Dan Schafer - GraphQL at Facebook at react-europe 2016
Why Stack Overflow recommends it
Stack Overflow users link it when discussing where to put authorization in a GraphQL server, since it shows a business-logic layer with gen() methods acting as the single source of truth for fetching and access checks.
Recommended by 1 people across 1 different months, 2016 to 2017.
What it is
A 26-minute conference talk from React Europe 2016 in which Facebook engineer Dan Schafer describes how Facebook designs and runs its production GraphQL API, which serves hundreds of billions of queries a day. He covers schema design patterns, how they differ from other API best practices, and the implications for server and client design.
What people said
Recommends Simen Brekken · 2017-08 · Stack Overflow · on “Lists and pagination authorization in GraphQL business layer”
In Dan Schafer's excellent "GraphQL at Facebook" talk from React Europe [this video] he goes over how centralizing authorization in business layer models avoids the problem of having to duplicate authorization logic for every edge that leads to an authorized node. [LINK] This works fine for something like Todo.getById(1) which in my case eventually ends up querying a database for SELECT * from todos WHERE id=1 and then verifying authorization with checkCanSee(resultFromDatabase) . However, let's say my todos table now contains 100,000 todos from multiple users, performing authorization purely in the business layer becomes impractical as I'd need to fetch every todo, filter the result using the sh
Cites ThomasReggi · 2016-06 · Stack Overflow · on “Methods based on capabilities of class versus methods based on altering self?”
I'm new to OOP and I'm trying to create a series new classes that add a tiered account status. Let's say the classes are Supervisor , Admin , User . The first option I see is, to make a class for each of the above namespaces. Then each class has methods that utilize the capabilities of that class. So Supervisor can .revokeAdminAccess() . The second option I see is, to make a class for each of the above namespaces. Then each class only performs actions based on itself. So the Admin class has a .revokeAccess() method, where you can pass in an instance of Supervisor and authorize within the .revokeAccess()` method. I was watching this video from Dan Schafer on graphQL [this video] where they show th
Cites Tony D · 2016-08 · Stack Overflow · on “How to unit test javascript ES6 classes that encapsulate their own creation within a static function?”
In Dan Schafer's React Europe talk ( [this video] ), he showed one approach to handling authorization in a GraphQL server could be delegating to a business logic layer in which each business object class has a gen() function [LINK] that acts as the "single source of truth" for both fetching and authorization . He implies that these classes could have no public constructor, thereby making gen() the only way to instantiate one of these classes. As a C# dev, this wouldn't be [easily] unit-testable. Perhaps, I'm taking his example too literally. In ES2015, is it possible to unit test the business logic in isolation with this pattern? If so, can you provide an example please? Here's a related Q&A, but