# ===== SCALAR TYPES (built-in primitives) =====
# Int     - Signed 32-bit integer
# Float   - Signed double-precision floating-point
# String  - UTF-8 character sequence
# Boolean - true or false
# ID      - Unique identifier (serialized as String)

# ===== CUSTOM SCALAR (for types not built-in) =====
scalar DateTime  # You define how this is serialized/parsed
scalar JSON

# ===== ENUM (fixed set of values) =====
enum Role {
  USER
  ADMIN
  MODERATOR
}

# ===== ENUM for status =====
enum PostStatus {
  DRAFT
  PUBLISHED
  ARCHIVED
}

# ===== OBJECT TYPE (the main building block) =====
type User {
  id: ID!             # ! means non-nullable (required)
  name: String!
  email: String!
  role: Role!
  avatar: String        # No ! means nullable (optional)
  posts: [Post!]!       # Non-null list of non-null Posts
  createdAt: DateTime!
}

type Post {
  id: ID!
  title: String!
  body: String!
  status: PostStatus!
  author: User!        # Relationship back to User
  comments: [Comment!]!
  tags: [String!]!
  createdAt: DateTime!
}

type Comment {
  id: ID!
  text: String!
  author: User!
  post: Post!
  createdAt: DateTime!
}

# ===== INPUT TYPE (for mutations) =====
# Input types are used for arguments. You can't use
# regular types as arguments — this is by design
# to separate "read shape" from "write shape"
input CreatePostInput {
  title: String!
  body: String!
  tags: [String!]
}

input UpdatePostInput {
  title: String       # All optional for partial updates
  body: String
  tags: [String!]
}

# ===== INTERFACE (shared fields) =====
interface Node {
  id: ID!
}

interface Timestamped {
  createdAt: DateTime!
  updatedAt: DateTime!
}

# ===== UNION TYPE (either this or that) =====
union SearchResult = User | Post | Comment

# ===== THE ROOT TYPES =====
type Query {
  # These are the "read" entry points
  user(id: ID!): User
  users(limit: Int, offset: Int): [User!]!
  post(id: ID!): Post
  posts(status: PostStatus): [Post!]!
  search(query: String!): [SearchResult!]!
}

type Mutation {
  # These are the "write" entry points
  createPost(input: CreatePostInput!): Post!
  updatePost(id: ID!, input: UpdatePostInput!): Post!
  deletePost(id: ID!): Boolean!
  register(email: String!, password: String!, name: String!): AuthPayload!
  login(email: String!, password: String!): AuthPayload!
}

type Subscription {
  # These are the "real-time" entry points
  postCreated: Post!
  commentAdded(postId: ID!): Comment!
}

type AuthPayload {
  token: String!
  user: User!
}

# The Connection pattern
type Query {
  posts(
    first: Int        # Number of items to fetch
    after: String     # Cursor: "fetch items AFTER this cursor"
    last: Int         # For backward pagination
    before: String    # Cursor: "fetch items BEFORE this cursor"
  ): PostConnection!
}

# The Connection type wraps the data + pagination info
type PostConnection {
  edges: [PostEdge!]!
  pageInfo: PageInfo!
  totalCount: Int!    # Optional but useful
}

# Each Edge wraps a node + its cursor
type PostEdge {
  node: Post!           # The actual data
  cursor: String!      # Opaque cursor for this item
}

# Pagination metadata
type PageInfo {
  hasNextPage: Boolean!
  hasPreviousPage: Boolean!
  startCursor: String
  endCursor: String
}

# Client usage: get first 10 posts
query {
  posts(first: 10) {
    edges {
      node {
        id
        title
      }
      cursor
    }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
}

# Next page: use the endCursor from previous response
query {
  posts(first: 10, after: "Y3Vyc29yXzEw") {
    edges {
      node {
        id
        title
      }
    }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
}

# BAD: Returns just a boolean
type Mutation {
  createPost(input: CreatePostInput!): Boolean!
  # Client has no data to update cache with!
}

