Limiting query access to certain type relationships

[vladrnd]

Hi. I'm trying to determine what the best practice is for limiting the querying of relations on a particular type..

For example, an Account type has many relationships, but under certain circumstances I don't want the user to be able to query some of them.

I can think of creating a RestrictedAccount type, possibly implementing a common interface of Account, but I'm hoping I won't have to duplicate code.

Thanks

[zabavnikov]

@vladrnd, try this https://github.com/rebing/graphql-laravel#privacy

public function fields(): array
{
    return [
        'like' => [
            'type' => GraphQL::type('Like'),
            'privacy' => function(array $args, $ctx): bool {
                return auth()->check();
            },
            'description' => 'Loaded only if the user is logged in.',
        ],
    ];
}

[mfn]

• Indeed what @zabavnikov suggested is a good way iff you use SelectFields
• if not, you multiple ways:
  • add logic to your resolve callback
    This is basically what the privacy feature of SelectFields does for you
  • use separate queries returning separate types
    Especially if there's a lot of additional information you want to expose / not expose, it might just make more sense to do it that way