Add GraphQL query complexity/depth limiting and missing unit tests for pkg/projects and pkg/probe

[VarshaUN]

Hi maintainers,

I've been getting set up to contribute and while going through chaoscenter/graphql/server I noticed two related gaps. Wanted to open this as a discussion before writing any code, per the CONTRIBUTING guide.

A few core packages have no test files at all
While checking coverage, these have zero _test.go files:

pkg/projects (project_handler.go) — handles project creation/init, no tests
pkg/probe (handler/handler.go) — has a ready-made mock in pkg/probe/model/mocks/service.go that nothing currently uses
pkg/image_registry, pkg/gitops, pkg/grpc , same situation

pkg/projects and pkg/probe seemed like the most self-contained ones to start with since they already depend on the mongodb.MongoOperator interface, which is mockable, and pkg/probe already has the mock scaffolding sitting there unused.

Proposed scope

If this sounds reasonable, I'd like to take on:

Adding a complexity limit to the gqlgen handler in server.go (open to whatever threshold makes sense, can also look at depth limiting if preferred)
Writing unit tests for pkg/projects/project_handler.go and pkg/probe/handler/handler.go using the existing mocks

[VarshaUN]

Cc: @PriteshKiri @ispeakc0de @Jonsy13

[kunalworldwide]

The two items in this issue are related but probably worth separate PRs to keep reviews manageable.

For the missing tests: pkg/projects and pkg/probe are the highest-value targets since they handle core business logic (project lifecycle, probe execution). The existing mock at pkg/probe/model/mocks/service.go makes the probe tests straightforward to set up — the mock interface is already there, just needs test cases that exercise the handler's error paths and validation logic.

On the GraphQL complexity/depth limiting: this is a security concern worth prioritizing. Without query depth limits, a malicious or misconfigured client can send deeply nested queries that consume disproportionate server resources. Libraries like gqlgen (if that's what chaoscenter uses) have built-in complexity analysis that can be enabled with a middleware. Worth checking what GraphQL library is in use before deciding on the implementation approach.

[VarshaUN]

Yes, chaoscenter is on gqlgen v0.17.49 , I checked go.mod. It ships extension.FixedComplexityLimit() and extension.ComplexityLimit() out of the box, so no extra dependency needed. I'll add it to the handler setup in server.go and assign per-field weights for the deepest nested paths (Probe.recentExecutions[].executionHistory[], infra subscription resolvers). I'll also include a test that verifies an over-budget query actually gets rejected.
For the tests, agreed on splitting into two PRs. I'll start with pkg/probe since the mock scaffold is already there, then follow up with pkg/projects . I'll cover the error paths and validation logic as you mentioned.

Can you assign this issue to me so I can get started?

[PriteshKiri]

@VarshaUN assigned