[Doc] JSON DQL mutation for GraphQL Schema requires clarification

[amaster507 (Anthony Master)]

@Poolshark

No, this is simply wrong. An API is much more than a query language like GraphQL. GraphQL by itself cannot and never will be able to provide (programmable) mechanisms connect to services. But read for yourself, graphql.org has it as it’s H1 header

You stopped the quote too early… It is also a runtime.

To say GraphQL is not an API is like saying REST is not an API or FHIR or HL7 or SOAP or CCDA or any other API flavor is not an API. It is the spec that the API must conform to, to be classified as a GraphQL server. But whatever you want to believe you may. You probably know GraphQL better than me anyways.

@Poolshark

Dgraph runs these @auth queries before the actual request

No they don’t… And this is not what Jonathan said either.

@jdgamble555

The @auth does not get triggered, and then your final query gets triggered separately. In fact, it compiles with your query, as an extra filter. This means it is faster, and you ultimately just have one filter. If I look for todos, my @auth is going to filter for todos I have access to form the beginning, hence never over-fetching, and then filtering those results.

There are glaring holes in auth rules currently so be careful with them.

Auth will also currently slow down your queries if not done correctly which is close to impossible to do in the current state. I would almost say that there are NO secure Dgraph natiive GraphQL APIs. Anybody who thinks their auth rules are secure, please send me your graphql api endpoint and I will help you understand the issues.