ObjectFieldResolver::denyAccessUnlessGranted() - Code Metrics - Inspection of "Security role" - ynloultratech/graphql-bundle - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Pull Request — master (#7)

by Yonel Ceruto

created 2018-01-18 18:27 UTC

ObjectFieldResolver::denyAccessUnlessGranted() A

↳ Parent: ObjectFieldResolver

Complexity

Conditions	4
Paths	4

Size

Total Lines	10
Code Lines	6

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	4
CRAP Score	4.5923

Importance

Changes

Metric	Value
dl	0
loc	10
ccs	4
cts	6
cp	0.6667
rs	9.2
c	0
b	0
f	0
cc	4
eloc	6
nc	4
nop	1
crap	4.5923

<?php
/*******************************************************************************
 *  This file is part of the GraphQL Bundle package.
 *
 *  (c) YnloUltratech <[email protected]>
 *
 *  For the full copyright and license information, please view the LICENSE
 *  file that was distributed with this source code.
 ******************************************************************************/

namespace Ynlo\GraphQLBundle\Resolver;

use Doctrine\Common\Collections\Collection;
use Doctrine\Common\Persistence\Proxy;
use GraphQL\Deferred;
use GraphQL\Error\Error;
use GraphQL\Type\Definition\ResolveInfo;
use Symfony\Component\DependencyInjection\ContainerAwareInterface;
use Symfony\Component\DependencyInjection\ContainerAwareTrait;
use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\PropertyAccess\PropertyAccessor;
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationCredentialsNotFoundException;
use Ynlo\GraphQLBundle\Definition\FieldDefinition;
use Ynlo\GraphQLBundle\Definition\FieldsAwareDefinitionInterface;
use Ynlo\GraphQLBundle\Definition\QueryDefinition;
use Ynlo\GraphQLBundle\Definition\Registry\Endpoint;
use Ynlo\GraphQLBundle\Model\ID;
use Ynlo\GraphQLBundle\Model\NodeInterface;
use Ynlo\GraphQLBundle\Type\Definition\EndpointAwareInterface;
use Ynlo\GraphQLBundle\Type\Definition\EndpointAwareTrait;
use Ynlo\GraphQLBundle\Type\Types;

/**
 * Default resolver for all object fields
 */
class ObjectFieldResolver implements ContainerAwareInterface, EndpointAwareInterface
{
    use ContainerAwareTrait;
    use EndpointAwareTrait;

    /**
     * @var int[]
     */
    private static $concurrentUsages = [];

    protected $definition;
    protected $deferredBuffer;
    protected $authorizationChecker;

    public function __construct(ContainerInterface $container, Endpoint $endpoint, FieldsAwareDefinitionInterface $definition, DeferredBuffer $deferredBuffer, AuthorizationCheckerInterface $authorizationChecker)
    {
        $this->container = $container;
        $this->endpoint = $endpoint;
        $this->definition = $definition;
        $this->deferredBuffer = $deferredBuffer;
        $this->authorizationChecker = $authorizationChecker;
    }

    /**
     * @param mixed       $root
     * @param array       $args
     * @param mixed       $context
     * @param ResolveInfo $info
     *
     * @return mixed|null|string
     *
     * @throws \Exception
     */
    public function __invoke($root, array $args, $context, ResolveInfo $info)
    {
        $value = null;
        $fieldDefinition = $this->definition->getField($info->fieldName);
        $this->verifyConcurrentUsage($fieldDefinition);
        $this->denyAccessUnlessGranted($fieldDefinition);

