infinityloop-dev/graphpinator-query-cost

Modules to limit maximum query cost by resticting maximum depth or number of nodes.

v2.0 2025-12-19 11:57 UTC

Requires

• infinityloop-dev/graphpinator: ^2.0
• infinityloop-dev/graphpinator-common: ^2.0
• infinityloop-dev/graphpinator-parser: ^2.0

Requires (Dev)

• infection/infection: ^0.29
• infinityloop-dev/graphpinator-tokenizer: ^1.3
• infinityloop-dev/utils: ^2.3
• phpstan/extension-installer: ^1.4
• phpstan/phpstan: ^2.0
• phpstan/phpstan-deprecation-rules: ^2.0
• phpstan/phpstan-strict-rules: ^2.0
• phpunit/phpunit: ^10.4
• shipmonk/composer-dependency-analyser: ^1.8
• thecodingmachine/phpstan-safe-rule: ^1.4
• webthinx/codestyle: ^1.1

MIT

• Václav Pelíšek

README

⚡🌐⚡ Modules to limit query cost by restricting maximum depth or number of nodes.

Introduction

Installation

Install package using composer

composer require infinityloop-dev/graphpinator-query-cost

How to use

This package includes two modules. They can be used together or each on their own.

• MaxDepthModule validates maximum depth of a query.
• MaxNodesModule validates that size of a query does not exceed maximum number of nodes.
  • One node is essentially a single value which is to be resolved.
  • This module automatically recognises "multiplier" arguments, such as limit, which multiply inner number of nodes for that field.
    • Default multiplier arguments are ['limit', 'first', 'last'], but can be changed using second constructor argument.
    • If you wish to disable this feature, set the constructor argument to empty array.

1. Register selected modules to GraPHPinator:

$depthModule = new \Graphpinator\QueryCost\MaxDepthModule(
    10, // selected maximum depth
);
$nodesModule = new \Graphpinator\QueryCost\MaxNodesModule(
    10000, // selected number of nodes
    ['limit'], // optional: multiplier argument names
);
$graphpinator = new \Graphpinator\Graphpinator(
    $schema,
    $catchExceptions,
    new \Graphpinator\Module\ModuleSet([$depthModule, $nodesModule /* possibly other modules */]),
    $logger,
);

1. You are all set, queries are validated for maximum depth/maximum number of nodes.