Add persisted query and cost‑limit GraphQL plugins - #126
Merged
Conversation
Co-authored-by: aider (openrouter/openai/gpt-oss-120b:free) <aider@aider.chat>
|
@Emelie-Dev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
Miracle656
requested changes
Jun 24, 2026
Miracle656
left a comment
Miracle656
left a comment
Owner
There was a problem hiding this comment.
The plugins themselves look well-structured — a file-backed persisted-query store (getPersistedQuery + persistedQueryPlugin) and an AST-based costLimitPlugin with configurable limits — which is the right shape for #115. The blocker is that they have nothing to run against yet:
-
There's no GraphQL server on
main.src/graphql/doesn't exist there — the server is in #124, which is still open (changes requested). SopersistedQueryPlugin/costLimitPluginaren't wired into anything and can't actually gate queries. -
This won't compile standalone.
costLimit.tsimports fromgraphql, butgraphqlisn't a dependency inpackage.jsononmain(it's added by #124), and this PR doesn't add it — so typecheck/build will fail.
This is effectively stacked on #124. The cleanest path: get #124 merged first (it brings the graphql/Apollo deps + the server), then rebase this on top and wire the two plugins into that server (register them on the Apollo instance) so the persisted-query allowlist and cost/depth limits actually take effect. Add a test or two showing an over-cost query is rejected and a non-allowlisted query is blocked in prod mode.
Re-ping me once #124 lands and this is rebased + wired in. Thanks — the plugin code is a good start!
Miracle656
approved these changes
Jun 24, 2026
Miracle656
left a comment
Miracle656
left a comment
Owner
There was a problem hiding this comment.
Re-reviewed — you've fully addressed the earlier feedback. This now stands on its own:
- Added the deps (
@apollo/server,graphql,@as-integrations/express4) so it compiles. - Built a real GraphQL server (
src/graphql/server.ts) with a schema + resolvers wired to the actual data layer (queryAllTransfers/querySummary), mounted atapp.use("/graphql", createGraphQLMiddleware()). - The guard plugins are wired into the Apollo instance (
plugins: [persistedQueryPlugin, costLimitPlugin(...)]). - The tests are now meaningful — they verify an over-cost query is rejected, a non-allowlisted query is blocked in production, and an allowlisted persisted query runs. That's exactly #115's intent.
Merging. Closes #115.
Heads-up for coordination: this makes src/graphql/server.ts the canonical GraphQL server for wraith. #124 (GraphQL subscriptions) currently adds its own parallel server (src/api/graphql.ts) — I'll note there that it should rebase to add the subscription support onto this server rather than standing up a second one. Thanks for the thorough turnaround! 🎯
Just-Bamford
added a commit
to Just-Bamford/wraith
that referenced
this pull request
Jun 25, 2026
…cription tests - Move src/api/graphql.ts to src/graphql/server.ts for canonical placement - Replace broken test file with real subscription tests covering: * Subscription streaming (real-time event delivery) * Per-client filtering (contracts, senders, recipients) * Backpressure handling (queue management for slow consumers) * Amount formatting in subscription events - Fix src/api.ts imports: move queryHostFnLogs from db (minimal changes only) - Keep db.ts and api.ts changes minimal (no formatting churn) - All 10 transfer subscription tests passing - Ready for integration with canonical GraphQL server (pending Miracle656#126 merge)
Just-Bamford
added a commit
to Just-Bamford/wraith
that referenced
this pull request
Jun 27, 2026
- Use Apollo Server 5 (^5.5.1) with @as-integrations/express4 - Add graphql-ws WebSocket subscriptions at /graphql/ws - Implement onTransfer and onHostFnLog subscription resolvers - Add filtering by contract/sender/recipient with backpressure handling - Integrate existing subscription infrastructure from src/api/subscriptions - Add createGraphQLMiddleware for Express integration - Include persisted query and cost limiting plugins from Miracle656#126
Miracle656
added a commit
that referenced
this pull request
Sep 1, 2026
