Output ignores Jackson annotations

[miguelocarvajal]

I am annotating my objects with Jackson annotations @JsonIgnore.

I see that spqr respects these annotations for the input type, but does not do so for the output type.

Is there any reason in particular why this was implemented this way? Or am I just missing something?

[kaqqao]

Ah, I see the confusion. SPQR doesn't ever serialize objects, so it isn't concerned with the output. GraphQL Java produces the output based on the query and this is what you receive. After that, GraphQL is no longer in charge of what you do with the result. If you end up serializing it, it's your web framework doing it. Normally, the serialization is trivial as the result contains only scalars and maps (containing further scalars or maps only), no POJOs or anything complex to serialize.

If any of the scalars happens to be a POJO, it will be left as-is in the result (it's a scalar, so GraphQL doesn't look inside). If there's special rules for serializing those, it's up to you to handle the web framework configuration (this usually means the ObjectMapper instance that it uses) as you wish.

[miguelocarvajal]

Gotcha! But the ExecutionResult is basically a Map containing the result of my query.

For example:

public Test {
  private String publicField1;
  private String publicField2;
  //This field we don't want ever getting to the client side
  private String privateField1;

  //Getters / setters assumed
}

In the above example, the privateField1 property should never been queried by the client side, it shouldn't even show up in the schema docs.

How do I prevent specific properties in an object from being queried?

[kaqqao]

Oops, closed accidentally.
I see what you mean now. The simplest way is to slap GraphQLIgnore on it. Another is to add a filter to the ResolverBuilder in use, e.g:

generator.withResolverBuilder(new AnnotatedResolverBuilder()
               .withFilters(method -> !method.isAnnotationPresent(JsonIgnore.class)));

(Sorry if I mistyped something, I'm on a phone right now).
This will ignore @JsonIgnore'd methods everywhere. It should probably be out-of-the-box though... but I have to assess a bit more thoroughly.

[kaqqao]

The reason Jackson's configuration is respected for inputs is that Jackson is directly involved in deserializing the input. So if it is configured to ignore a field, SPQR can not do anything about it.
For output, Jackson isn't involved, so there's no direct reason to assume its configuration should be reflected in the shape of the GraphQL API. Still, it is easy to set it up that way (as described above), and may be a reasonable thing to do by default.

[miguelocarvajal]

Sorry for the delay in getting back to you! I didn't notified of the response!

I definitely see how this would help. However this would only apply to queries and mutations, what about the types in the schema? AnnotatedResolverBuilder isn't in charge of creating the GraphQL schema for the objects (from what I can tell) is it?

[kaqqao]

There's no distinction between a field and a query, as even the top-level operations are just fields of the root object. The only special thing is that you can register different ResolverBuilders for the top-level (AnnotatedResolverBuilder by default) and sub-levels (both AnnotatedResolverBuilder and BeanResolverBuilder by default).

So in your case, you should configure it like this:

//As in my example above
ResolverBuilder annotated = new AnnotatedResolverBuilder().withFilters(...);

//Same filter
ResolverBuilder bean = new BeanResolverBuilder(basePackages)
  .withJavaDeprecationRespected(true)
  .withFilters(...);

generator
  .withResolverBuilders(annotated)
  .withNestedResolverBuilders(annotated, bean);

This should give you the same default behavior, but with @JsonIgnored methods filtered out on each level and for all types.

[miguelocarvajal]

This worked like a charm!

I guess the other Jackson annotation that should be taken into account is @JsonProperty. For example if you do:

@JsonProperty(access = JsonProperty.Access.WRITE_ONLY)

If you're thinking about putting this as default behavior.

[HelLViS69]

Same here, all fields annotated with @JsonProperty are serialized as they are, ignoring the annotation

[retrodaredevil]

I think the main problem is the implementation of PublicResolverBuilder and that it doesn't really allow for much customization. I made a Jackson specific ResolverBuilder that fixes this problem, which is a lot better than just checking for @JsonIgnore, but it doesn't allow for setters yet. I might make a PR to see what people think.

[HelLViS69]

@retrodaredevil That would be very useful!

[retrodaredevil]

@HelLViS69 Here's my current implementation. I don't know if I'll get around to making a pull request because I have a few custom bits thrown into my own implementation, so I'm still debating on the best way to generalize this. This works pretty well, but doesn't work with custom serializers yet. Here's the permalink

This also doesn't work with mutations or subscriptions.

[HelLViS69]

Thanks! will give it a try!