DTO style input type objects and not directly on your model objects. Using it on your model objects can cause coupling in undesirable ways. + +### Multiple Input Types from the same class + +Simple usage of the `#[Input]` attribute on a class creates a GraphQL input named by class name + "Input" suffix if a class name does not end with it already. Ex. `LocationInput` for `Location` class. + +You can add multiple `#[Input]` attributed to the same class, give them different names and link different fields. +Consider the following example: + +```php +#[Input(name: 'CreateUserInput', default: true)] +#[Input(name: 'UpdateUserInput', update: true)] +class UserInput +{ + + #[Field] + public string $username; + + #[Field(for: 'CreateUserInput')] + public string $email; + + #[Field(for: 'CreateUserInput', inputType: 'String!')] + #[Field(for: 'UpdateUserInput', inputType: 'String')] + public string $password; + + protected ?int $age; + + + #[Field] + public function setAge(?int $age): void + { + $this->age = $age; + } +} +``` + +There are 2 input types added to the `UserInput` class: `CreateUserInput` and `UpdateUserInput`. A few notes: +- `CreateUserInput` input will be used by default for this class. +- Field `username` is created for both input types, and it is required because the property type is not nullable. +- Field `email` will appear only for `CreateUserInput` input. +- Field `password` will appear for both. For `CreateUserInput` it'll be the required field and for `UpdateUserInput` optional. +- Field `age` is optional for both input types. + +Note that `update: true` argument for `UpdateUserInput`. It should be used when input type is used for a partial update, +It makes all fields optional and removes all default values from thus prevents setting default values via setters or directly to public properties. +In example above if you use the class as `UpdateUserInput` and set only `username` the other ones will be ignored. +In PHP 7 they will be set to `null`, while in PHP 8 they will be in not initialized state - this can be used as a trick +to check if user actually passed a value for a certain field. + +## Factory + +A **Factory** is a method that takes in parameter all the fields of the input type and return an object. + +Here is an example of factory: + +```php +class MyFactory +{ + /** + * The Factory attribute will create automatically a LocationInput input type in GraphQL. + */ + #[Factory] + public function createLocation(float $latitude, float $longitude): Location + { + return new Location($latitude, $longitude); + } +} +``` + +and now, you can run query like this: + +```graphql +query { + getCities(location: { + latitude: 45.0, + longitude: 0.0, + }, + radius: 42) + { + id, + name + } +} +``` + +- Factories must be declared with the **#[Factory]** attribute. +- The parameters of the factories are the field of the GraphQL input type + +A few important things to notice: + +- The container MUST contain the factory class. The identifier of the factory MUST be the fully qualified class name of the class that contains the factory. + This is usually already the case if you are using a container with auto-wiring capabilities +- We recommend that you put the factories in the same directories as the types. + +### Specifying the input type name + +The GraphQL input type name is derived from the return type of the factory. + +Given the factory below, the return type is "Location", therefore, the GraphQL input type will be named "LocationInput". + +```php +#[Factory] +public function createLocation(float $latitude, float $longitude): Location +{ + return new Location($latitude, $longitude); +} +``` + +In case you want to override the input type name, you can use the "name" attribute of the #[Factory] attribute: + +```php +#[Factory(name: 'MyNewInputName', default: true)] +``` + +Note that you need to add the "default" attribute is you want your factory to be used by default (more on this in +the next chapter). + +Unless you want to have several factories for the same PHP class, the input type name will be completely transparent +to you, so there is no real reason to customize it. + +### Forcing an input type + +You can use the `#[UseInputType]` attribute to force an input type of a parameter. + +Let's say you want to force a parameter to be of type "ID", you can use this: + +```php +#[Factory] +#[UseInputType(for: "$id", inputType:"ID!")] +public function getProductById(string $id): Product +{ + return $this->productRepository->findById($id); +} +``` + +### Declaring several input types for the same PHP class +Available in GraphQLite 4.0+ + +There are situations where a given PHP class might use one factory or another depending on the context. + +This is often the case when your objects map database entities. +In these cases, you can use combine the use of `#[UseInputType]` and `#[Factory]` attribute to achieve your goal. + +Here is an annotated sample: + +```php +/** + * This class contains 2 factories to create Product objects. + * The "getProduct" method is used by default to map "Product" classes. + * The "createProduct" method will generate another input type named "CreateProductInput" + */ +class ProductFactory +{ + // ... + + /** + * This factory will be used by default to map "Product" classes. + */ + #[Factory(name: "ProductRefInput", default: true)] + public function getProduct(string $id): Product + { + return $this->productRepository->findById($id); + } + /** + * We specify a name for this input type explicitly. + */ + #[Factory(name: "CreateProductInput", default: false)] + public function createProduct(string $name, string $type): Product + { + return new Product($name, $type); + } +} + +class ProductController +{ + /** + * The "createProduct" factory will be used for this mutation. + */ + #[Mutation] + #[UseInputType(for: "$product", inputType: "CreateProductInput!")] + public function saveProduct(Product $product): Product + { + // ... + } + + /** + * The default "getProduct" factory will be used for this query. + * + * @return Color[] + */ + #[Query] + public function availableColors(Product $product): array + { + // ... + } +} +``` + +### Ignoring some parameters +Available in GraphQLite 4.0+ + +GraphQLite will automatically map all your parameters to an input type. +But sometimes, you might want to avoid exposing some of those parameters. + +Image your `getProductById` has an additional `lazyLoad` parameter. This parameter is interesting when you call +directly the function in PHP because you can have some level of optimisation on your code. But it is not something that +you want to expose in the GraphQL API. Let's hide it! + +```php +#[Factory] +public function getProductById( + string $id, + #[HideParameter] + bool $lazyLoad = true + ): Product +{ + return $this->productRepository->findById($id, $lazyLoad); +} +``` + +With the `#[HideParameter]` attribute, you can choose to remove from the GraphQL schema any argument. + +To be able to hide an argument, the argument must have a default value. diff --git a/website/versioned_docs/version-8.0.0/internals.md b/website/versioned_docs/version-8.0.0/internals.md new file mode 100644 index 0000000000..93c7e958b8 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/internals.md @@ -0,0 +1,142 @@ +--- +id: internals +title: Internals +sidebar_label: Internals +--- + +## Mapping types + +The core of GraphQLite is its ability to map PHP types to GraphQL types. This mapping is performed by a series of +"type mappers". + +GraphQLite contains 4 categories of type mappers: + +- **Parameter mappers** +- **Root type mappers** +- **Recursive (class) type mappers** +- **(class) type mappers** + +```mermaid +graph TD; + classDef custom fill:#cfc,stroke:#7a7,stroke-width:2px,stroke-dasharray: 5, 5; + subgraph RootTypeMapperInterface + NullableTypeMapperAdapter-->CompoundTypeMapper + IteratorTypeMapper-->YourCustomRootTypeMapper + CompoundTypeMapper-->IteratorTypeMapper + YourCustomRootTypeMapper-->MyCLabsEnumTypeMapper + MyCLabsEnumTypeMapper-->EnumTypeMapper + EnumTypeMapper-->BaseTypeMapper + BaseTypeMapper-->FinalRootTypeMapper + end + subgraph RecursiveTypeMapperInterface + BaseTypeMapper-->RecursiveTypeMapper + end + subgraph TypeMapperInterface + RecursiveTypeMapper-->YourCustomTypeMapper + YourCustomTypeMapper-->PorpaginasTypeMapper + PorpaginasTypeMapper-->GlobTypeMapper + end + class YourCustomRootTypeMapper,YourCustomTypeMapper custom; +``` + +## Root type mappers + +(Classes implementing the [`RootTypeMapperInterface`](https://github.com/thecodingmachine/graphqlite/blob/master/src/Mappers/Root/RootTypeMapperInterface.php)) + +These type mappers are the first type mappers called. + +They are responsible for: + +- mapping scalar types (for instance mapping the "int" PHP type to GraphQL Integer type) +- detecting nullable/non-nullable types (for instance interpreting "?int" or "int|null") +- mapping list types (mapping a PHP array to a GraphQL list) +- mapping union types +- mapping enums + +Root type mappers have access to the *context* of a type: they can access the PHP DocBlock and read annotations. +If you want to write a custom type mapper that needs access to annotations, it needs to be a "root type mapper". + +GraphQLite provides 6 classes implementing `RootTypeMapperInterface`: + +- `NullableTypeMapperAdapter`: a type mapper in charge of making GraphQL types non-nullable if the PHP type is non-nullable +- `IteratorTypeMapper`: a type mapper in charge of iterable types (for instance: `MyIterator|User[]`) +- `CompoundTypeMapper`: a type mapper in charge of union types +- `MyCLabsEnumTypeMapper`: maps MyCLabs/enum types to GraphQL enum types (Deprecated: use native enums) +- `EnumTypeMapper`: maps PHP enums to GraphQL enum types +- `BaseTypeMapper`: maps scalar types and lists. Passes the control to the "recursive type mappers" if an object is encountered. +- `FinalRootTypeMapper`: the last type mapper of the chain, used to throw error if no other type mapper managed to handle the type. + +Type mappers are organized in a chain; each type-mapper is responsible for calling the next type mapper. + +```mermaid +graph TD; + classDef custom fill:#cfc,stroke:#7a7,stroke-width:2px,stroke-dasharray: 5, 5; + subgraph RootTypeMapperInterface + NullableTypeMapperAdapter-->CompoundTypeMapper + CompoundTypeMapper-->IteratorTypeMapper + IteratorTypeMapper-->YourCustomRootTypeMapper + YourCustomRootTypeMapper-->MyCLabsEnumTypeMapper + MyCLabsEnumTypeMapper-->EnumTypeMapper + EnumTypeMapper-->BaseTypeMapper + BaseTypeMapper-->FinalRootTypeMapper + end + class YourCustomRootTypeMapper custom; +``` + +## Class type mappers + +(Classes implementing the [`TypeMapperInterface`](https://github.com/thecodingmachine/graphqlite/blob/master/src/Mappers/TypeMapperInterface.php)) + +Class type mappers are mapping PHP classes to GraphQL object types. + +GraphQLite provide 3 default implementations: + +- `CompositeTypeMapper`: a type mapper that delegates mapping to other type mappers using the Composite Design Pattern. +- `GlobTypeMapper`: scans classes in a directory for the `#[Type]` or `#[ExtendType]` attribute and maps those to GraphQL types +- `PorpaginasTypeMapper`: maps and class implementing the Porpaginas `Result` interface to a [special paginated type](pagination.mdx). + +### Registering a type mapper in Symfony + +If you are using the GraphQLite Symfony bundle, you can register a type mapper by tagging the service with the "graphql.type_mapper" tag. + +### Registering a type mapper using the SchemaFactory + +If you are using the `SchemaFactory` to bootstrap GraphQLite, you can register a type mapper using the `SchemaFactory::addTypeMapper` method. + +## Recursive type mappers + +(Classes implementing the [`RecursiveTypeMapperInterface`](https://github.com/thecodingmachine/graphqlite/blob/master/src/Mappers/RecursiveTypeMapperInterface.php)) + +There is only one implementation of the `RecursiveTypeMapperInterface`: the `RecursiveTypeMapper`. + +Standard "class type mappers" are mapping a given PHP class to a GraphQL type. But they do not handle class hierarchies. +This is the role of the "recursive type mapper". + +Imagine that class "B" extends class "A" and class "A" maps to GraphQL type "AType". + +Since "B" *is a* "A", the "recursive type mapper" role is to make sure that "B" will also map to GraphQL type "AType". + +## Parameter mapper middlewares + +"Parameter middlewares" are used to decide what argument should be injected into a parameter. + +Let's have a look at a simple query: + +```php +/** + * @return Product[] + */ +#[Query] +public function products(ResolveInfo $info): array +``` + +As you may know, [the `ResolveInfo` object injected in this query comes from Webonyx/GraphQL-PHP library](query-plan.mdx). +GraphQLite knows that is must inject a `ResolveInfo` instance because it comes with a [`ResolveInfoParameterHandler`](https://github.com/thecodingmachine/graphqlite/blob/master/src/Mappers/Parameters/ResolveInfoParameterHandler.php) class +that implements the [`ParameterMiddlewareInterface`](https://github.com/thecodingmachine/graphqlite/blob/master/src/Mappers/Parameters/ParameterMiddlewareInterface.php)). + +You can register your own parameter middlewares using the `SchemaFactory::addParameterMiddleware()` method, or by tagging the +service as "graphql.parameter_middleware" if you are using the Symfony bundle. + +
+ Use a parameter middleware if you want to inject an argument in a method and if this argument is not a GraphQL input type or if you want to alter the way input types are imported (for instance if you want to add a validation step) +
diff --git a/website/versioned_docs/version-8.0.0/laravel-package-advanced.mdx b/website/versioned_docs/version-8.0.0/laravel-package-advanced.mdx new file mode 100644 index 0000000000..3341538023 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/laravel-package-advanced.mdx @@ -0,0 +1,221 @@ +--- +id: laravel-package-advanced +title: "Laravel package: advanced usage" +sidebar_label: Laravel specific features +--- + +
+ Be advised! This documentation will be removed in a future release. For current and up-to-date Laravel extension specific documentation, please see the Github repository. +
+ +The Laravel package comes with a number of features to ease the integration of GraphQLite in Laravel. + +## Support for Laravel validation rules + +The GraphQLite Laravel package comes with a special `#[Validate]` attribute to use Laravel validation rules in your +input types. + +```php +use TheCodingMachine\GraphQLite\Laravel\Annotations\Validate; + +class MyController +{ + #[Mutation] + public function createUser( + #[Validate("email|unique:users")] + string $email, + #[Validate("gte:8")] + string $password + ): User + { + // ... + } +} +``` + +You can use the `#[Validate]` attribute in any query / mutation / field / factory / decorator. + +If a validation fails to pass, the message will be printed in the "errors" section and you will get a HTTP 400 status code: + +```json +{ + "errors": [ + { + "message": "The email must be a valid email address.", + "extensions": { + "argument": "email" + } + }, + { + "message": "The password must be greater than or equal 8 characters.", + "extensions": { + "argument": "password" + } + } + ] +} +``` + +You can use any validation rule described in [the Laravel documentation](https://laravel.com/docs/6.x/validation#available-validation-rules) + +## Support for pagination + +In your query, if you explicitly return an object that extends the `Illuminate\Pagination\LengthAwarePaginator` class, +the query result will be wrapped in a "paginator" type. + +```php +class MyController +{ + /** + * @return Product[] + */ + #[Query] + public function products(): Illuminate\Pagination\LengthAwarePaginator + { + return Product::paginate(15); + } +} +``` + +Notice that: + +- the method return type MUST BE `Illuminate\Pagination\LengthAwarePaginator` or a class extending `Illuminate\Pagination\LengthAwarePaginator` +- you MUST add a `@return` statement to help GraphQLite find the type of the list + +Once this is done, you can get plenty of useful information about this page: + +```graphql +products { + items { # The items for the selected page + id + name + } + totalCount # The total count of items. + lastPage # Get the page number of the last available page. + firstItem # Get the "index" of the first item being paginated. + lastItem # Get the "index" of the last item being paginated. + hasMorePages # Determine if there are more items in the data source. + perPage # Get the number of items shown per page. + hasPages # Determine if there are enough items to split into multiple pages. + currentPage # Determine the current page being paginated. + isEmpty # Determine if the list of items is empty or not. + isNotEmpty # Determine if the list of items is not empty. +} +``` + + +
+ Be sure to type hint on the class (Illuminate\Pagination\LengthAwarePaginator) and not on the interface (Illuminate\Contracts\Pagination\LengthAwarePaginator). The interface itself is not iterable (it does not extend Traversable) and therefore, GraphQLite will refuse to iterate over it. +
+ +### Simple paginator + +Note: if you are using `simplePaginate` instead of `paginate`, you can type hint on the `Illuminate\Pagination\Paginator` class. + +```php +class MyController +{ + /** + * @return Product[] + */ + #[Query] + public function products(): Illuminate\Pagination\Paginator + { + return Product::simplePaginate(15); + } +} +``` + +The behaviour will be exactly the same except you will be missing the `totalCount` and `lastPage` fields. + +## Using GraphQLite with Eloquent efficiently + +In GraphQLite, you are supposed to put a `#[Field]` attribute on each getter. + +Eloquent uses PHP magic properties to expose your database records. +Because Eloquent relies on magic properties, it is quite rare for an Eloquent model to have proper getters and setters. + +So we need to find a workaround. GraphQLite comes with a `#[MagicField]` attribute to help you +working with magic properties. + +```php +#[Type] +#[MagicField(name: "id", outputType: "ID!")] +#[MagicField(name: "name", phpType: "string")] +#[MagicField(name: "categories", phpType: "Category[]")] +class Product extends Model +{ +} +``` + +Please note that since the properties are "magic", they don't have a type. Therefore, +you need to pass either the "outputType" attribute with the GraphQL type matching the property, +or the "phpType" attribute with the PHP type matching the property. + +### Pitfalls to avoid with Eloquent + +When designing relationships in Eloquent, you write a method to expose that relationship this way: + +```php +class User extends Model +{ + /** + * Get the phone record associated with the user. + */ + public function phone() + { + return $this->hasOne('App\Phone'); + } +} +``` + +It would be tempting to put a `#[Field]` attribute on the `phone()` method, but this will not work. Indeed, +the `phone()` method does not return a `App\Phone` object. It is the `phone` magic property that returns it. + +In short: + +
+ This does not work: + +```php +class User extends Model +{ + + #[Field] + public function phone() + { + return $this->hasOne('App\Phone'); + } +} +``` + +
+ +
+ This works: + +```php +#[MagicField(name: "phone", phpType:"App\\Phone")] +class User extends Model +{ + public function phone() + { + return $this->hasOne('App\Phone'); + } +} +``` + +
+ +## Export the schema from the CLI + +The extension comes with a special command: `graphqlite:export-schema`. + +Usage: + +```console +$ ./artisan graphqlite:export-schema --output=schema.graphql +``` + +This will export your GraphQL schema in SDL format. You can use this exported schema to import it in other +tools (like graphql-codegen). \ No newline at end of file diff --git a/website/versioned_docs/version-8.0.0/laravel-package.md b/website/versioned_docs/version-8.0.0/laravel-package.md new file mode 100644 index 0000000000..d7014c2bcc --- /dev/null +++ b/website/versioned_docs/version-8.0.0/laravel-package.md @@ -0,0 +1,153 @@ +--- +id: laravel-package +title: Getting started with Laravel +sidebar_label: Laravel package +--- + +
+ Be advised! This documentation will be removed in a future release. For current and up-to-date Laravel extension specific documentation, please see the Github repository. +
+ +The GraphQLite-Laravel package is compatible with **Laravel 5.7+**, **Laravel 6.x** and **Laravel 7.x**. + +## Installation + +Open a terminal in your current project directory and run: + +```console +$ composer require thecodingmachine/graphqlite-laravel +``` + +If you want to publish the configuration (in order to edit it), run: + +```console +$ php artisan vendor:publish --provider="TheCodingMachine\GraphQLite\Laravel\Providers\GraphQLiteServiceProvider" +``` + +You can then configure the library by editing `config/graphqlite.php`. + +```php title="config/graphqlite.php" + 'App\\Http\\Controllers', + 'types' => 'App\\', + 'debug' => Debug::RETHROW_UNSAFE_EXCEPTIONS, + 'uri' => env('GRAPHQLITE_URI', '/graphql'), + 'middleware' => ['web'], + 'guard' => ['web'], +]; +``` + +The debug parameters are detailed in the [documentation of the Webonyx GraphQL library](https://webonyx.github.io/graphql-php/error-handling/) +which is used internally by GraphQLite. + +## Configuring CSRF protection + +
By default, the /graphql route is placed under web middleware group which requires a +CSRF token.
