# ===== SCALAR TYPES (built-in primitives) =====
# Int     - Signed 32-bit integer
# Float   - Signed double-precision floating-point
# String  - UTF-8 character sequence
# Boolean - true or false
# ID      - Unique identifier (serialized as String)

# ===== CUSTOM SCALAR (for types not built-in) =====
scalar DateTime  # You define how this is serialized/parsed
scalar JSON

# ===== ENUM (fixed set of values) =====
enum Role {
  USER
  ADMIN
  MODERATOR
}

# ===== ENUM for status =====
enum PostStatus {
  DRAFT
  PUBLISHED
  ARCHIVED
}

# ===== OBJECT TYPE (the main building block) =====
type User {
  id: ID!             # ! means non-nullable (required)
  name: String!
  email: String!
  role: Role!
  avatar: String        # No ! means nullable (optional)
  posts: [Post!]!       # Non-null list of non-null Posts
  createdAt: DateTime!
}

type Post {
  id: ID!
  title: String!
  body: String!
  status: PostStatus!
  author: User!        # Relationship back to User
  comments: [Comment!]!
  tags: [String!]!
  createdAt: DateTime!
}

type Comment {
  id: ID!
  text: String!
  author: User!
  post: Post!
  createdAt: DateTime!
}

# ===== INPUT TYPE (for mutations) =====
# Input types are used for arguments. You can't use
# regular types as arguments — this is by design
# to separate "read shape" from "write shape"
input CreatePostInput {
  title: String!
  body: String!
  tags: [String!]
}

input UpdatePostInput {
  title: String       # All optional for partial updates
  body: String
  tags: [String!]
}

# ===== INTERFACE (shared fields) =====
interface Node {
  id: ID!
}

interface Timestamped {
  createdAt: DateTime!
  updatedAt: DateTime!
}

# ===== UNION TYPE (either this or that) =====
union SearchResult = User | Post | Comment

# ===== THE ROOT TYPES =====
type Query {
  # These are the "read" entry points
  user(id: ID!): User
  users(limit: Int, offset: Int): [User!]!
  post(id: ID!): Post
  posts(status: PostStatus): [Post!]!
  search(query: String!): [SearchResult!]!
}

type Mutation {
  # These are the "write" entry points
  createPost(input: CreatePostInput!): Post!
  updatePost(id: ID!, input: UpdatePostInput!): Post!
  deletePost(id: ID!): Boolean!
  register(email: String!, password: String!, name: String!): AuthPayload!
  login(email: String!, password: String!): AuthPayload!
}

type Subscription {
  # These are the "real-time" entry points
  postCreated: Post!
  commentAdded(postId: ID!): Comment!
}

type AuthPayload {
  token: String!
  user: User!
}

# The Connection pattern
type Query {
  posts(
    first: Int        # Number of items to fetch
    after: String     # Cursor: "fetch items AFTER this cursor"
    last: Int         # For backward pagination
    before: String    # Cursor: "fetch items BEFORE this cursor"
  ): PostConnection!
}

# The Connection type wraps the data + pagination info
type PostConnection {
  edges: [PostEdge!]!
  pageInfo: PageInfo!
  totalCount: Int!    # Optional but useful
}

# Each Edge wraps a node + its cursor
type PostEdge {
  node: Post!           # The actual data
  cursor: String!      # Opaque cursor for this item
}

# Pagination metadata
type PageInfo {
  hasNextPage: Boolean!
  hasPreviousPage: Boolean!
  startCursor: String
  endCursor: String
}

# Client usage: get first 10 posts
query {
  posts(first: 10) {
    edges {
      node {
        id
        title
      }
      cursor
    }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
}

# Next page: use the endCursor from previous response
query {
  posts(first: 10, after: "Y3Vyc29yXzEw") {
    edges {
      node {
        id
        title
      }
    }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
}

# BAD: Returns just a boolean
type Mutation {
  createPost(input: CreatePostInput!): Boolean!
  # Client has no data to update cache with!
}

# GOOD: Returns the created entity + possible errors
type Mutation {
  createPost(input: CreatePostInput!): CreatePostPayload!
}

type CreatePostPayload {
  post: Post            # The created post (null on error)
  errors: [UserError!]!  # Business logic errors
}

type UserError {
  field: [String!]!     # Path to the field: ["input", "title"]
  message: String!      # Human-readable error
  code: ErrorCode!      # Machine-readable error code
}

enum ErrorCode {
  VALIDATION_ERROR
  NOT_FOUND
  UNAUTHORIZED
  DUPLICATE
}

# Built-in directives
query UserProfile($withPosts: Boolean!, $skipAvatar: Boolean!) {
  user(id: 1) {
    name
    avatar @skip(if: $skipAvatar)       # Skip this field if true
    posts @include(if: $withPosts) {  # Include only if true
      title
    }
  }
}

# Schema directives (custom)
directive @auth(requires: Role!) on FIELD_DEFINITION
directive @deprecated(reason: String) on FIELD_DEFINITION

type User {
  email: String! @auth(requires: ADMIN)     # Only admins see email
  username: String! @deprecated(reason: "Use name instead")
}

# === 1. Basic Query ===
query {
  users {
    id
    name
  }
}

# === 2. Named Query with Variables ===
# Naming queries is a best practice for:
# - Debugging (shows in network tab & server logs)
# - Caching (Apollo uses operation name)
# - APQ (Automatic Persisted Queries)
query GetUser($userId: ID!) {
  user(id: $userId) {
    id
    name
    email
  }
}
# Variables (sent as separate JSON):
# { "userId": "123" }

# === 3. Aliases (query same field multiple times) ===
query TwoUsers {
  firstUser: user(id: "1") {
    name
  }
  secondUser: user(id: "2") {
    name
  }
}
# Returns: { firstUser: { name: "..." }, secondUser: { name: "..." } }

# === 4. Fragments (reusable field sets) ===
fragment UserFields on User {
  id
  name
  email
  avatar
}

query Dashboard {
  me {
    ...UserFields           # Spread the fragment
    posts {
      title
      author {
        ...UserFields       # Reuse same fragment
      }
    }
  }
}

# === 5. Inline Fragments (for unions/interfaces) ===
query Search($q: String!) {
  search(query: $q) {
    # SearchResult = User | Post | Comment
    ... on User {
      name
      avatar
    }
    ... on Post {
      title
      body
    }
    ... on Comment {
      text
    }
  }
}

# === Create ===
mutation CreatePost($input: CreatePostInput!) {
  createPost(input: $input) {
    post {
      id
      title
      body
      author {
        name
      }
    }
    errors {
      field
      message
    }
  }
}
# Variables:
# {
#   "input": {
#     "title": "My First Post",
#     "body": "Hello World!",
#     "tags": ["graphql", "tutorial"]
#   }
# }

