graphql-spec VS graphql-shield

GraphQL's first draft release was 8 years ago. [1]

It's first non-draft release was 5 years ago. [2]

It's first release under a community foundation was 2 years ago. [3]

[1] https://spec.graphql.org/July2015/

[2] https://github.com/graphql/graphql-spec/releases/tag/June201...

[3] https://github.com/graphql/graphql-spec/releases/tag/October...

I'm a big believer in GraphQL (in fact, at time of writing I'm #2 contributor to the GraphQL spec itself) so it pains me that a tool I built doesn't always have easy ways to achieve the "versionless schema" design that GraphQL encourages when it comes to making significant breaking changes to your underlying database tables. (Personally, I think you should aim for your database schema itself to be versionless, but this is not always possible.) Of course you can build your PostGraphile schema over views instead of tables, but views have their own problems that I won't go into here…

I created a proposal for Map type but didn’t make it through.

https://github.com/graphql/graphql-spec/pull/888

The issue with GraphQL is it tries to appease too many masters.

Similar to jsx. The language isn’t evolving.

The good thing is the spec is (almost) frozen, so there’s many implementations, the bad is it can encompass the flexibility of json schema can do.

Longer thread - Subscriptions RFC: Are Subscriptions and Live Queries the same thing?

https://github.com/graphql/graphql-spec/issues/284

You’ve probably figured it out by now, but for others who may be in a similar position; GraphQL is a specification (with various implementations) and you can read up on the spec here: https://spec.graphql.org/

If you're asking whether GraphQL supports anonymous objects that can be arbitrarily nested then no, it doesn't.

show this feature request some love https://github.com/graphql/graphql-spec/issues/174

* Performance: It's just hard to track down what makes an operation slow. The waterfall nature of resolvers is a big contributor

[1] https://github.com/graphql/graphql-spec/issues/488

:::note GraphQL Union is available for Types only, not for Inputs. However, the oneOf directive will bridge the gap in the future.

- https://github.com/dimatill/graphql-shield/issues/988 - https://github.com/dimatill/graphql-shield/issues/1485

Second a NextJS app is deployed to Vercel containing a GraphQL server function. This is an Apollo server that consumes the halo-graphql package using GraphQL Modules. The server also implements caching and rate limiting using GraphQL Shield.

GraphQL Shield is a great tool for creating authorization layers that has vast adoption from the community. In fact, GraphQL AuthZ is highly inspired by GraphQL Shield! However, GraphQL Shield uses a different approach compared to GraphQL AuthZ for applying authorization rules.

Haven't used it yet but GraphQL Shield looks pretty good. https://github.com/maticzav/graphql-shield

You can also use libraries like GraphQL Shield which offers powerful middlewares to do this. But remember that authorization does come with attached cost since you are running a specific logic in/before your resolvers for all the fields which you want to authorize.

Try graphql-shield