yosef-ali / fullstack-react-graphql-typescript

Fullstack react graphql typescript twitter clone

GraphQL Server with Authentication & Permissions

This example shows how to implement a GraphQL server with TypeScript with the following stack:

• Apollo Server: HTTP server for GraphQL APIs
• GraphQL Nexus: GraphQL schema definition and resolver implementation
• GraphQL Shield: Authorization/permission layer for GraphQL schemas
• Prisma Client: Databases access (ORM)
• Prisma Migrate: Database migrations
• SQLite: Local, file-based SQL database

Contents

• Getting Started
• Using the GraphQL API
• Evolving the app
• Switch to another database (e.g. PostgreSQL, MySQL, SQL Server)
• Next steps

Getting started

1. Download example and install dependencies

Download this example:

curl https://codeload.github.com/prisma/prisma-examples/tar.gz/latest | tar -xz --strip=2 prisma-examples-latest/typescript/graphql-auth

Install npm dependencies:

cd graphql-auth
npm install

Alternative: Clone the entire repo

Clone this repository:

git clone [email protected]:prisma/prisma-examples.git --depth=1

Install npm dependencies:

cd prisma-examples/typescript/graphql-auth
npm install

2. Create and seed the database

Run the following command to create your SQLite database file. This also creates the User and Post tables that are defined in prisma/schema.prisma:

npx prisma migrate dev --name init

When npx prisma migrate dev is executed against a newly created database, seeding is also triggered. The seed file in prisma/seed.ts will be executed and your database will be populated with the sample data.

3. Start the GraphQL server

Launch your GraphQL server with this command:

npm run dev

Navigate to http://localhost:4000 in your browser to explore the API of your GraphQL server in a GraphQL Playground.

Using the GraphQL API

The schema that specifies the API operations of your GraphQL server is defined in ./schema.graphql. Below are a number of operations that you can send to the API using the GraphQL Playground.

Feel free to adjust any operation by adding or removing fields. The GraphQL Playground helps you with its auto-completion and query validation features.

Retrieve all published posts and their authors

query {
  feed {
    id
    title
    content
    published
    author {
      id
      name
      email
    }
  }
}

See more API operations

Register a new user

You can send the following mutation in the Playground to sign up a new user and retrieve an authentication token for them:

mutation {
  signup(name: "Sarah", email: "[email protected]", password: "HelloWorld42") {
    token
  }
}

Log in an existing user

This mutation will log in an existing user by requesting a new authentication token for them.

mutation {
  login(email: "[email protected]", password: "HelloWorld42") {
    token
  }
}

If you seeded the database with sample data in step 2. of this README, you can use the following email and password combinations (from prisma/seed.ts) for the login mutation as well:

Email	Password
[email protected]	myPassword42
[email protected]	random42
[email protected]	iLikeTurtles42

Check whether a user is currently logged in with the me query

For this query, you need to make sure a valid authentication token is sent along with the Bearer-prefix in the Authorization header of the request:

{
  "Authorization": "Bearer __YOUR_TOKEN__"
}

With a real token, this looks similar to this:

{
  "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiJjanAydHJyczFmczE1MGEwM3kxaWl6c285IiwiaWF0IjoxNTQzNTA5NjY1fQ.Vx6ad6DuXA0FSQVyaIngOHYVzjKwbwq45flQslnqX04"
}

Inside the Playground, you can set HTTP headers in the bottom-left corner:

Once you've set the header, you can send the following query to check whether the token is valid:

{
  me {
    id
    name
    email
  }
}

Create a new draft

You need to be logged in for this query to work, i.e. an authentication token that was retrieved through a signup or login mutation needs to be added to the Authorization header in the GraphQL Playground.

mutation {
  createDraft(
    data: {
      title: "Join the Prisma Slack"
      content: "https://slack.prisma.io"
    }
  ) {
    id
    published
  }
}

Publish an existing post

You need to be logged in for this query to work, i.e. an authentication token that was retrieved through a signup or login mutation needs to be added to the Authorization header in the GraphQL Playground. The authentication token must belong to the user who created the post.

mutation {
  togglePublishPost(id: __POST_ID__) {
    id
    published
  }
}

Note that you need to replace the __POST_ID__ placeholder with an actual id from a Post record in the database, e.g.5:

mutation {
  togglePublishPost(id: 5) {
    id
    published
  }
}

Search for posts with a specific title or content

{
  feed(
    searchString: "prisma"
  ) {
    id
    title
    content
    published
  }
}

Retrieve a single post

You need to be logged in for this query to work, i.e. an authentication token that was retrieved through a signup or login mutation needs to be added to the Authorization header in the GraphQL Playground.

