GraphQL Deep Dive

# The GraphQL schema nightmare that kills database performance
type User {
  id: ID!
  username: String!
  email: String!
  # Direct reference without batching consideration - RED FLAG #1
  posts: [Post!]!
  # Expensive computed field - RED FLAG #2
  followerCount: Int!
  # Unbounded relationship - RED FLAG #3
  followers: [User!]!
  # Circular reference without depth limiting - RED FLAG #4
  following: [User!]!
  # Complex nested data - RED FLAG #5
  analytics: UserAnalytics!
}

type Post {
  id: ID!
  title: String!
  content: String!
  # Another N+1 problem waiting to happen - RED FLAG #6
  author: User!
  # Nested comments without pagination - RED FLAG #7
  comments: [Comment!]!
  # Expensive aggregation - RED FLAG #8
  likeCount: Int!
  # More circular references - RED FLAG #9
  likes: [Like!]!
}

type Comment {
  id: ID!
  content: String!
  # More N+1 problems - RED FLAG #10
  author: User!
  # Unbounded nested comments - RED FLAG #11
  replies: [Comment!]!
  # Parent reference creating cycles - RED FLAG #12
  parent: Comment
}

type UserAnalytics {
  # Expensive real-time calculations - RED FLAG #13
  totalViews: Int!
  avgEngagementRate: Float!
  # Time-series data without proper aggregation - RED FLAG #14
  dailyStats: [DailyStats!]!
}

type Query {
  # No pagination, no limits - RED FLAG #15
  users: [User!]!
  # Allows unlimited depth queries - RED FLAG #16
  user(id: ID!): User
  # No query complexity consideration - RED FLAG #17
  posts: [Post!]!
}

# This schema allows queries like:
# query DisasterQuery {
#   users {
#     followers {
#       following {
#         posts {
#           comments {
#             replies {
#               author {
#                 posts {
#                   comments {
#                     # ... infinite nesting possible
#                   }
#                 }
#               }
#             }
#           }
#         }
#       }
#     }
#   }
# }

// The naive resolver implementation that destroys performance
const resolvers = {
  Query: {
    // N+1 problem: Will make 1 query + N queries for each user's posts - RED FLAG #1
    users: async () => {
      return await User.find({});
    },

    user: async (_, { id }) => {
      return await User.findById(id);
    },
  },

  User: {
    // N+1 problem: Separate query for each user's posts - RED FLAG #2
    posts: async (user) => {
      return await Post.find({ authorId: user.id });
    },

    // Expensive aggregation on every user - RED FLAG #3
    followerCount: async (user) => {
      return await Follow.countDocuments({ followingId: user.id });
    },

    // Unbounded data loading - RED FLAG #4
    followers: async (user) => {
      const follows = await Follow.find({ followingId: user.id });
      return await Promise.all(
        follows.map((follow) => User.findById(follow.followerId))
      );
    },

    // More N+1 problems - RED FLAG #5
    following: async (user) => {
      const follows = await Follow.find({ followerId: user.id });
      return await Promise.all(
        follows.map((follow) => User.findById(follow.followingId))
      );
    },

    // Complex calculation on every request - RED FLAG #6
    analytics: async (user) => {
      const posts = await Post.find({ authorId: user.id });
      const totalLikes = await Promise.all(
        posts.map((post) => Like.countDocuments({ postId: post.id }))
      );

      return {
        totalViews: posts.reduce((sum, post) => sum + post.views, 0),
        avgEngagementRate: calculateEngagementRate(posts, totalLikes),
        dailyStats: await calculateDailyStats(user.id), // More expensive queries
      };
    },
  },

  Post: {
    // N+1 problem for author loading - RED FLAG #7
    author: async (post) => {
      return await User.findById(post.authorId);
    },

    // Unbounded comment loading - RED FLAG #8
    comments: async (post) => {
      return await Comment.find({ postId: post.id });
    },

    // Expensive aggregation - RED FLAG #9
    likeCount: async (post) => {
      return await Like.countDocuments({ postId: post.id });
    },

    // More N+1 problems - RED FLAG #10
    likes: async (post) => {
      return await Like.find({ postId: post.id });
    },
  },

  Comment: {
    // Nested N+1 problems - RED FLAG #11
    author: async (comment) => {
      return await User.findById(comment.authorId);
    },

    // Recursive loading without limits - RED FLAG #12
    replies: async (comment) => {
      return await Comment.find({ parentId: comment.id });
    },
  },
};

// A simple query like this:
// query {
//   users {
//     posts {
//       author {
//         followerCount
//       }
//       comments {
//         author {
//           username
//         }
//       }
//     }
//   }
// }
//
// Will result in:
// - 1 query to get users
// - N queries to get posts for each user
// - N*M queries to get authors for each post
// - N*M queries to get follower counts
// - N*P queries to get comments for each post
// - N*P*Q queries to get authors for each comment
// = Potentially thousands of database queries for a simple request!

// High-performance GraphQL schema with proper batching and optimization
import {
  GraphQLObjectType,
  GraphQLID,
  GraphQLString,
  GraphQLInt,
  GraphQLList,
  GraphQLSchema,
  GraphQLNonNull,
} from "graphql";
import DataLoader from "dataloader";
import {
  connectionFromArray,
  connectionArgs,
  ConnectionType,
} from "graphql-relay";

// Optimized schema design with pagination and performance considerations
export const typeDefs = `
  # Pagination wrapper for all list queries
  type PageInfo {
    hasNextPage: Boolean!
    hasPreviousPage: Boolean!
    startCursor: String
    endCursor: String
  }

  # User type with performance-optimized fields
  type User {
    id: ID!
    username: String!
    email: String!
    
    # Paginated relationships to prevent unbounded data loading
    posts(first: Int = 10, after: String, orderBy: PostOrderBy = CREATED_AT_DESC): PostConnection!
    
    # Cached computed fields
    followerCount: Int!
    followingCount: Int!
    
    # Paginated followers with reasonable limits
    followers(first: Int = 50, after: String): UserConnection!
    following(first: Int = 50, after: String): UserConnection!
    
    # Optional analytics that can be skipped if not needed
    analytics: UserAnalytics
    
    createdAt: String!
    updatedAt: String!
  }

  # Post type with efficient relationships
  type Post {
    id: ID!
    title: String!
    content: String!
    excerpt(length: Int = 150): String!
    
    # Author loaded via DataLoader batching
    author: User!
    
    # Paginated comments with threading support
    comments(first: Int = 20, after: String, parentId: ID): CommentConnection!
    
    # Pre-calculated metrics stored in database
    likeCount: Int!
    commentCount: Int!
    viewCount: Int!
    
    # Efficient boolean flags instead of expensive relationships
    isLiked: Boolean! # Resolved based on current user context
    
    tags: [String!]!
    createdAt: String!
    updatedAt: String!
  }

  # Comment with controlled nesting
  type Comment {
    id: ID!
    content: String!
    
    # Batched author loading
    author: User!
    
    # Limited reply depth (max 3 levels)
    replies(first: Int = 10, after: String): CommentConnection!
    
    # Parent reference for threading
    parentId: ID
    
    likeCount: Int!
    isLiked: Boolean!
    
    createdAt: String!
    updatedAt: String!
  }

  # Efficient analytics with pre-computed data
  type UserAnalytics {
    # Stored in analytics table, not computed on-demand
    totalViews: Int!
    totalLikes: Int!
    totalComments: Int!
    
    # Recent stats with proper aggregation
    last30DaysViews: Int!
    last30DaysLikes: Int!
    
    # Engagement rate pre-calculated daily
    engagementRate: Float!
    
    # Time-series data with proper pagination
    dailyStats(days: Int = 7): [DailyAnalyticsStat!]!
  }

  type DailyAnalyticsStat {
    date: String!
    views: Int!
    likes: Int!
    comments: Int!
  }

  # Connection types for pagination
  type PostConnection {
    edges: [PostEdge!]!
    pageInfo: PageInfo!
    totalCount: Int!
  }

  type PostEdge {
    node: Post!
    cursor: String!
  }

  type UserConnection {
    edges: [UserEdge!]!
    pageInfo: PageInfo!
    totalCount: Int!
  }

  type UserEdge {
    node: User!
    cursor: String!
  }

  type CommentConnection {
    edges: [CommentEdge!]!
    pageInfo: PageInfo!
    totalCount: Int!
  }

  type CommentEdge {
    node: Comment!
    cursor: String!
  }

  enum PostOrderBy {
    CREATED_AT_ASC
    CREATED_AT_DESC
    LIKE_COUNT_ASC
    LIKE_COUNT_DESC
    VIEW_COUNT_ASC
    VIEW_COUNT_DESC
  }

  type Query {
    # Paginated queries with reasonable defaults
    users(first: Int = 10, after: String, search: String): UserConnection!
    user(id: ID!): User
    
    posts(
      first: Int = 10, 
      after: String, 
      authorId: ID, 
      tag: String,
      orderBy: PostOrderBy = CREATED_AT_DESC
    ): PostConnection!
    
    post(id: ID!): Post
    
    # Search with proper indexing
    searchPosts(
      query: String!, 
      first: Int = 10, 
      after: String
    ): PostConnection!
    
    # Trending content with caching
    trendingPosts(timeframe: String = "24h", first: Int = 10): [Post!]!
  }

  type Mutation {
    createPost(input: CreatePostInput!): Post!
    updatePost(id: ID!, input: UpdatePostInput!): Post!
    deletePost(id: ID!): Boolean!
    
    likePost(postId: ID!): Post!
    unlikePost(postId: ID!): Post!
    
    createComment(input: CreateCommentInput!): Comment!
    updateComment(id: ID!, input: UpdateCommentInput!): Comment!
    deleteComment(id: ID!): Boolean!
    
    followUser(userId: ID!): User!
    unfollowUser(userId: ID!): User!
  }

  type Subscription {
    # Real-time updates with proper filtering
    postAdded(authorId: ID): Post!
    commentAdded(postId: ID!): Comment!
    