# === Update ===
mutation UpdatePost($id: ID!, $input: UpdatePostInput!) {
  updatePost(id: $id, input: $input) {
    post {
      id
      title     # Returns updated data for cache update
    }
    errors {
      field
      message
    }
  }
}

# === Delete ===
mutation DeletePost($id: ID!) {
  deletePost(id: $id) {
    success
    errors {
      message
    }
  }
}

# === Multiple mutations in one request ===
# They execute SEQUENTIALLY (in order), unlike queries
mutation BatchOps {
  first: createPost(input: { title: "A", body: "..." }) {
    post { id }
  }
  second: createPost(input: { title: "B", body: "..." }) {
    post { id }
  }
}

# Client subscribes to new comments on a post
subscription OnCommentAdded($postId: ID!) {
  commentAdded(postId: $postId) {
    id
    text
    author {
      name
      avatar
    }
    createdAt
  }
}

# Server pushes this shape every time
# a new comment is added to that post

// Every resolver function has this signature:
const resolver = (
  parent,   // Result from the PARENT resolver
              // (also called "root" or "obj")
              // For top-level Query/Mutation: undefined
              // For nested fields: the parent object

  args,     // Arguments passed to this field
              // e.g., user(id: "1") => args = { id: "1" }

  context,  // Shared across ALL resolvers in a request
              // Common: { db, user, loaders, req }
              // Set once per request in server setup

  info      // AST of the query + schema info
              // Advanced: used for optimizations like
              // checking which fields were requested
) => {
  // Return data (or a Promise)
};

// Given this query:
// query {
//   user(id: "1") {     ← Query.user resolver
//     name              ← User.name resolver (often default)
//     posts {           ← User.posts resolver
//       title           ← Post.title resolver (often default)
//       author {        ← Post.author resolver
//         name          ← User.name resolver (often default)
//       }
//     }
//   }
// }

const resolvers = {
  // Step 1: Top-level query resolver
  Query: {
    user: async (parent, args, context) => {
      // parent is undefined for root queries
      // args = { id: "1" }
      return await context.db.user.findUnique({
        where: { id: args.id }
      });
      // Returns: { id: "1", name: "Yatin", email: "..." }
      // This return value becomes "parent" for child resolvers
    },
  },

  // Step 2: User type resolvers
  User: {
    // "name" doesn't need a resolver!
    // GraphQL has a DEFAULT resolver that does:
    // (parent) => parent["name"]
    // So if parent.name exists, it just works.

    // "posts" DOES need a resolver because it's a relationship
    posts: async (parent, args, context) => {
      // parent = the user object from step 1
      // parent = { id: "1", name: "Yatin", email: "..." }
      return await context.db.post.findMany({
        where: { authorId: parent.id }
      });
      // Returns: [{ id: "101", title: "...", authorId: "1" }, ...]
    },
  },

  // Step 3: Post type resolvers
  Post: {
    // "title" uses default resolver: parent.title

    author: async (parent, args, context) => {
      // parent = a single post from step 2
      // parent = { id: "101", title: "...", authorId: "1" }
      return await context.db.user.findUnique({
        where: { id: parent.authorId }
      });
    },
  },
};

# Initialize project
mkdir graphql-api && cd graphql-api
npm init -y

# Core dependencies
npm install @apollo/server graphql express cors

# Database (Prisma ORM)
npm install prisma @prisma/client
npx prisma init

# Authentication
npm install jsonwebtoken bcryptjs

# Performance
npm install dataloader

# Subscriptions (real-time)
npm install graphql-ws ws graphql-subscriptions

# Dev dependencies
npm install -D nodemon typescript @types/node ts-node

graphql-api/
├── prisma/
│   └── schema.prisma          # Database schema
├── src/
│   ├── index.js               # Server entry point
│   ├── schema/
│   │   ├── typeDefs.js        # GraphQL schema definitions
│   │   └── resolvers/
│   │       ├── index.js       # Merge all resolvers
│   │       ├── userResolver.js
│   │       ├── postResolver.js
│   │       └── commentResolver.js
│   ├── middleware/
│   │   └── auth.js            # JWT authentication
│   ├── utils/
│   │   ├── dataLoaders.js     # DataLoader setup
│   │   └── errors.js          # Custom error classes
│   └── context.js             # Context builder
├── .env
└── package.json

// prisma/schema.prisma
// This defines your DATABASE tables.
// Prisma generates a type-safe client from this.

generator client {
  provider = "prisma-client-js"
}

datasource db {
  provider = "postgresql"  // or "mysql", "sqlite"
  url      = env("DATABASE_URL")
}

model User {
  id        String   @id @default(cuid())
  email     String   @unique
  password  String             // Hashed, never exposed in GraphQL
  name      String
  role      Role     @default(USER)
  avatar    String?           // ? means nullable
  posts     Post[]             // One-to-many relation
  comments  Comment[]
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt
}

model Post {
  id        String     @id @default(cuid())
  title     String
  body      String
  status    PostStatus @default(DRAFT)
  tags      String[]
  author    User       @relation(fields: [authorId], references: [id])
  authorId  String
  comments  Comment[]
  createdAt DateTime   @default(now())
  updatedAt DateTime   @updatedAt

  @@index([authorId])  // Index for faster lookups
}

model Comment {
  id        String   @id @default(cuid())
  text      String
  author    User     @relation(fields: [authorId], references: [id])
  authorId  String
  post      Post     @relation(fields: [postId], references: [id])
  postId    String
  createdAt DateTime @default(now())

  @@index([postId])
  @@index([authorId])
}

enum Role {
  USER
  ADMIN
  MODERATOR
}

enum PostStatus {
  DRAFT
  PUBLISHED
  ARCHIVED
}

// src/schema/typeDefs.js
// This is where we define our GraphQL schema using SDL.
// The `gql` tag parses the string into an AST that Apollo understands.

const typeDefs = `#graphql
  # ===== Custom Scalars =====
  scalar DateTime

  # ===== Enums =====
  enum Role {
    USER
    ADMIN
    MODERATOR
  }

  enum PostStatus {
    DRAFT
    PUBLISHED
    ARCHIVED
  }

  enum SortOrder {
    ASC
    DESC
  }

  # ===== Types =====
  type User {
    id: ID!
    name: String!
    email: String!
    role: Role!
    avatar: String
    posts(limit: Int, offset: Int): [Post!]!
    postCount: Int!
    createdAt: DateTime!
  }

  type Post {
    id: ID!
    title: String!
    body: String!
    status: PostStatus!
    tags: [String!]!
    author: User!
    comments: [Comment!]!
    commentCount: Int!
    createdAt: DateTime!
    updatedAt: DateTime!
  }

  type Comment {
    id: ID!
    text: String!
    author: User!
    post: Post!
    createdAt: DateTime!
  }

