Merge branch 'ajk-graphql-packages' into 'master'

Packages to use composition, not inheritance [RUN AS-IF-FOSS]

See merge request gitlab-org/gitlab!52131

app/graphql/resolvers/package_details_resolver.rb

 # frozen_string_literal: true
 module Resolvers
-  # No return types defined because they can be different.
-  # rubocop: disable Graphql/ResolverType
   class PackageDetailsResolver < BaseResolver
+    type ::Types::Packages::PackageType, null: true
+
     argument :id, ::Types::GlobalIDType[::Packages::Package],
       required: true,
       description: 'The global ID of the package.'

app/graphql/resolvers/packages_resolver.rb

@@ -2,7 +2,7 @@
 module Resolvers
   class PackagesResolver < BaseResolver
-    type Types::Packages::PackageType, null: true
+    type Types::Packages::PackageType.connection_type, null: true
     def resolve(**args)
       return unless packages_available?

app/graphql/types/packages/composer/details_type.rb

-# frozen_string_literal: true
-
-module Types
-  module Packages
-    module Composer
-      class DetailsType < Types::Packages::PackageType
-        graphql_name 'PackageComposerDetails'
-        description 'Details of a Composer package'
-
-        authorize :read_package
-
-        field :composer_metadatum, Types::Packages::Composer::MetadatumType, null: false, description: 'The Composer metadatum.'
-      end
-    end
-  end
-end

app/graphql/types/packages/composer/metadatum_type.rb

@@ -4,8 +4,8 @@ module Types
   module Packages
     module Composer
       class MetadatumType < BaseObject
-        graphql_name 'PackageComposerMetadatumType'
-        description 'Composer metadatum'
+        graphql_name 'ComposerMetadata'
+        description 'Composer metadata'
         authorize :read_package

app/graphql/types/packages/metadata_type.rb

+# frozen_string_literal: true
+
+module Types
+  module Packages
+    class MetadataType < BaseUnion
+      graphql_name 'PackageMetadata'
+      description 'Represents metadata associated with a Package'
+
+      possible_types ::Types::Packages::Composer::MetadatumType
+
+      def self.resolve_type(object, context)
+        case object
+        when ::Packages::Composer::Metadatum
+          ::Types::Packages::Composer::MetadatumType
+        else
+          # NOTE: This method must be kept in sync with `PackageWithoutVersionsType#metadata`,
+          # which must never produce data that this discriminator cannot handle.
+          raise 'Unsupported metadata type'
+        end
+      end
+    end
+  end
+end

app/graphql/types/packages/package_type.rb

@@ -2,26 +2,13 @@
 module Types
   module Packages
-    class PackageType < BaseObject
+    class PackageType < PackageWithoutVersionsType
       graphql_name 'Package'
       description 'Represents a package in the Package Registry'
-
       authorize :read_package
-      field :id, GraphQL::ID_TYPE, null: false, description: 'The ID of the package.'
-      field :name, GraphQL::STRING_TYPE, null: false, description: 'The name of the package.'
-      field :created_at, Types::TimeType, null: false, description: 'The created date.'
-      field :updated_at, Types::TimeType, null: false, description: 'The updated date.'
-      field :version, GraphQL::STRING_TYPE, null: true, description: 'The version of the package.'
-      field :package_type, Types::Packages::PackageTypeEnum, null: false, description: 'The type of the package.'
-      field :tags, Types::Packages::PackageTagType.connection_type, null: true, description: 'The package tags.'
-      field :project, Types::ProjectType, null: false, description: 'Project where the package is stored.'
-      field :pipelines, Types::Ci::PipelineType.connection_type, null: true, description: 'Pipelines that built the package.'
-      field :versions, Types::Packages::PackageType.connection_type, null: true, description: 'The other versions of the package.'
-
-      def project
-        Gitlab::Graphql::Loaders::BatchModelLoader.new(Project, object.project_id).find
-      end
+      field :versions, ::Types::Packages::PackageWithoutVersionsType.connection_type, null: true,
+        description: 'The other versions of the package.'
     end
   end
 end

