Merge branch '62535-upgrade-graphql-gem-to-latest-version-1-9-6-or-higher' into 'master'

Upgrade GraphQL gem to 1.9.11

See merge request gitlab-org/gitlab-ce!31980

Gemfile

@@ -83,7 +83,7 @@ gem 'grape-entity', '~> 0.7.1'
 gem 'rack-cors', '~> 1.0.0', require: 'rack/cors'
 # GraphQL API
-gem 'graphql', '= 1.8.17'
+gem 'graphql', '~> 1.9.11'
 gem 'graphiql-rails', '~> 1.4.10'
 gem 'apollo_upload_server', '~> 2.0.0.beta3'
 gem 'graphql-docs', '~> 1.6.0', group: [:development, :test]

Gemfile.lock

@@ -377,7 +377,7 @@ GEM
     graphiql-rails (1.4.10)
       railties
       sprockets-rails
-    graphql (1.8.17)
+    graphql (1.9.11)
     graphql-docs (1.6.0)
       commonmarker (~> 0.16)
       escape_utils (~> 1.2)
@@ -1110,7 +1110,7 @@ DEPENDENCIES
   grape-path-helpers (~> 1.1)
   grape_logging (~> 1.7)
   graphiql-rails (~> 1.4.10)
-  graphql (= 1.8.17)
+  graphql (~> 1.9.11)
   graphql-docs (~> 1.6.0)
   grpc (~> 1.19.0)
   haml_lint (~> 0.31.0)

lib/gitlab/graphql/authorize/authorize_field_service.rb

@@ -74,9 +74,9 @@ def filter_allowed(current_user, resolved_type, authorizing_object)
             # Authorizing fields representing scalars, or a simple field with an object
             resolved_type if allowed_access?(current_user, authorizing_object)
           elsif @field.connection?
-            # A connection with pagination, modify the visible nodes in on the
+            # A connection with pagination, modify the visible nodes on the
             # connection type in place
-            resolved_type.edge_nodes.to_a.keep_if { |node| allowed_access?(current_user, node) }
+            resolved_type.object.edge_nodes.to_a.keep_if { |node| allowed_access?(current_user, node) }
             resolved_type
           elsif resolved_type.is_a? Array
             # A simple list of rendered types  each object being an object to authorize

lib/gitlab/graphql/representation/submodule_tree_entry.rb

@@ -4,6 +4,8 @@ module Gitlab
   module Graphql
     module Representation
       class SubmoduleTreeEntry < SimpleDelegator
+        include GlobalID::Identification
+
         class << self
           def decorate(submodules, tree)
             repository = tree.repository

lib/gitlab/graphql/representation/tree_entry.rb

@@ -4,6 +4,8 @@ module Gitlab
   module Graphql
     module Representation
       class TreeEntry < SimpleDelegator
+        include GlobalID::Identification
+
         class << self
           def decorate(entries, repository)
             return if entries.nil?