    # User activity feed
    userActivityFeed(userId: ID!): ActivityFeedItem!
  }

  input CreatePostInput {
    title: String!
    content: String!
    tags: [String!]
  }

  input UpdatePostInput {
    title: String
    content: String
    tags: [String!]
  }

  input CreateCommentInput {
    postId: ID!
    content: String!
    parentId: ID
  }

  input UpdateCommentInput {
    content: String!
  }

  union ActivityFeedItem = Post | Comment | Follow
`;

// DataLoader implementation for efficient batching
export class DataLoaderService {
  private userLoader: DataLoader<string, any>;
  private postLoader: DataLoader<string, any>;
  private userPostsLoader: DataLoader<string, any[]>;
  private postCommentsLoader: DataLoader<string, any[]>;
  private postLikesLoader: DataLoader<string, number>;
  private userFollowersLoader: DataLoader<string, any[]>;

  constructor(private db: Database, private userId?: string) {
    this.userLoader = new DataLoader(async (userIds: string[]) => {
      // Batch load users in single query
      const users = await this.db
        .collection("users")
        .find({
          _id: { $in: userIds.map((id) => new ObjectId(id)) },
        })
        .toArray();

      // Return in same order as requested
      return userIds.map(
        (id) => users.find((user) => user._id.toString() === id) || null
      );
    });

    this.postLoader = new DataLoader(async (postIds: string[]) => {
      const posts = await this.db
        .collection("posts")
        .find({
          _id: { $in: postIds.map((id) => new ObjectId(id)) },
        })
        .toArray();

      return postIds.map(
        (id) => posts.find((post) => post._id.toString() === id) || null
      );
    });

    this.userPostsLoader = new DataLoader(async (userIds: string[]) => {
      // Batch load posts for multiple users
      const posts = await this.db
        .collection("posts")
        .find({
          authorId: { $in: userIds.map((id) => new ObjectId(id)) },
        })
        .toArray();

      // Group posts by author
      const postsByAuthor = userIds.map((userId) =>
        posts.filter((post) => post.authorId.toString() === userId)
      );

      return postsByAuthor;
    });

    this.postCommentsLoader = new DataLoader(async (postIds: string[]) => {
      const comments = await this.db
        .collection("comments")
        .find({
          postId: { $in: postIds.map((id) => new ObjectId(id)) },
        })
        .toArray();

      const commentsByPost = postIds.map((postId) =>
        comments.filter((comment) => comment.postId.toString() === postId)
      );

      return commentsByPost;
    });

    this.postLikesLoader = new DataLoader(async (postIds: string[]) => {
      // Use aggregation for efficient counting
      const likeCounts = await this.db
        .collection("likes")
        .aggregate([
          {
            $match: { postId: { $in: postIds.map((id) => new ObjectId(id)) } },
          },
          { $group: { _id: "$postId", count: { $sum: 1 } } },
        ])
        .toArray();

      return postIds.map((postId) => {
        const countDoc = likeCounts.find(
          (doc) => doc._id.toString() === postId
        );
        return countDoc ? countDoc.count : 0;
      });
    });

    this.userFollowersLoader = new DataLoader(async (userIds: string[]) => {
      const follows = await this.db
        .collection("follows")
        .find({
          followingId: { $in: userIds.map((id) => new ObjectId(id)) },
        })
        .toArray();

      const followersByUser = userIds.map((userId) =>
        follows.filter((follow) => follow.followingId.toString() === userId)
      );

      return followersByUser;
    });
  }

  // Convenience methods
  async loadUser(id: string) {
    return this.userLoader.load(id);
  }

  async loadPost(id: string) {
    return this.postLoader.load(id);
  }

  async loadUserPosts(userId: string, first: number = 10, after?: string) {
    // For pagination, we need more sophisticated logic
    const posts = await this.userPostsLoader.load(userId);

    // Apply cursor-based pagination
    return this.applyCursorPagination(posts, first, after);
  }

  async loadPostLikeCount(postId: string): Promise<number> {
    return this.postLikesLoader.load(postId);
  }

  async isPostLikedByCurrentUser(postId: string): Promise<boolean> {
    if (!this.userId) return false;

    const like = await this.db.collection("likes").findOne({
      postId: new ObjectId(postId),
      userId: new ObjectId(this.userId),
    });

    return !!like;
  }

  private applyCursorPagination<T>(
    items: T[],
    first: number,
    after?: string
  ): { items: T[]; hasNextPage: boolean; hasPreviousPage: boolean } {
    let startIndex = 0;

    if (after) {
      const afterIndex = items.findIndex(
        (item: any) => item._id.toString() === after
      );
      startIndex = afterIndex + 1;
    }

    const endIndex = startIndex + first;
    const selectedItems = items.slice(startIndex, endIndex);

    return {
      items: selectedItems,
      hasNextPage: endIndex < items.length,
      hasPreviousPage: startIndex > 0,
    };
  }
}

