Internal and Public API

[yoeran]

I'm setting up a new platform that is going to serve two separate GraphQL endpoints, one for internal use and one for the public. The reason is not for authentication, but because I don't want to expose my entire database structure to the public.

I thought I worked out how to do this, but I stumble upon a weird issue. This is a summarized version of the setup:

product-model.js

import mongoose from 'mongoose'

const productSchema = new mongoose.Schema({
    name: String,
    secretProperty: String,
})

export const Product = mongoose.model('Product', productSchema)

public-api.js

import { SchemaComposer } from 'graphql-compose'
import { composeWithMongoose } from 'graphql-compose-mongoose'

import { Product } from './product.model'

const schemaComposer = new SchemaComposer()

const ProductTC = composeWithMongoose(Product, {
    fields: {
        remove: ['secretProperty'],
    },
})

schemaComposer.Query.addFields({
    productMany: ProductTC.getResolver('findMany'),
})

schemaComposer.Mutation.addFields({
    productCreateOne: ProductTC.getResolver('createOne'),
})

export const publicApi = schemaComposer.buildSchema()

private-api.js

import { SchemaComposer } from 'graphql-compose'
import { composeWithMongoose } from 'graphql-compose-mongoose'

import { Product } from './product.model'

const schemaComposer = new SchemaComposer()

const ProductTC = composeWithMongoose(Product)

schemaComposer.Query.addFields({
    productMany: ProductTC.getResolver('findMany'),
})

schemaComposer.Mutation.addFields({
    productCreateOne: ProductTC.getResolver('createOne'),
})

export const privateApi = schemaComposer.buildSchema()

server.js

import {publicApi} from './public-api'
import {privateApi} from './private-api'

const PublicGraphQL = graphqlHTTP({
    schema: publicApi,
})

const AdminGraphQL = graphqlHTTP({
    schema: privateApi,
})

app.use('/internal-api', AdminGraphQL)
app.use('/', PublicGraphQL)

By importing SchemaComposer instead of schemaComposer I've managed that the queries and mutations are correct for both the internal and public endpoint. But now in both Product Types the field secretProperty is unavailable. While I would have expected it to be available for the internal api. I've also tried using composeWithMongoose(Product, {name: 'internalProduct'}), but it had no effect. Am I missing something or is this frankly not possible?

[nodkz]

You need to pass proper schemaComposer to composeWithMongoose(Product, {schemaComposer} ). In such case all types will be created under provided schemaComposer. (Will be great if you can make PR to readme about this property) In your case you will need call composeWithMongoose for every your schemas.

Also you may try another strategy for creating several differentschemas:

• create private schema
• schemaComposer.clone()
• remove private fields from clonned schema

[yoeran]

Ah great, thanks for the pointers! I will try them out coming week, if I get it working I will surely make a PR to document this property.

[yoeran]

Works like a charm, thanks! Going to try to write this out next week.