+ +You have 3 options: + +- Use the `api` middleware +- Disable CSRF for GraphQL routes +- or configure your GraphQL client to pass the `X-CSRF-TOKEN` with every GraphQL query + +### Use the `api` middleware + +If you plan to use graphql for server-to-server connection only, you should probably configure GraphQLite to use the +`api` middleware instead of the `web` middleware: + +```php title="config/graphqlite.php" + ['api'], + 'guard' => ['api'], +]; +``` + +### Disable CSRF for the /graphql route + +If you plan to use graphql from web browsers and if you want to explicitly allow access from external applications +(through CORS headers), you need to disable the CSRF token. + +Simply add `graphql` to `$except` in `app/Http/Middleware/VerifyCsrfToken.php`. + +### Configuring your GraphQL client + +If you are planning to use `graphql` only from your website domain, then the safest way is to keep CSRF enabled and +configure your GraphQL JS client to pass the CSRF headers on any graphql request. + +The way you do this depends on the Javascript GraphQL client you are using. + +Assuming you are using [Apollo](https://www.apollographql.com/docs/link/links/http/), you need to be sure that Apollo passes the token +back to Laravel on every request. + +```js title="Sample Apollo client setup with CSRF support" +import { ApolloClient, ApolloLink, InMemoryCache, HttpLink } from 'apollo-boost'; + +const httpLink = new HttpLink({ uri: 'https://api.example.com/graphql' }); + +const authLink = new ApolloLink((operation, forward) => { + // Retrieve the authorization token from local storage. + const token = localStorage.getItem('auth_token'); + + // Get the XSRF-TOKEN that is set by Laravel on each request + var cookieValue = document.cookie.replace(/(?:(?:^|.*;\s*)XSRF-TOKEN\s*\=\s*([^;]*).*$)|^.*$/, "$1"); + + // Use the setContext method to set the X-CSRF-TOKEN header back. + operation.setContext({ + headers: { + 'X-CSRF-TOKEN': cookieValue + } + }); + + // Call the next link in the middleware chain. + return forward(operation); +}); + +const client = new ApolloClient({ + link: authLink.concat(httpLink), // Chain it with the HttpLink + cache: new InMemoryCache() +}); +``` + +## Adding GraphQL DevTools + +GraphQLite does not include additional GraphQL tooling, such as the GraphiQL editor. +To integrate a web UI to query your GraphQL endpoint with your Laravel installation, +we recommend installing [GraphQL Playground](https://github.com/mll-lab/laravel-graphql-playground) + +```console +$ composer require mll-lab/laravel-graphql-playground +``` + +By default, the playground will be available at `/graphql-playground`. + +Or you can install [Altair GraphQL Client](https://github.com/XKojiMedia/laravel-altair-graphql) + +```console +$ composer require xkojimedia/laravel-altair-graphql +``` + +You can also use any external client with GraphQLite, make sure to point it to the URL defined in the config (`'/graphql'` by default). + +## Troubleshooting HTTP 419 errors + +If HTTP requests to GraphQL endpoint generate responses with the HTTP 419 status code, you have an issue with the configuration of your +CSRF token. Please check again [the paragraph dedicated to CSRF configuration](#configuring-csrf-protection). diff --git a/website/versioned_docs/version-8.0.0/migrating.md b/website/versioned_docs/version-8.0.0/migrating.md new file mode 100644 index 0000000000..2753878265 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/migrating.md @@ -0,0 +1,54 @@ +--- +id: migrating +title: Migrating +sidebar_label: Migrating +--- + +## Migrating from v4.0 to v4.1 + +GraphQLite follows Semantic Versioning. GraphQLite 4.1 is backward compatible with GraphQLite 4.0. See +[semantic versioning](semver.md) for more details. + +There is one exception though: the **ecodev/graphql-upload** package (used to get support for file uploads in GraphQL +input types) is now a "recommended" dependency only. +If you are using GraphQL file uploads, you need to add `ecodev/graphql-upload` to your `composer.json` by running this command: + +```console +$ composer require ecodev/graphql-upload +``` + +## Migrating from v3.0 to v4.0 + +If you are a "regular" GraphQLite user, migration to v4 should be straightforward: + +- Annotations are mostly untouched. The only annotation that is changed is the `#[SourceField]` annotation. + - Check your code for every places where you use the `#[SourceField]` annotation: + - The "id" attribute has been remove (`@SourceField(id=true)`). Instead, use `@SourceField(outputType="ID")` + - The "logged", "right" and "failWith" attributes have been removed (`@SourceField(logged=true)`). + Instead, use the annotations attribute with the same annotations you use for the `#[Field]` annotation: + `@SourceField(annotations={@Logged, @FailWith(null)})` + - If you use magic property and were creating a getter for every magic property (to put a `#[Field]` annotation on it), + you can now replace this getter with a `#[MagicField]` annotation. +- In GraphQLite v3, the default was to hide a field from the schema if a user has no access to it. + In GraphQLite v4, the default is to still show this field, but to throw an error if the user makes a query on it + (this way, the schema is the same for all users). If you want the old mode, use the new + [`@HideIfUnauthorized` annotation](annotations-reference.md#hideifunauthorized-annotation) +- If you are using the Symfony bundle, the Laravel package or the Universal module, you must also upgrade those to 4.0. + These package will take care of the wiring for you. Apart for upgrading the packages, you have nothing to do. +- If you are relying on the `SchemaFactory` to bootstrap GraphQLite, you have nothing to do. + +On the other hand, if you are a power user and if you are wiring GraphQLite services yourself (without using the +`SchemaFactory`) or if you implemented custom "TypeMappers", you will need to adapt your code: + +- The `FieldsBuilderFactory` is gone. Directly instantiate `FieldsBuilder` in v4. +- The `CompositeTypeMapper` class has no more constructor arguments. Use the `addTypeMapper` method to register + type mappers in it. +- The `FieldsBuilder` now accept an extra argument: the `RootTypeMapper` that you need to instantiate accordingly. Take + a look at the `SchemaFactory` class for an example of proper configuration. +- The `HydratorInterface` and all implementations are gone. When returning an input object from a TypeMapper, the object + must now implement the `ResolvableMutableInputInterface` (an input object type that contains its own resolver) + +Note: we strongly recommend to use the Symfony bundle, the Laravel package, the Universal module or the SchemaManager +to bootstrap GraphQLite. Wiring directly GraphQLite classes (like the `FieldsBuilder`) into your container is not recommended, +as the signature of the constructor of those classes may vary from one minor release to another. +Use the `SchemaManager` instead. diff --git a/website/versioned_docs/version-8.0.0/multiple-output-types.mdx b/website/versioned_docs/version-8.0.0/multiple-output-types.mdx new file mode 100644 index 0000000000..2f0d5b1e8f --- /dev/null +++ b/website/versioned_docs/version-8.0.0/multiple-output-types.mdx @@ -0,0 +1,105 @@ +--- +id: multiple-output-types +title: Mapping multiple output types for the same class +sidebar_label: Class with multiple output types +--- + +Available in GraphQLite 4.0+ + +In most cases, you have one PHP class and you want to map it to one GraphQL output type. + +But in very specific cases, you may want to use different GraphQL output type for the same class. +For instance, depending on the context, you might want to prevent the user from accessing some fields of your object. + +To do so, you need to create 2 output types for the same PHP class. You typically do this using the "default" attribute of the `#[Type]` attribute. + +## Example + +Here is an example. Say we are manipulating products. When I query a `Product` details, I want to have access to all fields. +But for some reason, I don't want to expose the price field of a product if I query the list of all products. + +```php +#[Type] +class Product +{ + // ... + + #[Field] + public function getName(): string + { + return $this->name; + } + + #[Field] + public function getPrice(): ?float + { + return $this->price; + } +} +``` + +The `Product` class is declaring a classic GraphQL output type named "Product". + +```php +#[Type(class: Product::class, name: "LimitedProduct", default: false)] +#[SourceField(name: "name")] +class LimitedProductType +{ + // ... +} +``` + +The `LimitedProductType` also declares an ["external" type](external-type-declaration.mdx) mapping the `Product` class. +But pay special attention to the `#[Type]` attribute. + +First of all, we specify `name="LimitedProduct"`. This is useful to avoid having colliding names with the "Product" GraphQL output type +that is already declared. + +Then, we specify `default=false`. This means that by default, the `Product` class should not be mapped to the `LimitedProductType`. +This type will only be used when we explicitly request it. + +Finally, we can write our requests: + +```php +class ProductController +{ + /** + * This field will use the default type. + */ + #[Field] + public function getProduct(int $id): Product { /* ... */ } + + /** + * Because we use the "outputType" attribute, this field will use the other type. + * + * @return Product[] + */ + #[Field(outputType: "[LimitedProduct!]!")] + public function getProducts(): array { /* ... */ } +} +``` + +Notice how the "outputType" attribute is used in the `#[Field]` attribute to force the output type. + +Is a result, when the end user calls the `product` query, we will have the possibility to fetch the `name` and `price` fields, +but if he calls the `products` query, each product in the list will have a `name` field but no `price` field. We managed +to successfully expose a different set of fields based on the query context. + +## Extending a non-default type + +If you want to extend a type using the `#[ExtendType]` attribute and if this type is declared as non-default, +you need to target the type by name instead of by class. + +So instead of writing: + +```php +#[ExtendType(class: Product::class)] +``` + +you will write: + +```php +#[ExtendType(name: "LimitedProduct")] +``` + +Notice how we use the "name" attribute instead of the "class" attribute in the `#[ExtendType]` attribute. diff --git a/website/versioned_docs/version-8.0.0/mutations.mdx b/website/versioned_docs/version-8.0.0/mutations.mdx new file mode 100644 index 0000000000..614705e6f6 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/mutations.mdx @@ -0,0 +1,27 @@ +--- +id: mutations +title: Mutations +sidebar_label: Mutations +--- + +In GraphQLite, mutations are created [like queries](queries.mdx). + +To create a mutation, you must annotate a method in a controller with the `#[Mutation]` attribute. + +For instance: + +```php +namespace App\Controller; + +use TheCodingMachine\GraphQLite\Annotations\Mutation; + +class ProductController +{ + #[Mutation] + public function saveProduct(int $id, string $name, ?float $price = null): Product + { + // Some code that saves a product. + } +} +``` + diff --git a/website/versioned_docs/version-8.0.0/operation-complexity.md b/website/versioned_docs/version-8.0.0/operation-complexity.md new file mode 100644 index 0000000000..bf946721ee --- /dev/null +++ b/website/versioned_docs/version-8.0.0/operation-complexity.md @@ -0,0 +1,223 @@ +--- +id: operation-complexity +title: Operation complexity +sidebar_label: Operation complexity +--- + +At some point you may find yourself receiving queries with an insane amount of requested +fields or items, all at once. Usually, it's not a good thing, so you may want to somehow +limit the amount of requests or their individual complexity. + +## Query depth + +The simplest way to limit complexity is to limit the max query depth. `webonyx/graphql-php`, +which GraphQLite relies on, [has this built in](https://webonyx.github.io/graphql-php/security/#limiting-query-depth). +To use it, you may use `addValidationRule` when building your PSR15 middleware: + +```php +$builder = new Psr15GraphQLMiddlewareBuilder($schema); + +$builder->addValidationRule(new \GraphQL\Validator\Rules\QueryDepth(7)); +``` + +Although this works for simple cases, this doesn't prevent requesting an excessive amount +of fields on the depth of under 7, nor does it prevent requesting too many nodes in paginated lists. +This is where automatic query complexity comes to save us. + +## Static request analysis + +The operation complexity analyzer is a useful tool to make your API secure. The operation +complexity analyzer assigns by default every field a complexity of `1`. The complexity of +all fields in one of the operations of a GraphQL request is not allowed to be greater +than the maximum permitted operation complexity. + +This sounds fairly simple at first, but the more you think about this, the more you +wonder if that is so. Does every field have the same complexity? + +In a data graph, not every field is the same. We have fields that fetch data that are +more expensive than fields that just complete already resolved data. + +```graphql +type Query { + books(take: Int = 10): [Book] +} + +type Book { + title + author: Author +} + +type Author { + name +} +``` + +In the above example executing the `books` field on the `Query` type might go to the +database and fetch the `Book`. This means that the cost of the `books` field is +probably higher than the cost of the `title` field. The cost of the title field +might be the impact on the memory and to the transport. For `title`, the default +cost of `1` os OK. But for `books`, we might want to go with a higher cost of `10` +since we are getting a list of books from our database. + +Moreover, we have the field `author` on the book, which might go to the database +as well to fetch the `Author` object. Since we are only fetching a single item here, +we might want to apply a cost of `5` to this field. + +```php +class Controller { + /** + * @return Book[] + */ + #[Query] + #[Cost(complexity: 10)] + public function books(int $take = 10): array {} +} + +#[Type] +class Book { + #[Field] + public string $title; + + #[Field] + #[Cost(complexity: 5)] + public Author $author; +} + +#[Type] +class Author { + #[Field] + public string $name; +} +``` + +If we run the following query against our data graph, we will come up with the cost of `11`. + +```graphql +query { + books { + title + } +} +``` + +When drilling in further, a cost of `17` occurs. + +```graphql +query { + books { + title + author { + name + } + } +} +``` + +This kind of analysis is entirely static and could just be done by inspecting the +query syntax tree. The impact on the overall execution performance is very low. +But with this static approach, we do have a very rough idea of the performance. +Is it correct to apply always a cost of `10` even though we might get one or one +hundred books back? + +## Full request analysis + +The operation complexity analyzer can also take arguments into account when analyzing operation complexity. + +If we look at our data graph, we can see that the `books` field actually has an argument +that defines how many books are returned. The `take` argument, in this case, specifies +the maximum books that the field will return. + +When measuring the field\`s impact, we can take the argument `take` into account as a +multiplier of our cost. This means we might want to lower the cost to `5` since now we +get a more fine-grained cost calculation by multiplying the complexity +of the field with the `take` argument. + +```php +class Controller { + /** + * @return Book[] + */ + #[Query] + #[Cost(complexity: 5, multipliers: ['take'], defaultMultiplier: 200)] + public function books(?int $take = 10): array {} +} + +#[Type] +class Book { + #[Field] + public string $title; + + #[Field] + #[Cost(complexity: 5)] + public Author $author; +} + +#[Type] +class Author { + #[Field] + public string $name; +} +``` + +With the multiplier in place, we now get a cost of `60` for the request since the multiplier +is applied to the books field and the child fields' cost. If multiple multipliers are specified, +the cost will be multiplied by each of the fields. + +Cost calculation: `10 * (5 + 1)` + +```graphql +query { + books { + title + } +} +``` + +When drilling in further, the cost will go up to `240` since we are now pulling twice as much books and also their authors. + +Cost calculation: `20 * (5 + 1 + 5 + 1)` + +```graphql +query { + books(take: 20) { + title + author { + name + } + } +} +``` + +Notice the nullable `$take` parameter. This might come in handy if `take: null` means "get all items", +but that would also mean that the overall complexity would only be `1 + 5 + 1 + 5 + 1 = 11`, +when in fact that would be a very costly query to execute. + +If all of the multiplier fields are either `null` or missing (and don't have default values), +`defaultMultiplier` is used: + +Cost calculation: `200 * (5 + 1 + 5 + 1)` + +```graphql +query { + books(take: null) { + title + author { + name + } + } +} +``` + +## Setup + +As with query depth, automatic query complexity is configured through PSR15 middleware: + +```php +$builder = new Psr15GraphQLMiddlewareBuilder($schema); + +// Total query cost cannot exceed 1000 points +$builder->limitQueryComplexity(1000); +``` + +Beware that introspection queries would also be limited in complexity. A full introspection +query sits at around `107` points, so we recommend a minimum of `150` for query complexity limit. diff --git a/website/versioned_docs/version-8.0.0/other-frameworks.mdx b/website/versioned_docs/version-8.0.0/other-frameworks.mdx new file mode 100644 index 0000000000..e2684c0e9f --- /dev/null +++ b/website/versioned_docs/version-8.0.0/other-frameworks.mdx @@ -0,0 +1,326 @@ +--- +id: other-frameworks +title: Getting started with any framework +sidebar_label: "Other frameworks / No framework" +--- + +## Installation + +Open a terminal in your current project directory and run: + +```console +$ composer require thecodingmachine/graphqlite +``` + +## Requirements + +In order to bootstrap GraphQLite, you will need: + +- A PSR-11 compatible container +- A PSR-16 cache + +Additionally, you will have to route the HTTP requests to the underlying GraphQL library. + +GraphQLite relies on the [webonyx/graphql-php](http://webonyx.github.io/graphql-php/) library internally. +This library plays well with PSR-7 requests and we also provide a [PSR-15 middleware](#psr-15-middleware). + +## Integration + +Webonyx/graphql-php library requires a [Schema](https://webonyx.github.io/graphql-php/type-system/schema/) in order to resolve +GraphQL queries. We provide a `SchemaFactory` class to create such a schema: + +```php +use TheCodingMachine\GraphQLite\SchemaFactory; + +// $cache is a PSR-16 compatible cache +// $container is a PSR-11 compatible container +$factory = new SchemaFactory($cache, $container); +$factory->addNamespace('App'); + +$schema = $factory->createSchema(); +``` + +You can now use this schema with [Webonyx GraphQL facade](https://webonyx.github.io/graphql-php/getting-started/#hello-world) +or the [StandardServer class](https://webonyx.github.io/graphql-php/executing-queries/#using-server). + +The `SchemaFactory` class also comes with a number of methods that you can use to customize your GraphQLite settings. + +```php +// Configure an authentication service (to resolve the #[Logged] attributes). +$factory->setAuthenticationService(new VoidAuthenticationService()); +// Configure an authorization service (to resolve the #[Right] attributes). +$factory->setAuthorizationService(new VoidAuthorizationService()); +// Change the naming convention of GraphQL types globally. +$factory->setNamingStrategy(new NamingStrategy()); +// Add a custom type mapper. +$factory->addTypeMapper($typeMapper); +// Add a custom type mapper using a factory to create it. +// Type mapper factories are useful if you need to inject the "recursive type mapper" into your type mapper constructor. +$factory->addTypeMapperFactory($typeMapperFactory); +// Add a root type mapper. +$factory->addRootTypeMapper($rootTypeMapper); +// Add a parameter mapper. +$factory->addParameterMapper($parameterMapper); +// Add a query provider. These are used to find queries and mutations in the application. +$factory->addQueryProvider($queryProvider); +// Add a query provider using a factory to create it. +// Query provider factories are useful if you need to inject the "fields builder" into your query provider constructor. +$factory->addQueryProviderFactory($queryProviderFactory); +// Set a default InputType validator service to handle validation on all `Input` annotated types +$factory->setInputTypeValidator($validator); +// Add custom options to the Webonyx underlying Schema. +$factory->setSchemaConfig($schemaConfig); +// Configures the time-to-live for the GraphQLite cache. Defaults to 2 seconds in dev mode. +$factory->setGlobTtl(2); +// Enables prod-mode (cache settings optimized for best performance). +// This is a shortcut for `$schemaFactory->setGlobTtl(null)` +$factory->prodMode(); +// Enables dev-mode (this is the default mode: cache settings optimized for best developer experience). +// This is a shortcut for `$schemaFactory->setGlobTtl(2)` +$factory->devMode(); +``` + +### GraphQLite context + +Webonyx allows you pass a "context" object when running a query. +For some GraphQLite features to work (namely: the prefetch feature), GraphQLite needs you to initialize the Webonyx context +with an instance of the `TheCodingMachine\GraphQLite\Context\Context` class. + +For instance: + +```php +use TheCodingMachine\GraphQLite\Context\Context; + +$result = GraphQL::executeQuery($schema, $query, null, new Context(), $variableValues); +``` + +### Disabling autoloading + +GraphQLite uses `kcs/class-finder` to find all classes that have GraphQLite attributes. By default, it uses +autoloading under the hood. But if you have an older codebase that contains classes with incorrect or missing +namespaces, you may need to use `include_once` instead. To do so, you can overwrite the finder using `setFinder()`: + +```php +use Kcs\ClassFinder\Finder\ComposerFinder; +use TheCodingMachine\GraphQLite\SchemaFactory; + +$factory = new SchemaFactory($cache, $container); +$factory->addNamespace('App') + ->setFinder( + (new ComposerFinder())->useAutoloading(false) + ); + +$schema = $factory->createSchema(); +``` + +## Minimal example + +The smallest working example using no framework is: + +```php +addNamespace('App'); + +$schema = $factory->createSchema(); + +$rawInput = file_get_contents('php://input'); +$input = json_decode($rawInput, true); +$query = $input['query']; +$variableValues = isset($input['variables']) ? $input['variables'] : null; + +$result = GraphQL::executeQuery($schema, $query, null, new Context(), $variableValues); +$output = $result->toArray(); + +header('Content-Type: application/json'); +echo json_encode($output); +``` + +## PSR-15 Middleware + +When using a framework, you will need a way to route your HTTP requests to the `webonyx/graphql-php` library. + +If the framework you are using is compatible with PSR-15 (like Slim PHP or Zend-Expressive / Laminas), GraphQLite +comes with a PSR-15 middleware out of the box. + +In order to get an instance of this middleware, you can use the `Psr15GraphQLMiddlewareBuilder` builder class: + +```php +// $schema is an instance of the GraphQL schema returned by SchemaFactory::createSchema (see previous chapter) +$builder = new Psr15GraphQLMiddlewareBuilder($schema); + +$middleware = $builder->createMiddleware(); + +// You can now inject your middleware in your favorite PSR-15 compatible framework. +// For instance: +$zendMiddlewarePipe->pipe($middleware); +``` + +The builder offers a number of setters to modify its behaviour: + +```php +$builder->setUrl("/graphql"); // Modify the URL endpoint (defaults to /graphql) + +$config = $builder->getConfig(); // Returns a Webonyx ServerConfig object. +// Define your own formatter and error handlers for Webonyx. +$config->setErrorFormatter([ExceptionHandler::class, 'errorFormatter']); +$config->setErrorsHandler([ExceptionHandler::class, 'errorHandler']); + +$builder->setConfig($config); + +$builder->setResponseFactory(new ResponseFactory()); // Set a PSR-18 ResponseFactory (not needed if you are using zend-framework/zend-diactoros ^2 +$builder->setStreamFactory(new StreamFactory()); // Set a PSR-18 StreamFactory (not needed if you are using zend-framework/zend-diactoros ^2 +$builder->setHttpCodeDecider(new HttpCodeDecider()); // Set a class in charge of deciding the HTTP status code based on the response. + +// Configure the server to use Apollo automatic persisted queries with given cache and an optional time-to-live. +// See https://www.apollographql.com/docs/apollo-server/performance/apq/ +$builder->useAutomaticPersistedQueries($cache, new DateInterval('PT1H')); +``` + +### Example + +In this example, we will focus on getting a working version of GraphQLite using: + +- [Laminas Stratigility](https://docs.laminas.dev/laminas-stratigility/) as a PSR-15 server +- `mouf/picotainer` (a micro-container) for the PSR-11 container +- `symfony/cache ` for the PSR-16 cache + +The choice of the libraries is really up to you. You can adapt it based on your needs. + +```json title="composer.json" +{ + "autoload": { + "psr-4": { + "App\\": "src/" + } + }, + "require": { + "thecodingmachine/graphqlite": "^4", + "laminas/laminas-diactoros": "^2", + "laminas/laminas-stratigility": "^3", + "laminas/laminas-httphandlerrunner": "^2", + "mouf/picotainer": "^1.1", + "symfony/cache": "^4.2" + }, + "minimum-stability": "dev", + "prefer-stable": true +} +``` + +```php title="index.php" +get(MiddlewarePipe::class), + new SapiStreamEmitter(), + $serverRequestFactory, + $errorResponseGenerator +); +$runner->run(); +``` + +Here we are initializing a Laminas `RequestHandler` (it receives requests) and we pass it to a Laminas Stratigility `MiddlewarePipe`. +This `MiddlewarePipe` comes from the container declared in the `config/container.php` file: + +```php title="config/container.php" + function(ContainerInterface $container) { + $pipe = new MiddlewarePipe(); + $pipe->pipe($container->get(WebonyxGraphqlMiddleware::class)); + return $pipe; + }, + // The WebonyxGraphqlMiddleware is a PSR-15 compatible + // middleware that exposes Webonyx schemas. + WebonyxGraphqlMiddleware::class => function(ContainerInterface $container) { + $builder = new Psr15GraphQLMiddlewareBuilder($container->get(Schema::class)); + return $builder->createMiddleware(); + }, + CacheInterface::class => function() { + // Any PSR-16 cache should work - APCu is recommended for good + // performance, but it requires that module to be enabled. For + // small scale testing with zero dependencies, FilesystemCache + // can be used instead. + return new ApcuCache(); + }, + Schema::class => function(ContainerInterface $container) { + // The magic happens here. We create a schema using GraphQLite SchemaFactory. + $factory = new SchemaFactory($container->get(CacheInterface::class), $container); + $factory->addNamespace('App'); + return $factory->createSchema(); + } +]); +``` + +Now, we need to add a first query and therefore create a controller. +The application will look into the `App\Controllers` namespace for GraphQLite controllers. + +It assumes that the container has an entry whose name is the controller's fully qualified class name. + +```php title="src/Controllers/MyController.php" +namespace App\Controllers; + +use TheCodingMachine\GraphQLite\Annotations\Query; + +class MyController +{ + #[Query] + public function hello(string $name): string + { + return 'Hello '.$name; + } +} +``` + +```php title="config/container.php" +use App\Controllers\MyController; + +return new Picotainer([ + // ... + + // We declare the controller in the container. + MyController::class => function() { + return new MyController(); + }, +]); +``` + +And we are done! You can now test your query using your favorite GraphQL client. diff --git a/website/versioned_docs/version-8.0.0/pagination.mdx b/website/versioned_docs/version-8.0.0/pagination.mdx new file mode 100644 index 0000000000..44ad427c53 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/pagination.mdx @@ -0,0 +1,65 @@ +--- +id: pagination +title: Paginating large result sets +sidebar_label: Pagination +--- + +It is quite common to have to paginate over large result sets. + +GraphQLite offers a simple way to do that using [Porpaginas](https://github.com/beberlei/porpaginas). + +Porpaginas is a set of PHP interfaces that can be implemented by result iterators. It comes with a native support for +PHP arrays, Doctrine and [TDBM](https://thecodingmachine.github.io/tdbm/doc/limit_offset_resultset.html). + +
If you are a Laravel user, Eloquent does not come with a Porpaginas +iterator. However, the GraphQLite Laravel bundle comes with its own pagination system.
