GraphQL Query Depth and Complexity Attacks Causing Resource Exhaustion

const { ApolloServer, gql } = require('apollo-server-express');
const depthLimit = require('graphql-depth-limit');
const costAnalysis = require('graphql-query-complexity').costAnalysisValidator;
const { createComplexityLimitRule } = require('graphql-query-complexity');

// Enhanced GraphQL server with comprehensive protection
const typeDefs = gql`
  type User {
    id: ID!
    name: String!
    posts(first: Int = 10, after: String): PostConnection!  # Paginated
    followers(first: Int = 20): [User!]!
    following(first: Int = 20): [User!]!
  }
  
  type Post {
    id: ID!
    title: String!
    content: String!
    author: User!
    comments(first: Int = 10): [Comment!]!
  }
  
  type PostConnection {
    edges: [PostEdge!]!
    pageInfo: PageInfo!
    totalCount: Int!
  }
  
  type PostEdge {
    node: Post!
    cursor: String!
  }
  
  type PageInfo {
    hasNextPage: Boolean!
    hasPreviousPage: Boolean!
    startCursor: String
    endCursor: String
  }
  
  type Query {
    users(first: Int = 20): [User!]!
    posts(first: Int = 20): [Post!]!
  }
`;

// Configure query complexity analysis
const MAX_QUERY_DEPTH = 10;
const MAX_QUERY_COMPLEXITY = 1000;

const server = new ApolloServer({
  typeDefs,
  resolvers,
  
  // Security validations
  validationRules: [
    // Limit query depth
    depthLimit(MAX_QUERY_DEPTH),
    
    // Analyze query complexity
    costAnalysis({
      maximumCost: MAX_QUERY_COMPLEXITY,
      defaultCost: 1,
      scalarCost: 1,
      objectCost: 2,
      listFactor: 10,  // Lists multiply cost
      introspectionCost: 1000,  // Make introspection expensive
      createError: (max, actual) => {
        return new Error(
          `Query complexity of ${actual} exceeds maximum allowed complexity of ${max}`
        );
      },
      // Custom field costs
      fieldExtensions: {
        cost: {
          User: {
            posts: { complexity: 10 },      // Expensive field
            followers: { complexity: 5 },
            following: { complexity: 5 }
          },
          Post: {
            comments: { complexity: 5 },
            author: { complexity: 2 }
          }
        }
      }
    }),
    
    // Custom validation for specific patterns
    (context) => ({
      Field: {
        enter(node, key, parent) {
          // Prevent certain dangerous field combinations
          if (node.name.value === 'users' && 
              context.getVariableValues().first > 100) {
            context.reportError(new Error(
              'Cannot request more than 100 users at once'
            ));
          }
        }
      }
    })
  ],
  
  // Request timeout
  plugins: [
    {
      requestDidStart() {
        return {
          willSendResponse(requestContext) {
            // Log expensive queries
            const complexity = requestContext.request.http?.complexity;
            if (complexity && complexity > 500) {
              console.warn('High complexity query executed:', {
                complexity,
                query: requestContext.request.query?.substring(0, 200),
                variables: requestContext.request.variables,
                userAgent: requestContext.request.http?.headers?.get('user-agent')
              });
            }
          },
          
          didEncounterErrors(requestContext) {
            // Log validation errors
            requestContext.errors?.forEach(error => {
              if (error.message.includes('complexity') || 
                  error.message.includes('depth')) {
                console.warn('Query security violation:', {
                  error: error.message,
                  query: requestContext.request.query,
                  ip: requestContext.request.ip
                });
              }
            });
          }
        };
      }
    }
  ],
  
  // Global timeout
  context: ({ req }) => {
    const startTime = Date.now();
    
    return {
      startTime,
      timeout: 30000, // 30 second timeout
      checkTimeout: () => {
        if (Date.now() - startTime > 30000) {
          throw new Error('Query timeout: Request took too long to process');
        }
      }
    };
  },
  
  formatError: (error) => {
    // Don't expose internal details in production
    if (process.env.NODE_ENV === 'production') {
      if (error.message.includes('timeout') || 
          error.message.includes('complexity') || 
          error.message.includes('depth')) {
        return new Error('Query rejected: Resource limits exceeded');
      }
    }
    
    return error;
  }
});

const DataLoader = require('dataloader');
const { ApolloServer, gql } = require('apollo-server-express');

// Create DataLoader instances for efficient batching
class DataLoaderFactory {
  static createUserLoader() {
    return new DataLoader(async (userIds) => {
      console.log(`Batching ${userIds.length} user lookups`);
      
      const users = await User.find({ _id: { $in: userIds } });
      
      // Return users in the same order as requested IDs
      return userIds.map(id => 
        users.find(user => user._id.toString() === id.toString()) || null
      );
    }, {
      cache: true,
      maxBatchSize: 100,  // Limit batch size
      batchScheduleFn: callback => setTimeout(callback, 10)  // Small delay for batching
    });
  }
  
  static createPostsByAuthorLoader() {
    return new DataLoader(async (authorIds) => {
      console.log(`Batching posts lookup for ${authorIds.length} authors`);
      
      const posts = await Post.find({ 
        authorId: { $in: authorIds } 
      }).sort({ createdAt: -1 }).limit(100); // Limit results
      
      // Group posts by author ID
      const postsByAuthor = authorIds.map(authorId => 
        posts.filter(post => post.authorId.toString() === authorId.toString())
      );
      
      return postsByAuthor;
    });
  }
  
  static createCommentsByPostLoader() {
    return new DataLoader(async (postIds) => {
      console.log(`Batching comments lookup for ${postIds.length} posts`);
      
      const comments = await Comment.find({ 
        postId: { $in: postIds } 
      }).sort({ createdAt: -1 }).limit(1000); // Global limit
      
      return postIds.map(postId =>
        comments.filter(comment => comment.postId.toString() === postId.toString())
      );
    });
  }
  
  static createFollowersLoader() {
    return new DataLoader(async (userIds) => {
      console.log(`Batching followers lookup for ${userIds.length} users`);
      
      // Use aggregation for efficient followers lookup
      const followersData = await Follow.aggregate([
        { $match: { followingId: { $in: userIds } } },
        { 
          $group: {
            _id: '$followingId',
            followers: { $push: '$followerId' }
          }
        }
      ]);
      
      // Get actual user objects for followers
      const allFollowerIds = [...new Set(
        followersData.flatMap(item => item.followers)
      )];
      
      const followers = await User.find({ 
        _id: { $in: allFollowerIds } 
      }).select('id name avatar');
      
      return userIds.map(userId => {
        const userData = followersData.find(
          item => item._id.toString() === userId.toString()
        );
        
        if (!userData) return [];
        
        return userData.followers
          .map(followerId => followers.find(
            follower => follower._id.toString() === followerId.toString()
          ))
          .filter(Boolean)
          .slice(0, 50); // Limit followers returned
      });
    });
  }
}

// Enhanced resolvers with DataLoader
const resolvers = {
  Query: {
    users: async (_, { first = 20 }, { userLoader }) => {
      // Limit and paginate results
      const users = await User.find()
        .sort({ createdAt: -1 })
        .limit(Math.min(first, 100)); // Cap at 100
      
      return users;
    },
    
    posts: async (_, { first = 20 }) => {
      return await Post.find()
        .sort({ createdAt: -1 })
        .limit(Math.min(first, 100))
        .populate('author');
    }
  },
  
  User: {
    posts: async (user, { first = 10 }, { postsByAuthorLoader, checkTimeout }) => {
      checkTimeout(); // Check for timeout
      
      const posts = await postsByAuthorLoader.load(user._id);
      return posts.slice(0, Math.min(first, 50)); // Limit results
    },
    
    followers: async (user, { first = 20 }, { followersLoader, checkTimeout }) => {
      checkTimeout();
      
      const followers = await followersLoader.load(user._id);
      return followers.slice(0, Math.min(first, 100));
    },
    
    following: async (user, { first = 20 }, { followingLoader, checkTimeout }) => {
      checkTimeout();
      
      const following = await followingLoader.load(user._id);
      return following.slice(0, Math.min(first, 100));
    }
  },
  
  Post: {
    author: async (post, _, { userLoader, checkTimeout }) => {
      checkTimeout();
      
      return await userLoader.load(post.authorId);
    },
    
    comments: async (post, { first = 10 }, { commentsByPostLoader, checkTimeout }) => {
      checkTimeout();
      
      const comments = await commentsByPostLoader.load(post._id);
      return comments.slice(0, Math.min(first, 50));
    }
  },
  
  Comment: {
    author: async (comment, _, { userLoader, checkTimeout }) => {
      checkTimeout();
      
      return await userLoader.load(comment.authorId);
    },
    
    post: async (comment, _, { postLoader, checkTimeout }) => {
      checkTimeout();
      
      return await postLoader.load(comment.postId);
    }
  }
};

// Context factory with DataLoaders
function createContext({ req }) {
  const startTime = Date.now();
  const TIMEOUT_MS = 30000; // 30 seconds
  
  return {
    // DataLoader instances
    userLoader: DataLoaderFactory.createUserLoader(),
    postsByAuthorLoader: DataLoaderFactory.createPostsByAuthorLoader(),
    commentsByPostLoader: DataLoaderFactory.createCommentsByPostLoader(),
    followersLoader: DataLoaderFactory.createFollowersLoader(),
    
    // Timeout checking
    startTime,
    checkTimeout: () => {
      if (Date.now() - startTime > TIMEOUT_MS) {
        throw new Error(`Query timeout after ${TIMEOUT_MS}ms`);
      }
    },
    
    // Request metadata
    userAgent: req.headers['user-agent'],
    ip: req.ip
  };
}

// Server with DataLoader context
const server = new ApolloServer({
  typeDefs,
  resolvers,
  context: createContext,
  
  // Performance monitoring plugin
  plugins: [
    {
      requestDidStart() {
        return {
          willSendResponse(requestContext) {
            const duration = Date.now() - requestContext.context.startTime;
            
            if (duration > 5000) { // Log slow queries
              console.warn('Slow query detected:', {
                duration: `${duration}ms`,
                query: requestContext.request.query?.substring(0, 200),
                variables: requestContext.request.variables
              });
            }
          }
        };
      }
    }
  ]
});

const { ApolloServer, gql } = require('apollo-server-express');
const { createComplexityLimitRule } = require('graphql-query-complexity');
const depthLimit = require('graphql-depth-limit');

// Resource monitoring and limits
class QueryResourceManager {
  constructor() {
    this.activeQueries = new Map();
    this.queryStats = {
      totalQueries: 0,
      timeouts: 0,
      complexityRejections: 0,
      averageExecutionTime: 0
    };
  }
  
  startQuery(queryId, query, variables) {
    const queryInfo = {
      id: queryId,
      query: query?.substring(0, 500), // Truncate for logging
      variables,
      startTime: Date.now(),
      memoryStart: process.memoryUsage().heapUsed,
      timeout: null,
      cancelled: false
    };
    
    // Set timeout
    queryInfo.timeout = setTimeout(() => {
      this.cancelQuery(queryId, 'timeout');
    }, 30000); // 30 second timeout
    
    this.activeQueries.set(queryId, queryInfo);
    this.queryStats.totalQueries++;
    
    // Monitor memory usage
    this.checkMemoryUsage();
    
    return queryInfo;
  }
  
  finishQuery(queryId, success = true) {
    const queryInfo = this.activeQueries.get(queryId);
    if (!queryInfo) return;
    
    const duration = Date.now() - queryInfo.startTime;
    const memoryEnd = process.memoryUsage().heapUsed;
    const memoryUsed = memoryEnd - queryInfo.memoryStart;
    
    // Clear timeout
    if (queryInfo.timeout) {
      clearTimeout(queryInfo.timeout);
    }
    
    // Update statistics
    this.queryStats.averageExecutionTime = 
      (this.queryStats.averageExecutionTime + duration) / 2;
    
    // Log long-running or memory-intensive queries
    if (duration > 10000 || memoryUsed > 100 * 1024 * 1024) { // 100MB
      console.warn('Resource-intensive query completed:', {
        queryId,
        duration: `${duration}ms`,
        memoryUsed: `${Math.round(memoryUsed / 1024 / 1024)}MB`,
        success,
        query: queryInfo.query
      });
    }
    
    this.activeQueries.delete(queryId);
  }
  
  cancelQuery(queryId, reason) {
    const queryInfo = this.activeQueries.get(queryId);
    if (!queryInfo || queryInfo.cancelled) return;
    
    queryInfo.cancelled = true;
    
    if (reason === 'timeout') {
      this.queryStats.timeouts++;
    }
    
    console.warn('Query cancelled:', {
      queryId,
      reason,
      duration: `${Date.now() - queryInfo.startTime}ms`,
      query: queryInfo.query
    });
    
    this.finishQuery(queryId, false);
  }
  
  checkMemoryUsage() {
    const memoryUsage = process.memoryUsage();
    const heapUsedMB = Math.round(memoryUsage.heapUsed / 1024 / 1024);
    
    // Warn if memory usage is high
    if (heapUsedMB > 1000) { // 1GB
      console.warn('High memory usage detected:', {
        heapUsed: `${heapUsedMB}MB`,
        activeQueries: this.activeQueries.size
      });
      
      // Cancel oldest queries if memory is critically high
      if (heapUsedMB > 1500) { // 1.5GB
        this.cancelOldestQueries(3);
      }
    }
  }
  
  cancelOldestQueries(count) {
    const sortedQueries = Array.from(this.activeQueries.entries())
      .sort(([, a], [, b]) => a.startTime - b.startTime)
      .slice(0, count);
    
    sortedQueries.forEach(([queryId]) => {
      this.cancelQuery(queryId, 'memory_pressure');
    });
  }
  
  getStats() {
    return {
      ...this.queryStats,
      activeQueries: this.activeQueries.size,
      memoryUsage: process.memoryUsage()
    };
  }
}

const resourceManager = new QueryResourceManager();

// Custom timeout plugin
const timeoutPlugin = {
  requestDidStart() {
    return {
      didResolveOperation(requestContext) {
        const queryId = `${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
        requestContext.queryId = queryId;
        
        const queryInfo = resourceManager.startQuery(
          queryId,
          requestContext.request.query,
          requestContext.request.variables
        );
        
        requestContext.queryInfo = queryInfo;
        
        // Add timeout check to context
        requestContext.context.checkTimeout = () => {
          if (queryInfo.cancelled) {
            throw new Error('Query was cancelled due to resource limits');
          }
          
          const elapsed = Date.now() - queryInfo.startTime;
          if (elapsed > 30000) {
            resourceManager.cancelQuery(queryId, 'timeout');
            throw new Error('Query timeout: Request took too long to process');
          }
        };
      },
      
      willSendResponse(requestContext) {
        if (requestContext.queryId) {
          resourceManager.finishQuery(requestContext.queryId, true);
        }
      },
      
      didEncounterErrors(requestContext) {
        if (requestContext.queryId) {
          resourceManager.finishQuery(requestContext.queryId, false);
        }
      }
    };
  }
};

// Enhanced server with comprehensive protection
const server = new ApolloServer({
  typeDefs,
  resolvers,
  
  validationRules: [
    depthLimit(10),
    createComplexityLimitRule(1000, {
      onComplete: (complexity) => {
        if (complexity > 500) {
          console.warn('High complexity query approved:', { complexity });
        }
      },
      onReject: (complexity) => {
        resourceManager.queryStats.complexityRejections++;
        console.warn('Query rejected for high complexity:', { complexity });
      }
    })
  ],
  
  plugins: [
    timeoutPlugin,
    
    // Performance monitoring plugin
    {
      requestDidStart() {
        return {
          willSendResponse(requestContext) {
            const duration = Date.now() - requestContext.queryInfo?.startTime;
            
            // Log performance metrics
            if (duration > 1000) {
              console.info('Query performance:', {
                duration: `${duration}ms`,
                complexity: requestContext.queryComplexity,
                fieldCount: requestContext.fieldCount
              });
            }
          }
        };
      }
    }
  ],
  
  context: ({ req }) => {
    return {
      startTime: Date.now(),
      userAgent: req.headers['user-agent'],
      ip: req.ip,
      
      // Will be populated by timeout plugin
      checkTimeout: () => {}
    };
  },
  
  formatError: (error) => {
    // Log errors with context
    console.error('GraphQL Error:', {
      message: error.message,
      locations: error.locations,
      path: error.path,
      timestamp: new Date().toISOString()
    });
    
    // Return sanitized errors in production
    if (process.env.NODE_ENV === 'production') {
      if (error.message.includes('timeout') ||
          error.message.includes('cancelled') ||
          error.message.includes('complexity')) {
        return new Error('Query execution failed: Resource limits exceeded');
      }
    }
    
    return error;
  }
});

// Health check endpoint with resource stats
app.get('/graphql/health', (req, res) => {
  const stats = resourceManager.getStats();
  const isHealthy = stats.activeQueries < 10 && 
                   stats.memoryUsage.heapUsed < 1024 * 1024 * 1024; // 1GB
  
  res.status(isHealthy ? 200 : 503).json({
    status: isHealthy ? 'healthy' : 'unhealthy',
    stats,
    timestamp: new Date().toISOString()
  });
});

// Graceful shutdown
process.on('SIGTERM', () => {
  console.log('Shutting down GraphQL server...');
  
  // Cancel all active queries
  for (const [queryId] of resourceManager.activeQueries) {
    resourceManager.cancelQuery(queryId, 'shutdown');
  }
  
  server.stop().then(() => {
    console.log('GraphQL server stopped');
    process.exit(0);
  });
});

const { ApolloServer, gql } = require('apollo-server-express');
const { connectionFromArray, cursorToOffset, offsetToCursor } = require('graphql-relay');

// Secure GraphQL schema with pagination
const typeDefs = gql`
  # Implement Relay-style pagination
  type PageInfo {
    hasNextPage: Boolean!
    hasPreviousPage: Boolean!
    startCursor: String
    endCursor: String
  }
  
  type UserEdge {
    node: User!
    cursor: String!
  }
  
  type UserConnection {
    edges: [UserEdge!]!
    pageInfo: PageInfo!
    totalCount: Int!
  }
  
  type PostEdge {
    node: Post!
    cursor: String!
  }
  
  type PostConnection {
    edges: [PostEdge!]!
    pageInfo: PageInfo!
    totalCount: Int!
  }
  
  type CommentEdge {
    node: Comment!
    cursor: String!
  }
  
  type CommentConnection {
    edges: [CommentEdge!]!
    pageInfo: PageInfo!
    totalCount: Int!
  }
  
  type User {
    id: ID!
    name: String!
    email: String!
    
    # Paginated relationships with limits
    posts(
      first: Int = 10,
      after: String,
      orderBy: PostOrderBy = CREATED_AT_DESC
    ): PostConnection!
    
    followers(
      first: Int = 20,
      after: String
    ): UserConnection!
    
    following(
      first: Int = 20, 
      after: String
    ): UserConnection!
    
    # Limited aggregations
    postCount: Int!          # Cached/indexed value
    followerCount: Int!      # Cached/indexed value
  }
  
  type Post {
    id: ID!
    title: String!
    content: String!
    createdAt: String!
    author: User!
    
    comments(
      first: Int = 10,
      after: String,
      orderBy: CommentOrderBy = CREATED_AT_DESC
    ): CommentConnection!
    
    # Pre-calculated metrics (avoid real-time computation)
    likeCount: Int!          # Cached value
    commentCount: Int!       # Cached value
    viewCount: Int!          # Cached value
  }
  
  type Comment {
    id: ID!
    content: String!
    createdAt: String!
    author: User!
    post: Post!
    
    # Limited nested comments
    replies(
      first: Int = 5,
      after: String
    ): CommentConnection!
    
    replyCount: Int!         # Cached value
  }
  
  enum PostOrderBy {
    CREATED_AT_ASC
    CREATED_AT_DESC
    TITLE_ASC
    TITLE_DESC
  }
  
  enum CommentOrderBy {
    CREATED_AT_ASC
    CREATED_AT_DESC
  }
  
  type Query {
    # Paginated root queries with strict limits
    users(
      first: Int = 20,
      after: String,
      search: String
    ): UserConnection!
    
    posts(
      first: Int = 20,
      after: String,
      authorId: ID,
      orderBy: PostOrderBy = CREATED_AT_DESC
    ): PostConnection!
    
    # Single item queries
    user(id: ID!): User
    post(id: ID!): Post
  }
`;

// Pagination utility functions
class PaginationHelper {
  static validatePaginationArgs(first, after) {
    // Enforce maximum page size
    const MAX_PAGE_SIZE = 100;
    const DEFAULT_PAGE_SIZE = 20;
    
    if (first && first > MAX_PAGE_SIZE) {
      throw new Error(`Cannot request more than ${MAX_PAGE_SIZE} items at once`);
    }
    
    if (first && first < 1) {
      throw new Error('Page size must be at least 1');
    }
    
    return {
      first: Math.min(first || DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE),
      after: after || null
    };
  }
  
  static async paginateQuery(model, filter, options) {
    const { first, after, orderBy } = options;
    const { field, direction } = this.parseOrderBy(orderBy);
    
    // Calculate offset from cursor
    let offset = 0;
    if (after) {
      try {
        offset = cursorToOffset(after) + 1;
      } catch (error) {
        throw new Error('Invalid cursor provided');
      }
    }
    
    // Build sort object
    const sort = { [field]: direction === 'DESC' ? -1 : 1 };
    
    // Execute query with pagination
    const [items, totalCount] = await Promise.all([
      model.find(filter)
        .sort(sort)
        .skip(offset)
        .limit(first + 1), // Get one extra to check hasNextPage
      model.countDocuments(filter)
    ]);
    
    // Check if there are more items
    const hasNextPage = items.length > first;
    if (hasNextPage) {
      items.pop(); // Remove the extra item
    }
    
    const hasPreviousPage = offset > 0;
    
    // Create edges with cursors
    const edges = items.map((item, index) => ({
      node: item,
      cursor: offsetToCursor(offset + index)
    }));
    
    return {
      edges,
      pageInfo: {
        hasNextPage,
        hasPreviousPage,
        startCursor: edges.length > 0 ? edges[0].cursor : null,
        endCursor: edges.length > 0 ? edges[edges.length - 1].cursor : null
      },
      totalCount
    };
  }
  
  static parseOrderBy(orderBy) {
    const orderByMap = {
      CREATED_AT_ASC: { field: 'createdAt', direction: 'ASC' },
      CREATED_AT_DESC: { field: 'createdAt', direction: 'DESC' },
      TITLE_ASC: { field: 'title', direction: 'ASC' },
      TITLE_DESC: { field: 'title', direction: 'DESC' }
    };
    
    return orderByMap[orderBy] || orderByMap.CREATED_AT_DESC;
  }
}

// Secure resolvers with pagination
const resolvers = {
  Query: {
    users: async (_, args, { checkTimeout }) => {
      checkTimeout();
      
      const { first, after } = PaginationHelper.validatePaginationArgs(
        args.first, args.after
      );
      
      const filter = {};
      if (args.search) {
        // Limit search query length
        if (args.search.length > 100) {
          throw new Error('Search query too long');
        }
        filter.$text = { $search: args.search };
      }
      
      return await PaginationHelper.paginateQuery(User, filter, {
        first,
        after,
        orderBy: 'CREATED_AT_DESC'
      });
    },
    
    posts: async (_, args, { checkTimeout }) => {
      checkTimeout();
      
      const { first, after } = PaginationHelper.validatePaginationArgs(
        args.first, args.after
      );
      
      const filter = {};
      if (args.authorId) {
        filter.authorId = args.authorId;
      }
      
      return await PaginationHelper.paginateQuery(Post, filter, {
        first,
        after,
        orderBy: args.orderBy
      });
    },
    
    user: async (_, { id }, { userLoader, checkTimeout }) => {
      checkTimeout();
      return await userLoader.load(id);
    },
    
    post: async (_, { id }, { postLoader, checkTimeout }) => {
      checkTimeout();
      return await postLoader.load(id);
    }
  },
  
  User: {
    posts: async (user, args, { checkTimeout }) => {
      checkTimeout();
      
      const { first, after } = PaginationHelper.validatePaginationArgs(
        args.first, args.after
      );
      
      return await PaginationHelper.paginateQuery(
        Post, 
        { authorId: user._id },
        { first, after, orderBy: args.orderBy }
      );
    },
    
    followers: async (user, args, { checkTimeout }) => {
      checkTimeout();
      
      const { first, after } = PaginationHelper.validatePaginationArgs(
        args.first, args.after
      );
      
      // Use efficient aggregation for followers
      const followerIds = await Follow.find({ followingId: user._id })
        .select('followerId')
        .limit(first * 2); // Pre-filter to reasonable size
      
      const filter = { _id: { $in: followerIds.map(f => f.followerId) } };
      
      return await PaginationHelper.paginateQuery(User, filter, {
        first,
        after,
        orderBy: 'CREATED_AT_DESC'
      });
    },
    
    following: async (user, args, { checkTimeout }) => {
      checkTimeout();
      
      const { first, after } = PaginationHelper.validatePaginationArgs(
        args.first, args.after
      );
      
      const followingIds = await Follow.find({ followerId: user._id })
        .select('followingId')
        .limit(first * 2);
      
      const filter = { _id: { $in: followingIds.map(f => f.followingId) } };
      
      return await PaginationHelper.paginateQuery(User, filter, {
        first,
        after,
        orderBy: 'CREATED_AT_DESC'
      });
    },
    
    // Use cached/indexed counts instead of real-time aggregation
    postCount: (user) => user.postCount || 0,
    followerCount: (user) => user.followerCount || 0
  },
  
  Post: {
    author: async (post, _, { userLoader, checkTimeout }) => {
      checkTimeout();
      return await userLoader.load(post.authorId);
    },
    
    comments: async (post, args, { checkTimeout }) => {
      checkTimeout();
      
      const { first, after } = PaginationHelper.validatePaginationArgs(
        args.first, args.after
      );
      
      return await PaginationHelper.paginateQuery(
        Comment,
        { postId: post._id, parentId: null }, // Only top-level comments
        { first, after, orderBy: args.orderBy }
      );
    },
    
    // Use cached metrics
    likeCount: (post) => post.likeCount || 0,
    commentCount: (post) => post.commentCount || 0,
    viewCount: (post) => post.viewCount || 0
  },
  
  Comment: {
    author: async (comment, _, { userLoader, checkTimeout }) => {
      checkTimeout();
      return await userLoader.load(comment.authorId);
    },
    
    post: async (comment, _, { postLoader, checkTimeout }) => {
      checkTimeout();
      return await postLoader.load(comment.postId);
    },
    
    replies: async (comment, args, { checkTimeout }) => {
      checkTimeout();
      
      const { first, after } = PaginationHelper.validatePaginationArgs(
        args.first, args.after
      );
      
      // Limit reply depth to prevent infinite nesting
      const MAX_REPLY_DEPTH = 3;
      if (comment.depth && comment.depth >= MAX_REPLY_DEPTH) {
        return {
          edges: [],
          pageInfo: {
            hasNextPage: false,
            hasPreviousPage: false,
            startCursor: null,
            endCursor: null
          },
          totalCount: 0
        };
      }
      
      return await PaginationHelper.paginateQuery(
        Comment,
        { parentId: comment._id },
        { first, after, orderBy: 'CREATED_AT_DESC' }
      );
    },
    
    replyCount: (comment) => comment.replyCount || 0
  }
};

// Example usage with security limits:
// query SecurePaginatedQuery {
//   users(first: 20) {
//     edges {
//       node {
//         name
//         posts(first: 10) {
//           edges {
//             node {
//               title
//               comments(first: 5) {
//                 edges {
//                   node {
//                     content
//                     replies(first: 3) {
//                       totalCount
//                       # Cannot go deeper than 3 levels
//                     }
//                   }
//                 }
//               }
//             }
//           }
//         }
//       }
//     }
//     pageInfo {
//       hasNextPage
//       endCursor
//     }
//   }
// }