  # ===== Pagination Types =====
  type PageInfo {
    hasNextPage: Boolean!
    hasPreviousPage: Boolean!
    startCursor: String
    endCursor: String
  }

  type PostEdge {
    node: Post!
    cursor: String!
  }

  type PostConnection {
    edges: [PostEdge!]!
    pageInfo: PageInfo!
    totalCount: Int!
  }

  # ===== Input Types =====
  input CreatePostInput {
    title: String!
    body: String!
    tags: [String!]
    status: PostStatus
  }

  input UpdatePostInput {
    title: String
    body: String
    tags: [String!]
    status: PostStatus
  }

  input RegisterInput {
    name: String!
    email: String!
    password: String!
  }

  input LoginInput {
    email: String!
    password: String!
  }

  input PostFilters {
    status: PostStatus
    authorId: ID
    tag: String
    search: String
  }

  # ===== Payload Types (Mutation Responses) =====
  type AuthPayload {
    token: String!
    user: User!
  }

  type PostPayload {
    post: Post
    errors: [UserError!]!
  }

  type DeletePayload {
    success: Boolean!
    errors: [UserError!]!
  }

  type UserError {
    field: [String!]!
    message: String!
  }

  # ===== Queries (Read Operations) =====
  type Query {
    # User queries
    me: User                              # Current logged-in user
    user(id: ID!): User                   # Get user by ID
    users(limit: Int, offset: Int): [User!]!

    # Post queries
    post(id: ID!): Post
    posts(
      filters: PostFilters
      first: Int
      after: String
      orderBy: SortOrder
    ): PostConnection!
  }

  # ===== Mutations (Write Operations) =====
  type Mutation {
    # Auth
    register(input: RegisterInput!): AuthPayload!
    login(input: LoginInput!): AuthPayload!

    # Posts (require authentication)
    createPost(input: CreatePostInput!): PostPayload!
    updatePost(id: ID!, input: UpdatePostInput!): PostPayload!
    deletePost(id: ID!): DeletePayload!

    # Comments
    addComment(postId: ID!, text: String!): Comment!
  }

  # ===== Subscriptions (Real-time) =====
  type Subscription {
    postCreated: Post!
    commentAdded(postId: ID!): Comment!
  }
`;

module.exports = { typeDefs };

// src/middleware/auth.js
// Extracts and verifies the JWT token from the request header.
// This runs on EVERY request to build the context object.

const jwt = require('jsonwebtoken');

// This function extracts the user from the JWT token.
// It does NOT throw if there's no token — some queries are public.
// Authorization (who can do what) happens in the resolvers.
function getUser(token) {
  if (!token) return null;

  try {
    // Remove "Bearer " prefix if present
    const cleanToken = token.startsWith('Bearer ')
      ? token.slice(7)
      : token;

    // jwt.verify() does two things:
    // 1. Checks the signature (was this token created by us?)
    // 2. Checks expiration (is the token still valid?)
    const decoded = jwt.verify(cleanToken, process.env.JWT_SECRET);
    return decoded; // { userId: "...", role: "..." }
  } catch (err) {
    return null; // Invalid/expired token = no user
  }
}

// Helper to generate tokens
function generateToken(user) {
  return jwt.sign(
    {
      userId: user.id,
      role: user.role,
    },
    process.env.JWT_SECRET,
    { expiresIn: '7d' } // Token expires in 7 days
  );
}

// Helper: throw if not authenticated
function requireAuth(context) {
  if (!context.user) {
    throw new GraphQLError('Authentication required', {
      extensions: { code: 'UNAUTHENTICATED' },
    });
  }
  return context.user;
}

module.exports = { getUser, generateToken, requireAuth };

// src/utils/dataLoaders.js
// DataLoader batches and caches database queries within a single request.
// Instead of N individual queries, it batches them into 1 query.
//
// WITHOUT DataLoader (N+1 problem):
//   SELECT * FROM users WHERE id = '1'
//   SELECT * FROM users WHERE id = '2'
//   SELECT * FROM users WHERE id = '3'  ... N queries!
//
// WITH DataLoader (batched):
//   SELECT * FROM users WHERE id IN ('1', '2', '3')  ... 1 query!

const DataLoader = require('dataloader');

// IMPORTANT: Create new DataLoader instances PER REQUEST
// because the cache should not leak between requests.
function createLoaders(prisma) {
  return {
    // User loader: batch-fetch users by their IDs
    user: new DataLoader(async (userIds) => {
      // userIds = ['1', '2', '3'] (collected from all resolvers)

      // One query fetches all users
      const users = await prisma.user.findMany({
        where: { id: { in: [...userIds] } },
      });

      // CRITICAL: DataLoader requires results in the SAME ORDER
      // as the input IDs. If a user is not found, return null.
      const userMap = new Map(users.map(u => [u.id, u]));
      return userIds.map(id => userMap.get(id) || null);
    }),

    // Posts by author loader
    postsByAuthor: new DataLoader(async (authorIds) => {
      const posts = await prisma.post.findMany({
        where: { authorId: { in: [...authorIds] } },
      });

      // Group posts by authorId
      const postsByAuthor = {};
      posts.forEach(post => {
        if (!postsByAuthor[post.authorId]) {
          postsByAuthor[post.authorId] = [];
        }
        postsByAuthor[post.authorId].push(post);
      });

      return authorIds.map(id => postsByAuthor[id] || []);
    }),

    // Comment count by post loader
    commentCountByPost: new DataLoader(async (postIds) => {
      const counts = await prisma.comment.groupBy({
        by: ['postId'],
        where: { postId: { in: [...postIds] } },
        _count: { id: true },
      });

      const countMap = new Map(
        counts.map(c => [c.postId, c._count.id])
      );
      return postIds.map(id => countMap.get(id) || 0);
    }),
  };
}

module.exports = { createLoaders };

// src/schema/resolvers/index.js
// Complete resolver implementation with explanations.

const { GraphQLError } = require('graphql');
const bcrypt = require('bcryptjs');
const { generateToken, requireAuth } = require('../../middleware/auth');
const { PubSub } = require('graphql-subscriptions');

// PubSub for subscriptions (use Redis-based in production!)
const pubsub = new PubSub();

const resolvers = {

  // ==========================================
  // CUSTOM SCALAR: DateTime
  // ==========================================
  DateTime: {
    // How to serialize (server -> client)
    serialize(value) {
      return value.toISOString();
    },
    // How to parse from variable (client -> server)
    parseValue(value) {
      return new Date(value);
    },
  },