// High-performance resolvers with proper batching
export const resolvers = {
  Query: {
    users: async (
      _: any,
      { first = 10, after, search }: any,
      { dataloaders, db }: GraphQLContext
    ) => {
      let query: any = {};

      if (search) {
        query.$text = { $search: search };
      }

      const users = await db
        .collection("users")
        .find(query)
        .limit(first + 1) // Get one extra to determine hasNextPage
        .toArray();

      const hasNextPage = users.length > first;
      if (hasNextPage) users.pop(); // Remove the extra item

      return {
        edges: users.map((user) => ({
          node: user,
          cursor: user._id.toString(),
        })),
        pageInfo: {
          hasNextPage,
          hasPreviousPage: false, // Simplified for example
          startCursor: users[0]?._id?.toString(),
          endCursor: users[users.length - 1]?._id?.toString(),
        },
        totalCount: await db.collection("users").countDocuments(query),
      };
    },

    user: async (_: any, { id }: any, { dataloaders }: GraphQLContext) => {
      return dataloaders.loadUser(id);
    },

    posts: async (
      _: any,
      { first = 10, after, authorId, tag, orderBy = "CREATED_AT_DESC" }: any,
      { db }: GraphQLContext
    ) => {
      let query: any = {};

      if (authorId) {
        query.authorId = new ObjectId(authorId);
      }

      if (tag) {
        query.tags = tag;
      }

      // Convert orderBy enum to MongoDB sort
      const sort = this.convertOrderByToSort(orderBy);

      const posts = await db
        .collection("posts")
        .find(query)
        .sort(sort)
        .limit(first + 1)
        .toArray();

      const hasNextPage = posts.length > first;
      if (hasNextPage) posts.pop();

      return {
        edges: posts.map((post) => ({
          node: post,
          cursor: post._id.toString(),
        })),
        pageInfo: {
          hasNextPage,
          hasPreviousPage: false,
          startCursor: posts[0]?._id?.toString(),
          endCursor: posts[posts.length - 1]?._id?.toString(),
        },
        totalCount: await db.collection("posts").countDocuments(query),
      };
    },
  },

  User: {
    posts: async (
      user: any,
      { first = 10, after }: any,
      { dataloaders }: GraphQLContext
    ) => {
      return dataloaders.loadUserPosts(user._id.toString(), first, after);
    },

    followerCount: async (user: any, _: any, { redis }: GraphQLContext) => {
      // Use Redis cache for follower counts
      const cacheKey = `follower_count:${user._id}`;
      const cached = await redis.get(cacheKey);

      if (cached) {
        return parseInt(cached);
      }

      const count = await dataloaders.db.collection("follows").countDocuments({
        followingId: user._id,
      });

      // Cache for 5 minutes
      await redis.setex(cacheKey, 300, count.toString());
      return count;
    },

    followingCount: async (
      user: any,
      _: any,
      { redis, db }: GraphQLContext
    ) => {
      const cacheKey = `following_count:${user._id}`;
      const cached = await redis.get(cacheKey);

      if (cached) {
        return parseInt(cached);
      }

      const count = await db.collection("follows").countDocuments({
        followerId: user._id,
      });

      await redis.setex(cacheKey, 300, count.toString());
      return count;
    },

    analytics: async (user: any, _: any, { db, redis }: GraphQLContext) => {
      // Load pre-computed analytics from dedicated table
      const analytics = await db.collection("user_analytics").findOne({
        userId: user._id,
      });

      return (
        analytics || {
          totalViews: 0,
          totalLikes: 0,
          totalComments: 0,
          last30DaysViews: 0,
          last30DaysLikes: 0,
          engagementRate: 0,
          dailyStats: [],
        }
      );
    },
  },

  Post: {
    author: async (post: any, _: any, { dataloaders }: GraphQLContext) => {
      return dataloaders.loadUser(post.authorId.toString());
    },

    likeCount: async (post: any, _: any, { dataloaders }: GraphQLContext) => {
      return dataloaders.loadPostLikeCount(post._id.toString());
    },

    isLiked: async (post: any, _: any, { dataloaders }: GraphQLContext) => {
      return dataloaders.isPostLikedByCurrentUser(post._id.toString());
    },

    comments: async (
      post: any,
      { first = 20, after, parentId }: any,
      { db }: GraphQLContext
    ) => {
      let query: any = { postId: post._id };

      if (parentId) {
        query.parentId = new ObjectId(parentId);
      } else {
        query.parentId = { $exists: false }; // Top-level comments only
      }

      const comments = await db
        .collection("comments")
        .find(query)
        .sort({ createdAt: -1 })
        .limit(first + 1)
        .toArray();

      const hasNextPage = comments.length > first;
      if (hasNextPage) comments.pop();

      return {
        edges: comments.map((comment) => ({
          node: comment,
          cursor: comment._id.toString(),
        })),
        pageInfo: {
          hasNextPage,
          hasPreviousPage: false,
          startCursor: comments[0]?._id?.toString(),
          endCursor: comments[comments.length - 1]?._id?.toString(),
        },
        totalCount: await db.collection("comments").countDocuments(query),
      };
    },
  },

