amboss-mededu / gateway / 33635574540

91%

master: 91%

Build Type

Pull #17

github

Committed by cideM

Commit Message

reserve var name for dependent step node IDs

A query whose fields span two services is split into a plan where the
second step re-enters the remote service through node(id: ...), once per
object the first step returned. The planner declared that argument's
variable as $id, and only when the client had not already declared one
by that name; otherwise it reused the client's declaration. The executor
then assigned the node ID under the same name on every dependent step.

$id is an ordinary name for a client to choose, so the two collided.
Given:

    query ($id: ID!, $category: String!) {
      allUsers {
        favoriteCatPhoto(category: $category, owner: $id) { URL }
      }
    }

where favoriteCatPhoto is owned by a second service, the dependent step
ran once per user with $id set to that user's ID. The owner argument,
which the client meant to pin to a single ID, was silently rewritten to
u1, then u2, then u3. Nothing surfaced an error: the query is valid and
both node(id:) and owner take an ID, so every request succeeded and
returned the wrong photos.

Reusing the client's declaration also inherited its type. A client
declaring $id as String! and using it for a String! argument, which is
legal on its own terms, produced node(id: $id) against node(id: ID!) and
the remote service rejected the entire step.

Give the gateway a name of its own, _gateway_node_id. Since it can never
be one of the client's variables, declare it unconditionally rather than
conditionally reusing whatever is there, and reject operations that
declare it instead of overwriting them silently.

Fixes: 6f691985c345 ("query printing and assembly happens at planning time (#35)")

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #17: planner: reserve a variable name for dependent step node IDs

Coverage Stats

10 of 10 new or added lines in 2 files covered. (100.0%)

28 existing lines in 2 files now uncovered.

2757 of 3018 relevant lines covered (91.35%)

396.5 hits per line