BE-451: Enforce configurable maximum `limit` for entity query endpoints by TimDiekmann · Pull Request #8512 · hashintel/hash

TimDiekmann · 2026-03-06T12:37:05Z

🌟 What is the purpose of this PR?

Enforce a server-configurable maximum limit for queryEntities and queryEntitySubgraph endpoints, defaulting to 1000. Requests exceeding the limit are rejected with InvalidArgument; omitted limits default to the configured value.

🔗 Related links

BE-451: Enforce configurable maximum limit for queryEntities and queryEntitySubgraph

🔍 What does this change?

Introduce ApiConfig struct in hash-graph-api with optional clap feature for CLI argument derivation, flattened into ServerConfig
New CLI arg --query-entity-limit (env HASH_GRAPH_QUERY_ENTITY_LIMIT, default: 1000)
Move limit validation into into_params / into_traversal_params, returning Report<EntityQueryOptionsError> with attached StatusCode::InvalidArgument
Change QueryEntitiesParams.limit from Option<usize> to usize — the internal representation always has a resolved limit

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

do not affect the execution graph

⚠️ Known issues

🐾 Next steps

BE-452: Enforce configurable maximum limit for ontology query endpoints — stacked on this PR

🛡 What tests cover this?

Existing integration tests updated to use explicit limit: 1000
Limit validation logic in into_params is tested implicitly through the existing entity query test suite

❓ How to test this?

Start the graph server: cargo run --bin hash-graph --all-features -- server
Send a POST /entities/query with limit > 1000 → expect 400 InvalidArgument
Send without limit → expect results capped at 1000
Start with --query-entity-limit 50 → verify the new limit is enforced

Adds a server-configurable limit (default: 1000) for `queryEntities` and `queryEntitySubgraph`. Requests exceeding the limit are rejected with `InvalidArgument`; omitted limits default to the configured value. - Introduce `ApiConfig` in `hash-graph-api` with optional `clap` feature for CLI argument derivation (`--query-entity-limit` / env `HASH_GRAPH_QUERY_ENTITY_LIMIT`) - Change `QueryEntitiesParams.limit` from `Option<usize>` to `usize` - Move limit validation into `into_params` / `into_traversal_params`, returning `Report<EntityQueryOptionsError>` with attached `StatusCode::InvalidArgument`

vercel · 2026-03-06T12:37:11Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview, Comment	Mar 6, 2026 3:04pm
petrinaut	Ready	Preview, Comment	Mar 6, 2026 3:04pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hashdotdesign	Ignored	Preview	Mar 6, 2026 3:04pm
hashdotdesign-tokens	Ignored	Preview	Mar 6, 2026 3:04pm

cursor · 2026-03-06T12:37:12Z

PR Summary

Medium Risk
Changes REST entity query behavior by defaulting and rejecting limit values based on a new server-side config, which could break clients relying on unlimited/large queries. Also refactors the internal store query params type from Option<usize> to usize, touching query plumbing and tests.

Overview
Entity query endpoints now enforce a server-configurable maximum limit. A new ApiConfig (optionally clap-derived) is added to hash-graph-api, injected into the Axum router via Extension, and flattened into the hash-graph server CLI (--query-entity-limit / HASH_GRAPH_QUERY_ENTITY_LIMIT, default 1000).

queryEntities and queryEntitySubgraph now resolve an effective limit (defaulting to the configured max) and reject requests that exceed it with InvalidArgument; the store layer is updated so QueryEntitiesParams.limit is always a concrete usize rather than Option<usize>, and benchmarks/integration tests are updated to pass limit: 1000 explicitly.

^{Written by Cursor Bugbot for commit cad3334. This will update automatically on new commits. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

libs/@local/graph/api/src/rest/entity_query_request.rs

augmentcode · 2026-03-06T12:39:48Z

🤖 Augment PR Summary

Summary: Enforces a server-configurable maximum for entity query limits (default: 1000) on the entity query REST endpoints.

Changes:

Introduce a REST-scoped ApiConfig and pass it through RestRouterDependencies via an Axum Extension
Add CLI/env configuration for the max entity query limit (--query-entity-limit / HASH_GRAPH_QUERY_ENTITY_LIMIT) behind an optional clap feature
Move limit resolution/validation into EntityQueryOptions::into_params and into_traversal_params, rejecting over-limit requests with InvalidArgument
Change QueryEntitiesParams.limit from Option<usize> to usize so the internal representation always has a resolved limit
Update Postgres query compilation and test/benchmark fixtures to use explicit/resolved limits (typically 1000)

Technical Notes: Limit violations now surface as EntityQueryOptionsError::LimitExceeded wrapped in error_stack::Report with an attached StatusCode::InvalidArgument.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 1 suggestions posted.

Comment augment review to trigger a new review at any time.

libs/@local/graph/api/src/rest/entity_query_request.rs

codecov · 2026-03-06T12:41:18Z

Codecov Report

❌ Patch coverage is 0% with 57 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.64%. Comparing base (313a166) to head (cad3334).
⚠️ Report is 20 commits behind head on main.

Files with missing lines	Patch %	Lines
.../@local/graph/api/src/rest/entity_query_request.rs	0.00%	44 Missing ⚠️
libs/@local/graph/api/src/rest/entity.rs	0.00%	10 Missing ⚠️
libs/@local/graph/api/src/rest/mod.rs	0.00%	2 Missing ⚠️
...s-store/src/store/postgres/knowledge/entity/mod.rs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8512      +/-   ##
==========================================
- Coverage   62.65%   62.64%   -0.01%     
==========================================
  Files        1312     1312              
  Lines      133689   133694       +5     
  Branches     5510     5510              
==========================================
- Hits        83757    83756       -1     
- Misses      49018    49024       +6     
  Partials      914      914

Flag	Coverage Δ
apps.hash-ai-worker-ts	`1.40% <ø> (ø)`
apps.hash-api	`0.00% <ø> (ø)`
local.hash-graph-sdk	`7.73% <ø> (ø)`
local.hash-isomorphic-utils	`0.00% <ø> (ø)`
rust.error-stack	`90.88% <ø> (ø)`
rust.harpc-codec	`84.70% <ø> (ø)`
rust.harpc-tower	`66.80% <ø> (ø)`
rust.hash-graph-api	`2.64% <0.00%> (-0.01%)`	⬇️
rust.hash-graph-authorization	`62.34% <ø> (ø)`
rust.hash-graph-temporal-versioning	`47.95% <ø> (ø)`
rust.hash-graph-types	`0.00% <ø> (ø)`
rust.hashql-mir	`92.59% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codspeed-hq · 2026-03-06T12:42:47Z

Merging this PR will not alter performance

✅ 80 untouched benchmarks

_{Comparing t/be-451-enforce-entity-query-limit (cad3334) with main (313a166)}

Since limit is now always resolved to a concrete value by `into_params`, sorting paths are always generated. The cursor was only passed through to the return struct without affecting path generation logic. The function now returns `Vec<EntityQuerySortingRecord>` and the caller assembles `EntityQuerySorting` with the cursor directly.

libs/@local/graph/api/src/rest/entity_query_request.rs

The integration test assertions now correctly account for pagination by checking `cursor.is_none()` (first page) in addition to the limit check. Previously, the assertion fired incorrectly on follow-up pages where `count` (total) != `results.len()` (current page). Also fix rustdoc warnings for intra-doc links to private `EntityQueryOptionsError::LimitExceeded`.

TimDiekmann · 2026-03-06T14:57:23Z

This stack of pull requests is managed by Graphite. Learn more about stacking.

github-actions · 2026-03-06T16:20:21Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$27.7 \mathrm{ms} \pm 253 \mathrm{μs}\left({\color{gray}-0.699 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.54 \mathrm{ms} \pm 19.8 \mathrm{μs}\left({\color{gray}-0.553 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1001	$$12.8 \mathrm{ms} \pm 114 \mathrm{μs}\left({\color{gray}1.23 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$44.4 \mathrm{ms} \pm 372 \mathrm{μs}\left({\color{gray}-0.088 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$15.2 \mathrm{ms} \pm 137 \mathrm{μs}\left({\color{gray}0.203 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1526	$$25.5 \mathrm{ms} \pm 198 \mathrm{μs}\left({\color{gray}2.90 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$29.1 \mathrm{ms} \pm 148 \mathrm{μs}\left({\color{gray}0.264 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.92 \mathrm{ms} \pm 25.6 \mathrm{μs}\left({\color{gray}1.38 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$14.5 \mathrm{ms} \pm 110 \mathrm{μs}\left({\color{red}6.28 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.93 \mathrm{ms} \pm 25.1 \mathrm{μs}\left({\color{gray}-1.018 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.11 \mathrm{ms} \pm 18.3 \mathrm{μs}\left({\color{gray}-1.251 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 51	$$3.48 \mathrm{ms} \pm 20.2 \mathrm{μs}\left({\color{gray}-0.357 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.32 \mathrm{ms} \pm 29.2 \mathrm{μs}\left({\color{gray}-2.069 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.79 \mathrm{ms} \pm 24.2 \mathrm{μs}\left({\color{gray}1.44 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 107	$$4.33 \mathrm{ms} \pm 26.8 \mathrm{μs}\left({\color{gray}-0.717 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.56 \mathrm{ms} \pm 21.8 \mathrm{μs}\left({\color{gray}-1.707 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.59 \mathrm{ms} \pm 21.4 \mathrm{μs}\left({\color{gray}-0.607 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.16 \mathrm{ms} \pm 23.7 \mathrm{μs}\left({\color{gray}-2.501 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.85 \mathrm{ms} \pm 13.5 \mathrm{μs}\left({\color{gray}0.360 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.83 \mathrm{ms} \pm 17.5 \mathrm{μs}\left({\color{gray}1.21 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1	$$2.92 \mathrm{ms} \pm 14.8 \mathrm{μs}\left({\color{gray}-0.153 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$3.19 \mathrm{ms} \pm 18.5 \mathrm{μs}\left({\color{gray}0.442 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.02 \mathrm{ms} \pm 16.2 \mathrm{μs}\left({\color{gray}1.29 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$3.32 \mathrm{ms} \pm 21.1 \mathrm{μs}\left({\color{gray}0.880 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.21 \mathrm{ms} \pm 20.3 \mathrm{μs}\left({\color{gray}-0.686 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.90 \mathrm{ms} \pm 18.8 \mathrm{μs}\left({\color{gray}-1.558 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 25	$$3.05 \mathrm{ms} \pm 17.0 \mathrm{μs}\left({\color{gray}-1.751 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.65 \mathrm{ms} \pm 21.0 \mathrm{μs}\left({\color{gray}-1.148 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.15 \mathrm{ms} \pm 14.5 \mathrm{μs}\left({\color{gray}-2.551 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 26	$$3.39 \mathrm{ms} \pm 21.0 \mathrm{μs}\left({\color{gray}-1.680 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.54 \mathrm{ms} \pm 15.9 \mathrm{μs}\left({\color{gray}-1.118 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.15 \mathrm{ms} \pm 14.4 \mathrm{μs}\left({\color{gray}-3.865 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.46 \mathrm{ms} \pm 17.7 \mathrm{μs}\left({\color{gray}-1.609 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$46.2 \mathrm{ms} \pm 314 \mathrm{μs}\left({\color{red}8.20 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$82.8 \mathrm{ms} \pm 537 \mathrm{μs}\left({\color{gray}2.86 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$51.2 \mathrm{ms} \pm 351 \mathrm{μs}\left({\color{red}8.68 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$52.0 \mathrm{ms} \pm 297 \mathrm{μs}\left({\color{gray}4.29 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$61.7 \mathrm{ms} \pm 308 \mathrm{μs}\left({\color{red}8.02 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$47.2 \mathrm{ms} \pm 199 \mathrm{μs}\left({\color{red}8.95 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$422 \mathrm{ms} \pm 1.28 \mathrm{ms}\left({\color{gray}-1.825 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$97.4 \mathrm{ms} \pm 537 \mathrm{μs}\left({\color{gray}3.68 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$92.2 \mathrm{ms} \pm 432 \mathrm{μs}\left({\color{gray}4.01 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$320 \mathrm{ms} \pm 1.29 \mathrm{ms}\left({\color{gray}-0.982 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$19.6 \mathrm{ms} \pm 109 \mathrm{μs}\left({\color{red}22.4 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$20.0 \mathrm{ms} \pm 118 \mathrm{μs}\left({\color{red}24.7 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$20.4 \mathrm{ms} \pm 106 \mathrm{μs}\left({\color{red}22.8 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$20.1 \mathrm{ms} \pm 104 \mathrm{μs}\left({\color{red}25.0 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$24.2 \mathrm{ms} \pm 226 \mathrm{μs}\left({\color{red}24.4 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$19.8 \mathrm{ms} \pm 139 \mathrm{μs}\left({\color{red}23.0 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$19.5 \mathrm{ms} \pm 102 \mathrm{μs}\left({\color{red}22.5 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$19.7 \mathrm{ms} \pm 107 \mathrm{μs}\left({\color{red}24.4 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$20.2 \mathrm{ms} \pm 118 \mathrm{μs}\left({\color{red}20.2 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$25.9 \mathrm{ms} \pm 166 \mathrm{μs}\left({\color{red}8.01 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$34.9 \mathrm{ms} \pm 297 \mathrm{μs}\left({\color{red}7.96 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$34.4 \mathrm{ms} \pm 295 \mathrm{μs}\left({\color{red}13.1 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$34.4 \mathrm{ms} \pm 295 \mathrm{μs}\left({\color{red}6.00 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$35.5 \mathrm{ms} \pm 284 \mathrm{μs}\left({\color{red}11.0 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$34.1 \mathrm{ms} \pm 308 \mathrm{μs}\left({\color{red}9.59 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$35.2 \mathrm{ms} \pm 284 \mathrm{μs}\left({\color{red}10.8 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$34.9 \mathrm{ms} \pm 305 \mathrm{μs}\left({\color{red}8.80 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$33.9 \mathrm{ms} \pm 312 \mathrm{μs}\left({\color{red}7.33 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$34.6 \mathrm{ms} \pm 295 \mathrm{μs}\left({\color{red}7.89 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$8.61 \mathrm{ms} \pm 47.6 \mathrm{μs}\left({\color{gray}-1.109 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$93.8 \mathrm{ms} \pm 436 \mathrm{μs}\left({\color{red}5.08 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$145 \mathrm{ms} \pm 610 \mathrm{μs}\left({\color{gray}2.41 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$101 \mathrm{ms} \pm 473 \mathrm{μs}\left({\color{gray}3.14 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$108 \mathrm{ms} \pm 548 \mathrm{μs}\left({\color{gray}2.83 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$116 \mathrm{ms} \pm 491 \mathrm{μs}\left({\color{gray}1.52 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$124 \mathrm{ms} \pm 535 \mathrm{μs}\left({\color{gray}2.21 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$100 \mathrm{ms} \pm 443 \mathrm{μs}\left({\color{red}14.3 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$130 \mathrm{ms} \pm 518 \mathrm{μs}\left({\color{red}11.0 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$107 \mathrm{ms} \pm 462 \mathrm{μs}\left({\color{red}12.9 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$116 \mathrm{ms} \pm 484 \mathrm{μs}\left({\color{red}11.6 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$119 \mathrm{ms} \pm 632 \mathrm{μs}\left({\color{red}12.5 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$118 \mathrm{ms} \pm 494 \mathrm{μs}\left({\color{red}12.0 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$127 \mathrm{ms} \pm 366 \mathrm{μs}\left({\color{gray}-1.743 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$139 \mathrm{ms} \pm 465 \mathrm{μs}\left({\color{red}7.05 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$105 \mathrm{ms} \pm 455 \mathrm{μs}\left({\color{gray}-1.519 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$572 \mathrm{ms} \pm 3.28 \mathrm{ms}\left({\color{lightgreen}-8.366 \mathrm{\%}}\right) $$	Flame Graph

graphite-app bot assigned TimDiekmann Mar 6, 2026

vercel bot deployed to Preview – hashdotdesign-tokens March 6, 2026 12:38 View deployment

vercel bot deployed to Preview – hashdotdesign March 6, 2026 12:39 View deployment

vercel bot deployed to Preview – petrinaut March 6, 2026 12:39 View deployment

cursor bot reviewed Mar 6, 2026

View reviewed changes

libs/@local/graph/api/src/rest/entity_query_request.rs Show resolved Hide resolved

augmentcode bot reviewed Mar 6, 2026

View reviewed changes

libs/@local/graph/api/src/rest/entity_query_request.rs Outdated Show resolved Hide resolved

vercel bot deployed to Preview – petrinaut March 6, 2026 12:55 View deployment

graphite-app bot reviewed Mar 6, 2026

View reviewed changes

libs/@local/graph/api/src/rest/entity_query_request.rs Show resolved Hide resolved

vercel bot deployed to Preview – hash March 6, 2026 13:01 View deployment

TimDiekmann mentioned this pull request Mar 6, 2026

BE-452: Enforce configurable limit for ontology query endpoints #8513

Open

4 tasks

vercel bot deployed to Preview – petrinaut March 6, 2026 14:59 View deployment

vercel bot deployed to Preview – hash March 6, 2026 15:04 View deployment

vercel bot deployed to Preview – hashdotdesign-tokens March 6, 2026 15:04 View deployment

vercel bot deployed to Preview – hashdotdesign March 6, 2026 15:04 View deployment

graphite-app bot requested review from a team March 6, 2026 15:41

CiaranMn approved these changes Mar 10, 2026

View reviewed changes

CiaranMn approved these changes Mar 12, 2026

View reviewed changes

TimDiekmann added this pull request to the merge queue Mar 12, 2026

github-merge-queue bot removed this pull request from the merge queue due to failed status checks Mar 12, 2026

TimDiekmann added this pull request to the merge queue Mar 12, 2026

Merged via the queue into main with commit 349b22c Mar 12, 2026
231 of 233 checks passed

TimDiekmann deleted the t/be-451-enforce-entity-query-limit branch March 12, 2026 19:25

Conversation

TimDiekmann commented Mar 6, 2026

🌟 What is the purpose of this PR?

🔗 Related links

🔍 What does this change?

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

📜 Does this require a change to the docs?

🕸️ Does this require a change to the Turbo Graph?

⚠️ Known issues

🐾 Next steps

🛡 What tests cover this?

❓ How to test this?

Uh oh!

vercel bot commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

augmentcode bot commented Mar 6, 2026

Uh oh!

augmentcode bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov bot commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codspeed-hq bot commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

Uh oh!

TimDiekmann commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 6, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

vercel bot commented Mar 6, 2026 •

edited

Loading

cursor bot commented Mar 6, 2026 •

edited

Loading

codecov bot commented Mar 6, 2026 •

edited

Loading

codspeed-hq bot commented Mar 6, 2026 •

edited

Loading

TimDiekmann commented Mar 6, 2026 •

edited

Loading