5 ms·
many of these concerns are mitigated by ensuring you are using trusted documents (https://benjie.dev/graphql/trusted-documents https://benjie.dev/graphql/truste
by purge 2y ago
many of these concerns are mitigated by ensuring you are using trusted documents (https://benjie.dev/graphql/trusted-documents https://benjie.dev/graphql/trusted-documents)
- julian37 2y agoThis. For graphql-ruby: https://graphql-ruby.org/operation_store/overview https://graphql-ruby.org/operation_store/overview
- pjfii 2y agoYeah, we use Hot Chocolate with .NET where it is called Persisted Queries. https://chillicream.com/docs/hotchocolate/v13/security https://chillicream.com/docs/hotchocolate/v13/security Honestly most of the "problems" the OP discusses has solutions in the documentation.
- mst 2y agoSeems like at that point exposing each query as an OpenAPI endpoint would achieve pretty much the same thing. Then again having GraphQL as the definition for them is probably still not bad, I'll just have to write something that converts them to SQL::Abstract 2 trees once I get around to porting it to TS.
- dventimi 2y agoIt would be the same thing except with Benje's approach, you're basically using GraphQL as a developer tool to create those end points instead of writing code to do it. And you don't have to write something to convert them to SQL if you're using PostgreSQL, because Benje's already written it for you.
- mst 2y agopostgraphile does look like it'll handle basic cases pretty nicely but I've gone through the docs and didn't find anything like an explanation of what SQL queries it ends up mapping to - do you happen to know if there's one I missed, or a list of examples of GraphQL + corresponding SQL, or something?
- dventimihasura 2y agoPostGraphile compiles GraphQL directly to SQL. The SQL is "custom" in that it's specific to the GraphQL operation, though naturally it does follow rules. For example, Hasura does the same thing, and among the rules that it follows is that it uses `LEFT LATERAL JOIN` between tables (at least, on PostgreSQL). Full disclosure, I work for Hasura, so I'm not super familiar with the style of SQL PostGraphile generates but one thing you can do is just have PostGraphile report back the generated SQL for inspection: https://www.graphile.org/postgraphile/debugging/#via-postgraphiql-explain https://www.graphile.org/postgraphile/debugging/#via-postgra...
- purge 2y agopostgraphile v5 has significantly improved query generation (https://postgraphile.org/postgraphile/next/ https://postgraphile.org/postgraphile/next/) since moving to grafast (https://grafast.org/grafast/ https://grafast.org/grafast/)
- dventimihasura 2y agoNice!
- mst 2y ago> PostGraphile compiles GraphQL directly to SQL. The SQL is "custom" in that it's specific to the GraphQL operation Yes, that's why I said GraphQL and -corresponding- SQL, I was hoping to find something that showed me the SQL for each of half a dozen or a dozen examples ... though the debug option there will let me point the out-of-the-box CLI at a pre-existing database and have a look at as many examples as I like, so that's pretty close to what I was looking for. Would also be interested to see a bunch of examples of what Hasura generates if you have those to hand (I'm going to poke through the Hasura Community Edition docs but if you have the specific FM to R handy ... :)
- deleted 2y ago[deleted]