+ +## Installation + +You will need to install the [Porpaginas](https://github.com/beberlei/porpaginas) library to benefit from this feature. + +```bash +$ composer require beberlei/porpaginas +``` + +## Usage + +In your query, simply return a class that implements `Porpaginas\Result`: + +```php +class MyController +{ + /** + * @return Product[] + */ + #[Query] + public function products(): Porpaginas\Result + { + // Some code that returns a list of products + + // If you are using Doctrine, something like: + return new Porpaginas\Doctrine\ORM\ORMQueryResult($doctrineQuery); + } +} +``` + +Notice that: + +- the method return type MUST BE `Porpaginas\Result` or a class implementing `Porpaginas\Result` +- you MUST add a `@return` statement to help GraphQLite find the type of the list + +Once this is done, you can paginate directly from your GraphQL query: + +```graphql +products { + items(limit: 10, offset: 20) { + id + name + } + count +} +``` + +Results are wrapped into an item field. You can use the "limit" and "offset" parameters to apply pagination automatically. + +The "count" field returns the **total count** of items. diff --git a/website/versioned_docs/version-8.0.0/prefetch-method.mdx b/website/versioned_docs/version-8.0.0/prefetch-method.mdx new file mode 100644 index 0000000000..a12cb50891 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/prefetch-method.mdx @@ -0,0 +1,108 @@ +--- +id: prefetch-method +title: Prefetching records +sidebar_label: Prefetching records +--- + +## The problem + +GraphQL naive implementations often suffer from the "N+1" problem. + +Consider a request where a user attached to a post must be returned: + +```graphql +{ + posts { + id + user { + id + } + } +} +``` + +A naive implementation will do this: + +- 1 query to fetch the list of posts +- 1 query per post to fetch the user + +Assuming we have "N" posts, we will make "N+1" queries. + +There are several ways to fix this problem. +Assuming you are using a relational database, one solution is to try to look +ahead and perform only one query with a JOIN between "posts" and "users". +This method is described in the ["analyzing the query plan" documentation](query-plan.mdx). + +But this can be difficult to implement. This is also only useful for relational databases. If your data comes from a +NoSQL database or from the cache, this will not help. + +Instead, GraphQLite offers an easier to implement solution: the ability to fetch all fields from a given type at once. + +## The "prefetch" method + +```php +#[Type] +class PostType { + /** + * @param mixed $prefetchedUsers + * @return User + */ + #[Field] + public function getUser(#[Prefetch("prefetchUsers")] $prefetchedUsers): User + { + // This method will receive the $prefetchedUsers as first argument. This is the return value of the "prefetchUsers" method below. + // Using this prefetched list, it should be easy to map it to the post + } + + /** + * @param Post[] $posts + * @return mixed + */ + public static function prefetchUsers(iterable $posts) + { + // This function is called only once per GraphQL request + // with the list of posts. You can fetch the list of users + // associated with this posts in a single request, + // for instance using a "IN" query in SQL or a multi-fetch + // in your cache back-end. + } +} +``` + +When a `#[Prefetch]` attribute is detected on a parameter of `#[Field]` attribute, the method is called automatically. +The prefetch callable must be one of the following: + - a static method in the same class: `#[Prefetch('prefetchMethod')]` + - a static method in a different class: `#[Prefetch([OtherClass::class, 'prefetchMethod')]` + - a non-static method in a different class, resolvable through the container: `#[Prefetch([OtherService::class, 'prefetchMethod'])]` +The first argument of the method is always an array of instances of the main type. It can return absolutely anything (mixed). + +## Input arguments + +Field arguments can be set either on the `#[Field]` annotated method OR/AND on the prefetch methods. + +For instance: + +```php +#[Type] +class PostType { + /** + * @param mixed $prefetchedComments + * @return Comment[] + */ + #[Field] + public function getComments(#[Prefetch("prefetchComments")] $prefetchedComments): array + { + // ... + } + + /** + * @param Post[] $posts + * @return mixed + */ + public static function prefetchComments(iterable $posts, bool $hideSpam, int $filterByScore) + { + // Parameters passed after the first parameter (hideSpam, filterByScore...) are automatically exposed + // as GraphQL arguments for the "comments" field. + } +} +``` diff --git a/website/versioned_docs/version-8.0.0/queries.mdx b/website/versioned_docs/version-8.0.0/queries.mdx new file mode 100644 index 0000000000..138e4812eb --- /dev/null +++ b/website/versioned_docs/version-8.0.0/queries.mdx @@ -0,0 +1,138 @@ +--- +id: queries +title: Queries +sidebar_label: Queries +--- + +In GraphQLite, GraphQL queries are created by writing methods in *controller* classes. + +Those classes must be in the controllers namespaces which has been defined when you configured GraphQLite. +For instance, in Symfony, the controllers namespace is `App\Controller` by default. + +## Simple query + +In a controller class, each query method must be annotated with the `#[Query]` attribute. For instance: + +```php +namespace App\Controller; + +use TheCodingMachine\GraphQLite\Annotations\Query; + +class MyController +{ + #[Query] + public function hello(string $name): string + { + return 'Hello ' . $name; + } +} +``` + +This query is equivalent to the following [GraphQL type language](https://graphql.org/learn/schema/#type-language): + +```graphql +Type Query { + hello(name: String!): String! +} +``` + +As you can see, GraphQLite will automatically do the mapping between PHP types and GraphQL types. + +
Heads up! If you are not using a framework with an autowiring container (like Symfony or Laravel), please be aware that the MyController class must exist in the container of your application. Furthermore, the identifier of the controller in the container MUST be the fully qualified class name of controller.
+ +## About attributes + +GraphQLite relies a lot on attributes. + +It supports the new PHP 8 attributes (`#[Query]`), the "Doctrine annotations" style (`#[Query]`) was dropped. + +## Testing the query + +The default GraphQL endpoint is `/graphql`. + +The easiest way to test a GraphQL endpoint is to use [GraphiQL](https://github.com/graphql/graphiql) or +[Altair](https://altair.sirmuel.design/) clients (they are available as Chrome or Firefox plugins) + +
+ If you are using the Symfony bundle, GraphiQL is also directly embedded.
+ Simply head to http://[path-to-my-app]/graphiql +
+ +Here a query using our simple *Hello World* example: + +![](/img/query1.png) + +## Query with a type + +So far, we simply declared a query. But we did not yet declare a type. + +Let's assume you want to return a product: + +```php +namespace App\Controller; + +use TheCodingMachine\GraphQLite\Annotations\Query; + +class ProductController +{ + #[Query] + public function product(string $id): Product + { + // Some code that looks for a product and returns it. + } +} +``` + + +As the `Product` class is not a scalar type, you must tell GraphQLite how to handle it: + +```php +namespace App\Entities; + +use TheCodingMachine\GraphQLite\Annotations\Field; +use TheCodingMachine\GraphQLite\Annotations\Type; + +#[Type] +class Product +{ + // ... + + #[Field] + public function getName(): string + { + return $this->name; + } + + #[Field] + public function getPrice(): ?float + { + return $this->price; + } +} +``` + +The `#[Type]` attribute is used to inform GraphQLite that the `Product` class is a GraphQL type. + +The `#[Field]` attribute is used to define the GraphQL fields. This attribute must be put on a **public method**. + +The `Product` class must be in one of the *types* namespaces. As for *controller* classes, you configured this namespace when you installed +GraphQLite. By default, in Symfony, the allowed types namespaces are `App\Entity` and `App\Types`. + +This query is equivalent to the following [GraphQL type language](https://graphql.org/learn/schema/#type-language): + +```graphql +Type Product { + name: String! + price: Float +} +``` + +
+

If you are used to Domain driven design, you probably + realize that the Product class is part of your domain.

+

GraphQL attributes are adding some serialization logic that is out of scope of the domain. + These are just attributes and for most project, this is the fastest and easiest route.

+

If you feel that GraphQL attributes do not belong to the domain, or if you cannot modify the class + directly (maybe because it is part of a third party library), there is another way to create types without annotating + the domain class. We will explore that in the next chapter.

