GraphQL integration

Hey there. I stumbled into EdgeDB a couple of days ago and so far it seems really promising, I’ve struggled with a lot of the pain points EdgeDB is meant to solve and so I find the idea behind it brilliant. Hopefully it sees more and more adoption as time goes by.

I have a question about the GraphQL integration. I am aware that EdgeDB provides a built-in GraphQL server through its GraphQL extension that could be used to run CRUD operations against the database directly via GraphQL. Correct me if I’m wrong, but I don’t see how this (at least in its current state) is useful if you’re actually building a public-facing API (say, the back-end of a website, for example), as it doesn’t allow for any customization, auth, business logic, etc.

When I first heard that EdgeDB plays nicely with GraphQL and before actually reading the docs on the GraphQL integration, I was expecting some sort of an engine, perhaps as an NPM package, say, that would translate GraphQL queries into EdgeQL. Some kind of a library that you could plug into frameworks like Apollo Server, the idea of EdgeDB running its own standalone HTTP server with a GraphQL endpoint seems exotic, and far too inflexible.

Let me illustrate some very common requirements when building a semi-serious database-driven GraphQL API:

Let’s say I have:

type Product {
    required property title -> str;
    required property deleted -> bool;
}

I don’t want any deleted products (i.e. any product whose deleted column is true) to be exposed via my API. So, I also wouldn’t want the deleted column itself to be part of the corresponding GraphQL type either, as it would always be false anyway. Fields in GraphQL are usually written in the camelCase notation, while in Postgres and EdgeDB, the convention is snake_case. There’s currently no way to convert these property names into camelCase in the GraphQL API. Perhaps most importantly, there’s no way for me to define any business logic before applying mutations, anybody can delete or modify anything. If this was Apollo, for example, I would’ve simply declared a resolver function for the mutation and done the various checks there and then applied the right changes using EdgeDB’s Node client. There’s also no way I can customize exactly which fields the user can do filtering on, and much more.

This is perhaps the only part of EdgeDB that I’m very disappointed about. Today, what is the recommended approach to actually build a serious public-facing GraphQL API with EdgeDB as the underlying DBMS, if there is any?

As I mentioned earlier, I believe something that could be used as a plugin for Apollo or any GraphQL server framework of one’s choice would’ve actually been the most sensible and flexible option, that’s really the kind of thing I was expecting.

Let me know your thoughts, and tell me if I’m missing something because I’m extremely new to EdgeDB. Thank you in advance.

[elprans]

Hi @aradalvand!

Thank you for the feedback!

The bottom line is that the current GraphQL implementation is essentially an experimental proof-of-concept extension. We should be more upfront about this in the documentation so as not to betray the exectation of top-notch functionality like elsewhere in EdgeDB. The good news is that support for building secure public facing APIs with nothing but EdgeDB is something we are working toward. For example, one of the headline features of EdgeDB 2.0 (which is currently in the release candidate status) is the ability to declare precise object-level access control policies, so your “deleted” rule can be expressed as:

type Product {
    required property title -> str;
    required property deleted -> bool;
    
    access policy no_deleted allow select using (not .deleted);
}

or even:

type Product {
    required property title -> str;
    required property deleted -> bool;
    
    access policy no_deleted_in_graphql 
      when (global is_graphql)
      allow select using (not .deleted);
}

Control over the exposed API schema as well as explicit support for GraphQL federation is on the roadmap.

A standalone JavaScript library that translates GraphQL to EdgeQL and can be embedded into your app for greatest control is a very nice idea. GraphQL -> EdgeQL translation is pretty much what the current GraphQL extension does and it’s not very hard, since GraphQL is basically a small subset of EdgeQL.

[kerimcharfi]

My question regarding the graphql extension: Can you emit / generate the graphql schema with the great edgedb cli?