Redacting fields in GraphQL with Apollo Server

Readme.md

Demo showing that by specifying a resolver for a scalar property, you can override the value.

This is useful for authorization as it means you can centrally check permissions per field. Your general resolvers can return whole objects without caring about which fields the current user may or may not be allowed to see.

index.js

const express = require('express')
const { graphqlExpress } = require('apollo-server-express')
const { makeExecutableSchema } = require('graphql-tools')
const bodyParser = require('body-parser');

const app = express()

const typeDefs = `
type Query {
  test: Test
}

type Test {
  public: String
  private: String
}
`

const resolvers = {
  Query: {
    test: () => ({ public: 'hey', private: 'ho' }),
  },
  Test: {
    private: () => null,
  },
}

const schema = makeExecutableSchema({ typeDefs, resolvers })

app.use(bodyParser.json())
app.use('/graphql', graphqlExpress({ schema }))

app.listen(3000)

output.md

Query

{
  test {
    public
    private
  }
}

Result

{
  "data": {
    "test": {
      "public": "hey",
      "private": null
    }
  }
}