  Comment: {
    author: async (comment: any, _: any, { dataloaders }: GraphQLContext) => {
      return dataloaders.loadUser(comment.authorId.toString());
    },

    replies: async (
      comment: any,
      { first = 10, after }: any,
      { db }: GraphQLContext
    ) => {
      const replies = await db
        .collection("comments")
        .find({ parentId: comment._id })
        .sort({ createdAt: 1 }) // Replies in chronological order
        .limit(first + 1)
        .toArray();

      const hasNextPage = replies.length > first;
      if (hasNextPage) replies.pop();

      return {
        edges: replies.map((reply) => ({
          node: reply,
          cursor: reply._id.toString(),
        })),
        pageInfo: {
          hasNextPage,
          hasPreviousPage: false,
          startCursor: replies[0]?._id?.toString(),
          endCursor: replies[replies.length - 1]?._id?.toString(),
        },
        totalCount: await db.collection("comments").countDocuments({
          parentId: comment._id,
        }),
      };
    },

    likeCount: async (comment: any, _: any, { db }: GraphQLContext) => {
      return db.collection("comment_likes").countDocuments({
        commentId: comment._id,
      });
    },
  },
};

// Supporting interfaces
interface GraphQLContext {
  dataloaders: DataLoaderService;
  db: Database;
  redis: RedisClient;
  userId?: string;
}

interface Database {
  collection(name: string): any;
}

interface RedisClient {
  get(key: string): Promise<string | null>;
  setex(key: string, seconds: number, value: string): Promise<void>;
}

// The GraphQL query complexity nightmare
const dangerousQueries = [
  // Query that could return millions of records - RED FLAG #1
  `query GetAllData {
    users {
      posts {
        comments {
          replies {
            author {
              posts {
                comments {
                  author {
                    following {
                      posts {
                        # ... continues infinitely
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }`,

  // Query that triggers massive N+1 problems - RED FLAG #2
  `query ExpensiveUserData {
    users {
      followerCount    # Database query for each user
      followingCount   # Another database query for each user
      analytics {      # Complex calculation for each user
        totalViews
        engagementRate
        dailyStats     # Time-series query for each user
      }
      posts {
        likeCount      # Aggregation for each post
        commentCount   # Another aggregation for each post
        comments {
          author {
            followerCount  # More expensive calculations
          }
        }
      }
    }
  }`,

  // Query designed to consume maximum resources - RED FLAG #3
  `query ResourceExhaustion {
    posts(first: 1000) {  # Large page size
      author {
        followers(first: 1000) {  # Another large page size
          posts(first: 1000) {    # Exponential data explosion
            comments(first: 1000) {
              replies(first: 1000) {
                # Requesting millions of records
              }
            }
          }
        }
      }
    }
  }`,
];

// Naive middleware that provides no protection
const naiveExecutor = async (query: string) => {
  // No query analysis - RED FLAG #4
  // No complexity calculation - RED FLAG #5
  // No depth limiting - RED FLAG #6
  // No timeout protection - RED FLAG #7

  return await graphql(schema, query, rootValue, context);

  // Problems this creates:
  // - Queries can run for hours
  // - Database connections are exhausted
  // - Memory usage grows unbounded
  // - Server becomes unresponsive
  // - No way to identify problematic queries
};

// Comprehensive GraphQL query protection and optimization
import {
  getComplexity,
  maximumComplexityRule,
  depthLimit,
  costAnalysis,
  createComplexityLimitRule,
} from "graphql-query-complexity";
import { createRateLimitRule } from "graphql-rate-limit";
import { shield, rule, and, or } from "graphql-shield";

// Advanced query complexity calculator
export class GraphQLQueryComplexityAnalyzer {
  private complexityMap: ComplexityMap;
  private maxComplexity: number;
  private maxDepth: number;

  constructor(config: ComplexityConfig) {
    this.maxComplexity = config.maxComplexity || 1000;
    this.maxDepth = config.maxDepth || 10;
    this.complexityMap = this.buildComplexityMap();
  }

  private buildComplexityMap(): ComplexityMap {
    return {
      // Simple fields have low complexity
      User: {
        id: 1,
        username: 1,
        email: 1,
        createdAt: 1,

        // Expensive computed fields have higher complexity
        followerCount: 10,
        followingCount: 10,
        analytics: 50,

        // Relationship fields complexity based on potential data volume
        posts: {
          complexity: ({ args, childComplexity }) => {
            const first = args.first || 10;
            return first * childComplexity;
          },
          multipliers: ["first"],
        },

        followers: {
          complexity: ({ args, childComplexity }) => {
            const first = args.first || 50;
            return first * childComplexity;
          },
          multipliers: ["first"],
        },
      },

      Post: {
        id: 1,
        title: 1,
        content: 2, // Slightly more expensive due to size
        excerpt: 1,

        // Author requires a database lookup but uses DataLoader
        author: 5,

        // Aggregated fields are expensive
        likeCount: 10,
        commentCount: 10,
        viewCount: 5,

