api-platform / api-platform/core

[Feature Request?] Option to not expose GraphQL mutation

Open
#8,099 0 comments 1 reaction 0 assignees View on GitHub
GraphQL
Dominant language
PHP
Stars
2.6k
Forks
980
Avg merge
2d 4h
Merged PRs (30d)
49

Description

**Description**
I'm currently building a GraphQL api endpoint that has a number of mutation to create/update/delete entities. Some entities are more complex and have various relations to other entities. For example, entity A has a OneToMany relationship to entity B. Now, to be able to create B entities from entity A, we need to add a 'create' mutation on entity B, otherwise it doesn't work.

Now, this works, but this results in two mutations being exposed:
* `mutation createA()`
* `mutation createB()`

In our app (which is the only consumer of this API, we only use `createA()`, so to reduce potential threat surfaces we want to NOT expose the `createB()` mutation.

**Example**

```php
#[ApiResource(
operations: [],
paginationEnabled: false,
graphQlOperations: [
new Mutation(
normalizationContext: ['groups' => ['read:A']],
denormalizationContext: ['groups' => ['write:A']],
name: 'create',
),
],
)]
class A
{
// ...
#[ORM\OneToMany(mappedBy: 'backToA', targetEntity: B::class, cascade: ['persist', 'remove'], orphanRemoval: true)]
#[Groups(['read:A', 'write:A'])]
private Collection $bReferences;
// ...
}

#[ApiResource(
operations: [],
paginationEnabled: false,
graphQlOperations: [
new Mutation(
normalizationContext: ['groups' => ['read:A']],
denormalizationContext: ['groups' => ['write:A']],
name: 'create',
expose: false, // <-- I was looking for something like this.
),
],
)]
class B
{
// ...
}
```

If this happens to be already possible, I'm eager to learn how, but I don't think it's currently doable.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.