app/graphql/types/packages/package_without_versions_type.rb

+# frozen_string_literal: true
+
+module Types
+  module Packages
+    class PackageWithoutVersionsType < ::Types::BaseObject
+      graphql_name 'PackageWithoutVersions'
+      description 'Represents a version of a package in the Package Registry'
+
+      authorize :read_package
+
+      field :id, ::Types::GlobalIDType[::Packages::Package], null: false,
+            description: 'ID of the package.'
+
+      field :name, GraphQL::STRING_TYPE, null: false, description: 'Name of the package.'
+      field :created_at, Types::TimeType, null: false, description: 'Date of creation.'
+      field :updated_at, Types::TimeType, null: false, description: 'Date of most recent update.'
+      field :version, GraphQL::STRING_TYPE, null: true, description: 'Version string.'
+      field :package_type, Types::Packages::PackageTypeEnum, null: false, description: 'Package type.'
+      field :tags, Types::Packages::PackageTagType.connection_type, null: true, description: 'Package tags.'
+      field :project, Types::ProjectType, null: false, description: 'Project where the package is stored.'
+      field :pipelines, Types::Ci::PipelineType.connection_type, null: true,
+        description: 'Pipelines that built the package.'
+      field :metadata, Types::Packages::MetadataType, null: true,
+        description: 'Package metadata.'
+
+      def project
+        Gitlab::Graphql::Loaders::BatchModelLoader.new(Project, object.project_id).find
+      end
+
+      # NOTE: This method must be kept in sync with the union
+      # type: `Types::Packages::MetadataType`.
+      #
+      # `Types::Packages::MetadataType.resolve_type(metadata, ctx)` must never raise.
+      def metadata
+        case object.package_type
+        when 'composer'
+          object.composer_metadatum
+        else
+          nil
+        end
+      end
+    end
+  end
+end

app/graphql/types/project_type.rb

@@ -179,7 +179,7 @@ class ProjectType < BaseObject
           description: 'A single issue of the project',
           resolver: Resolvers::IssuesResolver.single
-    field :packages, Types::Packages::PackageType.connection_type, null: true,
+    field :packages,
          description: 'Packages of the project',
          resolver: Resolvers::PackagesResolver

app/graphql/types/query_type.rb

@@ -58,9 +58,8 @@ class QueryType < ::Types::BaseObject
             argument :id, ::Types::GlobalIDType[::ContainerRepository], required: true, description: 'The global ID of the container repository'
           end
-    field :package_composer_details, Types::Packages::Composer::DetailsType,
-          null: true,
-          description: 'Find a composer package',
+    field :package,
+          description: 'Find a package',
           resolver: Resolvers::PackageDetailsResolver
     field :user, Types::UserType,

app/services/security/ci_configuration/sast_parser_service.rb

@@ -94,7 +94,6 @@ def sast_template_attributes
       def gitlab_ci_yml_attributes
         @gitlab_ci_yml_attributes ||= begin
           config_content = @project.repository.blob_data_at(@project.repository.root_ref_sha, ci_config_file)
-
           return {} unless config_content
           build_sast_attributes(config_content)

changelogs/unreleased/ajk-graphql-packages.yml

+---
+title: 'Breaking change: Prevent mutual recursion in GraphQL Package'
+merge_request: 52131
+author:
+type: fixed