        // Boolean fields that require lookups
        isLiked: 15,

        // Paginated relationships
        comments: {
          complexity: ({ args, childComplexity }) => {
            const first = args.first || 20;
            return first * childComplexity;
          },
          multipliers: ["first"],
        },
      },

      Comment: {
        id: 1,
        content: 2,
        author: 5,
        likeCount: 10,
        isLiked: 15,

        replies: {
          complexity: ({ args, childComplexity }) => {
            const first = args.first || 10;
            // Recursive comments have exponential complexity
            return first * childComplexity * 2;
          },
          multipliers: ["first"],
        },
      },

      UserAnalytics: {
        // All analytics fields are expensive as they require aggregation
        totalViews: 20,
        totalLikes: 20,
        totalComments: 20,
        last30DaysViews: 30,
        last30DaysLikes: 30,
        engagementRate: 40,

        dailyStats: {
          complexity: ({ args }) => {
            const days = args.days || 7;
            return days * 5; // 5 complexity per day
          },
        },
      },

      Query: {
        // List queries have high base complexity
        users: {
          complexity: ({ args, childComplexity }) => {
            const first = args.first || 10;
            const searchMultiplier = args.search ? 2 : 1;
            return first * childComplexity * searchMultiplier;
          },
        },

        posts: {
          complexity: ({ args, childComplexity }) => {
            const first = args.first || 10;
            const searchMultiplier = args.search ? 2 : 1;
            return first * childComplexity * searchMultiplier;
          },
        },

        // Individual item queries are cheaper
        user: 50,
        post: 30,
      },
    };
  }

  analyzeQuery(query: string, variables: any = {}): QueryAnalysisResult {
    try {
      const document = parse(query);

      // Calculate query complexity
      const complexity = getComplexity({
        estimators: [
          this.createFieldComplexityEstimator(),
          this.createScalarComplexityEstimator(),
        ],
        maximumComplexity: this.maxComplexity,
        variables,
        schema: this.schema,
        query: document,
      });

      // Calculate query depth
      const depth = this.calculateQueryDepth(document);

      // Estimate execution time based on complexity
      const estimatedExecutionTime = this.estimateExecutionTime(complexity);

      // Calculate estimated cost
      const estimatedCost = this.calculateQueryCost(complexity, depth);

      return {
        complexity,
        depth,
        estimatedExecutionTime,
        estimatedCost,
        isWithinLimits:
          complexity <= this.maxComplexity && depth <= this.maxDepth,
        warnings: this.generateWarnings(complexity, depth),
      };
    } catch (error) {
      return {
        complexity: 0,
        depth: 0,
        estimatedExecutionTime: 0,
        estimatedCost: 0,
        isWithinLimits: false,
        error: error.message,
      };
    }
  }

  private createFieldComplexityEstimator() {
    return (args: any, childComplexity: number) => {
      const { type, field } = args;
      const typeName = type.name;
      const fieldName = field.name;

      const typeComplexity = this.complexityMap[typeName];
      if (!typeComplexity) return 1;

      const fieldComplexity = typeComplexity[fieldName];
      if (typeof fieldComplexity === "number") {
        return fieldComplexity + childComplexity;
      }

      if (typeof fieldComplexity === "object" && fieldComplexity.complexity) {
        return fieldComplexity.complexity({ args: args.args, childComplexity });
      }

      return 1 + childComplexity;
    };
  }

  private createScalarComplexityEstimator() {
    return () => 0; // Scalar fields have no additional complexity
  }

  private calculateQueryDepth(document: DocumentNode): number {
    let maxDepth = 0;

    visit(document, {
      Field: {
        enter: (node, key, parent, path) => {
          const currentDepth = path.filter(
            (p) => typeof p === "string" && p === "selectionSet"
          ).length;
          maxDepth = Math.max(maxDepth, currentDepth);
        },
      },
    });

    return maxDepth;
  }

  private estimateExecutionTime(complexity: number): number {
    // Empirically derived formula: complexity * 2ms base + exponential factor for high complexity
    const baseTime = complexity * 2;
    const exponentialFactor =
      complexity > 500 ? Math.pow(complexity / 500, 1.5) : 1;
    return Math.round(baseTime * exponentialFactor);
  }

  private calculateQueryCost(complexity: number, depth: number): number {
    // Cost calculation based on AWS Lambda pricing and database operations
    const baseCost = complexity * 0.0001; // $0.0001 per complexity point
    const depthPenalty = depth > 5 ? Math.pow(depth - 5, 2) * 0.001 : 0;
    return baseCost + depthPenalty;
  }

  private generateWarnings(complexity: number, depth: number): string[] {
    const warnings: string[] = [];

    if (complexity > this.maxComplexity * 0.8) {
      warnings.push(
        `Query complexity (${complexity}) is approaching the limit (${this.maxComplexity})`
      );
    }

    if (depth > this.maxDepth * 0.8) {
      warnings.push(
        `Query depth (${depth}) is approaching the limit (${this.maxDepth})`
      );
    }

    if (complexity > 500) {
      warnings.push("High complexity query may result in slow response times");
    }