  // ==========================================
  // QUERIES (Read Operations)
  // ==========================================
  Query: {
    // Get the currently logged-in user
    me: async (_parent, _args, context) => {
      // context.user was set by our auth middleware
      if (!context.user) return null;
      return context.prisma.user.findUnique({
        where: { id: context.user.userId },
      });
    },

    // Get user by ID
    user: async (_parent, { id }, { prisma }) => {
      // Destructuring: { id } from args, { prisma } from context
      return prisma.user.findUnique({ where: { id } });
    },

    // List users with basic pagination
    users: async (_parent, { limit = 10, offset = 0 }, { prisma }) => {
      return prisma.user.findMany({
        take: Math.min(limit, 50), // Cap at 50 to prevent abuse
        skip: offset,
        orderBy: { createdAt: 'desc' },
      });
    },

    // Get single post
    post: async (_parent, { id }, { prisma }) => {
      return prisma.post.findUnique({ where: { id } });
    },

    // Get posts with cursor-based pagination + filters
    posts: async (_parent, args, { prisma }) => {
      const {
        filters = {},
        first = 10,
        after,
        orderBy = 'DESC',
      } = args;

      // Build WHERE clause from filters
      const where = {};
      if (filters.status) where.status = filters.status;
      if (filters.authorId) where.authorId = filters.authorId;
      if (filters.tag) where.tags = { has: filters.tag };
      if (filters.search) {
        where.OR = [
          { title: { contains: filters.search, mode: 'insensitive' } },
          { body: { contains: filters.search, mode: 'insensitive' } },
        ];
      }

      // Cursor-based pagination with Prisma
      const queryArgs = {
        where,
        take: Math.min(first, 50) + 1, // +1 to check hasNextPage
        orderBy: { createdAt: orderBy.toLowerCase() },
      };

      if (after) {
        // Decode cursor (base64-encoded ID)
        const decodedCursor = Buffer.from(after, 'base64').toString();
        queryArgs.cursor = { id: decodedCursor };
        queryArgs.skip = 1; // Skip the cursor item itself
      }

      const [posts, totalCount] = await Promise.all([
        prisma.post.findMany(queryArgs),
        prisma.post.count({ where }),
      ]);

      // Check if we got more than requested (means there's a next page)
      const hasNextPage = posts.length > first;
      const edges = posts.slice(0, first).map(post => ({
        node: post,
        // Cursor = base64-encoded ID (opaque to client)
        cursor: Buffer.from(post.id).toString('base64'),
      }));

      return {
        edges,
        pageInfo: {
          hasNextPage,
          hasPreviousPage: !!after,
          startCursor: edges[0]?.cursor || null,
          endCursor: edges[edges.length - 1]?.cursor || null,
        },
        totalCount,
      };
    },
  },

  // ==========================================
  // MUTATIONS (Write Operations)
  // ==========================================
  Mutation: {
    // Register a new user
    register: async (_parent, { input }, { prisma }) => {
      const { name, email, password } = input;

      // Check if email already exists
      const existingUser = await prisma.user.findUnique({
        where: { email },
      });
      if (existingUser) {
        throw new GraphQLError('Email already in use', {
          extensions: { code: 'BAD_USER_INPUT' },
        });
      }

      // Hash the password (NEVER store plain text!)
      // bcrypt adds a random salt automatically
      const hashedPassword = await bcrypt.hash(password, 12);

      // Create the user
      const user = await prisma.user.create({
        data: { name, email, password: hashedPassword },
      });

      // Generate JWT and return
      const token = generateToken(user);
      return { token, user };
    },

    // Login
    login: async (_parent, { input }, { prisma }) => {
      const { email, password } = input;

      const user = await prisma.user.findUnique({
        where: { email },
      });

      if (!user) {
        throw new GraphQLError('Invalid credentials', {
          extensions: { code: 'UNAUTHENTICATED' },
        });
      }

      // Compare provided password with stored hash
      const validPassword = await bcrypt.compare(password, user.password);
      if (!validPassword) {
        throw new GraphQLError('Invalid credentials', {
          extensions: { code: 'UNAUTHENTICATED' },
        });
      }

      const token = generateToken(user);
      return { token, user };
    },

    // Create a new post (requires auth)
    createPost: async (_parent, { input }, context) => {
      const authUser = requireAuth(context);

      try {
        const post = await context.prisma.post.create({
          data: {
            title: input.title,
            body: input.body,
            tags: input.tags || [],
            status: input.status || 'DRAFT',
            authorId: authUser.userId,
          },
        });

        // Publish event for subscriptions
        pubsub.publish('POST_CREATED', { postCreated: post });

        return { post, errors: [] };
      } catch (error) {
        return {
          post: null,
          errors: [{
            field: ['input'],
            message: error.message,
          }],
        };
      }
    },

    // Update a post (only author or admin)
    updatePost: async (_parent, { id, input }, context) => {
      const authUser = requireAuth(context);

      // Check ownership
      const post = await context.prisma.post.findUnique({
        where: { id },
      });

      if (!post) {
        return {
          post: null,
          errors: [{ field: ['id'], message: 'Post not found' }],
        };
      }

      // Authorization: only author or admin can update
      if (post.authorId !== authUser.userId && authUser.role !== 'ADMIN') {
        throw new GraphQLError('Not authorized', {
          extensions: { code: 'FORBIDDEN' },
        });
      }

      // Build update data (only include provided fields)
      const data = {};
      if (input.title !== undefined) data.title = input.title;
      if (input.body !== undefined) data.body = input.body;
      if (input.tags !== undefined) data.tags = input.tags;
      if (input.status !== undefined) data.status = input.status;

      const updated = await context.prisma.post.update({
        where: { id },
        data,
      });

      return { post: updated, errors: [] };
    },

    // Delete a post
    deletePost: async (_parent, { id }, context) => {
      const authUser = requireAuth(context);

      const post = await context.prisma.post.findUnique({
        where: { id },
      });

      if (!post) {
        return {
          success: false,
          errors: [{ field: ['id'], message: 'Post not found' }],
        };
      }

      if (post.authorId !== authUser.userId && authUser.role !== 'ADMIN') {
        throw new GraphQLError('Not authorized', {
          extensions: { code: 'FORBIDDEN' },
        });
      }

      // Delete comments first (cascade), then post
      await context.prisma.comment.deleteMany({ where: { postId: id } });
      await context.prisma.post.delete({ where: { id } });

      return { success: true, errors: [] };
    },

    // Add a comment
    addComment: async (_parent, { postId, text }, context) => {
      const authUser = requireAuth(context);

      const comment = await context.prisma.comment.create({
        data: {
          text,
          postId,
          authorId: authUser.userId,
        },
      });

      // Publish for real-time subscriptions
      pubsub.publish(`COMMENT_ADDED_${postId}`, {
        commentAdded: comment,
      });

      return comment;
    },
  },

  // ==========================================
  // SUBSCRIPTIONS (Real-time)
  // ==========================================
  Subscription: {
    postCreated: {
      // subscribe returns an AsyncIterator
      subscribe: () => pubsub.asyncIterableIterator(['POST_CREATED']),
    },
    commentAdded: {
      subscribe: (_parent, { postId }) => {
        return pubsub.asyncIterableIterator([`COMMENT_ADDED_${postId}`]);
      },
    },
  },

  // ==========================================
  // TYPE RESOLVERS (Nested Field Resolution)
  // ==========================================

  // These resolve fields that don't directly exist on the
  // database model (relationships, computed fields).

  User: {
    // Resolve the "posts" field on a User
    posts: (parent, { limit = 10, offset = 0 }, { loaders }) => {
      // Use DataLoader to batch this!
      return loaders.postsByAuthor.load(parent.id);
    },

    // Computed field: count of user's posts
    postCount: async (parent, _args, { prisma }) => {
      return prisma.post.count({
        where: { authorId: parent.id },
      });
    },
  },

  Post: {
    // Resolve the "author" field on a Post
    author: (parent, _args, { loaders }) => {
      // parent.authorId exists on the Post record
      // DataLoader batches all author lookups into one query
      return loaders.user.load(parent.authorId);
    },

    // Resolve the "comments" field on a Post
    comments: (parent, _args, { prisma }) => {
      return prisma.comment.findMany({
        where: { postId: parent.id },
        orderBy: { createdAt: 'desc' },
      });
    },

    // Computed field: comment count (uses DataLoader)
    commentCount: (parent, _args, { loaders }) => {
      return loaders.commentCountByPost.load(parent.id);
    },
  },

  Comment: {
    author: (parent, _args, { loaders }) => {
      return loaders.user.load(parent.authorId);
    },
    post: (parent, _args, { prisma }) => {
      return prisma.post.findUnique({
        where: { id: parent.postId },
      });
    },
  },
};

module.exports = { resolvers, pubsub };

// src/index.js
// This is the main server file that ties everything together.

const { ApolloServer } = require('@apollo/server');
const { expressMiddleware } = require('@apollo/server/express4');
const {
  ApolloServerPluginDrainHttpServer,
} = require('@apollo/server/plugin/drainHttpServer');
const express = require('express');
const http = require('http');
const cors = require('cors');
const { WebSocketServer } = require('ws');
const { useServer } = require('graphql-ws/lib/use/ws');
const { makeExecutableSchema } = require('@graphql-tools/schema');
const { PrismaClient } = require('@prisma/client');

const { typeDefs } = require('./schema/typeDefs');
const { resolvers } = require('./schema/resolvers');
const { getUser } = require('./middleware/auth');
const { createLoaders } = require('./utils/dataLoaders');

// Initialize Prisma Client (database connection)
const prisma = new PrismaClient({
  log: ['query'], // Log SQL queries in development
});

async function startServer() {
  // 1. Create Express app and HTTP server
  const app = express();
  const httpServer = http.createServer(app);

  // 2. Create executable schema (combines typeDefs + resolvers)
  const schema = makeExecutableSchema({ typeDefs, resolvers });

  // 3. Set up WebSocket server for subscriptions
  const wsServer = new WebSocketServer({
    server: httpServer,
    path: '/graphql',      // Same path as HTTP endpoint
  });
  const serverCleanup = useServer(
    {
      schema,
      // Context for subscription connections
      context: async (ctx) => {
        const token = ctx.connectionParams?.authorization;
        const user = getUser(token);
        return { user, prisma, loaders: createLoaders(prisma) };
      },
    },
    wsServer
  );

  // 4. Create Apollo Server
  const server = new ApolloServer({
    schema,
    plugins: [
      // Graceful shutdown for HTTP server
      ApolloServerPluginDrainHttpServer({ httpServer }),
      // Graceful shutdown for WebSocket server
      {
        async serverWillStart() {
          return {
            async drainServer() {
              await serverCleanup.dispose();
            },
          };
        },
      },
    ],
    // Format errors for the client
    formatError(formattedError, error) {
      // Don't expose internal errors in production
      if (process.env.NODE_ENV === 'production') {
        if (formattedError.extensions?.code === 'INTERNAL_SERVER_ERROR') {
          return { message: 'Internal server error' };
        }
      }
      return formattedError;
    },
  });

  // 5. Start Apollo Server
  await server.start();

  // 6. Mount middleware
  app.use(
    '/graphql',
    cors({
      origin: ['http://localhost:3000', 'https://yourdomain.com'],
      credentials: true,
    }),
    express.json({ limit: '10mb' }),
    expressMiddleware(server, {
      // CONTEXT FUNCTION: runs on EVERY request
      // This is where we set up everything resolvers need
      context: async ({ req }) => {
        // Extract JWT from Authorization header
        const token = req.headers.authorization || '';
        const user = getUser(token);

        return {
          // Current authenticated user (or null)
          user,
          // Prisma client for database queries
          prisma,
          // DataLoaders (fresh per request!)
          loaders: createLoaders(prisma),
          // Raw request (for IP, headers, etc.)
          req,
        };
      },
    })
  );

  // 7. Health check endpoint (for load balancers)
  app.get('/health', (_req, res) => {
    res.json({ status: 'ok' });
  });

  // 8. Start listening
  const PORT = process.env.PORT || 4000;
  httpServer.listen(PORT, () => {
    console.log(`Server ready at http://localhost:${PORT}/graphql`);
    console.log(`Subscriptions at ws://localhost:${PORT}/graphql`);
  });
}

// Start the server
startServer().catch(console.error);

# Database
DATABASE_URL="postgresql://user:password@localhost:5432/graphql_db"

# Auth
JWT_SECRET="your-super-secret-key-change-in-production"

# Server
PORT=4000
NODE_ENV=development

# Create React app
npx create-react-app graphql-client
# OR with Vite (recommended)
npm create vite@latest graphql-client -- --template react

# Install Apollo Client
npm install @apollo/client graphql

// src/lib/apolloClient.js
// Apollo Client is the brain of GraphQL on the frontend.
// It handles: sending queries, caching, real-time, and state management.

import {
  ApolloClient,
  InMemoryCache,
  createHttpLink,
  split,
} from '@apollo/client';
import { setContext } from '@apollo/client/link/context';
import { GraphQLWsLink } from '@apollo/client/link/subscriptions';
import { getMainDefinition } from '@apollo/client/utilities';
import { createClient } from 'graphql-ws';

// ===== HTTP Link (for queries & mutations) =====
const httpLink = createHttpLink({
  uri: 'http://localhost:4000/graphql',
});

// ===== Auth Link (adds JWT to every request) =====
const authLink = setContext((_, { headers }) => {
  // Read token from localStorage
  const token = localStorage.getItem('token');
  return {
    headers: {
      ...headers,
      // If token exists, add it to the Authorization header
      authorization: token ? `Bearer ${token}` : '',
    },
  };
});

// ===== WebSocket Link (for subscriptions) =====
const wsLink = new GraphQLWsLink(
  createClient({
    url: 'ws://localhost:4000/graphql',
    connectionParams: {
      // Send auth token through WebSocket connection
      authorization: localStorage.getItem('token') || '',
    },
  })
);

// ===== Split Link (routes to HTTP or WS based on operation) =====
const splitLink = split(
  ({ query }) => {
    const definition = getMainDefinition(query);
    return (
      definition.kind === 'OperationDefinition' &&
      definition.operation === 'subscription'
    );
  },
  wsLink,      // Subscriptions go through WebSocket
  authLink.concat(httpLink)  // Everything else goes through HTTP
);

// ===== Apollo Client Instance =====
const client = new ApolloClient({
  link: splitLink,

  // InMemoryCache is a normalized cache.
  // It stores data by __typename + id, so if you fetch
  // the same user in two different queries, it's stored once.
  cache: new InMemoryCache({
    typePolicies: {
      Query: {
        fields: {
          // Custom merge for paginated queries
          posts: {
            keyArgs: ['filters'], // Cache separately per filter
            merge(existing, incoming, { args }) {
              if (!args?.after) return incoming; // Fresh query
              // Merge edges for infinite scroll
              return {
                ...incoming,
                edges: [...(existing?.edges || []), ...incoming.edges],
              };
            },
          },
        },
      },
    },
  }),

  // Default options for all queries
  defaultOptions: {
    watchQuery: {
      // fetchPolicy determines where data comes from:
      // 'cache-first' - check cache, then network (default)
      // 'network-only' - always hit the network
      // 'cache-and-network' - return cache, then update from network
      // 'cache-only' - only use cache
      fetchPolicy: 'cache-and-network',
    },
  },
});

export default client;

// src/graphql/operations.js
// Define all GraphQL operations in one place.
// The `gql` tag parses these strings into document ASTs.

import { gql } from '@apollo/client';

// ===== FRAGMENTS (reusable field sets) =====
export const USER_FIELDS = gql`
  fragment UserFields on User {
    id
    name
    email
    avatar
    role
  }
`;

export const POST_FIELDS = gql`
  fragment PostFields on Post {
    id
    title
    body
    status
    tags
    commentCount
    createdAt
    author {
      ...UserFields
    }
  }
  ${USER_FIELDS}
`;

// ===== QUERIES =====
export const GET_ME = gql`
  query GetMe {
    me {
      ...UserFields
    }
  }
  ${USER_FIELDS}
`;

export const GET_POSTS = gql`
  query GetPosts($first: Int, $after: String, $filters: PostFilters) {
    posts(first: $first, after: $after, filters: $filters) {
      edges {
        node {
          ...PostFields
        }
        cursor
      }
      pageInfo {
        hasNextPage
        endCursor
      }
      totalCount
    }
  }
  ${POST_FIELDS}
`;

export const GET_POST = gql`
  query GetPost($id: ID!) {
    post(id: $id) {
      ...PostFields
      comments {
        id
        text
        createdAt
        author {
          ...UserFields
        }
      }
    }
  }
  ${POST_FIELDS}
`;

// ===== MUTATIONS =====
export const LOGIN = gql`
  mutation Login($input: LoginInput!) {
    login(input: $input) {
      token
      user {
        ...UserFields
      }
    }
  }
  ${USER_FIELDS}
`;

export const CREATE_POST = gql`
  mutation CreatePost($input: CreatePostInput!) {
    createPost(input: $input) {
      post {
        ...PostFields
      }
      errors {
        field
        message
      }
    }
  }
  ${POST_FIELDS}
`;

export const DELETE_POST = gql`
  mutation DeletePost($id: ID!) {
    deletePost(id: $id) {
      success
      errors {
        field
        message
      }
    }
  }
`;

// ===== SUBSCRIPTIONS =====
export const COMMENT_ADDED = gql`
  subscription OnCommentAdded($postId: ID!) {
    commentAdded(postId: $postId) {
      id
      text
      createdAt
      author {
        ...UserFields
      }
    }
  }
  ${USER_FIELDS}
`;

// src/App.jsx
import { ApolloProvider } from '@apollo/client';
import client from './lib/apolloClient';
import PostList from './components/PostList';

// ApolloProvider makes the client available to all components
// via React Context. Similar to Redux's Provider.
function App() {
  return (
    <ApolloProvider client={client}>
      <div className="app">
        <h1>My Blog</h1>
        <PostList />
      </div>
    </ApolloProvider>
  );
}

// src/components/PostList.jsx
// Demonstrates: useQuery, loading/error states, pagination

import { useQuery } from '@apollo/client';
import { GET_POSTS } from '../graphql/operations';

function PostList() {
  // useQuery automatically:
  // 1. Sends the query when component mounts
  // 2. Returns loading/error/data states
  // 3. Re-renders when data changes
  // 4. Caches the result
  const { loading, error, data, fetchMore } = useQuery(GET_POSTS, {
    variables: {
      first: 10,
      filters: { status: 'PUBLISHED' },
    },
    // notifyOnNetworkStatusChange: true // for loading on fetchMore
  });

  // Loading state (first load)
  if (loading && !data) return <p>Loading...</p>;

  // Error state
  if (error) return <p>Error: {error.message}</p>;

  const { edges, pageInfo, totalCount } = data.posts;

  // Load More handler (cursor-based pagination)
  const handleLoadMore = () => {
    fetchMore({
      variables: {
        after: pageInfo.endCursor, // "Give me items after this cursor"
      },
      // The merge function in cache config handles combining results
    });
  };

  return (
    <div>
      <h2>Posts ({totalCount})</h2>
      {edges.map(({ node: post }) => (
        <article key={post.id}>
          <h3>{post.title}</h3>
          <p>By {post.author.name}</p>
          <p>{post.commentCount} comments</p>
          <div>{post.tags.map(t => <span key={t}>#{t}</span>)}</div>
        </article>
      ))}

      {pageInfo.hasNextPage && (
        <button onClick={handleLoadMore}>
          Load More
        </button>
      )}
    </div>
  );
}