spec/graphql/features/authorization_spec.rb

@@ -8,10 +8,10 @@
   let(:permission_single) { :foo }
   let(:permission_collection) { [:foo, :bar] }
   let(:test_object) { double(name: 'My name') }
-  let(:query_string) { '{ object() { name } }' }
+  let(:query_string) { '{ item() { name } }' }
   let(:result) { execute_query(query_type)['data'] }
-  subject { result['object'] }
+  subject { result['item'] }
   shared_examples 'authorization with a single permission' do
     it 'returns the protected field when user has permission' do
@@ -54,7 +54,7 @@
     describe 'with a single permission' do
       let(:query_type) do
         query_factory do |query|
-          query.field :object, type, null: true, resolve: ->(obj, args, ctx) { test_object }, authorize: permission_single
+          query.field :item, type, null: true, resolve: ->(obj, args, ctx) { test_object }, authorize: permission_single
         end
       end
@@ -65,7 +65,7 @@
       let(:query_type) do
         permissions = permission_collection
         query_factory do |qt|
-          qt.field :object, type, null: true, resolve: ->(obj, args, ctx) { test_object } do
+          qt.field :item, type, null: true, resolve: ->(obj, args, ctx) { test_object } do
             authorize permissions
           end
         end
@@ -78,7 +78,7 @@
   describe 'Field authorizations when field is a built in type' do
     let(:query_type) do
       query_factory do |query|
-        query.field :object, type, null: true, resolve: ->(obj, args, ctx) { test_object }
+        query.field :item, type, null: true, resolve: ->(obj, args, ctx) { test_object }
       end
     end
@@ -131,7 +131,7 @@
   describe 'Type authorizations' do
     let(:query_type) do
       query_factory do |query|
-        query.field :object, type, null: true, resolve: ->(obj, args, ctx) { test_object }
+        query.field :item, type, null: true, resolve: ->(obj, args, ctx) { test_object }
       end
     end
@@ -168,7 +168,7 @@
     let(:query_type) do
       query_factory do |query|
-        query.field :object, type, null: true, resolve: ->(obj, args, ctx) { test_object }, authorize: permission_2
+        query.field :item, type, null: true, resolve: ->(obj, args, ctx) { test_object }, authorize: permission_2
       end
     end
@@ -176,7 +176,7 @@
   end
   describe 'type authorizations when applied to a relay connection' do
-    let(:query_string) { '{ object() { edges { node { name } } } }' }
+    let(:query_string) { '{ item() { edges { node { name } } } }' }
     let(:second_test_object) { double(name: 'Second thing') }
     let(:type) do
@@ -187,11 +187,11 @@
     let(:query_type) do
       query_factory do |query|
-        query.field :object, type.connection_type, null: true, resolve: ->(obj, args, ctx) { [test_object, second_test_object] }
+        query.field :item, type.connection_type, null: true, resolve: ->(obj, args, ctx) { [test_object, second_test_object] }
       end
     end
-    subject { result.dig('object', 'edges') }
+    subject { result.dig('item', 'edges') }
     it 'returns only the elements visible to the user' do
       permit(permission_single)
@@ -207,13 +207,13 @@
     describe 'limiting connections with multiple objects' do
       let(:query_type) do
         query_factory do |query|
-          query.field :object, type.connection_type, null: true, resolve: ->(obj, args, ctx) do
+          query.field :item, type.connection_type, null: true, resolve: ->(obj, args, ctx) do
             [test_object, second_test_object]
           end
         end
       end
-      let(:query_string) { '{ object(first: 1) { edges { node { name } } } }' }
+      let(:query_string) { '{ item(first: 1) { edges { node { name } } } }' }
       it 'only checks permissions for the first object' do
         expect(Ability).to receive(:allowed?).with(user, permission_single, test_object) { true }
@@ -233,11 +233,11 @@
     let(:query_type) do
       query_factory do |query|
-        query.field :object, [type], null: true, resolve: ->(obj, args, ctx) { [test_object] }
+        query.field :item, [type], null: true, resolve: ->(obj, args, ctx) { [test_object] }
       end
     end
-    subject { result['object'].first }
+    subject { result['item'].first }
     include_examples 'authorization with a single permission'
   end

spec/lib/gitlab/graphql/authorize/authorize_field_service_spec.rb

@@ -32,7 +32,8 @@ def type_with_field(field_type, field_authorizations = [], resolved_value = 'Res
     let(:presented_type) { double('parent type', object: presented_object) }
     let(:query_type) { GraphQL::ObjectType.new }
     let(:schema) { GraphQL::Schema.define(query: query_type, mutation: nil)}
-    let(:context) { GraphQL::Query::Context.new(query: OpenStruct.new(schema: schema), values: { current_user: current_user }, object: nil) }
+    let(:query_context) { OpenStruct.new(schema: schema) }
+    let(:context) { GraphQL::Query::Context.new(query: OpenStruct.new(schema: schema, context: query_context), values: { current_user: current_user }, object: nil) }
     subject(:resolved) { service.authorized_resolve.call(presented_type, {}, context) }
     context 'scalar types' do

spec/lib/gitlab/graphql/connections/keyset_connection_spec.rb

@@ -8,7 +8,7 @@
   end
   def encoded_property(value)
-    Base64.strict_encode64(value.to_s)
+    Base64Bp.urlsafe_encode64(value.to_s, padding: false)
   end
   describe '#cursor_from_nodes' do

spec/requests/api/graphql/gitlab_schema_spec.rb

@@ -120,7 +120,7 @@
         query_string: query,
         variables: {}.to_s,
         complexity: 181,
-        depth: 0,
+        depth: 13,
         duration: 7
       }

spec/requests/api/graphql/mutations/merge_requests/set_wip_spec.rb

@@ -13,7 +13,16 @@
       project_path: project.full_path,
       iid: merge_request.iid.to_s
     }
-    graphql_mutation(:merge_request_set_wip, variables.merge(input), "clientMutationId\nerrors\nmergeRequest { id\ntitle }")
+    graphql_mutation(:merge_request_set_wip, variables.merge(input),
+                     <<-QL.strip_heredoc
+                       clientMutationId
+                       errors
+                       mergeRequest {
+                         id
+                         title
+                       }
+                     QL
+    )
   end
   def mutation_response