GraphQL vs REST: Making the Right Choice

// Fetching user data with REST: multiple requests required
async function getUserWithPosts(userId) {
  // First request: Get user
  const userResponse = await fetch(`/api/users/${userId}`);
  const user = await userResponse.json();
  
  // Second request: Get user's posts
  const postsResponse = await fetch(`/api/users/${userId}/posts`);
  const posts = await postsResponse.json();
  
  // Third+ requests: Get comments for each post
  const postsWithComments = await Promise.all(
    posts.map(async (post) => {
      const commentsResponse = await fetch(`/api/posts/${post.id}/comments`);
      const comments = await commentsResponse.json();
      return { ...post, comments };
    })
  );
  
  return {
    ...user,
    posts: postsWithComments
  };
}

// Usage
const userData = await getUserWithPosts(1);
// Problem: Over-fetching, we get ALL fields from each endpoint
// Problem: Under-fetching, multiple round trips needed

query GetUserWithPosts($userId: ID!) {
  user(id: $userId) {
    id
    name
    email
    avatar
    posts {
      id
      title
      createdAt
      comments {
        id
        body
        author {
          name
        }
      }
    }
  }
}

// Fetching user data with GraphQL: single request
async function getUserWithPosts(userId) {
  const query = `
    query GetUserWithPosts($userId: ID!) {
      user(id: $userId) {
        id
        name
        email
        avatar
        posts {
          id
          title
          createdAt
          comments {
            id
            body
            author { name }
          }
        }
      }
    }
  `;
  
  const response = await fetch('/graphql', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      query,
      variables: { userId }
    })
  });
  
  const { data } = await response.json();
  return data.user;
}

// Usage: exact data, single request
const userData = await getUserWithPosts("1");

// GraphQL Query
query {
  posts {      # 1 query to fetch posts
    title
    author {   # N queries, one per post to fetch author!
      name
    }
  }
}

// Without optimization, this generates:
// SELECT * FROM posts;                    -- 1 query
// SELECT * FROM users WHERE id = 1;       -- N queries
// SELECT * FROM users WHERE id = 2;       -- (one per post)
// SELECT * FROM users WHERE id = 3;
// ... and so on

import DataLoader from 'dataloader';

// Create a batch loading function
const userLoader = new DataLoader(async (userIds) => {
  // Single query to fetch all users at once
  const users = await User.findAll({
    where: { id: userIds }
  });
  
  // Return users in the same order as requested IDs
  const userMap = users.reduce((map, user) => {
    map[user.id] = user;
    return map;
  }, {});
  
  return userIds.map(id => userMap[id]);
});

// In your resolver
const resolvers = {
  Post: {
    author: (post, args, context) => {
      // Uses batching: all author requests in a single query
      return context.loaders.userLoader.load(post.authorId);
    }
  }
};

// Now the same query generates:
// SELECT * FROM posts;                              -- 1 query
// SELECT * FROM users WHERE id IN (1, 2, 3, ...);  -- 1 query (batched!)

import { createComplexityLimitRule } from 'graphql-validation-complexity';
import depthLimit from 'graphql-depth-limit';

const server = new ApolloServer({
  typeDefs,
  resolvers,
  validationRules: [
    // Limit query depth to prevent deeply nested attacks
    depthLimit(10),
    
    // Limit query complexity based on field weights
    createComplexityLimitRule(1000, {
      scalarCost: 1,
      objectCost: 10,
      listFactor: 20,
    }),
  ],
  
  // Disable introspection in production
  introspection: process.env.NODE_ENV !== 'production',
  
  // Field-level authorization in context
  context: ({ req }) => ({
    user: authenticateUser(req),
    permissions: getUserPermissions(req),
  }),
});

// Field-level authorization in resolvers
const resolvers = {
  User: {
    email: (user, args, context) => {
      // Only return email if user owns the profile or is admin
      if (context.user.id === user.id || context.permissions.isAdmin) {
        return user.email;
      }
      return null;
    },
    
    // Sensitive field with role check
    salary: (user, args, context) => {
      if (!context.permissions.canViewSalary) {
        throw new ForbiddenError('Not authorized to view salary');
      }
      return user.salary;
    }
  }
};