Revision history for DBIO-GraphQL

0.900001  2026-07-12
    Security fix.

    * Security
        - Fix SQL injection (CWE-89) in the orderBy.field argument of the
          plural allXs queries. The field was passed unvalidated into the DBIO
          order_by clause; under default DBIO storage identifiers are emitted
          unquoted into ORDER BY, so a client could inject arbitrary SQL in
          that position. orderBy.field is now validated against the source's
          columns (has_column) and rejected if it is not a known column,
          matching the column check the filter path already applies. Reported
          by Olaf via CPANSec's coordinated disclosure process.

    * Fixes
        - Filter's _compile_column guard used column_info() + an
          unless($info) die, but core's column_info throws "No such column"
          before that check could run, so the intended
          "DBIO::GraphQL::Filter: unknown column ..." message was
          unreachable. Switched to has_column (returns false instead of
          throwing), mirroring the orderBy fix above, so the clean
          GraphQL-level error message actually fires. karr #3.

    * Dependencies
        - Requires core DBIO >= 0.900001 (family-wide version alignment)

    * Project
        - Added SECURITY.md (CPAN Security Group guidelines v1.5.0)

0.900000  2026-06-23
    First release. Auto-generate an executable GraphQL schema from a connected DBIO schema.

    * Schema generation
        - DBIO::GraphQL->to_graphql($schema) introspects every source and
          returns an executable GraphQL::Schema with object types and
          relationship fields
        - One scalar field per column, typed (Int/Float/Boolean/String) from
          the column's data_type
        - Relationship fields: has_many resolves to a list, belongs_to and
          might_have to a single object
        - Composite primary keys supported throughout

    * Queries
        - Root Query with singular lookups and plural allXs queries
        - Nested per-column filtering (eq/not/gt/gte/lt/lte/in/like/contains/
          startsWith/endsWith/isNull) with recursive AND/OR combinators,
          mirroring the DBIO search-condition format
        - Per-scalar typed input filters (IntFilter, FloatFilter,
          StringFilter, BoolFilter); operator set follows the column type
        - Ordering (ASC/DESC) and both offset (page) and cursor pagination

    * Mutations
        - Root Mutation with createX, updateX, and deleteX per source

    * Architecture
        - Thin orchestrator over four focused modules: DBIO::GraphQL::ScalarMap
          (data_type to GraphQL scalar), DBIO::GraphQL::Filter (with ::Search
          and ::Null adapters, per-source filter input),
          DBIO::GraphQL::Relationship (relationship field resolution with
          strict relationship_info contract validation), and
          DBIO::GraphQL::Mutation

    * Acknowledgements
        - DBIO port of DBIx::Class::Schema::GraphQL by Mohammad Sajid Anwar
          (MANWAR); see ACKNOWLEDGEMENTS in the POD