Shared utilities to handle VRL expressions & some other improvements #540

ardatan · 2025-10-31T10:17:10Z

Removed pool_idle_timeout_seconds from traffic_shaping, instead use pool_idle_timeout with duration format.

traffic_shaping:
-  pool_idle_timeout_seconds: 30
+  pool_idle_timeout: 30s

Related documentation changes PR -> graphql-hive/console#7207

Created some helper functions to deduplicate the code to compile and resolve VRL expressions

gemini-code-assist

Code Review

This pull request introduces a new Expression type to centralize VRL expression handling, which is a great improvement for maintainability. The new type encapsulates VRL compilation and execution, removing duplicated logic from various parts of the executor. My review focuses on performance improvements for this new type, in line with the repository's style guide.

lib/router-config/src/primitives/expression.rs

github-actions · 2025-10-31T10:22:57Z

✅ `k6-benchmark` results

     ✓ response code was 200
     ✓ no graphql errors
     ✓ valid response structure

     █ setup

     checks.........................: 100.00% ✓ 201687      ✗ 0    
     data_received..................: 5.9 GB  196 MB/s
     data_sent......................: 79 MB   2.6 MB/s
     http_req_blocked...............: avg=3.57µs   min=701ns   med=1.86µs  max=11.52ms  p(90)=2.72µs  p(95)=3.13µs  
     http_req_connecting............: avg=659ns    min=0s      med=0s      max=1.8ms    p(90)=0s      p(95)=0s      
     http_req_duration..............: avg=21.81ms  min=2.2ms   med=20.86ms max=88.74ms  p(90)=29.81ms p(95)=33.27ms 
       { expected_response:true }...: avg=21.81ms  min=2.2ms   med=20.86ms max=88.74ms  p(90)=29.81ms p(95)=33.27ms 
     http_req_failed................: 0.00%   ✓ 0           ✗ 67249
     http_req_receiving.............: avg=132.89µs min=25.59µs med=41.19µs max=47.12ms  p(90)=86.31µs p(95)=391.18µs
     http_req_sending...............: avg=25.8µs   min=5.63µs  med=11.09µs max=28.17ms  p(90)=16.93µs p(95)=27.48µs 
     http_req_tls_handshaking.......: avg=0s       min=0s      med=0s      max=0s       p(90)=0s      p(95)=0s      
     http_req_waiting...............: avg=21.65ms  min=2.14ms  med=20.72ms max=88.64ms  p(90)=29.57ms p(95)=32.98ms 
     http_reqs......................: 67249   2236.224049/s
     iteration_duration.............: avg=22.3ms   min=5.43ms  med=21.21ms max=221.63ms p(90)=30.27ms p(95)=33.8ms  
     iterations.....................: 67229   2235.558991/s
     vus............................: 50      min=50        max=50 
     vus_max........................: 50      min=50        max=50

github-actions · 2025-10-31T10:25:12Z

🐋 This PR was built and pushed to the following Docker images:

Image Names: ghcr.io/graphql-hive/router

Platforms: linux/amd64,linux/arm64

Image Tags: ghcr.io/graphql-hive/router:pr-540 ghcr.io/graphql-hive/router:sha-a7217d0

Docker metadata

{
"buildx.build.ref": "builder-0c044f54-0e2b-44ec-bfea-e82a686617ee/builder-0c044f54-0e2b-44ec-bfea-e82a686617ee0/y48xbq6zugd2ihjm2u5orc7zd",
"containerimage.descriptor": {
  "mediaType": "application/vnd.oci.image.index.v1+json",
  "digest": "sha256:bddf9468aac1eed8ed60e9aafe2961dd07f839d788b19fcc1f45309bcf028c53",
  "size": 1609
},
"containerimage.digest": "sha256:bddf9468aac1eed8ed60e9aafe2961dd07f839d788b19fcc1f45309bcf028c53",
"image.name": "ghcr.io/graphql-hive/router:pr-540,ghcr.io/graphql-hive/router:sha-a7217d0"
}

kamilkisiela · 2025-10-31T11:49:25Z

lib/router-config/src/primitives/expression.rs

+static VRL_FUNCTIONS: Lazy<Vec<Box<dyn Function>>> = Lazy::new(vrl_build_functions);
+static VRL_TIMEZONE: Lazy<VrlTimeZone> = Lazy::new(VrlTimeZone::default);


