Skip to content

Add GraphQL protocol schema and security specifications - #371

Merged
hotlong merged 4 commits into
mainfrom
copilot/add-graphql-schema-security
Jan 30, 2026
Merged

hotlong merged 4 commits into
mainfrom
copilot/add-graphql-schema-security

Conversation

Copilot AI commented Jan 30, 2026 •

Copy link
Copy Markdown
Contributor

Implements GraphQL protocol definitions for auto-generating type-safe GraphQL APIs from ObjectQL metadata with production-grade security controls.

Schema Generation

Type System

  • ObjectQL→GraphQL type mapping for all 44 field types
  • Type configuration with field customization, interfaces, directives
  • Helper function mapFieldTypeToGraphQL() for runtime mapping

Operations

  • Query config: filtering (10+ operators), sorting, pagination (offset/cursor/relay)
  • Mutation config: CRUD + upsert, transaction control, lifecycle hooks
  • Subscription config: real-time events with filtering and payload customization
  • Resolver config: datasource, computed, script, proxy implementations
  • DataLoader config: N+1 prevention with batching/caching controls

Example Usage

import { GraphQLConfig } from '@objectstack/spec/api';

const config = GraphQLConfig.create({
  path: '/graphql',
  schema: {
    queries: [{
      name: 'customers',
      object: 'customer',
      type: 'list',
      pagination: { type: 'relay', maxLimit: 100 },
      filtering: { operators: ['eq', 'contains', 'in'] }
    }]
  },
  security: {
    complexity: { maxComplexity: 5000 },
    depthLimit: { maxDepth: 8 },
    rateLimit: { strategy: 'cost_based' }
  }
});

Security Controls

  • Query Depth Limiting: Max nesting levels with configurable violations handling
  • Query Complexity: Per-field scoring, list multipliers, custom calculators
  • Rate Limiting: Token bucket/fixed window/sliding window/cost-based strategies
  • Persisted Queries: APQ with SHA256/SHA1/MD5, query allow lists, multi-store support (memory/Redis/DB/file)

Files

  • packages/spec/src/api/graphql.zod.ts - 14 Zod schemas (983 lines)
  • packages/spec/src/api/graphql.test.ts - 77 test cases
  • Auto-generated JSON schemas and documentation
Original prompt

2.1 GraphQL Protocol / GraphQL协议

In THIS Repo (Spec Definitions) / 在本仓库(规范定义)

GraphQL Schema Generation Protocol

Create packages/spec/src/api/graphql.zod.ts
GraphQL type mapping from ObjectQL
Query generation configuration
Mutation generation configuration
Subscription configuration
Resolver configuration schema
DataLoader configuration schema
GraphQL directive schema
GraphQL Security Protocol

Add to packages/spec/src/api/graphql.zod.ts
Query depth limiting schema
Query complexity calculation schema
Rate limiting configuration
Persisted query configuration


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

@vercel

vercel Bot commented Jan 30, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
spec Ready Ready Preview, Comment Jan 30, 2026 1:23am

Request Review

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>
Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>
…t/deny list

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>
Copilot AI changed the title [WIP] Add GraphQL schema generation and security protocols Add GraphQL protocol schema and security specifications Jan 30, 2026
Copilot AI requested a review from hotlong January 30, 2026 01:24
@hotlong
hotlong marked this pull request as ready for review January 30, 2026 01:40
Copilot AI review requested due to automatic review settings January 30, 2026 01:40
@hotlong
hotlong merged commit 4ff61b7 into main Jan 30, 2026
2 checks passed

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR implements comprehensive GraphQL protocol specifications for ObjectStack, enabling auto-generation of type-safe GraphQL APIs from ObjectQL metadata with production-grade security controls.

Changes:

  • Added complete GraphQL schema generation protocol with type mapping, query/mutation/subscription configurations, and resolver definitions
  • Implemented security protocols including query depth limiting, complexity calculation, rate limiting, and persisted queries
  • Generated JSON schemas and documentation for all GraphQL configurations

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated no comments.

Show a summary per file
File Description
packages/spec/src/api/index.ts Exports the new GraphQL module
packages/spec/src/api/graphql.zod.ts Core GraphQL protocol definitions with 14 Zod schemas and helper functions
packages/spec/src/api/graphql.test.ts Comprehensive test coverage with 77 test cases
packages/spec/json-schema/api/*.json Auto-generated JSON schemas for all GraphQL configurations
content/docs/references/api/graphql.mdx Auto-generated API documentation
content/docs/references/api/meta.json Updated navigation to include GraphQL documentation
content/docs/references/api/index.mdx Added GraphQL to API reference index

This branch was successfully deployed

1 active deployment
Preview — e3594081 Deployed Jan 30, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants