Where are guidelines to implement it? How do we make our existing business code integrate with it? How do we make sure a client cannot access data from another client? Does it work well or at all with relational databases?
Is the backend a second-class citizen in this approach?
You basically define the schema, and for each method you want to support you implement pulling the data from your datastore.
Authentication is up to you - stick a bearer header on your requests and implement checks in your server and you have secure backends, etc.
I look forward to a sample that implements fine-grained (multi-role) security on a SQL database. Is there a .NET implementation already in development I can contribute to?
Edit: I'm interested more in GraphQL official JavaScript implementation, since that's the one most people are going to use.
Just implement resolve.
If the JavaScript implementation doesn't have something like this, perhaps it can be hacked on top.
eg: { firstName, lastName } doesn't need to load new rows but { mother { name }, father { name } } does need to load new rows.
DataLoader (https://github.com/facebook/dataloader) is a small utility which makes batching and caching database requests straight forward.
query User {
friends {
friends {
friends {
...
}
}
}
}