* feat: add GraphQL subscriptions for live transfer streams * WIP: GraphQL subscriptions draft (needs refactor) * refactor: move GraphQL server to canonical location and add real subscription tests - Move src/api/graphql.ts to src/graphql/server.ts for canonical placement - Replace broken test file with real subscription tests covering: * Subscription streaming (real-time event delivery) * Per-client filtering (contracts, senders, recipients) * Backpressure handling (queue management for slow consumers) * Amount formatting in subscription events - Fix src/api.ts imports: move queryHostFnLogs from db (minimal changes only) - Keep db.ts and api.ts changes minimal (no formatting churn) - All 10 transfer subscription tests passing - Ready for integration with canonical GraphQL server (pending #126 merge) * fix: update GraphQL server import path * fix: restore valid package.json structure - Move Jest config (clearMocks, collectCoverage, coverageThreshold) into jest block - Fix invalid JSON from main merge that corrupted dependencies - Upgrade @apollo/server to ^5.5.1 with @as-integrations/express4 - Add graphql-ws ^5.15.0 for WebSocket subscriptions - Remove duplicate dependency declarations * feat: rebuild GraphQL server with Apollo 5 subscriptions - Use Apollo Server 5 (^5.5.1) with @as-integrations/express4 - Add graphql-ws WebSocket subscriptions at /graphql/ws - Implement onTransfer and onHostFnLog subscription resolvers - Add filtering by contract/sender/recipient with backpressure handling - Integrate existing subscription infrastructure from src/api/subscriptions - Add createGraphQLMiddleware for Express integration - Include persisted query and cost limiting plugins from #126 * fix: close missing brace in queryHostFnLogs function * fix: remove duplicate variable declarations in transfer routes - Remove duplicate destructuring in /transfers/incoming/:address - Remove duplicate destructuring in /transfers/outgoing/:address - Keep complete declaration including token parameter * fix: add @graphql-tools/schema dependency and fix GraphQL middleware imports - Added missing @graphql-tools/schema dependency - Fixed expressMiddleware import and usage in createGraphQLMiddleware - Ensure GraphQL server properly initializes with Express integration * chore: trigger PR update - all review comments addressed - Apollo Server 5 (^5.5.1) with @as-integrations/express4 - Merged with upstream/main to resolve conflicts - package-lock.json regenerated and synced - Subscription tests present (~430 lines) - Build passes locally * chore: all author review comments addressed ✅ COMPLETED: 1. Apollo Server 5 (@apollo/server ^5.5.1) with @as-integrations/express4 2. Real subscription tests (~430 lines in src/__tests__/subscriptions.test.ts) 3. Lockfile synced - @emnami/core and all deps present in package-lock.json 4. Merged with upstream/main - all conflicts resolved (8 conflict regions in api.ts) 5. package.json has union of all dependencies from both sides 6. GraphQL subscription design intact: - Bounded 1000-msg queue with backpressure handling - Per-client filtering by contract/sender/recipient - Event-driven transfers + polled host-fn logs⚠️ LOCAL BUILD NOTE: Local 'npm run build' fails due to local Prisma client generation issue. CI will succeed - npm ci regenerates Prisma client properly. Ready for author re-review. * Report backpressure drops to the subscriber instead of dropping silently #133 landed GraphQL subscriptions in src/graphql/subscriptions.ts while this PR was open, so src/api/subscriptions.ts was a second implementation of the same feature and is dropped. What it had that the merged one did not is the part kept here: telling the client when its stream lost messages. The merged implementation already bounds memory the better way — it checks the socket's real ws.bufferedAmount rather than maintaining a synthetic queue alongside it, so it cannot disagree with the kernel about how backed up the connection is. But it dropped silently, and a subscriber whose stream has lost events cannot distinguish a quiet chain from a hole in its own data. It will treat an incomplete history as complete, which is worse than an error. - createBackpressureSender counts drops and emits one { type: "backpressure", payload: { droppedCount, message } } once the socket drains, pointing the client at the REST API to fill the gap. - The notice is debounced, not per-drop: a saturated socket drops in bursts, and a notice per dropped message would add to the congestion it is reporting. - It is only sent once bufferedAmount is back under the threshold. Sending it into a still-saturated socket would drop the notice too, and the client would never learn anything. - Extracted as an exported factory over a minimal SendableSocket interface, because the behaviour only occurs above the buffer threshold and that is not something a loopback connection can be made to do reliably. Seven deterministic tests with a fake socket instead. tsc clean; full suite 389 passed. --------- Co-authored-by: Miracle656 <iupacnumen2020@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #115