[jlouvel]

Closes #1584. Part of #1581.

Stacked on #1590 (G1), itself on #1589 (G0). Merge those first.

Summary

Completes GraphqlClientAdapter.

GraphqlClientAdapter graphql = new GraphqlClientAdapter(getContext());
graphql.setClient(restletClient);                         // borrowed: auth, proxy, timeouts
graphql.setEndpoint("https://api.example.com/graphql");
graphql.setSchema(UnExecutableSchemaGenerator.makeUnExecutableSchema(new SchemaParser().parse(sdl)));
graphql.setRequestCustomizer(request -> request.getHeaders().add("Authorization", apiKey));
graphql.start();
ExecutionResult result = graphql.execute(document, "GetIssue", Map.of("id", id));

Aspect	Behavior
Request	POST, Accept: application/graphql-response+json, application/json;q=0.9; variables serialized as JSON values, never templated as text
Local validation	With setSchema, documents (String or Document) are parsed with the adapter's ParserOptions and validated; invalid ones return an ExecutionResult with errors and no network call. The adapter never fetches a schema
Request errors	A 2xx or 4xx response with a GraphQL body is an ExecutionResult (no data when execution didn't start)
Transport errors	Connection failures, timeouts, responses above maxResponseBytes (10 MiB, checked on the declared size and while reading, never truncated) and non-GraphQL responses throw GraphqlTransportException with the status and a 1 KiB body excerpt
Authentication	Through the borrowed Client, or the request customizer

The HTTP status of a request error is not exposed on the ExecutionResult; isDataPresent() tells request errors from execution results. A follow-up can expose it if callers need it.

Validation

./mvnw -B verify -P default,test -pl org.restlet.ext.graphql: 31 tests, 0 failures; 96.3% instruction coverage (gate 80%); Spotless, SpotBugs, Javadoc, -Werror and dependency convergence pass.

New GraphqlClientTestCase (6 tests), against GraphqlServerAdapter and against an independent server: the JDK HttpServer running graphql-java the legacy way (chunked application/json, 200 for validation errors, 422 with a GraphQL body on another path):

• Text with {{…}}, quotes, {key=value}, backslashes, newlines and non-ASCII characters round trips unchanged in nested input objects (the escaping failures seen when GraphQL is templated as opaque JSON).
• Legacy validation errors and 4xx GraphQL bodies are results.
• Local validation of string and parsed documents with no network call (counted on the peer).
• Response limit with declared and chunked bodies.
• Request customizer; frozen configuration.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The Document overload bypasses configured parser limits, allowing operations rejected by the string overload to reach the server instead of returning local errors.

1 open issue

• Document overload bypasses configured parser limits · New

What changed in this PR

Completes the GraphQL client HTTP binding over a borrowed Restlet client, adding local validation and configurable response limits.

Changes:

• Adds optional schema validation, parser options, response-size limits, and request customization.
• Adds interoperability tests for JSON variables, error responses, validation, limits, and frozen configuration.
• Updates the changelog with the client capabilities.

File	Description
org.restlet.ext.graphql/​src/​test/​java/​org/​restlet/​ext/​graphql/​GraphqlTestSchemas.java	Adds input-echo and header fields for client tests.
org.restlet.ext.graphql/​src/​test/​java/​org/​restlet/​ext/​graphql/​GraphqlClientTestCase.java	Tests client behavior against Restlet and an independent HTTP server.
org.restlet.ext.graphql/​src/​main/​java/​org/​restlet/​ext/​graphql/​GraphqlClientAdapter.java	Adds validation, configurable limits, and request customization.
changes.md	Documents the expanded GraphQL client capabilities.

_{Review effort: Balanced}

[jlouvel]

Declining: the parser options bound the cost of parsing untrusted text, and a Document overload receives an AST the caller already built, so there is nothing left to protect locally (the string overload doesn't parse either without a schema). Reprinting and reparsing every Document just to apply token limits would add cost for no safety gain; the server still applies its own limits.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud