ObjectFieldResolver::denyAccessUnlessGranted() - Code Metrics - Inspection of "Security role" - ynloultratech/graphql-bundle - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Pull Request — master (#7)

by Yonel Ceruto

created 2018-01-18 18:21 UTC

ObjectFieldResolver::denyAccessUnlessGranted() A

↳ Parent: ObjectFieldResolver

Complexity

Conditions	4
Paths	4

Size

Total Lines	10
Code Lines	6

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	3
CRAP Score	4

Importance

Changes

Metric	Value
dl	0
loc	10
ccs	3
cts	3
cp	1
rs	9.2
c	0
b	0
f	0
cc	4
eloc	6
nc	4
nop	1
crap	4

<?php
/*******************************************************************************
 *  This file is part of the GraphQL Bundle package.
 *
 *  (c) YnloUltratech <[email protected]>
 *
 *  For the full copyright and license information, please view the LICENSE
 *  file that was distributed with this source code.
 ******************************************************************************/

namespace Ynlo\GraphQLBundle\Resolver;

use Doctrine\Common\Collections\Collection;
use Doctrine\Common\Persistence\Proxy;
use GraphQL\Deferred;
use GraphQL\Error\Error;
use GraphQL\Type\Definition\ResolveInfo;
use Symfony\Component\DependencyInjection\ContainerAwareInterface;
use Symfony\Component\DependencyInjection\ContainerAwareTrait;
use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\PropertyAccess\PropertyAccessor;
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationCredentialsNotFoundException;
use Ynlo\GraphQLBundle\Definition\FieldDefinition;
use Ynlo\GraphQLBundle\Definition\FieldsAwareDefinitionInterface;
use Ynlo\GraphQLBundle\Definition\QueryDefinition;
use Ynlo\GraphQLBundle\Definition\Registry\Endpoint;
use Ynlo\GraphQLBundle\Model\ID;
use Ynlo\GraphQLBundle\Model\NodeInterface;
use Ynlo\GraphQLBundle\Type\Definition\EndpointAwareInterface;
use Ynlo\GraphQLBundle\Type\Definition\EndpointAwareTrait;
use Ynlo\GraphQLBundle\Type\Types;

/**
 * Default resolver for all object fields
 */
class ObjectFieldResolver implements ContainerAwareInterface, EndpointAwareInterface
{
    use ContainerAwareTrait;
    use EndpointAwareTrait;

    /**
     * @var int[]
     */
    private static $concurrentUsages = [];

    protected $definition;
    protected $deferredBuffer;
    protected $authorizationChecker;

    public function __construct(ContainerInterface $container, Endpoint $endpoint, FieldsAwareDefinitionInterface $definition, DeferredBuffer $deferredBuffer, AuthorizationCheckerInterface $authorizationChecker)
    {
        $this->container = $container;
        $this->endpoint = $endpoint;
        $this->definition = $definition;
        $this->deferredBuffer = $deferredBuffer;
        $this->authorizationChecker = $authorizationChecker;
    }

    /**
     * @param mixed       $root
     * @param array       $args
     * @param mixed       $context
     * @param ResolveInfo $info
     *
     * @return mixed|null|string
     *
     * @throws \Exception
     */
    public function __invoke($root, array $args, $context, ResolveInfo $info)
    {
        $value = null;
        $fieldDefinition = $this->definition->getField($info->fieldName);
        $this->verifyConcurrentUsage($fieldDefinition);
        $this->denyAccessUnlessGranted($fieldDefinition);

        //when use external resolver or use a object method with arguments
        if (($resolver = $fieldDefinition->getResolver()) || $fieldDefinition->getArguments()) {
            $queryDefinition = new QueryDefinition();
            $queryDefinition->setName($fieldDefinition->getName());
            $queryDefinition->setType($fieldDefinition->getType());
            $queryDefinition->setNode($fieldDefinition->getNode());
            $queryDefinition->setArguments($fieldDefinition->getArguments());
            $queryDefinition->setList($fieldDefinition->isList());
            $queryDefinition->setRoles($fieldDefinition->getRoles());
            $queryDefinition->setMetas($fieldDefinition->getMetas());

            if ($resolver) {
''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
                $queryDefinition->setResolver($resolver);
            } elseif ($fieldDefinition->getOriginType() === \ReflectionMethod::class) {
                $queryDefinition->setResolver($fieldDefinition->getOriginName());
            }