// src/components/CreatePost.jsx
// Demonstrates: useMutation, optimistic UI, cache update

import { useState } from 'react';
import { useMutation } from '@apollo/client';
import { CREATE_POST, GET_POSTS } from '../graphql/operations';

function CreatePost() {
  const [title, setTitle] = useState('');
  const [body, setBody] = useState('');

  // useMutation returns: [mutationFunction, { data, loading, error }]
  const [createPost, { loading, error }] = useMutation(CREATE_POST, {
    // OPTION 1: refetchQueries - simple but slower
    // Refetches the posts list after mutation completes
    // refetchQueries: [{ query: GET_POSTS }],

    // OPTION 2: update - manual cache update (faster, more control)
    update(cache, { data: { createPost: result } }) {
      if (!result.post) return; // Don't update cache on error

      // Read existing posts from cache
      const existing = cache.readQuery({
        query: GET_POSTS,
        variables: { first: 10, filters: { status: 'PUBLISHED' } },
      });

      if (existing) {
        // Write updated data to cache
        cache.writeQuery({
          query: GET_POSTS,
          variables: { first: 10, filters: { status: 'PUBLISHED' } },
          data: {
            posts: {
              ...existing.posts,
              edges: [
                { node: result.post, cursor: btoa(result.post.id) },
                ...existing.posts.edges,
              ],
              totalCount: existing.posts.totalCount + 1,
            },
          },
        });
      }
    },

    // OPTION 3: Optimistic Response (instant UI update)
    // Shows the new post immediately, before server responds.
    // If the mutation fails, Apollo reverts the optimistic update.
    optimisticResponse: {
      createPost: {
        __typename: 'PostPayload',
        post: {
          __typename: 'Post',
          id: 'temp-id-' + Date.now(), // Temporary ID
          title,
          body,
          status: 'DRAFT',
          tags: [],
          commentCount: 0,
          createdAt: new Date().toISOString(),
          author: {
            __typename: 'User',
            id: 'current-user-id',
            name: 'You',
            email: '',
            avatar: null,
            role: 'USER',
          },
        },
        errors: [],
      },
    },
  });

  const handleSubmit = async (e) => {
    e.preventDefault();
    try {
      await createPost({
        variables: {
          input: { title, body },
        },
      });
      setTitle('');
      setBody('');
    } catch (err) {
      console.error('Failed to create post:', err);
    }
  };

  return (
    <form onSubmit={handleSubmit}>
      <input
        value={title}
        onChange={e => setTitle(e.target.value)}
        placeholder="Post title"
        required
      />
      <textarea
        value={body}
        onChange={e => setBody(e.target.value)}
        placeholder="Post body"
        required
      />
      <button type="submit" disabled={loading}>
        {loading ? 'Creating...' : 'Create Post'}
      </button>
      {error && <p className="error">{error.message}</p>}
    </form>
  );
}

// src/components/PostComments.jsx
// Demonstrates: useSubscription for real-time updates

import { useQuery, useSubscription } from '@apollo/client';
import { GET_POST, COMMENT_ADDED } from '../graphql/operations';

function PostComments({ postId }) {
  // Fetch initial comments
  const { data } = useQuery(GET_POST, {
    variables: { id: postId },
  });

  // Subscribe to new comments in real-time
  useSubscription(COMMENT_ADDED, {
    variables: { postId },
    // onData fires every time the server pushes a new comment
    onData({ client, data: subData }) {
      const newComment = subData.data.commentAdded;

      // Update the cache with the new comment
      const existing = client.cache.readQuery({
        query: GET_POST,
        variables: { id: postId },
      });

      if (existing) {
        client.cache.writeQuery({
          query: GET_POST,
          variables: { id: postId },
          data: {
            post: {
              ...existing.post,
              comments: [newComment, ...existing.post.comments],
            },
          },
        });
      }
    },
  });

  return (
    <div>
      <h3>Comments</h3>
      {data?.post?.comments.map(comment => (
        <div key={comment.id}>
          <strong>{comment.author.name}</strong>
          <p>{comment.text}</p>
        </div>
      ))}
    </div>
  );
}

// PATTERN 1: Direct in resolver (simple)
const resolvers = {
  Mutation: {
    deleteUser: (_, { id }, context) => {
      if (!context.user) throw new AuthenticationError('Login required');
      if (context.user.role !== 'ADMIN') throw new ForbiddenError('Admin only');
      // ... delete user
    },
  },
};

// PATTERN 2: Schema directive (scalable, used in production)
// In schema: type Mutation { deleteUser(id: ID!): User @auth(requires: ADMIN) }
// A directive transformer checks the role before the resolver runs.

// PATTERN 3: Middleware layer (using graphql-shield)
const { shield, rule, allow, deny } = require('graphql-shield');

const isAuthenticated = rule()((_, __, ctx) => ctx.user !== null);
const isAdmin = rule()((_, __, ctx) => ctx.user?.role === 'ADMIN');
const isOwner = rule()((_, { id }, ctx) => ctx.user?.userId === id);

const permissions = shield({
  Query: {
    me: isAuthenticated,
    users: isAdmin,
  },
  Mutation: {
    createPost: isAuthenticated,
    deletePost: isOwner,
  },
});

{
  // Data can be PARTIALLY present even with errors!
  "data": {
    "user": {
      "name": "Yatin",
      "email": null   // This field errored
    }
  },
  "errors": [
    {
      "message": "Not authorized to view email",
      "locations": [{ "line": 4, "column": 5 }],
      "path": ["user", "email"],  // Which field errored
      "extensions": {
        "code": "FORBIDDEN",        // Machine-readable error code
        "timestamp": "2024-01-15T10:30:00Z"
      }
    }
  ]
}

const { GraphQLError } = require('graphql');

// Standard error codes that Apollo/clients understand:
// GRAPHQL_PARSE_FAILED    - Query syntax error
// GRAPHQL_VALIDATION_FAILED - Query doesn't match schema
// BAD_USER_INPUT          - Invalid argument values
// UNAUTHENTICATED         - Not logged in
// FORBIDDEN               - Logged in but not authorized
// PERSISTED_QUERY_NOT_FOUND
// INTERNAL_SERVER_ERROR   - Catch-all

throw new GraphQLError('Post not found', {
  extensions: {
    code: 'NOT_FOUND',
    argumentName: 'id',
    // Add any extra context you want
  },
});

// A malicious query could look like this:
// query {
//   users {
//     posts {
//       author {
//         posts {
//           author {
//             posts { ... 50 levels deep ... }
//           }
//         }
//       }
//     }
//   }
// }

// Solution 1: Depth limiting
const depthLimit = require('graphql-depth-limit');

const server = new ApolloServer({
  validationRules: [depthLimit(7)], // Max 7 levels deep
});

