GraphQL SPQR: id shall not be shown at creation

Question

I use GraphQL SPQR with the entity

@Entity
public class MyEntity {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private UUID id;

    @GraphQLNonNull
    @GraphQLQuery(name = "a", description = "Any field")
    private String a;

    // Getters and Setters
}

and the service

@Service
@Transactional
public class MyService {

    @Autowired
    private MyRepository myRepository;

    @GraphQLMutation(name = "createEntity")
    public MyEntity createEntity(@GraphQLArgument(name = "entity") MyEntity entity) {
        myRepository.save(entity);
        return entity;
    }
}

In GraphiQL I am allowed to set the id:

mutation {
  createEntity(entity: {
    id: "11111111-2222-3333-4444-555555555555"
    a: "any value"
  }) {
    id
  }
}

But the id shall not be made editable to the user because it will be overwritten by the DB. It shall only be shown at the queries. I tried and added @GraphQLIgnore, but the id is shown all the same.

How can I hide the id at creation?

kaqqao · Accepted Answer · 2019-01-03T15:06:26.580

In GraphQL-SPQR version 0.9.9 and earlier, the private members are not scanned at all, so annotations on the private fields don't normally do anything. Incidentally, Jackson (or Gson, if so configured) is used to discover the deserializable fields on input types, and those libraries do look at private fields, so some annotations will appear to be working for input types. This is what is happening in your case. But, @GraphQLIgnore is not among the annotations that will work on a private field.

What you need to do is move the annotations to getters and setters.

@Entity
public class MyEntity {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private UUID id; 

    @GraphQLIgnore //This will prevent ID from being mapped on the input type
    //@JsonIgnore would likely work too
    public void setId(UUID id) {...}
}

There's other ways to achieve this, but this is the most straight-forward.

Note: In the future versions of SPQR (post 0.9.9), it will be possible to place the annotations on private fields as well, but mixing (placing some annotations on a field and some on the related getter/setter) will not work.

GraphQL SPQR: id shall not be shown at creation

1 Answers1