# graphql-validation-complexity

> Query complexity validation for GraphQL.js

Latest version **0.4.2** (published 2020-08-31) · MIT license · 0 weekly downloads

## Install

```sh
npm install graphql-validation-complexity
pnpm add graphql-validation-complexity
yarn add graphql-validation-complexity
bun add graphql-validation-complexity
```

## Health

**Score 38/100 (D)** — status: abandoned.

Positive: has types package; no vulnerabilities; high maintenance score; high quality score.

Warnings: low downloads; no esm support; pre 1.0.

Negative: abandoned.

## Facts

| | |
|---|---|
| Version | 0.4.2 |
| Published | 2020-08-31 |
| First published | 2017-06-21 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | separate (@types/graphql-validation-complexity) |
| Module format | CommonJS |
| Dependencies | 1 |
| Unpacked size | 18.8 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 345 |
| Author | 4Catalyzer |
| Maintainers | itajaja, monastic.panic, sloria, taion |
| Keywords | graphql |

## Links

- npm: https://www.npmjs.com/package/graphql-validation-complexity
- Repository: https://github.com/4Catalyzer/graphql-validation-complexity
- Homepage: https://github.com/4Catalyzer/graphql-validation-complexity#readme
- Issues: https://github.com/4Catalyzer/graphql-validation-complexity/issues
- npm.io page: https://npm.io/package/graphql-validation-complexity

## Dependencies (1)

- [warning](https://npm.io/package/warning.md) ^4.0.3

## Alternatives

- [apollo-link-http-common](https://npm.io/package/apollo-link-http-common.md) — 879.0K weekly downloads
- [react-relay](https://npm.io/package/react-relay.md) — 336.8K weekly downloads
- [relay-test-utils](https://npm.io/package/relay-test-utils.md) — 181.6K weekly downloads
- [@vendure/core](https://npm.io/package/@vendure/core.md) — 14.8K weekly downloads
- [@pnpm/deps.graph-sequencer](https://npm.io/package/@pnpm/deps.graph-sequencer.md) — 13.4K weekly downloads

## Recent versions

- 0.4.2 (latest) — 2020-08-31
- 0.4.1 — 2020-08-27
- 0.4.0 — 2020-08-27
- 0.3.0 — 2020-04-04
- 0.2.5 — 2019-03-19
- 0.2.4 — 2018-10-08
- 0.2.3 — 2018-03-12
- 0.2.2 — 2018-02-25
- 0.2.1 — 2017-07-27
- 0.2.0 — 2017-06-28
- 0.1.1 — 2017-06-27
- 0.1.0 — 2017-06-21

## README

# graphql-validation-complexity [![Travis][build-badge]][build] [![npm][npm-badge]][npm]

Query complexity validation for GraphQL.js.

[![Codecov][codecov-badge]][codecov]

## Usage

```js
import { createComplexityLimitRule } from 'graphql-validation-complexity';

const ComplexityLimitRule = createComplexityLimitRule(1000);
// Then use this rule with validate() or other validation APIs.
```

For example, with `express-graphql` or Apollo Server, pass the complexity limit rule to `validationRules`.

```js
const graphqlMiddleware = graphqlHTTP({
  schema,
  validationRules: [createComplexityLimitRule(1000)],
});

const apolloServer = new ApolloServer({
  schema,
  validationRules: [createComplexityLimitRule(1000)],
});
```

You can provide a configuration object with custom global costs for scalars and objects as `scalarCost` and `objectCost` respectively, and a custom cost factor for lists as `listFactor`.

```js
const ComplexityLimitRule = createComplexityLimitRule(1000, {
  scalarCost: 1,
  objectCost: 10, // Default is 0.
  listFactor: 20, // Default is 10.
});
```

You can also set custom costs and cost factors as field definition extensions with the `getCost` and `getCostFactor` callbacks.

```js
const expensiveField = {
  type: ExpensiveItem,
  extensions: {
    getCost: () => 50,
  },
};

const expensiveList = {
  type: new GraphQLList(MyItem),
  extensions: {
    getCostFactor: () => 100,
  },
};
```

You can also define these via field directives in the SDL.

```graphql
directive @cost(value: Int) on FIELD_DEFINITION
directive @costFactor(value: Int) on FIELD_DEFINITION

type CustomCostItem {
  expensiveField: ExpensiveItem @cost(value: 50)
  expensiveList: [MyItem] @costFactor(value: 100)
}
```

The configuration object also supports an `onCost` callback for logging query costs and a `formatErrorMessage` callback for customizing error messages. `onCost` will be called for every query with its cost. `formatErrorMessage` will be called with the cost whenever a query exceeds the complexity limit, and should return a string containing the error message.

```js
const ComplexityLimitRule = createComplexityLimitRule(1000, {
  onCost: (cost) => {
    console.log('query cost:', cost);
  },
  formatErrorMessage: (cost) =>
    `query with cost ${cost} exceeds complexity limit`,
});
```

The configuration object also supports a `createError` callback for creating a custom `GraphQLError`. `createError` will be called with the cost and the document node whenever an error occurs. `formatErrorMessage` will be ignored when `createError` is specified.

```js
const ComplexityLimitRule = createComplexityLimitRule(1000, {
  createError(cost, documentNode) {
    const error = new GraphQLError('custom error', [documentNode]);
    error.meta = { cost };
    return error;
  },
});
```

By default, the validation rule applies a custom, lower cost factor for lists of introspection types, to prevent introspection queries from having unreasonably high costs. You can adjust this by setting `introspectionListFactor` on the configuration object.

```js
const ComplexityLimitRule = createComplexityLimitRule(1000, {
  introspectionListFactor: 10, // Default is 2.
});
```

[build-badge]: https://img.shields.io/travis/4Catalyzer/graphql-validation-complexity/master.svg
[build]: https://travis-ci.org/4Catalyzer/graphql-validation-complexity
[npm-badge]: https://img.shields.io/npm/v/graphql-validation-complexity.svg
[npm]: https://www.npmjs.org/package/graphql-validation-complexity
[codecov-badge]: https://img.shields.io/codecov/c/github/4Catalyzer/graphql-validation-complexity/master.svg
[codecov]: https://codecov.io/gh/4Catalyzer/graphql-validation-complexity

---
_Source: https://npm.io/package/graphql-validation-complexity · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._