Skip to content

Compute resolver complexity based on items

Jan Provaznik requested to merge graphql-resolvers-complexity-ee into master

What does this MR do?

If a field is a resolver, its complexity is automatically increased. By default we add extra points for sort and search arguments (which will be common for various resolvers).

For specific resolvers we add field-specific complexity, e.g. for Issues complexity is increased if we filter issues by labelName (because then SQL query is more complex). We may want to tune these values in future depending on real-life results.

Complexity is also dependent on the number of loaded nodes, but only if we don't search by specific ID(s). Also added complexity is limited (by default only twice more than child complexity) - the reason is that although it's more complex to process more items, the complexity increase is not linear (there is not so much difference between loading 10, 20 or 100 records from DB).

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/58408

Does this MR meet the acceptance criteria?

Conformity

Performance and testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Coung Ngo

Merge request reports