You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
At the heart of GraphQL ASP.NET are 4 middleware pipelines; chains of components executed in a specific order to produce a result.
8
8
9
-
-`Query Execution Pipeline` : Invoked once per request this pipeline is responsible for validating the incoming package on the POST request, parsing the data and executing a query plan.
9
+
-`Query Execution Pipeline` : Invoked once per request this pipeline is responsible for validating the incoming package on the POST or GET request, parsing the data and executing a query plan.
10
10
-`Field Execution Pipeline` : Invoked once per requested field, this pipeline attempts to generate the requested data by calling the various controller actions and property resolvers.
11
11
-`Field Authorization Pipeline`: Ensures the user on the request can perform the action requested. This pipeline is invoked once for the whole query or for each field depending on your schema's configuration.
12
12
-`Directive Execution Pipeline`: Executes directives for various phases of schema and query document lifetimes.
@@ -78,7 +78,6 @@ public void ConfigureServices(IServiceCollection services)
78
78
79
79
Instead of adding to the end of the existing pipeline you can also call `.Clear()` to remove the default components and rebuild the pipeline from scratch. See below for the list of default middleware components and their order of execution. This can be handy when needing to inject a new component into the middle of the execution chain.
80
80
81
-
82
81
## The Context Object
83
82
84
83
Each context object has specific data fields required for it to perform its work (detailed below). However, all contexts share a common set of items to govern the flow of work.
@@ -140,7 +139,7 @@ The field execution pipeline is executed once for each field of data that needs
140
139
141
140
1.`ValidateFieldExecutionMiddleware` : Validates that the context and required invocation data has been correctly supplied.
142
141
2.`AuthorizeFieldMiddleware` : If the schema is configured for `PerField` authorization this component will invoke the field authorization pipeline for the current field and assign authorization results as appropriate.
143
-
4.`InvokeFieldResolverMiddleware` : The field resolver is called and a data value is created for the active context. This middleware component is ultimately responsible for invoking your controller actions. It also handles call outs to the directive execution pipeline when required.
142
+
3.`InvokeFieldResolverMiddleware` : The field resolver is called and a data value is created for the active context. This middleware component is ultimately responsible for invoking your controller actions. It also handles call outs to the directive execution pipeline when required.
144
143
4.`ProcessChildFieldsMiddleware` : If any child fields were registered with the invocation context for this field they are dispatched using the context's field result as the new source object.
145
144
146
145
#### GraphFieldExecutionContext
@@ -164,8 +163,8 @@ public class GraphFieldExecutionContext
164
163
165
164
The field authorization pipeline can be invoked as part of query execution or field execution depending on your schema's configuration. It contains 1 component:
166
165
167
-
1.`FieldSecurityRequirementsMiddleware` : Gathers the authentication and authorization requirements for the given field and ensures that the field _can_ be authorized. There are some instances where by
168
-
nested authorization requirements create a scenario in which no user could ever be authorized. This generally involves using multiple auth providers with specific authentication scheme requirements.
166
+
1.`FieldSecurityRequirementsMiddleware` : Gathers the authentication and authorization requirements for the given field and ensures that the field _can_ be authorized. There are some instances where by
167
+
nested authorization requirements create a scenario in which no user could ever be authorized. This generally involves using multiple auth providers with specific authentication scheme requirements.
169
168
2.`FieldAuthenticationMiddleware` : Authenticates the request to the field. This generates a ClaimsPrincipal to be authorized against.
170
169
3.`FieldAuthorizationMiddleware`: Inspects the active `ClaimsPrincipal` against the security requirements of the field on the context and generates a `FieldAuthorizationResult` indicating if the user is authorized or not. This component makes no decisions in regards to the authorization state. It is up to the other pipelines to act on the authorization results that are generated.
171
170
@@ -183,20 +182,21 @@ In addition to the common properties defined above the field security context de
183
182
// common properties omitted for brevity
184
183
}
185
184
```
185
+
186
186
-`SecurityRequirements`: The security rules that need to be checked to authorize a user.
187
187
-`Request`: Contains details about the field currently being authed.
188
188
-`Result`: The generated challenge result indicating if the user is authorized or unauthorized for the field. This result will contain additional detailed information as to why a request was not authorized. This information is automatically added to any generated log events.
189
189
190
-
191
190
## Directive Execution Pipeline
191
+
192
192
The directive execution pipeline will be invoked for each directive applied to each schema item during schema generation and each time the query engine encounters a
193
193
directive at runtime. The directive pipeline contains two components by default:
194
194
195
195
1.`ValidateDirectiveExecutionMiddleware`: Inspects the execution context against the validation requirements of the given execution phase applying appropriate error messages as necessary.
196
196
2.`InvokeDirectiveResolverMiddleware`: Generates a `DirectiveResolutionContext` and invokes the directive's resolver, calling the correct action methods.
197
197
198
-
199
198
#### GraphDirectiveExecutionContext
199
+
200
200
```csharp
201
201
publicclassGraphDirectiveExecutionContext
202
202
{
@@ -210,7 +210,7 @@ public class GraphDirectiveExecutionContext
210
210
211
211
-`Request`: Contains the directive metadata for this context, including the DirectiveTarget, execution phase and executing location.
212
212
-`Directive`: The specific `IDirective`, registered to the schema, that is being processed.
213
-
-`Schema`: the schema instance where the directive is declared.
213
+
-`Schema`: the schema instance where the directive is declared.
214
214
215
215
> WARNING: Since the directive execution pipeline is used to construct the schema and apply type system directives, middleware components cannot inject a schema instance
216
-
from the DI container. To do so will cause a circular reference. Instead use the schema instance attached to the `GraphDirectiveExecutionContext`. The state of this schema object is not guaranteed at during schema generation as it will continue to change as type system directives are applied by the pipeline.
216
+
> from the DI container. To do so will cause a circular reference. Instead use the schema instance attached to the `GraphDirectiveExecutionContext`. The state of this schema object is not guaranteed at during schema generation as it will continue to change as type system directives are applied by the pipeline.
Copy file name to clipboardExpand all lines: docs/controllers/actions.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -644,7 +644,7 @@ public class BakeryController : GraphController
644
644
645
645
### Defining a Query Timeout
646
646
647
-
By default GraphQL does not define a timeout for an executed query. The query will run as long as the underlying HTTP connection is open. In fact, the `CancellationToken` passed to your action methods is the same Cancellation Token offered on the HttpContext when it receives the initial post request.
647
+
By default GraphQL does not define a timeout for an executed query. The query will run as long as the underlying HTTP connection is open. In fact, the `CancellationToken` passed to your action methods is the same Cancellation Token offered on the HttpContext when it receives the initial request.
648
648
649
649
Optionally, you can define a query timeout for a given schema:
0 commit comments