            $resolver = new ResolverExecutor($this->container, $this->endpoint, $queryDefinition);
            $value = $resolver($root, $args, $context, $info);
        } else {
            $accessor = new PropertyAccessor(true);
            $originName = $fieldDefinition->getOriginName() ?: $fieldDefinition->getName();
            $value = $accessor->getValue($root, $originName);
        }

        if (null !== $value && Types::ID === $fieldDefinition->getType()) {
            //ID are formed with base64 representation of the Types and real database ID
            //in order to create a unique and global identifier for each resource
            //@see https://facebook.github.io/relay/docs/graphql-object-identification.html
            if ($value instanceof ID) {
                $value = (string) $value;
            } else {
                $value = (string) new ID($this->definition->getName(), $value);
            }
        }

        if ($value instanceof Collection) {
            $value = $value->toArray();
        }

        if ($value instanceof Proxy && $value instanceof NodeInterface && !$value->__isInitialized()) {
            $this->deferredBuffer->add($value);

            return new Deferred(
                function () use ($value) {
                    $this->deferredBuffer->loadBuffer();

                    return $this->deferredBuffer->getLoadedEntity($value);
                }
            );
        }

        return $value;
    }

    /**
     * @param FieldDefinition $definition
     *
     * @throws Error
     */
    private function verifyConcurrentUsage(FieldDefinition $definition)
    {
        if ($maxConcurrentUsage = $definition->getMaxConcurrentUsage()) {
            $oid = spl_object_hash($definition);
            $usages = static::$concurrentUsages[$oid] ?? 1;

            if ($usages > $maxConcurrentUsage) {
                if (1 === $maxConcurrentUsage) {
                    $error = sprintf(
                        'The field "%s" can be fetched only once per query. This field can`t be used in a list.',
                        $definition->getName()
                    );
                } else {
                    $error = sprintf(
                        'The field "%s" can`t be fetched more than %s times per query.',
                        $definition->getName(),
                        $maxConcurrentUsage
                    );
                }
                throw new Error($error);
            }
            static::$concurrentUsages[$oid] = $usages + 1;
        }
    }

    /**
     * @throws Error
     */
    private function denyAccessUnlessGranted(FieldDefinition $fieldDefinition): void
    {
        if ($fieldDefinition->hasMeta('roles')) {
            $roles = $fieldDefinition->getMeta('roles');
        } else {
            $roles = $fieldDefinition->getRoles();
        }

        if ($roles && !$this->authorizationChecker->isGranted($roles, $fieldDefinition)) {
            throw new Error(sprintf('Access denied to "%s" field', $fieldDefinition->getName()));
        }
    }
}


