graphql-authz VS graphql-public-schema-filter

https://pothos-graphql.dev/docs/plugins/scope-auth https://github.com/AstrumU/graphql-authz

Today we are excited to introduce GraphQL AuthZ - a new open-source library for adding authorization layers on top of your existing GraphQL microservices or monolith backend systems.

GraphQL AuthZ is a new approach for applying GraphQL native authorization. We are happy that we can finally share this library with the community and keen to learn about the ways it might be used within your next project!

The announcement is at https://the-guild.dev/blog/graphql-authz and the repo at https://github.com/AstrumU/graphql-authz

The announcement is at https://the-guild.dev/blog/graphql-authz and the repo at https://github.com/AstrumU/graphql-authz

Compatibility with modern GraphQL technologies providing ways to wrap the graphql.js execute function. Here are a few working examples for Envelop, GraphQL Helix, Apollo Server, and express-graphql.

We actually built the following package, @n1ru4l/graphql-public-schema-filter which solves the problem stated within the blog post in a similar way (by filtering an existing schema into a subset of the original schema).

I am using this technique in one of my projects where we have a public API that is a subset of the internal API. I open sourced the library for doing that: https://github.com/n1ru4l/graphql-public-schema-filter

I built something similar that is "metaframework"-agnostic https://github.com/n1ru4l/graphql-public-schema-filter. Using this method has its benefits and drawbacks. If you simply public and internal part of the schema it can work pretty well. We use it for hiding the internal API from the public customer facing integration API. It is definetly easier than makntaining two seperate GraphQL schemas. However, if you want full inteospection capabilities doing this can be confusing as the introspection query operation result is different based on the authorization header which moght be weird if you are using tools such as code generators, as you now have to do it for two different schemas.

While building an GraphQL API that powers web applications we introduced a public customer-facing API. Instead of building two separate endpoints we chose to serve a different schema based on the authorization header. Furthermore, requests that do not provide an customer kntegration authorization header are only allowed to execute persisted operations. That way we somehow avoided having multiple HTTP routr endpoints. Instead of building two schemas from scratch and because the public schema is basically a filtered down version of the full graph we decided to filter down the graph using directive annotations on the schema SDL. I open sourced rhe JavaScript library for doing that (which is based upon graphql-tools). The dynamic schema selection based on the authorization header is done with Envelop

graphql-public-schema-filter: This library allows you to filter down you big graphql schema into a smaller subgraph. I have been using this for filtering our big production schema down into a public api schema that our customers use. So they don't have access to all the internal types, that are only for our internal web applications. The great thing about this is that we can just serve the correct schema based on the authorization headers as API users and Web Application tokens differ. If you have one big monolithic GraphQL server this is a great way of doing this and we are quite happy with it.

Public schema filter - for creating a simple GraphQL schema that can be used for public APIs based on existing GraphQL schema.