How would you go about protecting parts of your schema? E.g. only revealing that a said query exists if the user provides a valid token? I just learned that schema directives existed yesterday and I'm pretty hyped about those. Currently using them for auth purposes. Would that be something that could solve that problem?

hey, I'd look into https://github.com/maticzav/graphql-shield and/or https://www.prisma.io/blog/graphql-directive-permissions-authorization-made-easy-54c076b5368e/

Sweet! Thanks a bunch!

@Jenkins that can be solved with a simple Express middleware in the case of you hiding the complete schema

@Jenkins that’s an interesting idea! I thought similarly and had an idea of creating a library to help you with that - heads up I hope it gets released very soon. Nevertheless, I don’t think that’s the best approach. I think that most of the cases can be handled with

shield

or just by wrapping your resolvers. Or, even better, just by writing the correct GraphQL Schema, but that’s a discussion for a blog post. What’s the reason for such immense need of hiding fields? Maybe you could just create two servers in that case! 🙂

if you want to hide individual fields, or even rename them, based on the user this can become quite tricky, but is still solvable.

For me it's more that there's not necessarily all the functionality of the api that I'd like to reveal to every user. Certain functionality like my own "ease of use tools" I'd like to not display but still be able to access when logged in.

@Jenkins I linked in my article to the GitHub "debate" on exposing introspection queries. Did you give that a look? I'm solving this issue with two different APIs both backed by the same Prisma server. I know that's not a practical solution in many cases, but for apps like mine with public and admin sides, it should work well.

I missed that on my first read-through (I'm guilty of skimming). Reading it now!

I've used Graphql-shield. It can do the job pretty well. But Prisma says it is not meant to be used to serve directly to client

I am well aware of that. My goal, however, is not one that graphql-shield solves. My goal is to further protect my outward-facing schema. No one in their right mind would expose their underlying DAL.

oh ok. got it.

@Jenkins what’s your timeline for this? I thought about putting together the library I mentioned above by the end of July. We could work on it together! 😄

Timeline is whenever wherever tbh. I'm only working on this as a hobby project.

@Jenkins I'm pretty new to Prisma. Just figuring out how this works

@Gijo Varghese same here! 🙂