    if (depth > 7) {
      warnings.push("Deep nested queries may cause exponential resource usage");
    }

    return warnings;
  }
}

// Query execution middleware with protection and monitoring
export class GraphQLExecutionEngine {
  private analyzer: GraphQLQueryComplexityAnalyzer;
  private metrics: GraphQLMetricsCollector;
  private rateLimiter: RateLimiter;

  constructor(private schema: GraphQLSchema, private config: ExecutionConfig) {
    this.analyzer = new GraphQLQueryComplexityAnalyzer(config.complexity);
    this.metrics = new GraphQLMetricsCollector();
    this.rateLimiter = new RateLimiter(config.rateLimit);
  }

  async executeQuery(
    query: string,
    variables: any = {},
    context: GraphQLContext
  ): Promise<ExecutionResult> {
    const startTime = Date.now();
    const queryId = uuidv4().substring(0, 8);

    try {
      // Step 1: Analyze query complexity and safety
      const analysis = this.analyzer.analyzeQuery(query, variables);

      if (!analysis.isWithinLimits) {
        return this.createErrorResult(
          "QUERY_TOO_COMPLEX",
          `Query complexity (${analysis.complexity}) or depth (${analysis.depth}) exceeds limits`,
          { analysis }
        );
      }

      // Step 2: Check rate limits
      const rateLimitResult = await this.rateLimiter.checkLimit(
        context.userId || context.ip,
        analysis.complexity
      );

      if (!rateLimitResult.allowed) {
        return this.createErrorResult(
          "RATE_LIMITED",
          `Rate limit exceeded. Try again in ${rateLimitResult.resetTime}ms`,
          { rateLimitResult }
        );
      }

      // Step 3: Log query execution start
      this.metrics.recordQueryStart({
        queryId,
        complexity: analysis.complexity,
        depth: analysis.depth,
        userId: context.userId,
        query: query.substring(0, 200), // Truncated query for logging
      });

      // Step 4: Execute with timeout protection
      const timeoutMs = Math.max(
        analysis.estimatedExecutionTime * 2,
        this.config.minTimeout || 5000
      );

      const result = await Promise.race([
        graphql({
          schema: this.schema,
          source: query,
          variableValues: variables,
          contextValue: {
            ...context,
            queryId,
            startTime,
          },
        }),
        this.createTimeoutPromise(timeoutMs),
      ]);

      const executionTime = Date.now() - startTime;

      // Step 5: Record metrics
      this.metrics.recordQueryCompletion({
        queryId,
        executionTime,
        success: !result.errors || result.errors.length === 0,
        errorCount: result.errors?.length || 0,
      });

      // Step 6: Log slow queries
      if (executionTime > 1000) {
        console.warn("Slow GraphQL query detected", {
          queryId,
          executionTime,
          complexity: analysis.complexity,
          query: query.substring(0, 200),
        });
      }

      return result;
    } catch (error) {
      const executionTime = Date.now() - startTime;

      this.metrics.recordQueryError({
        queryId,
        executionTime,
        error: error.message,
      });

      return this.createErrorResult(
        "EXECUTION_ERROR",
        "Query execution failed",
        { error: error.message }
      );
    }
  }

  private createTimeoutPromise(timeoutMs: number): Promise<never> {
    return new Promise((_, reject) => {
      setTimeout(() => {
        reject(new Error(`Query timeout after ${timeoutMs}ms`));
      }, timeoutMs);
    });
  }

  private createErrorResult(
    code: string,
    message: string,
    extensions: any = {}
  ): ExecutionResult {
    return {
      data: null,
      errors: [
        {
          message,
          extensions: {
            code,
            ...extensions,
          },
        },
      ],
    };
  }
}

// Advanced GraphQL metrics collection
export class GraphQLMetricsCollector {
  private metrics: Map<string, QueryMetrics> = new Map();

  recordQueryStart(info: QueryStartInfo): void {
    this.metrics.set(info.queryId, {
      ...info,
      startTime: Date.now(),
      status: "executing",
    });
  }

  recordQueryCompletion(info: QueryCompletionInfo): void {
    const existing = this.metrics.get(info.queryId);
    if (existing) {
      this.metrics.set(info.queryId, {
        ...existing,
        ...info,
        status: info.success ? "completed" : "error",
        endTime: Date.now(),
      });
    }