Let's not do it this way, where we centralize the function building.
Yeah, right now we pass all functions that vrl provides, but if we ever want to add one made by us or filter some, for certain expressions, we would have to opt out and, we won't be able to do it without basically reverting your changes

I just didn't want to copy/paste the same logic again like we did 3 different places before. How do you think I should do that instead?

You can create a function and reuse it. If we ever want to opt-out, we either slightly refactor it or duplicate.

if you move this logic to the config crate then we’re not able to do those small adjustments in future

Looks better now?

Yes, it's much better now. Thanks

If we ever want to use different set of function, we can now do:

compile_expression(expression, Some(fns))

and add pre-built functions anywhere in code, where it makes sense.

kamilkisiela · 2025-11-03T10:13:34Z

lib/router-config/src/override_labels.rs

-        /// An expression that must evaluate to a boolean. If true, the label will be applied.
-        expression: String,
-    },
+    Expression { expression: String },


original comment is missing

Reverted 👍

kamilkisiela · 2025-11-03T10:21:06Z

lib/executor/Cargo.toml

 indexmap = "2.10.0"
 bumpalo = "3.19.0"
+once_cell = "1.21.3"
+schemars = "1.0.4"


you sure we need schemars in executor?

Removed 👍

github-actions · 2025-11-05T14:38:14Z

🐋 This PR was built and pushed to the following Docker images:

Image Names: ghcr.io/graphql-hive/router

Platforms: linux/amd64,linux/arm64

Image Tags: ghcr.io/graphql-hive/router:pr-540 ghcr.io/graphql-hive/router:sha-a9357dd

Docker metadata

{
"buildx.build.ref": "builder-f7eef0ad-4ea7-46e8-ad04-461b9f8e33ef/builder-f7eef0ad-4ea7-46e8-ad04-461b9f8e33ef0/v2peugjk24d19970a7k2gnro3",
"containerimage.descriptor": {
  "mediaType": "application/vnd.oci.image.index.v1+json",
  "digest": "sha256:0c9322a3636b23031dc38dca705e9acdf0fc6e4fb7ea569863c0c2853506ef6f",
  "size": 1609
},
"containerimage.digest": "sha256:0c9322a3636b23031dc38dca705e9acdf0fc6e4fb7ea569863c0c2853506ef6f",
"image.name": "ghcr.io/graphql-hive/router:pr-540,ghcr.io/graphql-hive/router:sha-a9357dd"
}

Removed `pool_idle_timeout_seconds` from `traffic_shaping` and replaced it with `pool_idle_timeout` using duration format.

