# ❌ A query that recursively traverses circular references until memory exhaustion
# If your schema allows: User → orders → user → orders → user...
query RecursiveDoS {
  user(id: "1") {
    orders {
      user {
        orders {
          user {
            orders {
              user { name } # Depth 7 — already fetching exponentially
            }
          }
        }
      }
    }
  }
}

# ❌ Aliases bypass naive field-level rate limiting
# Each alias is a separate resolver execution — this fires 100 DB queries
query AliasAmplification {
  a1: user(id: "1") { orders { total } }
  a2: user(id: "1") { orders { total } }
  a3: user(id: "1") { orders { total } }
  # ... a100: same query
}

# ❌ Any client can dump your entire schema without authentication
query SchemaRecon {
  __schema {
    types {
      name
      fields { name type { name kind } }
    }
  }
}

// ✅ graphql-depth-limit — blocks recursive traversal DoS
import depthLimit from 'graphql-depth-limit';
import { createYoga } from 'graphql-yoga';

const yoga = createYoga({
  schema,
  validationRules: [
    depthLimit(
      7,  // Maximum allowed query depth — count from root field to deepest leaf
      { ignore: ['__schema', '__type'] }, // Allow introspection queries (disable in prod)
      (depths) => {
        // Optional: emit a metric for depth distribution monitoring
        console.log('Query depths:', depths);
      }
    ),
  ],
});

// ✅ graphql-query-complexity — per-query computational cost budget
import { createComplexityRule } from 'graphql-query-complexity';

const yoga = createYoga({
  schema,
  validationRules: [
    createComplexityRule({
      maximumComplexity: 1000,
      variables: {},
      onComplete: (complexity) => {
        console.log('Query complexity:', complexity);
        // Emit as a metric for p95 complexity monitoring
      },
      estimators: [
        // Per-field cost assignment
        fieldExtensionsEstimator(),       // Uses @complexity directive on schema fields
        simpleEstimator({ defaultComplexity: 1 }),  // Each field costs 1 by default
      ],
    }),
  ],
});

# Schema-level complexity annotations
type Query {
  # Expensive fields get higher costs
  users(first: Int): [User!]! @complexity(value: 5, multipliers: ["first"])
  # Standard fields use the default cost of 1
  user(id: ID!): User
}

// ✅ Apollo Router persisted operations manifest (router.yaml)

# router.yaml
persisted_queries:
  enabled: true
  log_unknown: true   # Log attempts to execute unregistered operations
  safelist:
    enabled: true     # In safelist mode, only registered operations execute
    require_id: true  # Clients must send the operation ID, not the full document

# Register operations from client bundles during build
rover persisted-queries publish my-graph \
  --manifest operations-manifest.json

// ✅ Disable introspection in production for non-authenticated requests
// graphql-armor v3 provides this as a plugin rule
import { createYoga } from 'graphql-yoga';
import { EnvelopArmorPlugin } from '@escape.tech/graphql-armor';

const yoga = createYoga({
  schema,
  plugins: [
    EnvelopArmorPlugin({
      blockFieldSuggestion: { enabled: true },      // No "Did you mean X?" leaks
      maxDepth: { enabled: true, n: 7 },            // Gate 1
      maxTokens: { enabled: true, n: 1000 },        // Gate 2 (token-based)
      costLimit: { enabled: true, maxCost: 5000 },  // Gate 2 (cost-based)
      // Introspection: allow for authenticated users, block for public
      introspectionBlockList: {
        enabled: process.env.NODE_ENV === 'production',
      },
    }),
  ],
  context: async (req) => {
    const user = await authenticateRequest(req);
    return { user };
  },
});

# Federation 2.x: gate introspection and admin mutations behind OAuth scopes
type Mutation {
  deleteUser(id: ID!): Boolean! @requiresScopes(scopes: [["admin"]])
  createOrganization(input: OrgInput!): Org! @requiresScopes(scopes: [["admin"], ["org:write"]])
}

// ✅ graphql-armor v3 — all security gates in one plugin
import { createYoga } from 'graphql-yoga';
import { EnvelopArmorPlugin } from '@escape.tech/graphql-armor';

const yoga = createYoga({
  schema,
  plugins: [
    EnvelopArmorPlugin({
      maxDepth: {
        enabled: true,
        n: 7,                     // Maximum query depth
        flattenFragments: true,   // Count fragment spreads against depth
      },
      maxAliases: {
        enabled: true,
        n: 15,                    // Maximum aliases per query (blocks alias amplification)
      },
      maxDirectives: {
        enabled: true,
        n: 50,
      },
      costLimit: {
        enabled: true,
        maxCost: 5000,
        objectCost: 2,            // Object types cost more than scalar fields
        scalarCost: 1,
        depthCostFactor: 1.5,     // Cost multiplies by depth (deeper = more expensive)
      },
      blockFieldSuggestion: {
        enabled: true,            // Prevents "Did you mean 'adminUsers'?" leaks
      },
    }),
  ],
});

// ✅ Per-operation-name rate limiting with ioredis
import { RateLimiterRedis } from 'rate-limiter-flexible';

const operationRateLimiter = new RateLimiterRedis({
  storeClient: redis,
  keyPrefix: 'rl:op',
  points: 100,      // Max 100 executions per window
  duration: 60,     // Per 60 seconds
});

// In GraphQL context or middleware:
async function checkOperationRateLimit(operationName: string, userId: string) {
  const key = `${userId}:${operationName}`;
  try {
    await operationRateLimiter.consume(key, 1);
  } catch {
    throw new GraphQLError('Rate limit exceeded for this operation', {
      extensions: { code: 'TOO_MANY_REQUESTS', operationName },
    });
  }
}