graphql-public-schema-filter VS envelop

We actually built the following package, @n1ru4l/graphql-public-schema-filter which solves the problem stated within the blog post in a similar way (by filtering an existing schema into a subset of the original schema).

I am using this technique in one of my projects where we have a public API that is a subset of the internal API. I open sourced the library for doing that: https://github.com/n1ru4l/graphql-public-schema-filter

I built something similar that is "metaframework"-agnostic https://github.com/n1ru4l/graphql-public-schema-filter. Using this method has its benefits and drawbacks. If you simply public and internal part of the schema it can work pretty well. We use it for hiding the internal API from the public customer facing integration API. It is definetly easier than makntaining two seperate GraphQL schemas. However, if you want full inteospection capabilities doing this can be confusing as the introspection query operation result is different based on the authorization header which moght be weird if you are using tools such as code generators, as you now have to do it for two different schemas.

While building an GraphQL API that powers web applications we introduced a public customer-facing API. Instead of building two separate endpoints we chose to serve a different schema based on the authorization header. Furthermore, requests that do not provide an customer kntegration authorization header are only allowed to execute persisted operations. That way we somehow avoided having multiple HTTP routr endpoints. Instead of building two schemas from scratch and because the public schema is basically a filtered down version of the full graph we decided to filter down the graph using directive annotations on the schema SDL. I open sourced rhe JavaScript library for doing that (which is based upon graphql-tools). The dynamic schema selection based on the authorization header is done with Envelop

graphql-public-schema-filter: This library allows you to filter down you big graphql schema into a smaller subgraph. I have been using this for filtering our big production schema down into a public api schema that our customers use. So they don't have access to all the internal types, that are only for our internal web applications. The great thing about this is that we can just serve the correct schema based on the authorization headers as API users and Web Application tokens differ. If you have one big monolithic GraphQL server this is a great way of doing this and we are quite happy with it.

Public schema filter - for creating a simple GraphQL schema that can be used for public APIs based on existing GraphQL schema.

The Guild took over the development of GraphQL Yoga from Prisma in early 2021, and with the growing community of tools in the GraphQL space, most recently Envelop, we were able to rewrite GraphQL Yoga 2.0 from scratch with easy setup, performance, and developer experience at the core.

Ideally, you already have your basic envelop setup with your http framework of choice. This guide we will be based on the graphql-helix fastify example, but the code can be easily transferred to any other example as listed on our Integrations and Examples documentation. In case you are hitting any roadblocks feel free to reach out to us via the chat box on this page! The full code of the end-result is also available in our examples graphql-helix-auth0 fastify example.

Make “hard” GraphQL capabilities easy by installing powerful plugins (Caching, Tracing with Prometheus/DataDog/NewRelic/Sentry/OpenTelemetry/ApolloTracing, Loggers, GraphQL-Jit, Persisted Operations, Security with rate-limit/depth-limit/Auth0 and many others from the Plugins Hub)

I started reimplementing the logic from GitHub over here https://github.com/dotansimha/envelop/pull/474

We just today published a new plugin for envelop (GraphQL execution flow customization layer) that allow rejecting GraphQL operations before being executed based on the selection set of the operation. It is pretty flexible and you can limit the access dynamically based on the GraphQL context. E.g. this allows loading the permission information from the database, the user record, or any other remote service. https://github.com/dotansimha/envelop/tree/main/packages/plugins/operation-field-permissions

We are already having a spec compatible implementation available that you can start using with envelop, without havign to wait for official graphql-js support to land: https://github.com/dotansimha/envelop/pull/179