[Fusion] Added post-merge validation rule "ImplementedByInaccessibleRule" (#8226)

Author: glen-84

src/HotChocolate/Fusion-vnext/src/Fusion.Composition/Logging/LogEntryCodes.cs

@@ -16,6 +16,7 @@ public static class LogEntryCodes
     public const string ExternalUnused = "EXTERNAL_UNUSED";
     public const string FieldArgumentTypesNotMergeable = "FIELD_ARGUMENT_TYPES_NOT_MERGEABLE";
     public const string FieldWithMissingRequiredArgument = "FIELD_WITH_MISSING_REQUIRED_ARGUMENT";
+    public const string ImplementedByInaccessible = "IMPLEMENTED_BY_INACCESSIBLE";
     public const string InputFieldDefaultMismatch = "INPUT_FIELD_DEFAULT_MISMATCH";
     public const string InputFieldTypesNotMergeable = "INPUT_FIELD_TYPES_NOT_MERGEABLE";
     public const string InputWithMissingRequiredFields = "INPUT_WITH_MISSING_REQUIRED_FIELDS";

src/HotChocolate/Fusion-vnext/src/Fusion.Composition/Logging/LogEntryHelper.cs

@@ -315,6 +315,27 @@ public static LogEntry FieldWithMissingRequiredArgument(
             schema);
     }
 
+    public static LogEntry ImplementedByInaccessible(
+        MutableOutputFieldDefinition field,
+        string typeName,
+        string interfaceFieldName,
+        string interfaceTypeName,
+        MutableSchemaDefinition schema)
+    {
+        var coordinate = new SchemaCoordinate(typeName, field.Name);
+
+        return new LogEntry(
+            string.Format(
+                LogEntryHelper_ImplementedByInaccessible,
+                coordinate,
+                new SchemaCoordinate(interfaceTypeName, interfaceFieldName)),
+            LogEntryCodes.ImplementedByInaccessible,
+            LogSeverity.Error,
+            coordinate,
+            field,
+            schema);
+    }
+
     public static LogEntry InputFieldDefaultMismatch(
         IValueNode defaultValueA,
         IValueNode defaultValueB,

src/HotChocolate/Fusion-vnext/src/Fusion.Composition/PostMergeValidationRules/ImplementedByInaccessibleRule.cs

@@ -0,0 +1,71 @@
+using HotChocolate.Fusion.Events;
+using HotChocolate.Fusion.Events.Contracts;
+using HotChocolate.Fusion.Extensions;
+using HotChocolate.Types.Mutable;
+using static HotChocolate.Fusion.Logging.LogEntryHelper;
+
+namespace HotChocolate.Fusion.PostMergeValidationRules;
+
+/// <summary>
+/// This rule ensures that inaccessible fields (<c>@inaccessible</c>) on an object or interface type
+/// are not exposed through an interface. A composite type that implements an interface must provide
+/// public access to each field defined by the interface. If a field on an object type is marked as
+/// <c>@inaccessible</c> but implements an interface field that is visible in the composed schema,
+/// this creates a contradiction: the interface contract requires that field to be accessible, yet
+/// the implementation hides it.
+/// </summary>
+/// <seealso href="https://graphql.github.io/composite-schemas-spec/draft/#sec-Implemented-by-Inaccessible">
+/// Specification
+/// </seealso>
+internal sealed class ImplementedByInaccessibleRule
+    : IEventHandler<ObjectTypeEvent>
+    , IEventHandler<InterfaceTypeEvent>
+{
+    public void Handle(ObjectTypeEvent @event, CompositionContext context)
+    {
+        var (objectType, schema) = @event;
+
+        Handle(objectType, schema, context);
+    }
+
+    public void Handle(InterfaceTypeEvent @event, CompositionContext context)
+    {
+        var (interfaceType, schema) = @event;
+
+        Handle(interfaceType, schema, context);
+    }
+
+    private static void Handle(
+        MutableComplexTypeDefinition type,
+        MutableSchemaDefinition schema,
+        CompositionContext context)
+    {
+        var accessibleImplementedInterfaces =
+            type.Implements
+                .AsEnumerable()
+                .Where(i => !i.HasFusionInaccessibleDirective());
+
+        foreach (var interfaceType in accessibleImplementedInterfaces)
+        {
+            var accessibleInterfaceFields =
+                interfaceType.Fields.AsEnumerable().Where(f => !f.HasFusionInaccessibleDirective());
+
+            foreach (var interfaceField in accessibleInterfaceFields)
+            {
+                var field = type.Fields[interfaceField.Name];
+
+                if (field.HasFusionInaccessibleDirective()
+                    || type.HasFusionInaccessibleDirective())
+                {
+                    context.Log.Write(
+                        ImplementedByInaccessible(
+                            field,
+                            type.Name,
+                            interfaceField.Name,
+                            interfaceType.Name,
+                            schema));
+                }
+            }
+        }
+    }
+}

src/HotChocolate/Fusion-vnext/src/Fusion.Composition/Properties/CompositionResources.Designer.cs

@@ -189,6 +189,9 @@
   <data name="LogEntryHelper_FieldWithMissingRequiredArgument" xml:space="preserve">
     <value>The argument '{0}' must be defined as required in schema '{1}'. Arguments marked with @require are treated as non-required.</value>
   </data>
+  <data name="LogEntryHelper_ImplementedByInaccessible" xml:space="preserve">
+    <value>The field '{0}' implementing interface field '{1}' is inaccessible in the composed schema.</value>
+  </data>
   <data name="LogEntryHelper_InputFieldDefaultMismatch" xml:space="preserve">
     <value>The default value '{0}' of input field '{1}' in schema '{2}' differs from the default value of '{3}' in schema '{4}'.</value>
   </data>

src/HotChocolate/Fusion-vnext/src/Fusion.Composition/Properties/CompositionResources.resx