+
diff --git a/website/versioned_docs/version-8.0.0/query-plan.mdx b/website/versioned_docs/version-8.0.0/query-plan.mdx new file mode 100644 index 0000000000..094b77c55e --- /dev/null +++ b/website/versioned_docs/version-8.0.0/query-plan.mdx @@ -0,0 +1,70 @@ +--- +id: query-plan +title: Query plan +sidebar_label: Query plan +--- + +## The problem + +GraphQL naive implementations often suffer from the "N+1" problem. + +Let's have a look at the following query: + +```graphql +{ + products { + name + manufacturer { + name + } + } +} +``` + +A naive implementation will do this: + +- 1 query to fetch the list of products +- 1 query per product to fetch the manufacturer + +Assuming we have "N" products, we will make "N+1" queries. + +There are several ways to fix this problem. Assuming you are using a relational database, one solution is to try to look +ahead and perform only one query with a JOIN between "products" and "manufacturers". + +But how do I know if I should make the JOIN between "products" and "manufacturers" or not? I need to know ahead +of time. + +With GraphQLite, you can answer this question by tapping into the `ResolveInfo` object. + +## Fetching the query plan + +Available in GraphQLite 4.0+ + +```php +use GraphQL\Type\Definition\ResolveInfo; + +class ProductsController +{ + /** + * @return Product[] + */ + #[Query] + public function products(ResolveInfo $info): array + { + if (isset($info->getFieldSelection()['manufacturer']) { + // Let's perform a request with a JOIN on manufacturer + } else { + // Let's perform a request without a JOIN on manufacturer + } + // ... + } +} +``` + +`ResolveInfo` is a class provided by Webonyx/GraphQL-PHP (the low-level GraphQL library used by GraphQLite). +It contains info about the query and what fields are requested. Using `ResolveInfo::getFieldSelection` you can analyze the query +and decide whether you should perform additional "JOINS" in your query or not. + +
As of the writing of this documentation, the ResolveInfo class is useful but somewhat limited. +The next version of Webonyx/GraphQL-PHP will add a "query plan" +that allows a deeper analysis of the query.
diff --git a/website/versioned_docs/version-8.0.0/semver.md b/website/versioned_docs/version-8.0.0/semver.md new file mode 100644 index 0000000000..12931f26a5 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/semver.md @@ -0,0 +1,45 @@ +--- +id: semver +title: Our backward compatibility promise +sidebar_label: Semantic versioning +--- + +Ensuring smooth upgrades of your project is a priority. That's why we promise you backward compatibility (BC) for all minor GraphQLite releases. You probably recognize this strategy as [Semantic Versioning](https://semver.org/). In short, Semantic Versioning means that only major releases (such as 4.0, 5.0 etc.) are allowed to break backward compatibility. Minor releases (such as 4.0, 4.1 etc.) may introduce new features, but must do so without breaking the existing API of that release branch (4.x in the previous example). + +But sometimes, a new feature is not quite "dry" and we need a bit of time to find the perfect API. +In such cases, we prefer to gather feedback from real-world usage, adapt the API, or remove it altogether. +Doing so is not possible with a no BC-break approach. + +To avoid being bound to our backward compatibility promise, such features can be marked as **unstable** or **experimental** and their classes and methods are marked with the `@unstable` or `@experimental` tag. + +`@unstable` or `@experimental` classes / methods will **not break** in a patch release, but *may be broken* in a minor version. + +As a rule of thumb: + +- If you are a GraphQLite user (using GraphQLite mainly through its annotations), we guarantee strict semantic versioning +- If you are extending GraphQLite features (if you are developing custom annotations, or if you are developing a GraphQlite integration + with a framework...), be sure to check the tags. + +Said otherwise: + +- If you are a GraphQLite user, in your `composer.json`, target a major version: + + ```json + { + "require": { + "thecodingmachine/graphqlite": "^4" + } + } + ``` + +- If you are extending the GraphQLite ecosystem, in your `composer.json`, target a minor version: + + ```json + { + "require": { + "thecodingmachine/graphqlite": "~4.1.0" + } + } + ``` + +Finally, classes / methods annotated with the `@internal` annotation are not meant to be used in your code or third-party library. They are meant for GraphQLite internal usage and they may break anytime. Do not use those directly. diff --git a/website/versioned_docs/version-8.0.0/subscriptions.mdx b/website/versioned_docs/version-8.0.0/subscriptions.mdx new file mode 100644 index 0000000000..bcfd118aac --- /dev/null +++ b/website/versioned_docs/version-8.0.0/subscriptions.mdx @@ -0,0 +1,53 @@ +--- +id: subscriptions +title: Subscriptions +sidebar_label: Subscriptions +--- + +In GraphQLite, subscriptions are created [like queries](queries.mdx) or [mutations](mutations.mdx). + +To create a subscription, you must annotate a method in a controller with the `#[Subscription]` attribute. + +For instance: + +```php +namespace App\Controller; + +use TheCodingMachine\GraphQLite\Annotations\Mutation; + +class ProductController +{ + #[Subscription(outputType: 'Product')] + public function productAdded(?ID $categoryId = null): void + { + // Some code that sets up any connections, stores the subscription details, etc. + } +} +``` + +As you will notice in the above example, we're returning `void`. In general, this is probably the +correct return type. + +You could, however, type the `Product` as the return type of the method, instead +of using the `outputType` argument on the `#[Subscription]` attribute. This means you +would have to return an instance of `Product` from the method though. One exception here, is if +you intend to use PHP for your long-running streaming process, you could block the process inside +the controller and basically never return anything from the method, just terminating the +connection/stream when it breaks, or when the client disconnects. + +Most implementations will want to offload the actual real-time streaming connection to a better suited +technology, like SSE (server-sent events), WebSockets, etc. GraphQLite does not make any assumptions +here. Therefore, it's most practical to return `void` from the controller method. Since GraphQL +is a strictly typed spec, we cannot return anything other than the defined `outputType` from the request. +That would be a violation of the GraphQL specification. Returning `void`, which is translated to `null` +in the GraphQL response body, allows for us to complete the request and terminate the PHP process. + +We recommend using response headers to pass back any necessary information realted to the subscription. +This might be a subscription ID, a streaming server URL to connect to, or whatever you need to pass +back to the client. + +
+ In the future, it may make sense to implement streaming servers directly into GraphQLite, especially + as PHP progresses with async and parallel processing. At this time, we might consider returning a + `Generator` (or `Fiber`) from the controller method. +
diff --git a/website/versioned_docs/version-8.0.0/symfony-bundle-advanced.mdx b/website/versioned_docs/version-8.0.0/symfony-bundle-advanced.mdx new file mode 100644 index 0000000000..c34c6d7628 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/symfony-bundle-advanced.mdx @@ -0,0 +1,169 @@ +--- +id: symfony-bundle-advanced +title: "Symfony bundle: advanced usage" +sidebar_label: Symfony specific features +--- + +
+ Be advised! This documentation will be removed in a future release. For current and up-to-date Symfony bundle specific documentation, please see the Github repository. +
+ +The Symfony bundle comes with a number of features to ease the integration of GraphQLite in Symfony. + +## Login and logout + +Out of the box, the GraphQLite bundle will expose a "login" and a "logout" mutation as well +as a "me" query (that returns the current user). + +If you need to customize this behaviour, you can edit the "graphqlite.security" configuration key. + +```yaml +graphqlite: + security: + enable_login: auto # Default setting + enable_me: auto # Default setting +``` + +By default, GraphQLite will enable "login" and "logout" mutations and the "me" query if the following conditions are met: + +- the "security" bundle is installed and configured (with a security provider and encoder) +- the "session" support is enabled (via the "framework.session.enabled" key). + +```yaml +graphqlite: + security: + enable_login: on +``` + +By settings `enable_login=on`, you are stating that you explicitly want the login/logout mutations. +If one of the dependencies is missing, an exception is thrown (unlike in default mode where the mutations +are silently discarded). + +```yaml +graphqlite: + security: + enable_login: off +``` + +Use the `enable_login=off` to disable the mutations. + +```yaml +graphqlite: + security: + firewall_name: main # default value +``` + +By default, GraphQLite assumes that your firewall name is "main". This is the default value used in the +Symfony security bundle so it is likely the value you are using. If for some reason you want to use +another firewall, configure the name with `graphqlite.security.firewall_name`. + +## Schema and request security + +You can disable the introspection of your GraphQL API (for instance in production mode) using +the `introspection` configuration properties. + +```yaml +graphqlite: + security: + introspection: false +``` + + +You can set the maximum complexity and depth of your GraphQL queries using the `maximum_query_complexity` +and `maximum_query_depth` configuration properties + +```yaml +graphqlite: + security: + maximum_query_complexity: 314 + maximum_query_depth: 42 +``` + +### Login using the "login" mutation + +The mutation below will log-in a user: + +```graphql +mutation login { + login(userName:"foo", password:"bar") { + userName + roles + } +} +``` + +### Get the current user with the "me" query + +Retrieving the current user is easy with the "me" query: + +```graphql +{ + me { + userName + roles + } +} +``` + +In Symfony, user objects implement `Symfony\Component\Security\Core\User\UserInterface`. +This interface is automatically mapped to a type with 2 fields: + +- `userName: String!` +- `roles: [String!]!` + +If you want to get more fields, just add the `#[Type]` attribute to your user class: + +```php +#[Type] +class User implements UserInterface +{ + #[Field] + public function getEmail() : string + { + // ... + } + +} +``` + +You can now query this field using an [inline fragment](https://graphql.org/learn/queries/#inline-fragments): + +```graphql +{ + me { + userName + roles + ... on User { + email + } + } +} +``` + +### Logout using the "logout" mutation + +Use the "logout" mutation to log a user out + +```graphql +mutation logout { + logout +} +``` + +## Injecting the Request + +You can inject the Symfony Request object in any query/mutation/field. + +Most of the time, getting the request object is irrelevant. Indeed, it is GraphQLite's job to parse this request and +manage it for you. Sometimes yet, fetching the request can be needed. In those cases, simply type-hint on the request +in any parameter of your query/mutation/field. + +```php +use Symfony\Component\HttpFoundation\Request; + +#[Query] +public function getUser(int $id, Request $request): User +{ + // The $request object contains the Symfony Request. +} +``` \ No newline at end of file diff --git a/website/versioned_docs/version-8.0.0/symfony-bundle.md b/website/versioned_docs/version-8.0.0/symfony-bundle.md new file mode 100644 index 0000000000..99822eeddd --- /dev/null +++ b/website/versioned_docs/version-8.0.0/symfony-bundle.md @@ -0,0 +1,121 @@ +--- +id: symfony-bundle +title: Getting started with Symfony +sidebar_label: Symfony bundle +--- + +
