refactor(Schema) move GlobalNodeIdentification to Schema by rmosolgo · Pull Request #243 · rmosolgo/graphql-ruby
Just some food for thought about global node ID's. We ended up rolling our own node identification system, to support a couple of use-cases.
1. Sometimes we need more than just Type + ID
Most of our GraphQL types are backed by ActiveRecord models, so node identification is just a matter of knowing the type and ID of the model. But sometimes, they're "computed" objects. We re-construct these by using the type of the object, and then some arbitrary parameters. A typical example looks like this:
class SomeCustomClass def to_id_attrs # return some hash end def self.from_id_attrs(attrs) # reconstruct the object given the same hash end end
We generate the ID's by serializing that info as JSON, and then Base64 encoding it. The only real difference between this and the built-in node ID system is that instead of using only an ID, we use a couple of pieces of information.
2. Preventing ID's from being synthesized by outside code
A second concern was that we didn't want users to be able to arbitrarily request objects from our API, by synthesizing the ID's. So, we cryptographically sign all of our global object ID's, and verify those signatures before we reconstruct the object.
That helps us with security in numerous ways, since you can't get an object from us that you didn't already have. But it also simplifies the code needed to reconstruct the objects, since we can count on having been given correct information.
So having said all of that, I think it's worth considering whether global object ID's really needs to be part of the core graphql gem. It's not very difficult to implement, and it seems like one of those features where different apps could have pretty different needs.
Just wanted to give some feedback, hopefully it's helpful. :)