        //when use external resolver or use a object method with arguments
        if (($resolver = $fieldDefinition->getResolver()) || $fieldDefinition->getArguments()) {
            $queryDefinition = new QueryDefinition();
            $queryDefinition->setName($fieldDefinition->getName());
            $queryDefinition->setType($fieldDefinition->getType());
            $queryDefinition->setNode($fieldDefinition->getNode());
            $queryDefinition->setArguments($fieldDefinition->getArguments());
            $queryDefinition->setList($fieldDefinition->isList());
            $queryDefinition->setRoles($fieldDefinition->getRoles());
            $queryDefinition->setMetas($fieldDefinition->getMetas());

            if ($resolver) {
''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
                $queryDefinition->setResolver($resolver);
            } elseif ($fieldDefinition->getOriginType() === \ReflectionMethod::class) {
                $queryDefinition->setResolver($fieldDefinition->getOriginName());
            }

            $resolver = new ResolverExecutor($this->container, $this->endpoint, $queryDefinition);
            $value = $resolver($root, $args, $context, $info);
        } else {
            $accessor = new PropertyAccessor(true);
            $originName = $fieldDefinition->getOriginName() ?: $fieldDefinition->getName();
            $value = $accessor->getValue($root, $originName);
        }

        if (null !== $value && Types::ID === $fieldDefinition->getType()) {
            //ID are formed with base64 representation of the Types and real database ID
            //in order to create a unique and global identifier for each resource
            //@see https://facebook.github.io/relay/docs/graphql-object-identification.html
            if ($value instanceof ID) {
                $value = (string) $value;
            } else {
                $value = (string) new ID($this->definition->getName(), $value);
            }
        }

        if ($value instanceof Collection) {
            $value = $value->toArray();
        }

        if ($value instanceof Proxy && $value instanceof NodeInterface && !$value->__isInitialized()) {
            $this->deferredBuffer->add($value);

            return new Deferred(
                function () use ($value) {
                    $this->deferredBuffer->loadBuffer();

                    return $this->deferredBuffer->getLoadedEntity($value);
                }
            );
        }

        return $value;
    }

    /**
     * @param FieldDefinition $definition
     *
     * @throws Error
     */
    private function verifyConcurrentUsage(FieldDefinition $definition)
    {
        if ($maxConcurrentUsage = $definition->getMaxConcurrentUsage()) {
            $oid = spl_object_hash($definition);
            $usages = static::$concurrentUsages[$oid] ?? 1;

            if ($usages > $maxConcurrentUsage) {
                if (1 === $maxConcurrentUsage) {
                    $error = sprintf(
                        'The field "%s" can be fetched only once per query. This field can`t be used in a list.',
                        $definition->getName()
                    );
                } else {
                    $error = sprintf(
                        'The field "%s" can`t be fetched more than %s times per query.',
                        $definition->getName(),
                        $maxConcurrentUsage
                    );
                }
                throw new Error($error);
            }
            static::$concurrentUsages[$oid] = $usages + 1;
        }
    }

    /**
     * @throws Error
     */
    private function denyAccessUnlessGranted(FieldDefinition $fieldDefinition): void
    {
        if ($fieldDefinition->hasMeta('roles')) {
            $roles = $fieldDefinition->getMeta('roles');
        } else {
            $roles = $fieldDefinition->getRoles();
        }

        if ($roles && !$this->authorizationChecker->isGranted($roles, $fieldDefinition)) {
            throw new Error(sprintf('Access denied to "%s" field', $fieldDefinition->getName()));
        }
    }
}