// Solution 2: Query complexity analysis
const { createComplexityLimitRule } = require('graphql-validation-complexity');

const server = new ApolloServer({
  validationRules: [
    createComplexityLimitRule(1000), // Max complexity score of 1000
  ],
});

// Without APQ (every request):
// POST /graphql
// Body: { query: "query GetUser($id: ID!) { user(id: $id) { name email ... } }" }
// ^^ This string can be HUGE for complex queries

// With APQ (first request sends hash + query, subsequent just hash):
// POST /graphql
// Body: { extensions: { persistedQuery: { sha256Hash: "abc123..." } } }
// ^^ Much smaller payload

// Client setup:
import { createPersistedQueryLink } from '@apollo/client/link/persisted-queries';
import { sha256 } from 'crypto-hash';

const link = createPersistedQueryLink({ sha256 }).concat(httpLink);

                    ┌─────────────┐
                    │   Clients   │
                    │ Web/Mobile  │
                    └──────┬──────┘
                           │
                    ┌──────▼──────┐
                    │     CDN     │  ← APQ cache, static assets
                    │ CloudFront  │
                    └──────┬──────┘
                           │
                    ┌──────▼──────┐
                    │    Load     │  ← Rate limiting, WAF
                    │  Balancer   │
                    └──────┬──────┘
                           │
              ┌────────────┼────────────┐
              │            │            │
        ┌─────▼────┐ ┌────▼─────┐ ┌────▼─────┐
        │ GraphQL  │ │ GraphQL  │ │ GraphQL  │  ← Multiple instances
        │ Server 1 │ │ Server 2 │ │ Server 3 │     (horizontal scaling)
        └─────┬────┘ └────┬─────┘ └────┬─────┘
              │            │            │
              └────────────┼────────────┘
                           │
           ┌───────────────┼───────────────┐
           │               │               │
     ┌─────▼────┐   ┌─────▼────┐   ┌──────▼─────┐
     │ Postgres │   │  Redis   │   │ Upstream   │
     │    DB    │   │  Cache   │   │ REST APIs  │
     └──────────┘   └──────────┘   └────────────┘

// ===== 1. HTTP Caching (CDN-level) =====
// For public queries, you can use GET requests + HTTP cache headers
// Apollo Server supports this for queries (not mutations)

// In schema, add cache hints:
// type User @cacheControl(maxAge: 300) {
//   name: String!     # Inherits 300s
//   email: String! @cacheControl(maxAge: 0) # Never cache
// }

// ===== 2. Server-side Redis Cache =====
const Redis = require('ioredis');
const redis = new Redis();

// In resolver:
async function getUser(id) {
  // Check Redis first
  const cached = await redis.get(`user:${id}`);
  if (cached) return JSON.parse(cached);

  // Not in cache, fetch from DB
  const user = await prisma.user.findUnique({ where: { id } });

  // Store in Redis with TTL (Time To Live)
  await redis.setex(`user:${id}`, 300, JSON.stringify(user)); // 5 min

  return user;
}

// ===== 3. Client-side (Apollo Cache) =====
// Already covered in the React section.
// Apollo's InMemoryCache is a normalized cache that
// deduplicates entities by __typename + id.

// __tests__/posts.test.js
const { ApolloServer } = require('@apollo/server');
const { typeDefs } = require('../src/schema/typeDefs');
const { resolvers } = require('../src/schema/resolvers');

// Create a test server
const testServer = new ApolloServer({ typeDefs, resolvers });

describe('Posts API', () => {
  it('should fetch published posts', async () => {
    const result = await testServer.executeOperation(
      {
        query: `
          query GetPosts($first: Int) {
            posts(first: $first) {
              edges {
                node { id title }
              }
              totalCount
            }
          }
        `,
        variables: { first: 5 },
      },
      {
        // Provide mock context
        contextValue: {
          prisma: mockPrisma,
          user: { userId: '1', role: 'USER' },
          loaders: mockLoaders,
        },
      }
    );

    // Assert
    expect(result.body.singleResult.errors).toBeUndefined();
    expect(result.body.singleResult.data.posts.edges.length)
      .toBeLessThanOrEqual(5);
  });

  it('should require auth for createPost', async () => {
    const result = await testServer.executeOperation(
      {
        query: `
          mutation { createPost(input: { title: "Test", body: "..." }) {
            post { id } errors { message }
          }}
        `,
      },
      {
        contextValue: {
          prisma: mockPrisma,
          user: null,  // No auth!
          loaders: mockLoaders,
        },
      }
    );

    // Should get UNAUTHENTICATED error
    expect(result.body.singleResult.errors[0].extensions.code)
      .toBe('UNAUTHENTICATED');
  });
});

import { render, screen } from '@testing-library/react';
import { MockedProvider } from '@apollo/client/testing';
import PostList from './PostList';
import { GET_POSTS } from '../graphql/operations';

const mocks = [
  {
    request: {
      query: GET_POSTS,
      variables: { first: 10, filters: { status: 'PUBLISHED' } },
    },
    result: {
      data: {
        posts: {
          edges: [
            {
              node: {
                id: '1',
                title: 'Test Post',
                // ... all required fields
              },
              cursor: 'abc',
            },
          ],
          pageInfo: { hasNextPage: false, endCursor: 'abc' },
          totalCount: 1,
        },
      },
    },
  },
];

test('renders posts', async () => {
  render(
    <MockedProvider mocks={mocks} addTypename={false}>
      <PostList />
    </MockedProvider>
  );

  // Wait for data to load
  const post = await screen.findByText('Test Post');
  expect(post).toBeInTheDocument();
});

                    ┌─────────────┐
                    │   Client    │  Sees ONE unified schema
                    └──────┬──────┘
                           │
                    ┌──────▼──────┐
                    │   Apollo    │  The "router" that composes
                    │   Gateway   │  subgraphs into one API
                    └──────┬──────┘
                           │
          ┌────────────────┼────────────────┐
          │                │                │
    ┌─────▼────┐    ┌─────▼────┐    ┌──────▼─────┐
    │  Users   │    │  Posts   │    │ Comments   │
    │ Subgraph │    │ Subgraph │    │ Subgraph   │
    │ (Team A) │    │ (Team B) │    │ (Team C)   │
    └──────────┘    └──────────┘    └────────────┘

# Users subgraph (owned by Team A)
type User @key(fields: "id") {
  id: ID!
  name: String!
  email: String!
}

type Query {
  user(id: ID!): User
}

# Posts subgraph (owned by Team B)
# Can EXTEND the User type from another subgraph!
type User @key(fields: "id") {
  id: ID!
  posts: [Post!]!   # Team B adds posts to User
}

type Post @key(fields: "id") {
  id: ID!
  title: String!
  author: User!
}