doc/api/graphql/reference/gitlab_schema.graphql

@@ -3879,6 +3879,21 @@ Identifier of ComplianceManagement::Framework.
 """
 scalar ComplianceManagementFrameworkID
+"""
+Composer metadata
+"""
+type ComposerMetadata {
+  """
+  Data of the Composer JSON file.
+  """
+  composerJson: PackageComposerJsonType!
+
+  """
+  Target SHA of the package.
+  """
+  targetSha: String!
+}
+
 """
 Autogenerated input type of ConfigureSast
 """
@@ -16880,142 +16895,27 @@ Represents a package in the Package Registry
 """
 type Package {
   """
-  The created date.
+  Date of creation.
   """
   createdAt: Time!
   """
-  The ID of the package.
-  """
-  id: ID!
-
-  """
-  The name of the package.
-  """
-  name: String!
-
-  """
-  The type of the package.
-  """
-  packageType: PackageTypeEnum!
-
-  """
-  Pipelines that built the package.
+  ID of the package.
   """
-  pipelines(
-    """
-    Returns the elements in the list that come after the specified cursor.
-    """
-    after: String
-
-    """
-    Returns the elements in the list that come before the specified cursor.
-    """
-    before: String
-
-    """
-    Returns the first _n_ elements from the list.
-    """
-    first: Int
-
-    """
-    Returns the last _n_ elements from the list.
-    """
-    last: Int
-  ): PipelineConnection
+  id: PackagesPackageID!
   """
-  Project where the package is stored.
+  Package metadata.
   """
-  project: Project!
+  metadata: PackageMetadata
   """
-  The package tags.
-  """
-  tags(
-    """
-    Returns the elements in the list that come after the specified cursor.
-    """
-    after: String
-
-    """
-    Returns the elements in the list that come before the specified cursor.
-    """
-    before: String
-
-    """
-    Returns the first _n_ elements from the list.
-    """
-    first: Int
-
-    """
-    Returns the last _n_ elements from the list.
-    """
-    last: Int
-  ): PackageTagConnection
-
-  """
-  The updated date.
-  """
-  updatedAt: Time!
-
-  """
-  The version of the package.
-  """
-  version: String
-
-  """
-  The other versions of the package.
-  """
-  versions(
-    """
-    Returns the elements in the list that come after the specified cursor.
-    """
-    after: String
-
-    """
-    Returns the elements in the list that come before the specified cursor.
-    """
-    before: String
-
-    """
-    Returns the first _n_ elements from the list.
-    """
-    first: Int
-
-    """
-    Returns the last _n_ elements from the list.
-    """
-    last: Int
-  ): PackageConnection
-}
-
-"""
-Details of a Composer package
-"""
-type PackageComposerDetails {
-  """
-  The Composer metadatum.
-  """
-  composerMetadatum: PackageComposerMetadatumType!
-
-  """
-  The created date.
-  """
-  createdAt: Time!
-
-  """
-  The ID of the package.
-  """
-  id: ID!
-
-  """
-  The name of the package.
+  Name of the package.
   """
   name: String!
   """
-  The type of the package.
+  Package type.
   """
   packageType: PackageTypeEnum!
@@ -17050,7 +16950,7 @@ type PackageComposerDetails {
   project: Project!
   """
-  The package tags.
+  Package tags.
   """
   tags(
     """
@@ -17075,12 +16975,12 @@ type PackageComposerDetails {
   ): PackageTagConnection
   """
-  The updated date.
+  Date of most recent update.
   """
   updatedAt: Time!
   """
-  The version of the package.
+  Version string.
   """
   version: String
@@ -17107,7 +17007,7 @@ type PackageComposerDetails {
     Returns the last _n_ elements from the list.
     """
     last: Int
-  ): PackageConnection
+  ): PackageWithoutVersionsConnection
 }
 """
@@ -17135,21 +17035,6 @@ type PackageComposerJsonType {
   version: String
 }
-"""
-Composer metadatum
-"""
-type PackageComposerMetadatumType {
-  """
-  Data of the Composer JSON file.
-  """
-  composerJson: PackageComposerJsonType!
-
-  """
-  Target SHA of the package.
-  """
-  targetSha: String!
-}
-
 """
 The connection type for Package.
 """
@@ -17265,6 +17150,11 @@ type PackageFileRegistryEdge {
   node: PackageFileRegistry
 }
+"""
+Represents metadata associated with a Package
+"""
+union PackageMetadata = ComposerMetadata
+
 """
 Namespace-level Package Registry settings
 """
@@ -17388,6 +17278,136 @@ enum PackageTypeEnum {
   PYPI
 }
+"""
+Represents a version of a package in the Package Registry
+"""
+type PackageWithoutVersions {
+  """
+  Date of creation.
+  """
+  createdAt: Time!
+
+  """
+  ID of the package.
+  """
+  id: PackagesPackageID!
+
+  """
+  Package metadata.
+  """
+  metadata: PackageMetadata
+
+  """
+  Name of the package.
+  """
+  name: String!
+
+  """
+  Package type.
+  """
+  packageType: PackageTypeEnum!
+
+  """
+  Pipelines that built the package.
+  """
+  pipelines(
+    """
+    Returns the elements in the list that come after the specified cursor.
+    """
+    after: String
+
+    """
+    Returns the elements in the list that come before the specified cursor.
+    """
+    before: String
+
+    """
+    Returns the first _n_ elements from the list.
+    """
+    first: Int
+
+    """
+    Returns the last _n_ elements from the list.
+    """
+    last: Int
+  ): PipelineConnection
+
+  """
+  Project where the package is stored.
+  """
+  project: Project!
+
+  """
+  Package tags.
+  """
+  tags(
+    """
+    Returns the elements in the list that come after the specified cursor.
+    """
+    after: String
+
+    """
+    Returns the elements in the list that come before the specified cursor.
+    """
+    before: String
+
+    """
+    Returns the first _n_ elements from the list.
+    """
+    first: Int
+
+    """
+    Returns the last _n_ elements from the list.
+    """
+    last: Int
+  ): PackageTagConnection
+
+  """
+  Date of most recent update.
+  """
+  updatedAt: Time!
+
+  """
+  Version string.
+  """
+  version: String
+}
+
+"""
+The connection type for PackageWithoutVersions.
+"""
+type PackageWithoutVersionsConnection {
+  """
+  A list of edges.
+  """
+  edges: [PackageWithoutVersionsEdge]
+
+  """
+  A list of nodes.
+  """
+  nodes: [PackageWithoutVersions]
+
+  """
+  Information to aid in pagination.
+  """
+  pageInfo: PageInfo!
+}
+
+"""
+An edge in a connection.
+"""
+type PackageWithoutVersionsEdge {
+  """
+  A cursor for use in pagination.
+  """
+  cursor: String!
+
+  """
+  The item at the end of the edge.
+  """
+  node: PackageWithoutVersions
+}
+
 """
 Identifier of Packages::Package.
 """
@@ -20538,14 +20558,14 @@ type Query {
   ): Namespace
   """
-  Find a composer package
+  Find a package
   """
-  packageComposerDetails(
+  package(
     """
     The global ID of the package.
     """
     id: PackagesPackageID!
-  ): PackageComposerDetails
+  ): Package
   """
   Find a project

