Hide schema sections?

[otryshko]

Hello, I'm looking into the options how to have "private" and "public" schemas served under different urls, where private schema is a superset of public one. Is it possible to have 2 schema documents referring to the same implementation, with private fields omitted in public schema? When I try to run public schema with removed field "private", it errors out with
"Field %s is not defined on type %s" % (field, self.name)
ValueError: Field private is not defined on type Full \

[rafalp]

There are two approaches to this:

Schema inheritance

This approach relies on GraphQL extend syntax which allows you to define additional fields for type after it was declared:

type MyType {
  somefield: String
}

extend type MyType {
  someSecretField: String
}

The trick is to run make_executable_schema twice, and pass only MyType with its resolvers to first run, and MyType together with extend (and extra types as well as resolvers) to next run. Then you setup two GraphQL urls and let client decide if they'll query /graphql/ or /graphql/private/. You can also put auth check in front of the URL to refuse queries without authorization to the private API.

Here's example repo that implements shared schema that both admin and public extend.

---

Permission checks on resolvers and overriding introspection

In this approach all fields are defined in single schema, but server overrides resolvers on __type __schema fields to check permissions and filter list of returned types. I've never done this approach myself so I can't offer any code examples. But I'm certain its possible to bind custom resolvers to those fields using ObjectType. It also sounds more error prone than previous approach.

[otryshko]

Thank you - I guess I'll try second approach and see how far can I get :)