Validation of argument default values

Any default values provided when defining an argument are currently not validated against that argument’s type. So a Float argument could be passed a string as a default value and this schema will be considered valid. Moreover, the default value will be passed as-is to the resolver instead of being coerced into an appropriate value.

As far as I can tell, the current behavior is inline with the spec. But it seems counterintuitive that doing something like this would be valid:

const assert = require('assert')
const { buildSchema, validateSchema } = require('graphql')

const schema = buildSchema(`
  type Query {
    foo(bar: Float = "ABC"): Float
  }
`)

const errors = validateSchema(schema)
assert(errors.length > 0)

We do validate default values on variables, so I think it’s reasonable to expect at least consistency with that behavior. At the very least, I think validateSchema should be modified to validate the provided values against the argument type. I’m less certain about coercing the values, but off-hand it seems like desirable behavior as well.

[IvanGoncharov]

@danielrearden Thanks for extracting this issue 👍 Meta: I added PR: labels to generate changelog and to track PRs I think it’s just a bug and if something could be breaking for user than you just setup milestone to the next major release.

It’s a general issue with SDL validation and should be done in validateSDL(called by buildSchema) and not in validateSchema. validateSchema happening too late in the chain and should be reserved only for stuff that can’t be validated earlier. It’s important because validateSDL can be used by LSP since it supports incomplete schema and is pretty close to AST, but validateSchema expect full schema (all extension are merged, query root type defined, etc.).

It’s even more serious in a sense we don’t validate argument of directives it’s serious problem related to how validateSDL works (it doesn’t have ability to work with built types only AST node for them) since it’s hard to validate default value defined in the same SDL as type it should be validated against:

input SomeInput {
  field: SomeOtherInputObject = { enum: INVALID }
}

input SomeOtherInputObject {
  enum: SomeEnum
}

enum SomeEnum {
  TEST
}

It’s planned for 16.0.0-alpha that we hopefully start somewhere around next month.

[spawnia]

@IvanGoncharov Can scalar.parseLiteral(value) be used to validate correctness, or am I missing something here?

It appears that valueFromAST() is already used in that way: https://github.com/graphql/graphql-js/blob/a75e95b873575434910c215a69ddcc3ac9000ac2/src/utilities/valueFromAST.js#L137. To make it suitable for validation, we would have to let the errors bubble up so it is possible to differentiate between having no default value and a wrong default value.