QueryComplexity for rate limiting?

[kinimodmeyer]

hello together,

i wonder if it would be possible to use the QueryComplexity rule to build a rate limiting system based on query/return complexity.

// lock other simultaneously request here (can be done with a database)

try {
    $rule = new QueryComplexity($user['credits'] ?? 2000);
    $parseErrors = DocumentValidator::validate(
        $schema,
        Parser::parse($input['query']),
        array_merge(DocumentValidator::defaultRules(), [$rule])
    );
} catch (\Exception $e) {
    $parseErrors[] = $e;
}

if (!empty($parseErrors)) {
    $body = [];
    foreach ($parseErrors as $parseError) {
        $body['errors'][] = $parseError;
    }

    echo json_encode($body);
    return;
}

// deny request with 429 header if "$rule->getQueryComplexity() + already used points"  is bigger then allowed costs

// add "$rule->getQueryComplexity()" to already used points in database
// release other request here and do the heavy "executeQuery" work
$result = GraphQL::executeQuery(
    $schema,
    $input['query'],
    null,
    $context,
    $input['variables'] ?? null,
    null,
    null,
    [] // rules not need to be checked again
);

// lock other simultaneously request here (can be done with a database)
// reduce already used points in database by  diff between real costs and query cost.

1. why got the method getQueryComplexity() removed in Simplify QueryComplexity and focus its implementation #961 (came in with Added function to retrieve the query complexity #531)
2. is there a way to get the real costs after executeQuery got executed? because query could be e.g. 50 costs but not all data was fetched and there for the cost was only 30 and we should give him 20 points. does this has to be done manually in e.g. the the resolve callbacks with a global context object?

[kinimodmeyer]

@spawnia Thanks for moving this into a discussion!
Was it intended that the public method "getQueryComplexity" got removed on your commit?

[kinimodmeyer]

Okay thanks for reply, question two is answered, it has to be done manually.
(If someone else try to build such a behavior keep issue #785 in mind)

[kinimodmeyer]

You can just access the public property. I don't believe in getters.

@spawnia which property do you mean, in #961 the "complexity" property from class "QueryComplexity" got removed.

[spawnia]

I thought you were referencing the removed FieldDefinition::getComplexityFn(), which is removed in favor of the public property FieldDefinition::$complexityFn.

As far as I know, QueryCompexity was not intended to be used in the manner you describe. Why isn't it sufficient for you to simply add it as a validation rule?

[kinimodmeyer]

We builded succesfully a rate limit application with this library.
We use the getter to:

• Give the user feedback how much his current request costed (in the extension field)
• We update in the transactional database system to reduce the credits or cancel the request
• We block simultaneously requests while the DocumentValidator::validate() runs
• We write back credits based on the time since his last request

For all this to work only the getter needs to be there 👍
A normal rate limit model (like x request per second) is not sufficient with graphql.
https://shopify.engineering/rate-limiting-graphql-apis-calculating-query-complexity

@spawnia Can i make a improvement ticket?

[spawnia]

I can see the need to do this validation before. Please formulate an issue in terms of a feature request that describes the problem you are trying to solve without prescribing a specific implementation. I think we can do much better than the previous API.