membphis commented on PR #13840:
URL: https://github.com/apache/apisix/pull/13840#issuecomment-5352054762

   Reviewed head: `67b72e5774565fcf4c87255955b4595fff971681`
   
   ### [P1] `deep` index mode drops concrete-type decorations inside fragments
   
   `TEST 42` verifies that a fragment `typeCondition` moves `sel_type`, but its 
decoration set contains only `Product.expensive`. That path has depth 2, so 
`build_index` leaves `index.deep = false` and the test exercises only the flat 
`<type>.<field>` lookup.
   
   As soon as the same Service has any supported type-level or deeper path, 
`index.deep` becomes true and `each_field` stops using the flat map. Entering 
`... on Product` updates `sel_type` but passes the existing candidate `queue` 
through unchanged. For `expensive`, the deep branch then calls 
`advance(state.root, queue, child_type, name)`; it seeds from the field's 
return type (for example, `String`), not from the fragment's concrete selection 
type (`Product`). Consequently, `Product.expensive` is not matched.
   
   A minimal regression is a decoration index containing both:
   
   ```lua
   {field_path = "Product.expensive", add_value = 100},
   {field_path = "Query.node.id", add_value = 9},
   ```
   
   For:
   
   ```graphql
   query { node { ... on Product { expensive } } }
   ```
   
   the unrelated deep path switches the whole index to deep mode, and the query 
is charged as three plain nodes instead of applying the `Product.expensive` 
weight. The named-fragment form follows the same path.
   
   This allows the same field to evade its configured weight based on fragment 
syntax and the presence of another decoration, so `max_cost` and quota charging 
can undercount client-controlled queries. Please realign/reseed the candidate 
queue when a fragment changes the concrete type (while preserving still-live 
pinned candidates), and add inline- and named-fragment regressions with mixed 
depth-2 and deep/type-level decorations.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to