1		<?php
2		/*******************************************************************************
3		* This file is part of the GraphQL Bundle package.
4		*
5		* (c) YnloUltratech <[email protected]>
6		*
7		* For the full copyright and license information, please view the LICENSE
8		* file that was distributed with this source code.
9		******************************************************************************/
10
11		namespace Ynlo\GraphQLBundle\Resolver;
12
13		use Doctrine\Common\Collections\Collection;
14		use Doctrine\Common\Persistence\Proxy;
15		use GraphQL\Deferred;
16		use GraphQL\Error\Error;
17		use GraphQL\Type\Definition\ResolveInfo;
18		use Symfony\Component\DependencyInjection\ContainerAwareInterface;
19		use Symfony\Component\DependencyInjection\ContainerAwareTrait;
20		use Symfony\Component\DependencyInjection\ContainerInterface;
21		use Symfony\Component\PropertyAccess\PropertyAccessor;
22		use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
23		use Symfony\Component\Security\Core\Exception\AuthenticationCredentialsNotFoundException;
24		use Ynlo\GraphQLBundle\Definition\FieldDefinition;
25		use Ynlo\GraphQLBundle\Definition\FieldsAwareDefinitionInterface;
26		use Ynlo\GraphQLBundle\Definition\QueryDefinition;
27		use Ynlo\GraphQLBundle\Definition\Registry\Endpoint;
28		use Ynlo\GraphQLBundle\Model\ID;
29		use Ynlo\GraphQLBundle\Model\NodeInterface;
30		use Ynlo\GraphQLBundle\Type\Definition\EndpointAwareInterface;
31		use Ynlo\GraphQLBundle\Type\Definition\EndpointAwareTrait;
32		use Ynlo\GraphQLBundle\Type\Types;
33
34		/**
35		* Default resolver for all object fields
36		*/
37		class ObjectFieldResolver implements ContainerAwareInterface, EndpointAwareInterface
38		{
39		use ContainerAwareTrait;
40		use EndpointAwareTrait;
41
42		/**
43		* @var int[]
44		*/
45		private static $concurrentUsages = [];
46
47		protected $definition;
48		protected $deferredBuffer;
49		protected $authorizationChecker;
50
51	22	public function __construct(ContainerInterface $container, Endpoint $endpoint, FieldsAwareDefinitionInterface $definition, DeferredBuffer $deferredBuffer, AuthorizationCheckerInterface $authorizationChecker)
52		{
53	22	$this->container = $container;
54	22	$this->endpoint = $endpoint;
55	22	$this->definition = $definition;
56	22	$this->deferredBuffer = $deferredBuffer;
57	22	$this->authorizationChecker = $authorizationChecker;
58	22	}
59
60		/**
61		* @param mixed $root
62		* @param array $args
63		* @param mixed $context
64		* @param ResolveInfo $info
65		*
66		* @return mixed\|null\|string
67		*
68		* @throws \Exception
69		*/
70	22	public function __invoke($root, array $args, $context, ResolveInfo $info)
71		{
72	22	$value = null;
73	22	$fieldDefinition = $this->definition->getField($info->fieldName);
74	22	$this->verifyConcurrentUsage($fieldDefinition);
75	22	$this->denyAccessUnlessGranted($fieldDefinition);
76
77		//when use external resolver or use a object method with arguments
78	22	if (($resolver = $fieldDefinition->getResolver()) \|\| $fieldDefinition->getArguments()) {
79	19	$queryDefinition = new QueryDefinition();
80	19	$queryDefinition->setName($fieldDefinition->getName());
81	19	$queryDefinition->setType($fieldDefinition->getType());
82	19	$queryDefinition->setNode($fieldDefinition->getNode());
83	19	$queryDefinition->setArguments($fieldDefinition->getArguments());
84	19	$queryDefinition->setList($fieldDefinition->isList());
85	19	$queryDefinition->setRoles($fieldDefinition->getRoles());
86	19	$queryDefinition->setMetas($fieldDefinition->getMetas());
87
88	19	if ($resolver) {
