Add query limits for array results

When doing a query such as:

query {
  allPosts(first: 10){
    id
  }
}

All is ok 👍

But what happens when someone does a query like:

query {
  allPosts(first: 10000000){
    id
  }
}

We need to have a way to set limits on the total results, perhaps like:

keystone.createList('Post', {
  fields: {},
  limits: {
    maxResults: 100
  }
});

[sarneaud]

Update: most of the features in the report have been added. The two that are still missing are

• Function-based limits
• Whitelisting of fields used in where clauses, etc.

The query limits haven’t been integrated with the (relatively) new multi-schema system. Maybe we don’t need the function-based limits if we have schema-aware limits.

I’m not doing any work on this at the moment.

[jesstelford]

why not let them?

To stop people launching DoS attacks against a KS5 instance, and to also catch the case where the developer accidentally does a query such as:

query {
  allPosts {
    id
  }
}

(ie; with no first arg).

These limits should additionally be by passable how do you control them at runtime?

Good points! We could accept a function like we already do for access control:

keystone.createList('Post', {
  fields: {},
  limits: {
    maxResults: ({ authentication: { item } }) => {
      if (item.isAdmin) {
        return null;
      }
      return 100;
    }
  }
});