GraphQL API Design

• · GQ1 — Every relation-fetching resolver uses batching (DataLoader or equivalent) to prevent N+1 query patterns.
• · GQ2 — Query depth and complexity are bounded (max depth, cost-based limiting) so no client query can trigger unbounded server work.
• · GQ3 — Field-level authorization is enforced in resolvers, matching OWASP API3 — not assumed from a top-level auth check alone.
• · GQ4 — Schema models the domain/client needs, not a 1:1 mirror of database tables.
• · GQ5 — Deprecated fields are marked @deprecated with a reason and migration path, not silently removed.

• · A resolver calling db.findOne() inside a .map() over parent items → N+1 candidate, batch it.
• · No query depth limit configured → any client can send an intentionally deeply nested query; add one before production traffic.
• · A schema type mirroring a database table's exact columns including internal fields → check if it should be reshaped for client needs and internal-field-hidden.
• · Mutation returning just {success: true} instead of the updated object → clients will need a follow-up query; return the object.

• · N+1 resolver — fetching related data per-item in a loop instead of batched, tanking performance on any list query.
• · Unbounded query depth — no limit on nested query depth, allowing a trivially crafted deeply-nested query to exhaust server resources (API4).
• · Database-mirror schema — GraphQL types that are literally the database schema, leaking internal fields and coupling the API to internal storage structure.
• · Auth-check-once — verifying authentication at the gateway but trusting every resolver to return only authorized data with no field-level check.
• · Introspection open in production — full schema introspection enabled publicly, handing attackers a complete map of the API surface.

• [ ] Relation resolvers batched (no N+1). (GR1)
• [ ] Query depth/complexity limits enforced. (GR2)
• [ ] Field-level authorization checked in resolvers. (GR3)
• [ ] Schema doesn't leak internal-only database fields. (GR4)
• [ ] Deprecated fields marked with reason before removal. (GR5)
• [ ] Mutations return affected object data. (GR6)

• GraphQL Specification

Este pack cita las siguientes fuentes registradas en el índice bibliográfico:

• webDataLoader
• webGraphQL SpecificationGraphQL Foundation