GraphQL Architecture Guide: Server Setup, Subscriptions & Apollo Federation

const { ApolloServer } = require('apollo-server');
const { ApolloServerPluginCacheControl } = require('apollo-server-core');
const responseCachePlugin = require('apollo-server-plugin-response-cache');

const server = new ApolloServer({
  typeDefs,
  resolvers,
  csrfPrevention: true,         // CSRF protection
  cache: 'bounded',              // Bounded in-memory cache
  introspection: process.env.NODE_ENV !== 'production', // Disable in production
  persistedQueries: true,        // Persisted query support
  plugins: [
    ApolloServerPluginCacheControl({ defaultMaxAge: 300 }),
    responseCachePlugin(),
  ],
  context: async ({ req }) => {
    const user = await authenticate(req);
    return { user, db };
  },
  // Limit query depth
  validationRules: [depthLimit(7)],
});

server.listen(4000).then(({ url }) => console.log(`Server at ${url}`));

type Subscription {
  threatDetected(deviceId: ID): Threat!
  deviceStatusChanged: Device!
}

const { PubSub } = require('graphql-subscriptions');
const pubsub = new PubSub();

const resolvers = {
  Subscription: {
    threatDetected: {
      subscribe: (parent, { deviceId }) => {
        // Filter by device ID if provided
        const channel = deviceId 
          ? `THREAT_DETECTED_${deviceId}` 
          : 'THREAT_DETECTED_ALL';
        return pubsub.asyncIterator(channel);
      },
    },
  },
  Mutation: {
    reportThreat: async (parent, { input }, context) => {
      const threat = await createThreat(input);
      
      // Publish to subscribers
      pubsub.publish(`THREAT_DETECTED_${threat.deviceId}`, {
        threatDetected: threat,
      });
      pubsub.publish('THREAT_DETECTED_ALL', {
        threatDetected: threat,
      });
      
      return threat;
    },
  },
};

const server = new ApolloServer({
  typeDefs,
  resolvers,
  context,
  subscriptions: {
    path: '/subscriptions',
    onConnect: (connectionParams) => {
      // Verify auth token from connection params
      if (connectionParams.authToken) {
        return { user: verifyToken(connectionParams.authToken) };
      }
      throw new Error('Auth required for subscriptions');
    },
  },
});

import { ApolloClient, InMemoryCache, gql, split } from '@apollo/client';
import { WebSocketLink } from '@apollo/client/link/ws';
import { getMainDefinition } from '@apollo/client/utilities';

// HTTP link for queries/mutations
const httpLink = createHttpLink({ uri: 'http://localhost:4000' });

// WebSocket link for subscriptions
const wsLink = new WebSocketLink({
  uri: 'ws://localhost:4000/subscriptions',
  options: { connectionParams: { authToken: 'bearer-token' } },
});

// Split based on operation type
const link = split(
  ({ query }) => {
    const def = getMainDefinition(query);
    return def.kind === 'OperationDefinition' && def.operation === 'subscription';
  },
  wsLink,
  httpLink
);

const client = new ApolloClient({ link, cache: new InMemoryCache() });

// Subscribe to real-time threats
client.subscribe({
  query: gql`subscription { 
    threatDetected(deviceId: "dev-001") { id name severity } 
  }`,
}).subscribe({
  next({ data }) {
    console.log('New threat:', data.threatDetected.name);
    showNotification(data.threatDetected);
  },
});

// Gateway
const { ApolloGateway } = require('@apollo/gateway');
const { ApolloServer } = require('apollo-server');

const gateway = new ApolloGateway({
  serviceList: [
    { name: 'devices', url: 'http://devices-service:4001' },
    { name: 'threats', url: 'http://threats-service:4002' },
    { name: 'users', url: 'http://users-service:4003' },
  ],
});

const server = new ApolloServer({ gateway, subscriptions: false });
server.listen(4000);

// Devices service schema (partial)
type Device @key(fields: "id") {
  id: ID!
  name: String!
  os: String!
  userId: ID!
}

// Users service schema (extends Device)
type Device @key(fields: "id") {
  id: ID!
  user: User!
}

extend type User @key(fields: "id") {
  id: ID! @external
  devices: [Device!]!
}

const { ApolloServer } = require('apollo-server');
const { costAnalysis } = require('graphql-cost-analysis');

const server = new ApolloServer({
  typeDefs,
  resolvers,
  validationRules: [
    depthLimit(7),               // Max query depth
    costAnalysis({
      maximumCost: 1000,         // Max query cost
      defaultCost: 1,
      costMap: {
        // Set higher costs for expensive fields
        "Device.threats": 10,
        "User.devices": 5,
      },
    }),
  ],
});

// Simple subscription server
const { ApolloServer, gql, PubSub } = require('apollo-server');
const pubsub = new PubSub();

const typeDefs = gql`
  type Threat { id: ID! name: String! }
  type Query { threats: [Threat!]! }
  type Mutation { addThreat(name: String!): Threat! }
  type Subscription { threatAdded: Threat! }
`;

const resolvers = {
  Query: { threats: () => [] },
  Mutation: {
    addThreat: (_, { name }) => {
      const threat = { id: String(Date.now()), name };
      pubsub.publish('THREAT_ADDED', { threatAdded: threat });
      return threat;
    },
  },
  Subscription: {
    threatAdded: { subscribe: () => pubsub.asyncIterator('THREAT_ADDED') },
  },
};

new ApolloServer({ typeDefs, resolvers }).listen(4000);