@ardatan

> [!IMPORTANT] > Merging this pull request will create these releases # query-planner 2.1.0 (2025-11-24) ## Features ### Directive-Based Authorization Introducing directive-based authorization. This allows you to enforce fine-grained access control directly from your subgraph schemas using the `@authenticated` and `@requiresScopes` directives. This new authorization layer runs before the query planner, ensuring that unauthorized requests are handled efficiently without reaching your subgraphs. ### Configuration You can configure how the router handles unauthorized requests with two modes: - **`filter`** (default): Silently removes any fields the user is not authorized to see from the query. The response will contain `null` for the removed fields and an error in the `errors` array. - **`reject`**: Rejects the entire GraphQL operation if it requests any field the user is not authorized to access. To configure this, add the following to your `router.yaml` configuration file: ```yaml authentication: directives: unauthorized: # "filter" (default): Removes unauthorized fields from the query and returns errors. # "reject": Rejects the entire request if any unauthorized field is requested. mode: reject ``` If this section is omitted, the router will use `filter` mode by default. ### JWT Scope Requirements When using the `@requiresScopes` directive, the router expects the user's granted scopes to be present in the JWT payload. The scopes should be in an array of strings or a string (scopes separated by space), within a claim named `scope`. Here is an example of a JWT payload with the correct format: ```json { "sub": "user-123", "scope": [ "read:products", "write:reviews" ], "iat": 1516239022 } ``` ## Fixes ### Avoid extra `query` prefix for anonymous queries When there is no variable definitions and no operation name, GraphQL queries can be sent without the `query` prefix. For example, instead of sending: ```diff - query { + { user(id: "1") { name } } ``` # config 0.0.12 (2025-11-24) ## Features ### Breaking Removed `pool_idle_timeout_seconds` from `traffic_shaping`, instead use `pool_idle_timeout` with duration format. ```diff traffic_shaping: - pool_idle_timeout_seconds: 30 + pool_idle_timeout: 30s ``` #540 by @ardatan # node-addon 0.0.4 (2025-11-24) ## Fixes ### Avoid extra `query` prefix for anonymous queries When there is no variable definitions and no operation name, GraphQL queries can be sent without the `query` prefix. For example, instead of sending: ```diff - query { + { user(id: "1") { name } } ``` # executor 6.1.0 (2025-11-24) ## Features ### Directive-Based Authorization Introducing directive-based authorization. This allows you to enforce fine-grained access control directly from your subgraph schemas using the `@authenticated` and `@requiresScopes` directives. This new authorization layer runs before the query planner, ensuring that unauthorized requests are handled efficiently without reaching your subgraphs. ### Configuration You can configure how the router handles unauthorized requests with two modes: - **`filter`** (default): Silently removes any fields the user is not authorized to see from the query. The response will contain `null` for the removed fields and an error in the `errors` array. - **`reject`**: Rejects the entire GraphQL operation if it requests any field the user is not authorized to access. To configure this, add the following to your `router.yaml` configuration file: ```yaml authentication: directives: unauthorized: # "filter" (default): Removes unauthorized fields from the query and returns errors. # "reject": Rejects the entire request if any unauthorized field is requested. mode: reject ``` If this section is omitted, the router will use `filter` mode by default. ### JWT Scope Requirements When using the `@requiresScopes` directive, the router expects the user's granted scopes to be present in the JWT payload. The scopes should be in an array of strings or a string (scopes separated by space), within a claim named `scope`. Here is an example of a JWT payload with the correct format: ```json { "sub": "user-123", "scope": [ "read:products", "write:reviews" ], "iat": 1516239022 } ``` ### Breaking Removed `pool_idle_timeout_seconds` from `traffic_shaping`, instead use `pool_idle_timeout` with duration format. ```diff traffic_shaping: - pool_idle_timeout_seconds: 30 + pool_idle_timeout: 30s ``` #540 by @ardatan # router 0.0.20 (2025-11-24) ## Features - support authenticated and requiresScopes directives (#538) ### Directive-Based Authorization Introducing directive-based authorization. This allows you to enforce fine-grained access control directly from your subgraph schemas using the `@authenticated` and `@requiresScopes` directives. This new authorization layer runs before the query planner, ensuring that unauthorized requests are handled efficiently without reaching your subgraphs. ### Configuration You can configure how the router handles unauthorized requests with two modes: - **`filter`** (default): Silently removes any fields the user is not authorized to see from the query. The response will contain `null` for the removed fields and an error in the `errors` array. - **`reject`**: Rejects the entire GraphQL operation if it requests any field the user is not authorized to access. To configure this, add the following to your `router.yaml` configuration file: ```yaml authentication: directives: unauthorized: # "filter" (default): Removes unauthorized fields from the query and returns errors. # "reject": Rejects the entire request if any unauthorized field is requested. mode: reject ``` If this section is omitted, the router will use `filter` mode by default. ### JWT Scope Requirements When using the `@requiresScopes` directive, the router expects the user's granted scopes to be present in the JWT payload. The scopes should be in an array of strings or a string (scopes separated by space), within a claim named `scope`. Here is an example of a JWT payload with the correct format: ```json { "sub": "user-123", "scope": [ "read:products", "write:reviews" ], "iat": 1516239022 } ``` ### Breaking Removed `pool_idle_timeout_seconds` from `traffic_shaping`, instead use `pool_idle_timeout` with duration format. ```diff traffic_shaping: - pool_idle_timeout_seconds: 30 + pool_idle_timeout: 30s ``` #540 by @ardatan ## Fixes ### Avoid extra `query` prefix for anonymous queries When there is no variable definitions and no operation name, GraphQL queries can be sent without the `query` prefix. For example, instead of sending: ```diff - query { + { user(id: "1") { name } } ``` Co-authored-by: knope-bot[bot] <152252888+knope-bot[bot]@users.noreply.github.com>

