api-platform / api-platform/core

[Feature Request?] Option to not expose GraphQL mutation

未关闭
#8,099 0 条评论 1 个 reaction 已指派 0 人 在 GitHub 查看
GraphQL
主要语言
PHP
星标
2.6k
派生
980
平均合并
2 天 4 小时
30 天内合并 PR
49

描述

**Description**
I'm currently building a GraphQL api endpoint that has a number of mutation to create/update/delete entities. Some entities are more complex and have various relations to other entities. For example, entity A has a OneToMany relationship to entity B. Now, to be able to create B entities from entity A, we need to add a 'create' mutation on entity B, otherwise it doesn't work.

Now, this works, but this results in two mutations being exposed:
* `mutation createA()`
* `mutation createB()`

In our app (which is the only consumer of this API, we only use `createA()`, so to reduce potential threat surfaces we want to NOT expose the `createB()` mutation.

**Example**

```php
#[ApiResource(
operations: [],
paginationEnabled: false,
graphQlOperations: [
new Mutation(
normalizationContext: ['groups' => ['read:A']],
denormalizationContext: ['groups' => ['write:A']],
name: 'create',
),
],
)]
class A
{
// ...
#[ORM\OneToMany(mappedBy: 'backToA', targetEntity: B::class, cascade: ['persist', 'remove'], orphanRemoval: true)]
#[Groups(['read:A', 'write:A'])]
private Collection $bReferences;
// ...
}

#[ApiResource(
operations: [],
paginationEnabled: false,
graphQlOperations: [
new Mutation(
normalizationContext: ['groups' => ['read:A']],
denormalizationContext: ['groups' => ['write:A']],
name: 'create',
expose: false, // <-- I was looking for something like this.
),
],
)]
class B
{
// ...
}
```

If this happens to be already possible, I'm eager to learn how, but I don't think it's currently doable.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。