{
  postById(id: __POST_ID__ ) {
    id
    title
    content
    published
  }
}

Note that you need to replace the __POST_ID__ placeholder with an actual id from a Post record in the database, e.g.5:

{
  postById(id: 5 ) {
    id
    title
    content
    published
  }
}

Delete a post

You need to be logged in for this query to work, i.e. an authentication token that was retrieved through a signup or login mutation needs to be added to the Authorization header in the GraphQL Playground. The authentication token must belong to the user who created the post.

mutation {
  deletePost(id: __POST_ID__) {
    id
  }
}

Note that you need to replace the __POST_ID__ placeholder with an actual id from a Post record in the database, e.g.5:

mutation {
  deletePost(id: 5) {
    id
  }
}

Retrieve the drafts of a user

You need to be logged in for this query to work, i.e. an authentication token that was retrieved through a signup or login mutation needs to be added to the Authorization header in the GraphQL Playground.

{
  draftsByUser(
    userUniqueInput: {
      email: "[email protected]"
    }
  ) {
    id
    title
    content
    published
    author {
      id
      name
      email
    }
  }
}

Authenticating GraphQL requests

In this example, you authenticate your GraphQL requests using the Authorization header field of the HTTP requests which are sent from clients to your GraphQL server. The required authentication token is returned by successful signup and login mutations.

Using the GraphQL Playground, the Authorization header can be configured in the HTTP HEADERS tab in the bottom-left corner of the GraphQL Playground. The values for the HTTP headers are defined in JSON format. Note that the authentication token needs to be sent with the Bearer -prefix:

{
  "Authorization": "Bearer __YOUR_TOKEN__"
}

With a "real" authentication token, it looks similar to this:

{
  "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiJjanAydHJyczFmczE1MGEwM3kxaWl6c285IiwiaWF0IjoxNTQzNTA5NjY1fQ.Vx6ad6DuXA0FSQVyaIngOHYVzjKwbwq45flQslnqX04"
}

As mentioned before, you can set HTTP headers in the bottom-left corner of the GraphQL Playground:

Authorization rules

The following authorization rules are defined for the GraphQL API via GraphQL Shield:

Operation name	Operation type	Rule	Description
me	Query	isAuthenticatedUser	Requires a user to be authenticated
draftsByUser	Query	isAuthenticatedUser	Requires a user to be authenticated
postById	Query	isAuthenticatedUser	Requires a user to be authenticated
createDraft	Mutation	isAuthenticatedUser	Requires a user to be authenticated
deletePost	Mutation	isPostOwner	Requires the authenticated user to be the author of the post to be deleted
incrementPostViewCount	Mutation	isAuthenticatedUser	Requires a user to be authenticated
togglePublishPost	Mutation	isPostOwner	Requires the authenticated user to be the author of the post to be published/unpublished

The isAuthenticatedUser rule requires you to send a valid authentication token. The isPostOwner rule additionaly requires the user to whom this authentication token belongs to be the author of the post on which the operation is applied.

Evolving the app

Evolving the application typically requires two steps:

1. Migrate your database using Prisma Migrate
2. Update your application code

For the following example scenario, assume you want to add a "profile" feature to the app where users can create a profile and write a short bio about themselves.

1. Migrate your database using Prisma Migrate

The first step is to add a new table, e.g. called Profile, to the database. You can do this by adding a new model to your Prisma schema file file and then running a migration afterwards:

// ./prisma/schema.prisma

model User {
  id      Int      @default(autoincrement()) @id
  name    String?
  email   String   @unique
  posts   Post[]
+ profile Profile?
}

model Post {
  id        Int      @id @default(autoincrement())
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt
  title     String
  content   String?
  published Boolean  @default(false)
  viewCount Int      @default(0)
  author    User?    @relation(fields: [authorId], references: [id])
  authorId  Int?
}

+model Profile {
+  id     Int     @default(autoincrement()) @id
+  bio    String?
+  user   User    @relation(fields: [userId], references: [id])
+  userId Int     @unique
+}

Once you've updated your data model, you can execute the changes against your database with the following command:

npx prisma migrate dev --name add-profile

This adds another migration to the prisma/migrations directory and creates the new Profile table in the database.

2. Update your application code

You can now use your PrismaClient instance to perform operations against the new Profile table. Those operations can be used to implement queries and mutations in the GraphQL API.

