[jlouvel]

Closes #1583. Part of #1581.

Stacked on #1589 (G0). Merge #1589 first; this PR's base then moves to 3.0.

Summary

Completes the GraphQL over HTTP binding of GraphqlServerAdapter.

GraphqlServerAdapter graphql = new GraphqlServerAdapter(getContext());
graphql.setGraphQL(GraphQL.newGraphQL(schema).build());
graphql.setGetEnabled(true);                                   // off by default
graphql.setMaxRequestBytes(256 * 1024);                        // 1 MiB by default
graphql.setParserOptions(ParserOptions.newParserOptions().maxTokens(5_000).build());
graphql.setExecutionInputCustomizer((request, input) -> input.dataLoaderRegistry(loaders()));

Aspect	Behavior
Methods	POST for all operations. GET for queries only when enabled; other operations over GET get 405 with Allow: POST
Request media type	application/json; others get 415. A JSON array (batch) gets 400, never executed
Response media type	application/graphql-response+json when named by the client, otherwise application/json; 406 if neither
Status codes	400 for malformed requests. Parse/validation errors and missing or unknown operations: 400 with graphql-response+json, 200 with application/json. 200 once execution starts, even with field errors
Limits	413 above maxRequestBytes, checked on the declared size and while reading. Parser limits from the adapter's ParserOptions, passed per execution in the GraphQLContext, never through graphql-java's process-wide static defaults
Request context	RestletGraphql.REQUEST and RestletGraphql.CLIENT_INFO in the GraphQLContext, set after the customizer so neither it nor caller extensions can replace them
Subscriptions	Rejected without executing the subscription field until SSE support (G3)

Policies stay native: depth and complexity limits (MaxQueryDepthInstrumentation, MaxQueryComplexityInstrumentation), introspection and exception rendering (DataFetcherExceptionHandler) are configured on the GraphQL instance.

The document is parsed once by the adapter (to select the operation and enforce the GET and subscription rules before anything executes) and again by graphql-java. The adapter does not install a PreparsedDocumentProvider, which remains the application's choice.

Validation

./mvnw -B verify -P default,test -pl org.restlet.ext.graphql: 25 tests, 0 failures; 95.8% instruction coverage (gate 80%); Spotless, SpotBugs, Javadoc, -Werror and dependency convergence pass.

New GraphqlServerBindingTestCase (12 tests): GET disabled by default, GET queries with variables and operationName, GET mutations rejected, 415, malformed parameters, status per media type for five kinds of document errors, field errors, subscriptions rejected without creating their publisher, 413 with declared and chunked bodies, per-adapter parser limits with the process-wide defaults unchanged, request and DataLoader through the customizer (which can't spoof the request key), the user of a ChallengeAuthenticator reaching a data fetcher, frozen configuration.

The community graphql-http audit suite (JavaScript) is not wired in; the cases above follow its server rules.

🤖 Generated with Claude Code

[jlouvel]

Added a test-only commit: the chunked oversized-body case now accepts either the 413 or a client-side communication error. The server answers before reading the whole body and closes the connection, so the client may fail while still writing (seen once while running G3).

[Copilot]

🟡 Changes recommended

The customizer can change the selected operation after transport validation, allowing mutations over GET and subscriptions to bypass execution restrictions.

4 open issues

• Validate the customized operation before executing GET requests · New
• Advertise GET in Allow when GET queries are enabled · New
• Add Vary: Accept to negotiated GET responses · New
• Treat an empty operationName as omitted · New

What changed in this PR

Completes the GraphQL server HTTP binding on top of the G0 extension, adding request controls and Restlet context integration for G1.

Changes:

• Adds opt-in GET queries, operation restrictions, parameter validation, and response-media-specific status codes.
• Introduces request-size limits, per-adapter parser options, and execution customization with protected request context keys.
• Adds binding tests and shared schema fixtures, and updates the changelog.

File	Description
org.restlet.ext.graphql/​src/​test/​java/​org/​restlet/​ext/​graphql/​TickPublisher.java	Adds a publisher fixture to detect subscription execution.
org.restlet.ext.graphql/​src/​test/​java/​org/​restlet/​ext/​graphql/​GraphqlTestSchemas.java	Adds context, DataLoader, and subscription test fields.
org.restlet.ext.graphql/​src/​test/​java/​org/​restlet/​ext/​graphql/​GraphqlServerBindingTestCase.java	Tests HTTP rules, limits, authentication context, and configuration freezing.
org.restlet.ext.graphql/​src/​main/​java/​org/​restlet/​ext/​graphql/​RestletGraphql.java	Defines public request and client-info context keys.
org.restlet.ext.graphql/​src/​main/​java/​org/​restlet/​ext/​graphql/​GraphqlServerAdapter.java	Implements the expanded HTTP binding and execution controls.
changes.md	Documents the new server-binding capabilities.

_{Review effort: Balanced}

[sonarqubecloud]

Quality Gate passed

Issues
12 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud