When I run prisma deploy, the api endpoints are au...
# orm-help
j
When I run prisma deploy, the api endpoints are automatically generated. WHen I deploy to a server (zeit.now) they are not. What do I need to do to have those endpoints generated when deploying to now?
n
what do you mean with api endpoints are generated?
j
The prisma endpoints for my data models
Like for example I have a type called “Post”. Prisma generates the endpoints for that so I don’t have to manually write the query resolver for all my types. So there is a “posts” query that I can use without having to manually write a resolver for it.
n
It's unexpected that the endpoint is not updated after deployment. Are you sure you are deploying the changes to the same endpoint?
j
For example see the difference in what queries are available in the palyground
n
The second screenshot you sent is not a Prisma endpoint.
That's an endpoint for a GraphQL Server, probably written in Node.
You are fully in charge for this schema, and it has nothing to do with deploying.
j
n
Ok. Do you understand why this doesn't work after what I just wrote?
j
Kind of. I’m a little confused about what the difference is between the prisma endpoint and my graphql server.
n
j
So say I wanted to use the prisma endpoint in production. How do I do that? Do I need to deploy a graphql server?
j
Okay thanks @patrickdevivo. I don’t know why this has been so difficult to wrap my head around but I appreciate the help! So basically the graphql server’s primary responsibility is to communicate with the database, and also can handle some other logic like user authentication tokens for example. But there’s also the prisma endpoint which is created when I run prisma deploy. And that is what I will use to actually communicate with the database from the front end. Am I understanding correctly?
p
it depends on your use case…but im going to guess in most cases you dont want your front-end directly accessing prisma/your db. if this were the case, it would mean that anyone could run arbitrary commands in your database without proper (application level) checks. most real deployments are going to require another graphql server in between your prisma and your front end. this let’s you build your application logic with prisma (see
prisma-bindings
)
j
So are you saying that in most production scenarios, you still need to write out all the resolvers?
I thought the prisma client was supposed to auto generate the CRUD operations for your datamodel
p
it does…do you want all those CRUD operations exposed to your frontend with no authentication? if so, you understand that that means that anyone can make a request to your prisma to delete or modify anything they want
j
Okay gotcha, no I don’t want that. Is that where the authorization token comes in to play?
Like could I communicate with the api directly if I used a token?
p
yes, but again, probably not from your frontend. the token is generated using the secret you specify in your prisma config. you should use
prisma-binding
in a new graphql server you set-up (pass in the secret) and write the resolvers you need for your application using calls to prisma
j
Okay. Also does prisma client change any of this? I was reading this (https://www.prisma.io/blog/prisma-client-beta-ahph4o1umail/) it looks like prisma client accomplishes what I’m looking to do? (Not have to write a resolver function for every CRUD operation for every type in my datamodel)
Or even this doc seems to suggest that you can interact with the api directly if you use a token.. https://www.prisma.io/docs/prisma-graphql-api/authentication-ghd4/
Is there any way to use prisma in a secure production app where my crud operations are automatically generated so that I don’t have to write a resolver for every one..?
p
i mean…you still have to define resolvers for your application level graphql calls, even in that example: https://github.com/prisma/prisma-examples/blob/master/node-graphql-schema-delegation/src/resolvers/Mutation.js#L2
as far as i know, authentication in prisma is all or nothing, so if you expose a single operation to your frontend/a user, they can do any CRUD on your db, if that’s fine with you then go for it, but im guessing it’s not sufficient for most apps
j
Okay thanks for your help