+ Be advised! This documentation will be removed in a future release. For current and up-to-date Symfony bundle specific documentation, please see the Github repository. +
+ +The GraphQLite bundle is compatible with **Symfony 4.x** and **Symfony 5.x**. + +## Applications that use Symfony Flex + +Open a command console, enter your project directory and execute: + +```console +$ composer require thecodingmachine/graphqlite-bundle +``` + +Now, go to the `config/packages/graphqlite.yaml` file and edit the namespaces to match your application. + +```yaml title="config/packages/graphqlite.yaml" +graphqlite: + namespace: + # The namespace(s) that will store your GraphQLite controllers. + # It accept either a string or a list of strings. + controllers: App\GraphQLController\ + # The namespace(s) that will store your GraphQL types and factories. + # It accept either a string or a list of strings. + types: + - App\Types\ + - App\Entity\ +``` + +More advanced parameters are detailed in the ["advanced configuration" section](#advanced-configuration) + +## Applications that don't use Symfony Flex + +Open a terminal in your current project directory and run: + +```console +$ composer require thecodingmachine/graphqlite-bundle +``` + +Enable the library by adding it to the list of registered bundles in the `app/AppKernel.php` file: + + +```php title="app/AppKernel.php" + + Do not put your GraphQL controllers in the App\Controller namespace Symfony applies a particular compiler pass to classes in the App\Controller namespace. This compiler pass will prevent you from using input types. Put your controllers in another namespace. We advise using App\GraphqlController. + + +The Symfony bundle come with a set of advanced features that are not described in this install documentation (like providing a login/logout mutation out of the box). Jump to the ["Symfony specific features"](symfony-bundle-advanced.mdx) documentation of GraphQLite if you want to learn more. diff --git a/website/versioned_docs/version-8.0.0/troubleshooting.md b/website/versioned_docs/version-8.0.0/troubleshooting.md new file mode 100644 index 0000000000..862cf9b4e7 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/troubleshooting.md @@ -0,0 +1,25 @@ +--- +id: troubleshooting +title: Troubleshooting +sidebar_label: Troubleshooting +--- + +**Error: Maximum function nesting level of '100' reached** + +Webonyx's GraphQL library tends to use a very deep stack. +This error does not necessarily mean your code is going into an infinite loop. +Simply try to increase the maximum allowed nesting level in your XDebug conf: + +``` +xdebug.max_nesting_level=500 +``` + + +**Cannot autowire service "_[some input type]_": argument "$..." of method "..." is type-hinted "...", you should configure its value explicitly.** + +The message says that Symfony is trying to instantiate an input type as a service. This can happen if you put your +GraphQLite controllers in the Symfony controller namespace (`App\Controller` by default). Symfony will assume that any +object type-hinted in a method of a controller is a service ([because all controllers are tagged with the "controller.service_arguments" tag](https://symfony.com/doc/current/service_container/3.3-di-changes.html#controllers-are-registered-as-services)) + +To fix this issue, do not put your GraphQLite controller in the same namespace as the Symfony controllers and +reconfigure your `config/graphqlite.yml` file to point to your new namespace. diff --git a/website/versioned_docs/version-8.0.0/type-mapping.mdx b/website/versioned_docs/version-8.0.0/type-mapping.mdx new file mode 100644 index 0000000000..d5b6c4dc29 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/type-mapping.mdx @@ -0,0 +1,383 @@ +--- +id: type-mapping +title: Type mapping +sidebar_label: Type mapping +--- + +As explained in the [queries](queries.mdx) section, the job of GraphQLite is to create GraphQL types from PHP types. + +## Scalar mapping + +Scalar PHP types can be type-hinted to the corresponding GraphQL types: + +* `string` +* `int` +* `bool` +* `float` + +For instance: + +```php +namespace App\Controller; + +use TheCodingMachine\GraphQLite\Annotations\Query; + +class MyController +{ + #[Query] + public function hello(string $name): string + { + return 'Hello ' . $name; + } +} +``` + +## Class mapping + +When returning a PHP class in a query, you must annotate this class using `#[Type]` and `#[Field]` attributes: + +```php +namespace App\Entities; + +use TheCodingMachine\GraphQLite\Annotations\Field; +use TheCodingMachine\GraphQLite\Annotations\Type; + +#[Type] +class Product +{ + // ... + + #[Field] + public function getName(): string + { + return $this->name; + } + + #[Field] + public function getPrice(): ?float + { + return $this->price; + } +} +``` + +**Note:** The GraphQL output type name generated by GraphQLite is equal to the class name of the PHP class. So if your +PHP class is `App\Entities\Product`, then the GraphQL type will be named "Product". + +In case you have several types with the same class name in different namespaces, you will face a naming collision. +Hopefully, you can force the name of the GraphQL output type using the "name" attribute: + +```php +#[Type(name: "MyProduct")] +class Product { /* ... */ } +``` + + + +## Array mapping + +You can type-hint against arrays (or iterators) as long as you add a detailed `@return` statement in the PHPDoc. + +```php +/** + * @return User[] <=== we specify that the array is an array of User objects. + */ +#[Query] +public function users(int $limit, int $offset): array +{ + // Some code that returns an array of "users". +} +``` + +## ID mapping + +GraphQL comes with a native `ID` type. PHP has no such type. + +There are two ways with GraphQLite to handle such type. + +### Force the outputType + +```php +#[Field(outputType: "ID")] +public function getId(): string +{ + // ... +} +``` + +Using the `outputType` attribute of the `#[Field]` attribute, you can force the output type to `ID`. + +You can learn more about forcing output types in the [custom types section](custom-types.mdx). + +### ID class + +```php +use TheCodingMachine\GraphQLite\Types\ID; + +#[Field] +public function getId(): ID +{ + // ... +} +``` + +Note that you can also use the `ID` class as an input type: + +```php +use TheCodingMachine\GraphQLite\Types\ID; + +#[Mutation] +public function save(ID $id, string $name): Product +{ + // ... +} +``` + +## Date mapping + +Out of the box, GraphQL does not have a `DateTime` type, but we took the liberty to add one, with sensible defaults. + +When used as an output type, `DateTimeImmutable` or `DateTimeInterface` PHP classes are +automatically mapped to this `DateTime` GraphQL type. + +```php +#[Field] +public function getDate(): \DateTimeInterface +{ + return $this->date; +} +``` + +The `date` field will be of type `DateTime`. In the returned JSON response to a query, the date is formatted as a string +in the **ISO8601** format (aka ATOM format). + +
+ PHP DateTime type is not supported. +
+ +## Union types + +Union types for return are supported in GraphQLite as of version 6.0: + +```php +#[Query] +public function companyOrContact(int $id): Company|Contact +{ + // Some code that returns a company or a contact. +} +``` + +## Enum types + +PHP 8.1 introduced native support for Enums. GraphQLite now also supports native enums as of version 5.1. + +```php +#[Type] +enum Status: string +{ + case ON = 'on'; + case OFF = 'off'; + case PENDING = 'pending'; +} +``` + +```php +/** + * @return User[] + */ +#[Query] +public function users(Status $status): array +{ + if ($status === Status::ON) { + // Your logic + } + // ... +} +``` + +```graphql +query users($status: Status!) {} + users(status: $status) { + id + } +} +``` + +By default, the name of the GraphQL enum type will be the name of the class. If you have a naming conflict (two classes +that live in different namespaces with the same class name), you can solve it using the `name` property on the `#[Type]` attribute: + +```php +namespace Model\User; + +#[Type(name: "UserStatus")] +enum Status: string +{ + // ... +} +``` + +### Enum types with myclabs/php-enum + +
+ This implementation is now deprecated and will be removed in the future. You are advised to use native enums instead. +
+ +*Prior to version 5.1, GraphQLite only supported Enums through the 3rd party library, [myclabs/php-enum](https://github.com/myclabs/php-enum). If you'd like to use this implementation you'll first need to add this library as a dependency to your application.* + +```bash +$ composer require myclabs/php-enum +``` + +Now, any class extending the `MyCLabs\Enum\Enum` class will be mapped to a GraphQL enum: + +```php +use MyCLabs\Enum\Enum; + +class StatusEnum extends Enum +{ + private const ON = 'on'; + private const OFF = 'off'; + private const PENDING = 'pending'; +} +``` + +```php +/** + * @return User[] + */ +#[Query] +public function users(StatusEnum $status): array +{ + if ($status == StatusEnum::ON()) { + // Note that the "magic" ON() method returns an instance of the StatusEnum class. + // Also, note that we are comparing this instance using "==" (using "===" would fail as we have 2 different instances here) + // ... + } + // ... +} +``` + +```graphql +query users($status: StatusEnum!) {} + users(status: $status) { + id + } +} +``` + +By default, the name of the GraphQL enum type will be the name of the class. If you have a naming conflict (two classes +that live in different namespaces with the same class name), you can solve it using the `#[EnumType]` attribute: + +```php +use TheCodingMachine\GraphQLite\Annotations\EnumType; + +#[EnumType(name: "UserStatus")] +class StatusEnum extends Enum +{ + // ... +} +``` + +
GraphQLite must be able to find all the classes extending the "MyCLabs\Enum" class +in your project. By default, GraphQLite will look for "Enum" classes in the namespaces declared for the types. For this +reason, your enum classes MUST be in one of the namespaces declared for the types in your GraphQLite +configuration file.