1		<?php
2		/*******************************************************************************
3		* This file is part of the GraphQL Bundle package.
4		*
5		* (c) YnloUltratech <[email protected]>
6		*
7		* For the full copyright and license information, please view the LICENSE
8		* file that was distributed with this source code.
9		******************************************************************************/
10
11		namespace Ynlo\GraphQLBundle\Resolver;
12
13		use Doctrine\Common\Collections\Collection;
14		use Doctrine\Common\Persistence\Proxy;
15		use GraphQL\Deferred;
16		use GraphQL\Error\Error;
17		use GraphQL\Type\Definition\ResolveInfo;
18		use Symfony\Component\DependencyInjection\ContainerAwareInterface;
19		use Symfony\Component\DependencyInjection\ContainerAwareTrait;
20		use Symfony\Component\DependencyInjection\ContainerInterface;
21		use Symfony\Component\PropertyAccess\PropertyAccessor;
22		use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
23		use Symfony\Component\Security\Core\Exception\AuthenticationCredentialsNotFoundException;
24		use Ynlo\GraphQLBundle\Definition\FieldDefinition;
25		use Ynlo\GraphQLBundle\Definition\FieldsAwareDefinitionInterface;
26		use Ynlo\GraphQLBundle\Definition\QueryDefinition;
27		use Ynlo\GraphQLBundle\Definition\Registry\Endpoint;
28		use Ynlo\GraphQLBundle\Model\ID;
29		use Ynlo\GraphQLBundle\Model\NodeInterface;
30		use Ynlo\GraphQLBundle\Type\Definition\EndpointAwareInterface;
31		use Ynlo\GraphQLBundle\Type\Definition\EndpointAwareTrait;
32		use Ynlo\GraphQLBundle\Type\Types;
33
34		/**
35		* Default resolver for all object fields
36		*/
37		class ObjectFieldResolver implements ContainerAwareInterface, EndpointAwareInterface
38		{
39		use ContainerAwareTrait;
40		use EndpointAwareTrait;
41
42		/**
43		* @var int[]
44		*/
45		private static $concurrentUsages = [];
46
47		protected $definition;
48		protected $deferredBuffer;
49		protected $authorizationChecker;
50
51		public function __construct(ContainerInterface $container, Endpoint $endpoint, FieldsAwareDefinitionInterface $definition, DeferredBuffer $deferredBuffer, AuthorizationCheckerInterface $authorizationChecker)
52		{
53		$this->container = $container;
54		$this->endpoint = $endpoint;
55		$this->definition = $definition;
56		$this->deferredBuffer = $deferredBuffer;
57		$this->authorizationChecker = $authorizationChecker;
58		}
59
60		/**
61		* @param mixed $root
62	22	* @param array $args
63		* @param mixed $context
64	22	* @param ResolveInfo $info
65	22	*
66	22	* @return mixed\|null\|string
67	22	*
68	22	* @throws \Exception
69		*/
70		public function __invoke($root, array $args, $context, ResolveInfo $info)
71		{
72		$value = null;
73		$fieldDefinition = $this->definition->getField($info->fieldName);
74		$this->verifyConcurrentUsage($fieldDefinition);
75		$this->denyAccessUnlessGranted($fieldDefinition);
76
77		//when use external resolver or use a object method with arguments
78		if (($resolver = $fieldDefinition->getResolver()) \|\| $fieldDefinition->getArguments()) {
79		$queryDefinition = new QueryDefinition();
80	22	$queryDefinition->setName($fieldDefinition->getName());
81		$queryDefinition->setType($fieldDefinition->getType());
82	22	$queryDefinition->setNode($fieldDefinition->getNode());
83	22	$queryDefinition->setArguments($fieldDefinition->getArguments());
84	22	$queryDefinition->setList($fieldDefinition->isList());
85		$queryDefinition->setRoles($fieldDefinition->getRoles());
86		$queryDefinition->setMetas($fieldDefinition->getMetas());
87	22
88	19	if ($resolver) {
		0 ignored issues – show Bug Best Practice introduced 2018-01-12 18:21 UTC by Report Bug Copy Issue Report The expression `$resolver` of type `null\|string` is loosely compared to `true`; this is ambiguous if the string can be empty. You might want to explicitly use `!== null` instead. In PHP, under loose comparison (like `==`, or `!=`, or `switch` conditions), values of different types might be equal. For `string` values, the empty string `''` is a special case, in particular the following results might be unexpected: '' == false // true '' == null // true 'ab' == false // false 'ab' == null // false // It is often better to use strict comparison '' === false // false '' === null // false Loading history...
89	19	$queryDefinition->setResolver($resolver);
90	19	} elseif ($fieldDefinition->getOriginType() === \ReflectionMethod::class) {
91	19	$queryDefinition->setResolver($fieldDefinition->getOriginName());
92	19	}
93	19
94	19	$resolver = new ResolverExecutor($this->container, $this->endpoint, $queryDefinition);
95		$value = $resolver($root, $args, $context, $info);
96	19	} else {
97		$accessor = new PropertyAccessor(true);
98		$originName = $fieldDefinition->getOriginName() ?: $fieldDefinition->getName();
99		$value = $accessor->getValue($root, $originName);
100		}
101	19
102		if (null !== $value && Types::ID === $fieldDefinition->getType()) {
103		//ID are formed with base64 representation of the Types and real database ID
104	19	//in order to create a unique and global identifier for each resource
105	19	//@see https://facebook.github.io/relay/docs/graphql-object-identification.html
106		if ($value instanceof ID) {
107	22	$value = (string) $value;
108	22	} else {
109	22	$value = (string) new ID($this->definition->getName(), $value);
110		}
111		}
112	22
113		if ($value instanceof Collection) {
114		$value = $value->toArray();
115		}
116	17
117	2	if ($value instanceof Proxy && $value instanceof NodeInterface && !$value->__isInitialized()) {
118		$this->deferredBuffer->add($value);
119	16
120		return new Deferred(
121		function () use ($value) {
122		$this->deferredBuffer->loadBuffer();
123	22
124	3	return $this->deferredBuffer->getLoadedEntity($value);
125		}
126		);
127	22	}
128	3
129		return $value;
130	3	}
131	3
132	3	/**
133		* @param FieldDefinition $definition
134	3	*
135	3	* @throws Error
136		*/
137		private function verifyConcurrentUsage(FieldDefinition $definition)
138		{
139	22	if ($maxConcurrentUsage = $definition->getMaxConcurrentUsage()) {
140		$oid = spl_object_hash($definition);
141		$usages = static::$concurrentUsages[$oid] ?? 1;
		0 ignored issues – show Bug introduced 2018-01-10 00:35 UTC by Report Bug Copy Issue Report Since `$concurrentUsages` is declared private, accessing it with `static` will lead to errors in possible sub-classes; you can either use `self`, or increase the visibility of `$concurrentUsages` to at least protected. Loading history...
142		if ($usages > $maxConcurrentUsage) {
143		if (1 === $maxConcurrentUsage) {
144		$error = sprintf(
145		'The field "%s" can be fetched only once per query. This field can`t be used in a list.',
146		$definition->getName()
147	22	);
148		} else {
149	22	$error = sprintf(
150	2	'The field "%s" can`t be fetched more than %s times per query.',
151	2	$definition->getName(),
152	2	$maxConcurrentUsage
153	1	);
154	1	}
155	1	throw new Error($error);
156	1	}
157		static::$concurrentUsages[$oid] = $usages + 1;
158		}
159		}
160
161		/**
162		* @throws Error
163		*/
164		private function denyAccessUnlessGranted(FieldDefinition $fieldDefinition): void
165	1	{
166		if ($fieldDefinition->hasMeta('roles')) {
167	1	$roles = $fieldDefinition->getMeta('roles');
168		} else {
169	22	$roles = $fieldDefinition->getRoles();
170		}
171
172		if ($roles && !$this->authorizationChecker->isGranted($roles, $fieldDefinition)) {
173		throw new Error(sprintf('Access denied to "%s" field', $fieldDefinition->getName()));
174		}
175		}
176		}
177

ynloultratech / graphql-bundle

Pull Request — master (#7)

ObjectFieldResolver::denyAccessUnlessGranted() A

Complexity

Size

Duplication

Code Coverage

Importance

Duplication Side-by-Side

Filter issues like