This comment was marked as outdated.

Sign in to view

gemini-code-assist bot reviewed Oct 31, 2025

View reviewed changes

lib/router-config/src/primitives/expression.rs Outdated Show resolved Hide resolved

lib/router-config/src/primitives/expression.rs Outdated Show resolved Hide resolved

kamilkisiela reviewed Oct 31, 2025

View reviewed changes

ardatan changed the title ~~New Expression type to handle VRL in one place~~ Shared utilities to handle VRL expressions Oct 31, 2025

kamilkisiela reviewed Nov 3, 2025

View reviewed changes

ardatan force-pushed the primitive-expression branch from 2644a55 to 128b10a Compare November 3, 2025 10:40

ardatan enabled auto-merge (squash) November 3, 2025 11:30

ardatan force-pushed the primitive-expression branch from 128b10a to 766bd0e Compare November 3, 2025 11:30

ardatan changed the title ~~Shared utilities to handle VRL expressions~~ Shared utilities to handle VRL expressions & some other improvements Nov 3, 2025

ardatan mentioned this pull request Nov 3, 2025

docs(router): new pool_idle_timeout graphql-hive/console#7207

Closed

ardatan requested review from dotansimha and kamilkisiela November 3, 2025 12:51

dotansimha force-pushed the main branch 4 times, most recently from 4cffb36 to c709bec Compare November 4, 2025 11:27

ardatan and others added 10 commits November 5, 2025 18:25

New Expression type to handle VRL in one place

809ba48

Fix

383f35d

Readme

21daa6c

Format

284bff1

Revert

13cd7b6

Remove extra dep and apply comments

1ce6fae

Auto generate changeset

e0ad7c4

Duration

01f66d7

Fix config'

1631140

Update traffic shaping configuration for VRL expressions

f1f60ba

Removed `pool_idle_timeout_seconds` from `traffic_shaping` and replaced it with `pool_idle_timeout` using duration format.

ardatan added 3 commits November 5, 2025 18:25

Avoid cloning endpoint multiple times

f19621e

Simplify

854aa50

Less diff

8650809

ardatan force-pushed the primitive-expression branch from 046cc07 to 8650809 Compare November 5, 2025 23:25

kamilkisiela approved these changes Nov 21, 2025

View reviewed changes

ardatan merged commit 5dab3d3 into main Nov 21, 2025
20 checks passed

ardatan deleted the primitive-expression branch November 21, 2025 15:38

knope-bot bot mentioned this pull request Nov 21, 2025

chore(release): router crates and artifacts #583

Merged

		static VRL_FUNCTIONS: Lazy<Vec<Box<dyn Function>>> = Lazy::new(vrl_build_functions);
		static VRL_TIMEZONE: Lazy<VrlTimeZone> = Lazy::new(VrlTimeZone::default);

Shared utilities to handle VRL expressions & some other improvements #540

Shared utilities to handle VRL expressions & some other improvements #540

Uh oh!

Conversation

ardatan commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ k6-benchmark results

Uh oh!

github-actions bot commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kamilkisiela Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Nov 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ardatan commented Oct 31, 2025 •

edited

Loading

github-actions bot commented Oct 31, 2025 •

edited

Loading

✅ `k6-benchmark` results

github-actions bot commented Oct 31, 2025 •

edited

Loading

kamilkisiela Oct 31, 2025 •

edited

Loading

github-actions bot commented Nov 5, 2025 •

edited

Loading