Method GraphqlHandler

internal/http_handlers/graphql.go:217–315

GraphqlHandler is the main handler that handles all GraphQL requests.

()

// GraphqlHandler is the main handler that handles all GraphQL requests.
func (h *httpProvider) GraphqlHandler() gin.HandlerFunc {
	gqlProvider, err := graphql.New(h.Config, &graphql.Dependencies{
		Log:                   h.Log,
		AuditProvider:         h.AuditProvider,
		AuthenticatorProvider: h.AuthenticatorProvider,
		EmailProvider:         h.EmailProvider,
		EventsProvider:        h.EventsProvider,
		MemoryStoreProvider:   h.MemoryStoreProvider,
		SMSProvider:           h.SMSProvider,
		StorageProvider:       h.StorageProvider,
		TokenProvider:         h.TokenProvider,
		ServiceProvider:       h.ServiceProvider,
		AuthzEngine:           h.AuthzEngine,
	})
	if err != nil {
		h.Log.Error().Err(err).Msg("Failed to create graphql provider")
		return func(c *gin.Context) {
			c.JSON(http.StatusServiceUnavailable, gin.H{
				"error":             "graphql_unavailable",
				"error_description": "GraphQL service failed to initialize.",
			})
		}
	}

	// NewExecutableSchema and Config are in the generated.go file
	// Resolver is in the resolver.go file
	srv := handler.New(generated.NewExecutableSchema(generated.Config{Resolvers: &graph.Resolver{
		GraphQLProvider: gqlProvider,
	}}))

	srv.AddTransport(transport.Options{})
	// transport.GET is intentionally omitted: GraphQL queries (and especially
	// mutations) over GET leak into proxy/server logs and browser history.
	// Clients must POST.
	srv.AddTransport(transport.POST{})

	srv.SetQueryCache(lru.New[*ast.QueryDocument](1000))
	srv.AroundFields(h.gqlCollectResolvedFieldsMiddleware())
	srv.AroundOperations(h.gqlMetricsMiddleware())
	if h.Config.EnableGraphQLIntrospection {
		srv.Use(extension.Introspection{})
	}
	srv.Use(extension.AutomaticPersistedQuery{
		Cache: lru.New[string](100),
	})

	// Limit query depth, alias count, AND complexity through a single
	// extension so all three rejections share one Prometheus counter
	// (authorizer_graphql_limit_rejections_total). Defaults applied if
	// config is unset.
	maxComplexity := h.Config.GraphQLMaxComplexity
	if maxComplexity <= 0 {
		maxComplexity = 300
	}
	maxDepth := h.Config.GraphQLMaxDepth
	if maxDepth <= 0 {
		maxDepth = 15
	}