api-platform / api-platform/core

[Feature Request?] Option to not expose GraphQL mutation

Abierto
#8,099 0 comentarios 1 reacción 0 asignados Ver en GitHub
GraphQL
Lenguaje dominante
PHP
Estrellas
2.6k
Forks
980
Merge medio
2 d 4 h
PR fusionados (30 d)
49

Descripción

**Description**
I'm currently building a GraphQL api endpoint that has a number of mutation to create/update/delete entities. Some entities are more complex and have various relations to other entities. For example, entity A has a OneToMany relationship to entity B. Now, to be able to create B entities from entity A, we need to add a 'create' mutation on entity B, otherwise it doesn't work.

Now, this works, but this results in two mutations being exposed:
* `mutation createA()`
* `mutation createB()`

In our app (which is the only consumer of this API, we only use `createA()`, so to reduce potential threat surfaces we want to NOT expose the `createB()` mutation.

**Example**

```php
#[ApiResource(
operations: [],
paginationEnabled: false,
graphQlOperations: [
new Mutation(
normalizationContext: ['groups' => ['read:A']],
denormalizationContext: ['groups' => ['write:A']],
name: 'create',
),
],
)]
class A
{
// ...
#[ORM\OneToMany(mappedBy: 'backToA', targetEntity: B::class, cascade: ['persist', 'remove'], orphanRemoval: true)]
#[Groups(['read:A', 'write:A'])]
private Collection $bReferences;
// ...
}

#[ApiResource(
operations: [],
paginationEnabled: false,
graphQlOperations: [
new Mutation(
normalizationContext: ['groups' => ['read:A']],
denormalizationContext: ['groups' => ['write:A']],
name: 'create',
expose: false, // <-- I was looking for something like this.
),
],
)]
class B
{
// ...
}
```

If this happens to be already possible, I'm eager to learn how, but I don't think it's currently doable.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.