doc/api/graphql/reference/index.md

@@ -593,6 +593,15 @@ Represents a ComplianceFramework associated with a Project.
 | `name` | String! | Name of the compliance framework |
 | `pipelineConfigurationFullPath` | String | Full path of the compliance pipeline configuration stored in a project repository, such as `.gitlab/compliance/soc2/.gitlab-ci.yml`. |
+### ComposerMetadata
+
+Composer metadata.
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `composerJson` | PackageComposerJsonType! | Data of the Composer JSON file. |
+| `targetSha` | String! | Target SHA of the package. |
+
 ### ConfigureSastPayload
 Autogenerated return type of ConfigureSast.
@@ -2541,34 +2550,17 @@ Represents a package in the Package Registry.
 | Field | Type | Description |
 | ----- | ---- | ----------- |
-| `createdAt` | Time! | The created date. |
-| `id` | ID! | The ID of the package. |
-| `name` | String! | The name of the package. |
-| `packageType` | PackageTypeEnum! | The type of the package. |
-| `pipelines` | PipelineConnection | Pipelines that built the package. |
-| `project` | Project! | Project where the package is stored. |
-| `tags` | PackageTagConnection | The package tags. |
-| `updatedAt` | Time! | The updated date. |
-| `version` | String | The version of the package. |
-| `versions` | PackageConnection | The other versions of the package. |
-
-### PackageComposerDetails
-
-Details of a Composer package.
-
-| Field | Type | Description |
-| ----- | ---- | ----------- |
-| `composerMetadatum` | PackageComposerMetadatumType! | The Composer metadatum. |
-| `createdAt` | Time! | The created date. |
-| `id` | ID! | The ID of the package. |
-| `name` | String! | The name of the package. |
-| `packageType` | PackageTypeEnum! | The type of the package. |
+| `createdAt` | Time! | Date of creation. |
+| `id` | PackagesPackageID! | ID of the package. |
+| `metadata` | PackageMetadata | Package metadata. |
+| `name` | String! | Name of the package. |
+| `packageType` | PackageTypeEnum! | Package type. |
 | `pipelines` | PipelineConnection | Pipelines that built the package. |
 | `project` | Project! | Project where the package is stored. |
-| `tags` | PackageTagConnection | The package tags. |
-| `updatedAt` | Time! | The updated date. |
-| `version` | String | The version of the package. |
-| `versions` | PackageConnection | The other versions of the package. |
+| `tags` | PackageTagConnection | Package tags. |
+| `updatedAt` | Time! | Date of most recent update. |
+| `version` | String | Version string. |
+| `versions` | PackageWithoutVersionsConnection | The other versions of the package. |
 ### PackageComposerJsonType
@@ -2581,15 +2573,6 @@ Represents a composer JSON file.
 | `type` | String | The type set in the Composer JSON file. |
 | `version` | String | The version set in the Composer JSON file. |
-### PackageComposerMetadatumType
-
-Composer metadatum.
-
-| Field | Type | Description |
-| ----- | ---- | ----------- |
-| `composerJson` | PackageComposerJsonType! | Data of the Composer JSON file. |
-| `targetSha` | String! | Target SHA of the package. |
-
 ### PackageFileRegistry
 Represents the Geo sync and verification state of a package file.
@@ -2625,6 +2608,23 @@ Represents a package tag.
 | `name` | String! | The name of the tag. |
 | `updatedAt` | Time! | The updated date. |
+### PackageWithoutVersions
+
+Represents a version of a package in the Package Registry.
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `createdAt` | Time! | Date of creation. |
+| `id` | PackagesPackageID! | ID of the package. |
+| `metadata` | PackageMetadata | Package metadata. |
+| `name` | String! | Name of the package. |
+| `packageType` | PackageTypeEnum! | Package type. |
+| `pipelines` | PipelineConnection | Pipelines that built the package. |
+| `project` | Project! | Project where the package is stored. |
+| `tags` | PackageTagConnection | Package tags. |
+| `updatedAt` | Time! | Date of most recent update. |
+| `version` | String | Version string. |
+
 ### PageInfo
 Information about pagination in a connection..