+ +## Deprecation of fields + +You can mark a field as deprecated in your GraphQL Schema by just annotating it with the `@deprecated` PHPDoc annotation. Note that a description (reason) is required for the annotation to be rendered. + +```php +namespace App\Entities; + +use TheCodingMachine\GraphQLite\Annotations\Field; +use TheCodingMachine\GraphQLite\Annotations\Type; + +#[Type] +class Product +{ + // ... + + #[Field] + public function getName(): string + { + return $this->name; + } + + /** + * @deprecated use field `name` instead + */ + #[Field] + public function getProductName(): string + { + return $this->name; + } +} +``` + +This will add the `@deprecated` directive to the field in the GraphQL Schema which sets the `isDeprecated` field to `true` and adds the reason to the `deprecationReason` field in an introspection query. Fields marked as deprecated can still be queried, but will be returned in an introspection query only if `includeDeprecated` is set to `true`. + +```graphql +query { + __type(name: "Product") { + fields(includeDeprecated: true) { + name + isDeprecated + deprecationReason + } + } +} +``` + +## Promise mapping + +GraphQL includes a native \GraphQL\Deferred type. +You can map the return type by adding a detailed `@return` statement in the PHPDoc. +An alternative to the `@return` statement is using `#[Field(outputType: SomeGQLType)]`. + +All the previously mentioned mappings work with Promises, except when a return type is explicitly declared +in the method signature. + +This allows you to use \Overblog\DataLoader\DataLoader as an alternative +for resolving N+1 query issues and caching intermediate results. + +```php +#[Type] +class Product +{ + // ... + + /** + * @return string + */ + #[Field] + public function getName(): Deferred + { + return new Deferred(fn() => $this->name); + } + + #[Field(outputType: "Float")] + public function getPrice(): Deferred + { + return new Deferred(fn() => $this->price); + } + + #[Field(outputType: "[String!]!")] + public function getCategories(#[Autowire('categoryDataLoader')] DataLoader $categoryDataLoader): SyncPromise + { + return $categoryDataLoader->load($this->id)->adoptedPromise; + } +} +``` + +## More scalar types + +Available in GraphQLite 4.0+ + +GraphQL supports "custom" scalar types. GraphQLite supports adding more GraphQL scalar types. + +If you need more types, you can check the [GraphQLite Misc. Types library](https://github.com/thecodingmachine/graphqlite-misc-types). +It adds support for more scalar types out of the box in GraphQLite. + +Or if you have some special needs, [you can develop your own scalar types](custom-types#registering-a-custom-scalar-type-advanced). diff --git a/website/versioned_docs/version-8.0.0/universal-service-providers.md b/website/versioned_docs/version-8.0.0/universal-service-providers.md new file mode 100644 index 0000000000..8375b0e1e4 --- /dev/null +++ b/website/versioned_docs/version-8.0.0/universal-service-providers.md @@ -0,0 +1,74 @@ +--- +id: universal-service-providers +title: "Getting started with a framework compatible with container-interop/service-provider" +sidebar_label: Universal service providers +--- + +[container-interop/service-provider](https://github.com/container-interop/service-provider/) is an experimental project +aiming to bring interoperability between framework module systems. + +If your framework is compatible with [container-interop/service-provider](https://github.com/container-interop/service-provider/), +GraphQLite comes with a service provider that you can leverage. + +## Installation + +Open a terminal in your current project directory and run: + +```console +$ composer require thecodingmachine/graphqlite-universal-service-provider +``` + +## Requirements + +In order to bootstrap GraphQLite, you will need: + +- A PSR-16 cache + +Additionally, you will have to route the HTTP requests to the underlying GraphQL library. + +GraphQLite relies on the [webonyx/graphql-php](http://webonyx.github.io/graphql-php/) library internally. +This library plays well with PSR-7 requests and we provide a [PSR-15 middleware](other-frameworks.mdx). + +## Integration + +Webonyx/graphql-php library requires a [Schema](https://webonyx.github.io/graphql-php/type-system/schema/) in order to resolve +GraphQL queries. The service provider provides this `Schema` class. + +[Checkout the the service-provider documentation](https://github.com/thecodingmachine/graphqlite-universal-service-provider) + +## Sample usage + +```json title="composer.json" +{ + "require": { + "mnapoli/simplex": "^0.5", + "thecodingmachine/graphqlite-universal-service-provider": "^3", + "thecodingmachine/symfony-cache-universal-module": "^1" + }, + "minimum-stability": "dev", + "prefer-stable": true +} +``` + +```php title="index.php" +set('graphqlite.namespace.types', ['App\\Types']); +$container->set('graphqlite.namespace.controllers', ['App\\Controllers']); + +$schema = $container->get(Schema::class); + +// or if you want the PSR-15 middleware: + +$middleware = $container->get(Psr15GraphQLMiddlewareBuilder::class); +``` diff --git a/website/versioned_docs/version-8.0.0/validation.mdx b/website/versioned_docs/version-8.0.0/validation.mdx new file mode 100644 index 0000000000..dde8a9413a --- /dev/null +++ b/website/versioned_docs/version-8.0.0/validation.mdx @@ -0,0 +1,188 @@ +--- +id: validation +title: Validation +sidebar_label: User input validation +--- + +GraphQLite does not handle user input validation by itself. It is out of its scope. + +However, it can integrate with your favorite framework validation mechanism. The way you validate user input will +therefore depend on the framework you are using. + +## Validating user input with Laravel + +If you are using Laravel, jump directly to the [GraphQLite Laravel package advanced documentation](laravel-package-advanced.mdx#support-for-laravel-validation-rules) +to learn how to use the Laravel validation with GraphQLite. + +## Validating user input with Symfony validator + +GraphQLite provides a bridge to use the [Symfony validator](https://symfony.com/doc/current/validation.html) directly in your application. + +- If you are using Symfony and the Symfony GraphQLite bundle, the bridge is available out of the box +- If you are using another framework, the "Symfony validator" component can be used in standalone mode. If you want to + add it to your project, you can require the *thecodingmachine/graphqlite-symfony-validator-bridge* package: + + ```bash + $ composer require thecodingmachine/graphqlite-symfony-validator-bridge + ``` + +### Using the Symfony validator bridge + +Usually, when you use the Symfony validator component, you put attributes in your entities and you validate those entities +using the `Validator` object. + +```php title="UserController.php" +use Symfony\Component\Validator\Validator\ValidatorInterface; +use TheCodingMachine\GraphQLite\Validator\ValidationFailedException + +class UserController +{ + private $validator; + + public function __construct(ValidatorInterface $validator) + { + $this->validator = $validator; + } + + #[Mutation] + public function createUser(string $email, string $password): User + { + $user = new User($email, $password); + + // Let's validate the user + $errors = $this->validator->validate($user); + + // Throw an appropriate GraphQL exception if validation errors are encountered + ValidationFailedException::throwException($errors); + + // No errors? Let's continue and save the user + // ... + } +} +``` + +Validation rules are added directly to the object in the domain model: + +```php title="User.php" +use Symfony\Component\Validator\Constraints as Assert; + +class User +{ + #[Assert\Email(message: "The email '{{ value }}' is not a valid email.", checkMX: true)] + private $email; + + /** + * The NotCompromisedPassword assertion asks the "HaveIBeenPawned" service if your password has already leaked or not. + */ + #[Assert\NotCompromisedPassword] + private $password; + + public function __construct(string $email, string $password) + { + $this->email = $email; + $this->password = $password; + } + + // ... +} +``` + +If a validation fails, GraphQLite will return the failed validations in the "errors" section of the JSON response: + +```json +{ + "errors": [ + { + "message": "The email '\"foo@thisdomaindoesnotexistatall.com\"' is not a valid email.", + "extensions": { + "code": "bf447c1c-0266-4e10-9c6c-573df282e413", + "field": "email" + } + } + ] +} +``` + + +### Using the validator directly on a query / mutation / subscription / factory ... + +If the data entered by the user is mapped to an object, please use the "validator" instance directly as explained in +the last chapter. It is a best practice to put your validation layer as close as possible to your domain model. + +If the data entered by the user is **not** mapped to an object, you can directly annotate your query, mutation, factory... + +
+ You generally don't want to do this. It is a best practice to put your validation constraints +on your domain objects. Only use this technique if you want to validate user input and user input will not be stored +in a domain object. +
+ +Use the `#[Assertion]` attribute to validate directly the user input. + +```php +use Symfony\Component\Validator\Constraints as Assert; +use TheCodingMachine\GraphQLite\Validator\Annotations\Assertion; +use TheCodingMachine\GraphQLite\Annotations\Query; + +#[Query] +#[Assertion(for: "email", constraint: new Assert\Email())] +public function findByMail(string $email): User +{ + // ... +} +``` + +Notice that the "constraint" parameter contains an attribute (it is an attribute wrapped in an attribute). + +You can also pass an array to the `constraint` parameter: + +```php +#[Assertion(for: "email", constraint: [new Assert\NotBlack(), new Assert\Email()])] +``` + +## Custom InputType Validation + +GraphQLite also supports a fully custom validation implementation for all input types defined with an `#[Input]` attribute. This offers a way to validate input types before they're available as a method parameter of your query and mutation controllers. This way, when you're using your query or mutation controllers, you can feel confident that your input type objects have already been validated. + +
+

It's important to note that this validation implementation does not validate input types created with a factory. If you are creating an input type with a factory, or using primitive parameters in your query/mutation controllers, you should be sure to validate these independently. This is strictly for input type objects.

+ +

You can use one of the framework validation libraries listed above or implement your own validation for these cases. If you're using input type objects for most all of your query and mutation controllers, then there is little additional validation concerns with regards to user input. There are many reasons why you should consider defaulting to an InputType object, as opposed to individual arguments, for your queries and mutations. This is just one additional perk.

+
+ +To get started with validation on input types defined by an `#[Input]` attribute, you'll first need to register your validator with the `SchemaFactory`. + +```php +$factory = new SchemaFactory($cache, $this->container); +$factory->addNamespace('App'); +// Register your validator +$factory->setInputTypeValidator($this->container->get('your_validator')); +$factory->createSchema(); +``` + +Your input type validator must implement the `TheCodingMachine\GraphQLite\Types\InputTypeValidatorInterface`, as shown below: + +```php +interface InputTypeValidatorInterface +{ + /** + * Checks to see if the Validator is currently enabled. + */ + public function isEnabled(): bool; + + /** + * Performs the validation of the InputType. + * + * @param object $input The input type object to validate + */ + public function validate(object $input): void; +} +``` + +The interface is quite simple. Handle all of your own validation logic in the `validate` method. For example, you might use Symfony's attribute based validation in addition to some other custom validation logic. It's really up to you on how you wish to handle your own validation. The `validate` method will receive the input type object populated with the user input. + +You'll notice that the `validate` method has a `void` return. The purpose here is to encourage you to throw an Exception or handle validation output however you best see fit. GraphQLite does it's best to stay out of your way and doesn't make attempts to handle validation output. You can, however, throw an instance of `TheCodingMachine\GraphQLite\Exceptions\GraphQLException` or `TheCodingMachine\GraphQLite\Exceptions\GraphQLAggregateException` as usual (see [Error Handling](error-handling) for more details). + +Also available is the `isEnabled` method. This method is checked before executing validation on an InputType being resolved. You can work out your own logic to selectively enable or disable validation through this method. In most cases, you can simply return `true` to keep it always enabled. + +And that's it, now, anytime an input type is resolved, the validator will be executed on that input type immediately after it has been hydrated with user input. diff --git a/website/versioned_sidebars/version-8.0.0-sidebars.json b/website/versioned_sidebars/version-8.0.0-sidebars.json new file mode 100644 index 0000000000..571f243dba --- /dev/null +++ b/website/versioned_sidebars/version-8.0.0-sidebars.json @@ -0,0 +1,58 @@ +{ + "docs": { + "Introduction": [ + "index" + ], + "Installation": [ + "getting-started", + "symfony-bundle", + "laravel-package", + "universal-service-providers", + "other-frameworks" + ], + "Usage": [ + "queries", + "mutations", + "subscriptions", + "type-mapping", + "autowiring", + "extend-type", + "external-type-declaration", + "input-types", + "inheritance-interfaces", + "error-handling", + "validation" + ], + "Security": [ + "authentication-authorization", + "fine-grained-security", + "implementing-security", + "operation-complexity" + ], + "Performance": [ + "query-plan", + "prefetch-method", + "automatic-persisted-queries" + ], + "Advanced": [ + "file-uploads", + "pagination", + "custom-types", + "field-middlewares", + "argument-resolving", + "extend-input-type", + "multiple-output-types", + "symfony-bundle-advanced", + "laravel-package-advanced", + "internals", + "troubleshooting", + "migrating" + ], + "Reference": [ + "doctrine-annotations-attributes", + "annotations-reference", + "semver", + "changelog" + ] + } +} diff --git a/website/versions.json b/website/versions.json index c6985e8cd8..5e6b133e0f 100644 --- a/website/versions.json +++ b/website/versions.json @@ -1,4 +1,5 @@ [ + "8.0.0", "7.0.0", "6.1", "6.0",