2.1. Add the Profile type to your GraphQL schema

First, add a new GraphQL type via Nexus' objectType function:

// ./src/schema.ts

+const Profile = objectType({
+  name: 'Profile',
+  definition(t) {
+    t.nonNull.int('id')
+    t.string('bio')
+    t.field('user', {
+      type: 'User',
+      resolve: (parent, _, context) => {
+        return context.prisma.profile
+          .findUnique({
+            where: { id: parent.id || undefined },
+          })
+          .user()
+      },
+    })
+  },
+})

const User = objectType({
  name: 'User',
  definition(t) {
    t.nonNull.int('id')
    t.string('name')
    t.nonNull.string('email')
    t.nonNull.list.nonNull.field('posts', {
      type: 'Post',
      resolve: (parent, _, context) => {
        return context.prisma.user
          .findUnique({
            where: { id: parent.id || undefined },
          })
          .posts()
      },
+   t.field('profile', {
+     type: 'Profile',
+     resolve: (parent, _, context) => {
+       return context.prisma.user.findUnique({
+         where: { id: parent.id }
+       }).profile()
+     }
+   })
  },
})

Don't forget to include the new type in the types array that's passed to makeSchema:

export const schema = makeSchema({
  types: [
    Query,
    Mutation,
    Post,
    User,
+   Profile,
    UserUniqueInput,
    UserCreateInput,
    PostCreateInput,
    PostOrderBy,
    DateTime,
  ],
  // ... as before
}

Note that in order to resolve any type errors, your development server needs to be running so that the Nexus types can be generated. If it's not running, you can start it with npm run dev.

2.2. Add a createProfile GraphQL mutation

// ./src/schema.ts

const Mutation = objectType({
  name: 'Mutation',
  definition(t) {

    // other mutations

+   t.field('addProfileForUser', {
+     type: 'Profile',
+     args: {
+       userUniqueInput: nonNull(
+         arg({
+           type: 'UserUniqueInput',
+         }),
+       ),
+       bio: stringArg()
+     }, 
+     resolve: async (_, args, context) => {
+       return context.prisma.profile.create({
+         data: {
+           bio: args.bio,
+           user: {
+             connect: {
+               id: args.userUniqueInput.id || undefined,
+               email: args.userUniqueInput.email || undefined,
+             }
+           }
+         }
+       })
+     }
+   })

  }
})

Finally, you can test the new mutation like this:

mutation {
  addProfileForUser(
    userUniqueInput: {
      email: "[email protected]"
    }
    bio: "I like turtles"
  ) {
    id
    bio
    user {
      id
      name
    }
  }
}

Expand to view more sample Prisma Client queries on Profile

Here are some more sample Prisma Client queries on the new Profile model:

Create a new profile for an existing user

const profile = await prisma.profile.create({
  data: {
    bio: 'Hello World',
    user: {
      connect: { email: '[email protected]' },
    },
  },
})

Create a new user with a new profile

const user = await prisma.user.create({
  data: {
    email: '[email protected]',
    name: 'John',
    profile: {
      create: {
        bio: 'Hello World',
      },
    },
  },
})

Update the profile of an existing user

const userWithUpdatedProfile = await prisma.user.update({
  where: { email: '[email protected]' },
  data: {
    profile: {
      update: {
        bio: 'Hello Friends',
      },
    },
  },
})

Switch to another database (e.g. PostgreSQL, MySQL, SQL Server, MongoDB)

If you want to try this example with another database than SQLite, you can adjust the the database connection in prisma/schema.prisma by reconfiguring the datasource block.

Learn more about the different connection configurations in the docs.

Expand for an overview of example configurations with different databases

PostgreSQL

For PostgreSQL, the connection URL has the following structure:

datasource db {
  provider = "postgresql"
  url      = "postgresql://USER:PASSWORD@HOST:PORT/DATABASE?schema=SCHEMA"
}

Here is an example connection string with a local PostgreSQL database:

datasource db {
  provider = "postgresql"
  url      = "postgresql://janedoe:mypassword@localhost:5432/notesapi?schema=public"
}

MySQL

For MySQL, the connection URL has the following structure:

datasource db {
  provider = "mysql"
  url      = "mysql://USER:PASSWORD@HOST:PORT/DATABASE"
}

Here is an example connection string with a local MySQL database:

datasource db {
  provider = "mysql"
  url      = "mysql://janedoe:mypassword@localhost:3306/notesapi"
}

Microsoft SQL Server

Here is an example connection string with a local Microsoft SQL Server database:

datasource db {
  provider = "sqlserver"
  url      = "sqlserver://localhost:1433;initial catalog=sample;user=sa;password=mypassword;"
}

MongoDB

Here is an example connection string with a local MongoDB database:

datasource db {
  provider = "mongodb"
  url      = "mongodb://USERNAME:PASSWORD@HOST/DATABASE?authSource=admin&retryWrites=true&w=majority"
}

Because MongoDB is currently in Preview, you need to specify the previewFeatures on your generator block:

generator client {
  provider        = "prisma-client-js"
  previewFeatures = ["mongodb"]
}

Next steps

• Check out the Prisma docs
• Share your feedback in the prisma2 channel on the Prisma Slack
• Create issues and ask questions on GitHub
• Watch our biweekly "What's new in Prisma" livestreams on Youtube

Fullstack-react-graphql-typescript