    // Send metrics to monitoring system
    this.sendToMonitoring({
      type: "query_execution",
      queryId: info.queryId,
      executionTime: info.executionTime,
      success: info.success,
    });
  }

  recordQueryError(info: QueryErrorInfo): void {
    const existing = this.metrics.get(info.queryId);
    if (existing) {
      this.metrics.set(info.queryId, {
        ...existing,
        ...info,
        status: "error",
        endTime: Date.now(),
      });
    }
  }

  getMetrics(queryId: string): QueryMetrics | undefined {
    return this.metrics.get(queryId);
  }

  getAggregatedMetrics(timeRange: TimeRange): AggregatedMetrics {
    const now = Date.now();
    const cutoff = now - timeRange.durationMs;

    const recentMetrics = Array.from(this.metrics.values()).filter(
      (metric) => metric.startTime >= cutoff
    );

    return {
      totalQueries: recentMetrics.length,
      successfulQueries: recentMetrics.filter((m) => m.status === "completed")
        .length,
      failedQueries: recentMetrics.filter((m) => m.status === "error").length,
      averageExecutionTime: this.calculateAverageExecutionTime(recentMetrics),
      averageComplexity: this.calculateAverageComplexity(recentMetrics),
      slowestQuery: this.findSlowestQuery(recentMetrics),
      mostComplexQuery: this.findMostComplexQuery(recentMetrics),
    };
  }

  private sendToMonitoring(data: any): void {
    // Integration with monitoring services like DataDog, New Relic, etc.
    console.log("GraphQL Metrics:", JSON.stringify(data));
  }

  private calculateAverageExecutionTime(metrics: QueryMetrics[]): number {
    const completedMetrics = metrics.filter((m) => m.executionTime);
    if (completedMetrics.length === 0) return 0;

    const total = completedMetrics.reduce(
      (sum, m) => sum + (m.executionTime || 0),
      0
    );
    return total / completedMetrics.length;
  }

  private calculateAverageComplexity(metrics: QueryMetrics[]): number {
    if (metrics.length === 0) return 0;

    const total = metrics.reduce((sum, m) => sum + m.complexity, 0);
    return total / metrics.length;
  }

  private findSlowestQuery(metrics: QueryMetrics[]): QueryMetrics | null {
    return metrics.reduce((slowest, current) => {
      if (!slowest) return current;
      if (!current.executionTime) return slowest;
      if (!slowest.executionTime) return current;

      return current.executionTime > slowest.executionTime ? current : slowest;
    }, null as QueryMetrics | null);
  }

  private findMostComplexQuery(metrics: QueryMetrics[]): QueryMetrics | null {
    return metrics.reduce((most, current) => {
      if (!most) return current;
      return current.complexity > most.complexity ? current : most;
    }, null as QueryMetrics | null);
  }
}

// Rate limiting for GraphQL operations
export class RateLimiter {
  private windows: Map<string, RateLimitWindow> = new Map();

  constructor(private config: RateLimitConfig) {}

  async checkLimit(
    identifier: string,
    complexity: number
  ): Promise<RateLimitResult> {
    const now = Date.now();
    const windowKey = this.getWindowKey(identifier, now);

    let window = this.windows.get(windowKey);
    if (!window) {
      window = {
        requests: 0,
        complexity: 0,
        startTime: now,
        resetTime: now + this.config.windowMs,
      };
      this.windows.set(windowKey, window);
    }

    // Clean up old windows
    this.cleanupOldWindows(now);

    // Check if within limits
    const wouldExceedRequests = window.requests >= this.config.maxRequests;
    const wouldExceedComplexity =
      window.complexity + complexity > this.config.maxComplexity;

    if (wouldExceedRequests || wouldExceedComplexity) {
      return {
        allowed: false,
        resetTime: window.resetTime - now,
        remainingRequests: Math.max(
          0,
          this.config.maxRequests - window.requests
        ),
        remainingComplexity: Math.max(
          0,
          this.config.maxComplexity - window.complexity
        ),
      };
    }

    // Update window
    window.requests++;
    window.complexity += complexity;

    return {
      allowed: true,
      resetTime: window.resetTime - now,
      remainingRequests: this.config.maxRequests - window.requests,
      remainingComplexity: this.config.maxComplexity - window.complexity,
    };
  }

  private getWindowKey(identifier: string, timestamp: number): string {
    const windowStart =
      Math.floor(timestamp / this.config.windowMs) * this.config.windowMs;
    return `${identifier}:${windowStart}`;
  }

  private cleanupOldWindows(now: number): void {
    const cutoff = now - this.config.windowMs;

    for (const [key, window] of this.windows.entries()) {
      if (window.resetTime < cutoff) {
        this.windows.delete(key);
      }
    }
  }
}

// Supporting interfaces
interface ComplexityMap {
  [typeName: string]: {
    [fieldName: string]:
      | number
      | {
          complexity: (args: any) => number;
          multipliers?: string[];
        };
  };
}

interface QueryAnalysisResult {
  complexity: number;
  depth: number;
  estimatedExecutionTime: number;
  estimatedCost: number;
  isWithinLimits: boolean;
  warnings?: string[];
  error?: string;
}

interface ExecutionConfig {
  complexity: ComplexityConfig;
  rateLimit: RateLimitConfig;
  minTimeout?: number;
}

interface ComplexityConfig {
  maxComplexity?: number;
  maxDepth?: number;
}

interface RateLimitConfig {
  windowMs: number;
  maxRequests: number;
  maxComplexity: number;
}

interface QueryMetrics {
  queryId: string;
  complexity: number;
  depth: number;
  userId?: string;
  query: string;
  startTime: number;
  endTime?: number;
  executionTime?: number;
  status: "executing" | "completed" | "error";
  errorCount?: number;
}