		0 ignored issues – show Bug Best Practice introduced 2018-01-12 18:21 UTC by Report Bug Copy Issue Report The expression `$resolver` of type `null\|string` is loosely compared to `true`; this is ambiguous if the string can be empty. You might want to explicitly use `!== null` instead. In PHP, under loose comparison (like `==`, or `!=`, or `switch` conditions), values of different types might be equal. For `string` values, the empty string `''` is a special case, in particular the following results might be unexpected: '' == false // true '' == null // true 'ab' == false // false 'ab' == null // false // It is often better to use strict comparison '' === false // false '' === null // false Loading history...
89	19	$queryDefinition->setResolver($resolver);
90		} elseif ($fieldDefinition->getOriginType() === \ReflectionMethod::class) {
91		$queryDefinition->setResolver($fieldDefinition->getOriginName());
92		}
93
94	19	$resolver = new ResolverExecutor($this->container, $this->endpoint, $queryDefinition);
95	19	$value = $resolver($root, $args, $context, $info);
96		} else {
97	22	$accessor = new PropertyAccessor(true);
98	22	$originName = $fieldDefinition->getOriginName() ?: $fieldDefinition->getName();
99	22	$value = $accessor->getValue($root, $originName);
100		}
101
102	22	if (null !== $value && Types::ID === $fieldDefinition->getType()) {
103		//ID are formed with base64 representation of the Types and real database ID
104		//in order to create a unique and global identifier for each resource
105		//@see https://facebook.github.io/relay/docs/graphql-object-identification.html
106	17	if ($value instanceof ID) {
107	2	$value = (string) $value;
108		} else {
109	16	$value = (string) new ID($this->definition->getName(), $value);
110		}
111		}
112
113	22	if ($value instanceof Collection) {
114	3	$value = $value->toArray();
115		}
116
117	22	if ($value instanceof Proxy && $value instanceof NodeInterface && !$value->__isInitialized()) {
118	4	$this->deferredBuffer->add($value);
119
120	4	return new Deferred(
121	4	function () use ($value) {
122	4	$this->deferredBuffer->loadBuffer();
123
124	4	return $this->deferredBuffer->getLoadedEntity($value);
125	4	}
126		);
127		}
128
129	22	return $value;
130		}
131
132		/**
133		* @param FieldDefinition $definition
134		*
135		* @throws Error
136		*/
137	22	private function verifyConcurrentUsage(FieldDefinition $definition)
138		{
139	22	if ($maxConcurrentUsage = $definition->getMaxConcurrentUsage()) {
140	2	$oid = spl_object_hash($definition);
141	2	$usages = static::$concurrentUsages[$oid] ?? 1;
		0 ignored issues – show Bug introduced 2018-01-10 00:35 UTC by Report Bug Copy Issue Report Since `$concurrentUsages` is declared private, accessing it with `static` will lead to errors in possible sub-classes; you can either use `self`, or increase the visibility of `$concurrentUsages` to at least protected. Loading history...
142	2	if ($usages > $maxConcurrentUsage) {
143	1	if (1 === $maxConcurrentUsage) {
144	1	$error = sprintf(
145	1	'The field "%s" can be fetched only once per query. This field can`t be used in a list.',
146	1	$definition->getName()
147		);
148		} else {
149		$error = sprintf(
150		'The field "%s" can`t be fetched more than %s times per query.',
151		$definition->getName(),
152		$maxConcurrentUsage
153		);
154		}
155	1	throw new Error($error);
156		}
157	1	static::$concurrentUsages[$oid] = $usages + 1;
158		}
159	22	}
160
161		/**
162		* @throws Error
163		*/
164	22	private function denyAccessUnlessGranted(FieldDefinition $fieldDefinition): void
165		{
166	22	if ($fieldDefinition->hasMeta('roles')) {
167		$roles = $fieldDefinition->getMeta('roles');
168		} else {
169	22	$roles = $fieldDefinition->getRoles();
170		}
171
172	22	if ($roles && !$this->authorizationChecker->isGranted($roles, $fieldDefinition)) {
173		throw new Error(sprintf('Access denied to "%s" field', $fieldDefinition->getName()));
174		}
175	22	}
176		}
177

ynloultratech / graphql-bundle

Pull Request — master (#7)

ObjectFieldResolver::denyAccessUnlessGranted() A

Complexity

Size

Duplication

Code Coverage

Importance

Duplication Side-by-Side

Filter issues like