https://www.prisma.io/ logo
Join Slack
Powered by
Hey guys I have encountered a problem I am not sur...
# orm-help
r
Hey guys I have encountered a problem I am not sure how to handle When returning information like user - password is a required field on my schema. But I would like to return a user without the password when a user logs in or when requesting users in general. What is the best practice here to get returning sensitive fields to the user? Thanks.
t
Couldn’t you make it, not required?
wait, what do you mean 
required
to be returned
the fields that are returned to the user are dependent on the query that is sent. unless i’m misunderstanding what you mean
r
maybe my knowledge is limited here
Copy code
type User{
  id: ID! @unique
  name: String! @unique
  username: String! @unique
  email: String! @unique
  password: String!
  teams: [Team!]!
}
that is my user object
and I want to make sure password is a required field when saving to the database
I could probably remove the password being required, but is that how this problem is usually handled @tabsnotspaces
t
right so your type is correctly defined. the password is required when creating a user. so your 
createUser
mutation will need to have a password in the payload. but querying for a user you can specify whatever fields you want
r
ye that is part of the problem
how would one prevent the ability to query the password field
if I delete it from the object, then graphql complains that password is a required field
the only thing I can think of is to have another authuser type that excludes password from the schema
l
Can't you make the passwork field optional on User but make it required on a Signup mutation (that would take an input of its own type) ?
Copy code
type Mutation {
  signup(email: String!, password: String!): User
}
t
^ yeah there’s that too. you can also look at persisted queries, it dictates what queries can be sent to the graphql server in production
t
from what i understand, in your 
datamodel.graphql
you would include the password field, but in the schema.graphql which is the second layer where you would expose your api to calls, you would "redefine" 
type User { ... }
in there and include only the fields you want to expose, so leave out password and anything that you don't want to be able to query.
so in your schema.graphql either above or below your 
type Query { ... }
and 
type Mutation { ... }
you literally add something like
Copy code
type User {
  id: ID!
  email: String!
  name: String!
}
which would only allow querying on id, email, and name
r
thanks guys … all of these are great solutions!
I think the last solution makes the most sense
👍 1
password should only flow through the signup and get saved through prisma bindings
I can redefine user so it’s not available for querying!
they are all kind of similar ideas though
thanks!
3 Views
Open in Slack
PreviousNext
Powered by