Hacker News Reader

GraphQL queries are strongly typed. You can only add fields for what your schema defines. And no, in that case you would simply have a users query and in the GraphQL resolver on the server side for that query you would just filter out banned users. If there's anything you don't want exposed to the client, you simply leave it out of your graphql schema.

View on HN

Got it. So the above example that I gave with SQL is pretty much the same thing as GraphQL. Assuming you would have a SQL resolver that just like the GraphQL resolver filters out things that should never hit the DB. So GraphQL is a middleware for safely querying the database openly by untrusted 3rd parties. Thanks that explains a lot, it's a pretty interesting idea actually

Not just a database; any data source.

The piece that got me hooked on GraphQL (prior to implementing servers with it, and now I really like GraphQL—but it’s not a silver bullet in any way) was a podcast where one of the creators of GraphQL at FB made it clear that, from the server side, every field in GraphQL is a function, not a field on a record.

It means that, although the FE is specifying the shape of the data it wants, the BE can determine whether to return the data or not. Also, errors are additive and may be returned in parallel to the requested data fields.

Reply on news.ycombinator.com