@giraphql/plugin-auth outdated peer depency about pothos

[hayes]

thanks for reporting. Looks like I made a bad assumption about how lerna works. I've update peerDeps across all the plugins, and released a new patch version of each. It doesn't look like there is a good workaround built into lerna currently, and their reasoning for not updating peerDepenencies makes sense.

The current setup will work until 2.0 but may not be as strict as it should be. I'll need to spend some more time looking into this.

[hayes]

Warning was more about the upcoming breaking change

[hayes]

Based on some discussions I've had with other people, I have removed peerDeps entirely in 2.0.

[hayes]

@gmencz one related thing I should mention. The current auth plugin has some significant (and hard to overcome) performance issues. It's probably fine for a lot of use cases, and has been used in some fairly complex apps, but it does add a bit of latency, and if your app is CPU bound rather than io bound, might be a bottle neck.

Because of these issues, the auth plugin will be completely replaced in v2.0 with a substantially different API. Most use cases that were covered by the current plugin should still be supported, but migrating a large number of auth checks may be somewhat time consuming. I am going to be working on implementing that plugin tomorrow.

There is a (slightly outdated) proposal doc for the new API here: https://github.com/hayes/giraphql/blob/02faee15de3c22953583d5d16fd22cddfb677f9e/docs/plugins/auth-v2.md and start of the implementation (more up to date) in #31

[gmencz]

Awesome, I haven't had any performance issues with it yet but it makes sense since the app I'm working on isn't heavy on the CPU, good to know though.

[hayes]

The root of the issue is that with the current approach requires 4+ awaits/async operations per field, even if the field does not have any auth, or do anything async itself. This overhead can add a few milliseconds to each request. If you are resolving less that 10k fields per second, you probably won't have any real issues