spec/fixtures/api/schemas/graphql/packages/package_composer_details.json

-{
-  "type": "object",
-  "allOf": [{ "$ref": "./package_details.json" }],
-  "properties": {
-    "target_sha": {
-      "type": "string"
-    },
-    "composer_json": {
-      "type": "object"
-    }
-  }
-}

spec/fixtures/api/schemas/graphql/packages/package_composer_metadata.json

+{
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["targetSha", "composerJson"],
+  "properties": {
+    "targetSha": {
+      "type": "string"
+    },
+    "composerJson": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "type", "license", "version"],
+      "properties": {
+        "name": { "type": "string" },
+        "type": { "type": "string" },
+        "license": { "type": "string" },
+        "version": { "type": "string" }
+      }
+    }
+  }
+}

spec/fixtures/api/schemas/graphql/packages/package_details.json

 {
   "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "id", "name", "createdAt", "updatedAt", "version", "packageType",
+    "project", "tags", "pipelines", "versions", "metadata"
+  ],
   "properties": {
     "id": {
       "type": "string"
@@ -16,21 +21,46 @@
     "version": {
       "type": ["string", "null"]
     },
-    "package_type": {
+    "packageType": {
       "type": ["string"],
       "enum": ["MAVEN", "NPM", "CONAN", "NUGET", "PYPI", "COMPOSER", "GENERIC", "GOLANG", "DEBIAN"]
     },
     "tags": {
-      "type": "object"
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "pageInfo": { "type": "object" },
+        "edges": { "type": "array" },
+        "nodes": { "type": "array" }
+      }
     },
     "project": {
       "type": "object"
     },
     "pipelines": {
-      "type": "object"
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "pageInfo": { "type": "object" },
+        "count": { "type": "integer" },
+        "edges": { "type": "array" },
+        "nodes": { "type": "array" }
+      }
     },
     "versions": {
-      "type": "object"
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "pageInfo": { "type": "object" },
+        "edges": { "type": "array" },
+        "nodes": { "type": "array" }
+      }
+    },
+    "metadata": {
+      "anyOf": [
+        { "$ref": "./package_composer_metadata.json" },
+        { "type": "null" }
+      ]
     }
   }
 }

spec/graphql/resolvers/package_details_resolver_spec.rb

@@ -4,6 +4,7 @@
 RSpec.describe Resolvers::PackageDetailsResolver do
   include GraphqlHelpers
+  include ::Gitlab::Graphql::Laziness
   let_it_be_with_reload(:project) { create(:project) }
   let_it_be(:user) { project.owner }
@@ -11,10 +12,10 @@
   describe '#resolve' do
     let(:args) do
-      { id: package.to_global_id.to_s }
+      { id: global_id_of(package) }
     end
-    subject { resolve(described_class, ctx: { current_user: user }, args: args).sync }
+    subject { force(resolve(described_class, ctx: { current_user: user }, args: args)) }
     it { is_expected.to eq(package) }
   end

spec/graphql/types/packages/composer/metadatum_type_spec.rb

@@ -2,9 +2,7 @@
 require 'spec_helper'
-RSpec.describe GitlabSchema.types['PackageComposerMetadatumType'] do
-  it { expect(described_class.graphql_name).to eq('PackageComposerMetadatumType') }
-
+RSpec.describe GitlabSchema.types['ComposerMetadata'] do
   it 'includes composer metadatum fields' do
     expected_fields = %w[
      target_sha composer_json

spec/graphql/types/packages/package_type_spec.rb

@@ -3,11 +3,12 @@
 require 'spec_helper'
 RSpec.describe GitlabSchema.types['Package'] do
-  it { expect(described_class.graphql_name).to eq('Package') }
-
   it 'includes all the package fields' do
     expected_fields = %w[
-        id name version created_at updated_at package_type tags project pipelines versions
+      id name version package_type
+      created_at updated_at
+      project
+      tags pipelines versions
     ]
     expect(described_class).to include_graphql_fields(*expected_fields)