Limit query depth and convert state change schema to interface

[aditya1702]

What

Major GraphQL API improvements focusing on security, performance, and maintainability:

1. Query Complexity Analysis & Limiting: Implements GraphQL query complexity calculation and logging to prevent DoS attacks through overly complex queries (ref:
   https://gqlgen.com/reference/complexity/)
2. State Change Schema Refactoring: Converts from monolithic StateChange type to extensible BaseStateChange interface with concrete implementations, enabling polymorphic state change models
3. Performance Optimizations:
   - Introduces AccountModel.BatchGetByStateChangeIDs for efficient batch loading to eliminate N+1 queries
   - Refactors pagination logic with baseStateChangeWithCursor for consistency across resolvers
4. Code Quality Improvements: Adds shared resolver helper functions for common patterns (nullable strings, JSONB fields, arrays) and breaks down large GraphQL structs into focused objects

The state change query is now converted to the following design:

stateChanges(first: 1) {
				edges {
					node {
						stateChangeCategory
						ingestedAt
						ledgerCreatedAt
						ledgerNumber
						
						... on StandardBalanceChange {
							amount
							tokenId
						}
						... on ReservesChange {
							stateChangeReason
							sponsoredAccountId
							sponsorAccountId
						}
						... on SignerChange {
							stateChangeReason
							signerAccountId
							signerWeights
						}
						... on SignatureThresholdsChange {
							stateChangeReason
							thresholds
						}
						... on FlagsChange {
							stateChangeReason
							flags
						}
						... on MetadataChange {
							stateChangeReason
							keyValue
						}
						... on BalanceAuthorizationChange {
							stateChangeReason
							flags
						}
					}
				}
}

Why

• Security: GraphQL's flexible query structure can be exploited for DoS attacks through deeply nested or complex queries. Query complexity limits provide essential protection.
• Performance: The existing state change resolvers suffered from N+1 query problems when loading associated accounts. Batch loading addresses this scalability issue.
• Maintainability: The monolithic state change approach made extending functionality difficult. The interface pattern provides better extensibility and type safety.
• Code Quality: Duplicated resolver logic across state change types created maintenance overhead and inconsistency risks.

Issue that this PR addresses

#250 #305

[JakeUrban]

I just dug into the schema to start and will follow up with a review of the implementation once we align on any schema changes. Super excited to see this!

[aristidesstaffieri]

metric collection can be pulled out into a helper/util

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​basemachina/​gqlgen-complexity-reporter@​v0.1.2

View full report