api-platform / api-platform/core
[Feature Request?] Option to not expose GraphQL mutation
- Ngôn ngữ chính
- PHP
- Star
- 2.6k
- Fork
- 980
- Merge trung bình
- 2 ngày 4 giờ
- Pull request đã merge (30 ngày)
- 49
Mô tả
**Description**
I'm currently building a GraphQL api endpoint that has a number of mutation to create/update/delete entities. Some entities are more complex and have various relations to other entities. For example, entity A has a OneToMany relationship to entity B. Now, to be able to create B entities from entity A, we need to add a 'create' mutation on entity B, otherwise it doesn't work.
Now, this works, but this results in two mutations being exposed:
* `mutation createA()`
* `mutation createB()`
In our app (which is the only consumer of this API, we only use `createA()`, so to reduce potential threat surfaces we want to NOT expose the `createB()` mutation.
**Example**
```php
#[ApiResource(
operations: [],
paginationEnabled: false,
graphQlOperations: [
new Mutation(
normalizationContext: ['groups' => ['read:A']],
denormalizationContext: ['groups' => ['write:A']],
name: 'create',
),
],
)]
class A
{
// ...
#[ORM\OneToMany(mappedBy: 'backToA', targetEntity: B::class, cascade: ['persist', 'remove'], orphanRemoval: true)]
#[Groups(['read:A', 'write:A'])]
private Collection $bReferences;
// ...
}
#[ApiResource(
operations: [],
paginationEnabled: false,
graphQlOperations: [
new Mutation(
normalizationContext: ['groups' => ['read:A']],
denormalizationContext: ['groups' => ['write:A']],
name: 'create',
expose: false, // <-- I was looking for something like this.
),
],
)]
class B
{
// ...
}
```
If this happens to be already possible, I'm eager to learn how, but I don't think it's currently doable.
Hướng dẫn đóng góp
Đánh giá
Issue này chưa được đánh giá.