@@ -131,6 +131,7 @@ public CompositionResult<MutableSchemaDefinition> Compose()
         new EmptyMergedObjectTypeRule(),
         new EmptyMergedUnionTypeRule(),
         new EnumTypeDefaultValueInaccessibleRule(),
+        new ImplementedByInaccessibleRule(),
         new InterfaceFieldNoImplementationRule(),
         new IsInvalidFieldRule(),
         new NonNullInputFieldIsInaccessibleRule(),

src/HotChocolate/Fusion-vnext/src/Fusion.Composition/SchemaComposer.cs

@@ -0,0 +1,170 @@
+using System.Collections.Immutable;
+using HotChocolate.Fusion.Logging;
+using static HotChocolate.Fusion.CompositionTestHelper;
+
+namespace HotChocolate.Fusion.PostMergeValidationRules;
+
+public sealed class ImplementedByInaccessibleRuleTests
+{
+    private static readonly object s_rule = new ImplementedByInaccessibleRule();
+    private static readonly ImmutableArray<object> s_rules = [s_rule];
+    private readonly CompositionLog _log = new();
+
+    [Theory]
+    [MemberData(nameof(ValidExamplesData))]
+    public void Examples_Valid(string[] sdl)
+    {
+        // arrange
+        var schemas = CreateSchemaDefinitions(sdl);
+        var merger = new SourceSchemaMerger(schemas);
+        var mergeResult = merger.Merge();
+        var validator = new PostMergeValidator(mergeResult.Value, s_rules, schemas, _log);
+
+        // act
+        var result = validator.Validate();
+
+        // assert
+        Assert.True(result.IsSuccess);
+        Assert.True(_log.IsEmpty);
+    }
+
+    [Theory]
+    [MemberData(nameof(InvalidExamplesData))]
+    public void Examples_Invalid(string[] sdl, string[] errorMessages)
+    {
+        // arrange
+        var schemas = CreateSchemaDefinitions(sdl);
+        var merger = new SourceSchemaMerger(schemas);
+        var mergeResult = merger.Merge();
+        var validator = new PostMergeValidator(mergeResult.Value, s_rules, schemas, _log);
+
+        // act
+        var result = validator.Validate();
+
+        // assert
+        Assert.True(result.IsFailure);
+        Assert.Equal(errorMessages, _log.Select(e => e.Message).ToArray());
+        Assert.True(_log.All(e => e.Code == "IMPLEMENTED_BY_INACCESSIBLE"));
+        Assert.True(_log.All(e => e.Severity == LogSeverity.Error));
+    }
+
+    public static TheoryData<string[]> ValidExamplesData()
+    {
+        return new TheoryData<string[]>
+        {
+            // In the following example, "User.id" is accessible and implements "Node.id" which is
+            // also accessible, no error occurs.
+            {
+                [
+                    """
+                    interface Node {
+                        id: ID!
+                    }
+
+                    type User implements Node {
+                        id: ID!
+                        name: String
+                    }
+                    """
+                ]
+            },
+            // Since "Auditable" and its field "lastAudit" are @inaccessible, the "Order.lastAudit"
+            // field is allowed to be @inaccessible because it does not implement any visible
+            // interface field in the composed schema.
+            {
+                [
+                    """
+                    interface Auditable @inaccessible {
+                        lastAudit: DateTime!
+                    }
+
+                    type Order implements Auditable {
+                        lastAudit: DateTime! @inaccessible
+                        orderNumber: String
+                    }
+                    """
+                ]
+            },
+            // Accessible interface field "User.id" implementing accessible field "Node.id" in
+            // another interface.
+            {
+                [
+                    """
+                    interface Node {
+                        id: ID!
+                    }
+
+                    interface User implements Node {
+                        id: ID!
+                        name: String
+                    }
+                    """
+                ]
+            },
+            // Inaccessible interface field "Order.lastAudit" implementing inaccessible field
+            // "Auditable.lastAudit" in another interface.
+            {
+                [
+                    """
+                    interface Auditable @inaccessible {
+                        lastAudit: DateTime!
+                    }
+
+                    interface Order implements Auditable {
+                        lastAudit: DateTime! @inaccessible
+                        orderNumber: String
+                    }
+                    """
+                ]
+            }
+        };
+    }
+
+    public static TheoryData<string[], string[]> InvalidExamplesData()
+    {
+        return new TheoryData<string[], string[]>
+        {
+            // In this example, "Node.id" is visible in the public schema (no @inaccessible), but
+            // "User.id" is marked @inaccessible. This violates the interface contract because
+            // "User" claims to implement "Node", yet does not expose the "id" field to the public
+            // schema.
+            {
+                [
+                    """
+                    interface Node {
+                        id: ID!
+                    }
+
+                    type User implements Node {
+                        id: ID! @inaccessible
+                        name: String
+                    }
+                    """
+                ],
+                [
+                    "The field 'User.id' implementing interface field 'Node.id' is inaccessible " +
+                    "in the composed schema."
+                ]
+            },
+            // Same as above, for an interface type.
+            {
+                [
+                    """
+                    interface Node {
+                        id: ID!
+                    }
+
+                    interface User implements Node {
+                        id: ID! @inaccessible
+                        name: String
+                    }
+                    """
+                ],
+                [
+                    "The field 'User.id' implementing interface field 'Node.id' is inaccessible " +
+                    "in the composed schema."
+                ]
+            }
+        };
+    }
+}