wundergraph-demo VS assert-combinators

If you want to follow along and experience these patterns yourself, you can clone this repository and play around.

Thanks to our GraphQL Operation Compiler, we're in a unique position that allows us to only send the "Operation Name" as well as the "Variables" to the server. This approach makes our GraphQL API much more secure as it hides it behind a JSON-RPC API. You can check out an example here, and we're also open sourcing the solution soon.

I've been working on this problem for a few years actually. What I came to realize is that 99% of all (GraphQL) APIs are private, meaning that we don't expose them to a 3rd party. One aspect of private GraphQL APIs that is almost always true is that the access patterns don't change at runtime, meaning that when deployed to production, the Operations don't change any more. What this means is that in production, we don't really need GraphQL. We don't benefit from GraphQL in production anymore, as we're not writing dynamic Operations. Instead, we could compile the GraphQL Operations that we need into a REST API. This step adds extra complexity, but reduced the attack surface and improves performance. To reduce the overhead, I've created a developer tool. WunderGraph! It compiles your GraphQL APIs into REST Endpoints and generates typesafe clients for them. The DX is still the same, you write GraphQL Operations and use a typesafe client. But behind the scenes, it's just REST. We even generate a Postman Collection, so you can easily share the generated API with your team. Here's a demo if you'd like to try it: https://github.com/wundergraph/wundergraph-demo We're open-sourcing the solution very soon! =)

Alternatively, you can also just run "wunderctl init --template nextjs-starter" to start with the NextJS template. (Obviously you need to install it first: yarn global add @wundergraph/wunderctl@latest)

We're going open source with this solution soon. So, any feedback is appreciated! You can also join our discord and shoot questions. =)

[0]: https://github.com/wundergraph/wundergraph-demo

WunderGraph: click here!

It's already possible. Here's a demo: https://github.com/wundergraph/wundergraph-demo

Shameless plug, you can use Federation, Schema Stitching, REST APIs, etc. all together and even transition from one to the other, here's a demo: https://github.com/wundergraph/wundergraph-demo

We use in prod variant of no 1. [0]. Why? Because:

* it's extremely lightweight (built on pure, functional combinators)

* it allows us to use more complex patterns ie. convention where every json field ends with Json which is automatically parsed; which, unlike datatype alone, allows us to create composable query to fetch arbitrarily nested graphs and promoting single [$] key ie. to return list of emails as `string[]` not `{ email: string }[]` with `select email as [$] from Users` etc.

* has convenience combinators for things like constructing where clauses from monodb like queries

* all usual queries like CRUD, exists etc. and some more complex ie. insertIgnore, merge1n etc has convenient api

We resort to runtime type assertions [1] which works well for this and all other i/o; runtime type assertions are necessary for cases when your running service is incorrectly attached to old or future remote schema (there are other protections against it but still happens).

[0] https://github.com/appliedblockchain/tsql

[1] https://github.com/appliedblockchain/assert-combinators

We use not so much frameworks but combination of lightweight libraries:

- runtime assertions [0] - to map unknown values at i/o boundary into statically typed code (rpc input parameters, sql results etc)

- template based sql combinators to sanitize sql/generate sql [1]

- jsonrpc over websockets - for bidirectional comms between f/e and b/e

[0] https://github.com/appliedblockchain/assert-combinators

[1] https://github.com/appliedblockchain/tsql

Types can be asserted at runtime (parsed) at IO boundaries (reading http request or response, websocket message, parsing json file etc). Once they enter statically type system they don't need to be asserted again.

The difference it makes is illusion of type-safety vs type-safety this article touches on.

You can try to bind service with client somehow but in many cases this will fail in production as you can't guarantee paired versioning, due to normal situations by design of your architecture or temporary mid-deployment state or other team doing something they were not suppose to do etc. It's hard to avoid runtime parsing in general.

Functional combinators [0] or faster [1] with predicate/assert semantics work very well with typescript, which is very pleasant language to work with.

[0] https://github.com/appliedblockchain/assert-combinators

[1] https://github.com/preludejs/refute

Once i/o boundaries are parsing unknown types into static types, your type safety is guaranteed.

[0] https://github.com/appliedblockchain/assert-combinators