feat(root-level-limitation): add max root fields limitation plugin

[srcgrp]

Introduction

This pull request introduces the root-level-limitation plugin, designed to enhance the performance and stability of our GraphQL server.

Motivation

Unrestricted query complexity can negatively impact GraphQL server performance. By allowing clients to request a vast amount of data in a single query, we risk overwhelming the server and potentially leading to timeouts or errors.

Solution

The root-level-limitation plugin addresses this concern by enforcing a limit on the number of root fields permitted within a GraphQL query. This approach offers several benefits:

• Improved Performance: Limiting root fields prevents overly complex queries that can strain server resources.
• Enhanced Stability: By restricting query complexity, we minimize the likelihood of queries exceeding server capabilities and causing errors.
• Predictable Behavior: Enforcing a root field limit promotes consistent server behavior and helps prevent unexpected performance issues.

Implementation

This plugin integrates seamlessly with our existing Yoga GraphQL Server setup. We can configure the maximum number of allowed root fields through the maxRootFields option. The provided doc inside website demonstrates how to utilize the plugin within our project.

[changeset-bot[bot]]

⚠️ No Changeset found

Latest commit: 73a787ba24cf2e3eba16a099c52049d033e3fc3a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ardatan]

That's a great idea! https://github.com/dotansimha/graphql-yoga/pull/3236 I think we can use onValidate instead of string matching because comments and some other cases I added in the tests can bypass the current method.

[EmrysMyrddin]

Great Idea! But I'm not sure this should be a Yoga plugin. This is not using any Yoga specific hooks, so it's actually a pure Envelop plugin.

And I think this could be a good addition to GraphQL Armor, which is already the go-to solution to configure limitations like this one. So perhaps this could be a GraphQL Armor plugins instead of an Envelop plugin ? You can take a look here: https://escape.tech/graphql-armor/docs/getting-started