pathom 2023-03-15 | Slack Archive

thoughts on defaulting the mutation env to non-lenient? I wrote this plugin

(defplugin strict-mutation-plugin
  "Mutations should not inherit lenient from env"
  {::pcr/wrap-mutate
   (fn [mutation]
     (fn [env ast]
       (mutation (dissoc env ::p.error/lenient-mode?) ast)))})

after I realized that it's dangerous to call the parser in a mutation with the env from the args, because you can get into bad situations like querying for user/banned? and if the resolver errors the mutation keeps going with that value as nil, so it's a fail-open state. In general it seems like lenient should be up to the caller, whereas mutation logic should be entirely up to the server so it should never be affected by lenient

Eric Dvorsak19:03:31

What I do for a case like auth is I throw when access is unauthorized, even with lenient the whole query fails

2023-03-15

Channels