# GOOD: Returns the created entity + possible errors
type Mutation {
  createPost(input: CreatePostInput!): CreatePostPayload!
}

type CreatePostPayload {
  post: Post            # The created post (null on error)
  errors: [UserError!]!  # Business logic errors
}

type UserError {
  field: [String!]!     # Path to the field: ["input", "title"]
  message: String!      # Human-readable error
  code: ErrorCode!      # Machine-readable error code
}

enum ErrorCode {
  VALIDATION_ERROR
  NOT_FOUND
  UNAUTHORIZED
  DUPLICATE
}

# Built-in directives
query UserProfile($withPosts: Boolean!, $skipAvatar: Boolean!) {
  user(id: 1) {
    name
    avatar @skip(if: $skipAvatar)       # Skip this field if true
    posts @include(if: $withPosts) {  # Include only if true
      title
    }
  }
}

# Schema directives (custom)
directive @auth(requires: Role!) on FIELD_DEFINITION
directive @deprecated(reason: String) on FIELD_DEFINITION

type User {
  email: String! @auth(requires: ADMIN)     # Only admins see email
  username: String! @deprecated(reason: "Use name instead")
}

# === 1. Basic Query ===
query {
  users {
    id
    name
  }
}

# === 2. Named Query with Variables ===
# Naming queries is a best practice for:
# - Debugging (shows in network tab & server logs)
# - Caching (Apollo uses operation name)
# - APQ (Automatic Persisted Queries)
query GetUser($userId: ID!) {
  user(id: $userId) {
    id
    name
    email
  }
}
# Variables (sent as separate JSON):
# { "userId": "123" }

# === 3. Aliases (query same field multiple times) ===
query TwoUsers {
  firstUser: user(id: "1") {
    name
  }
  secondUser: user(id: "2") {
    name
  }
}
# Returns: { firstUser: { name: "..." }, secondUser: { name: "..." } }

# === 4. Fragments (reusable field sets) ===
fragment UserFields on User {
  id
  name
  email
  avatar
}

query Dashboard {
  me {
    ...UserFields           # Spread the fragment
    posts {
      title
      author {
        ...UserFields       # Reuse same fragment
      }
    }
  }
}

# === 5. Inline Fragments (for unions/interfaces) ===
query Search($q: String!) {
  search(query: $q) {
    # SearchResult = User | Post | Comment
    ... on User {
      name
      avatar
    }
    ... on Post {
      title
      body
    }
    ... on Comment {
      text
    }
  }
}

# === Create ===
mutation CreatePost($input: CreatePostInput!) {
  createPost(input: $input) {
    post {
      id
      title
      body
      author {
        name
      }
    }
    errors {
      field
      message
    }
  }
}
# Variables:
# {
#   "input": {
#     "title": "My First Post",
#     "body": "Hello World!",
#     "tags": ["graphql", "tutorial"]
#   }
# }

# === Update ===
mutation UpdatePost($id: ID!, $input: UpdatePostInput!) {
  updatePost(id: $id, input: $input) {
    post {
      id
      title     # Returns updated data for cache update
    }
    errors {
      field
      message
    }
  }
}

# === Delete ===
mutation DeletePost($id: ID!) {
  deletePost(id: $id) {
    success
    errors {
      message
    }
  }
}

# === Multiple mutations in one request ===
# They execute SEQUENTIALLY (in order), unlike queries
mutation BatchOps {
  first: createPost(input: { title: "A", body: "..." }) {
    post { id }
  }
  second: createPost(input: { title: "B", body: "..." }) {
    post { id }
  }
}

# Client subscribes to new comments on a post
subscription OnCommentAdded($postId: ID!) {
  commentAdded(postId: $postId) {
    id
    text
    author {
      name
      avatar
    }
    createdAt
  }
}

# Server pushes this shape every time
# a new comment is added to that post

// Every resolver function has this signature:
const resolver = (
  parent,   // Result from the PARENT resolver
              // (also called "root" or "obj")
              // For top-level Query/Mutation: undefined
              // For nested fields: the parent object

  args,     // Arguments passed to this field
              // e.g., user(id: "1") => args = { id: "1" }

  context,  // Shared across ALL resolvers in a request
              // Common: { db, user, loaders, req }
              // Set once per request in server setup

  info      // AST of the query + schema info
              // Advanced: used for optimizations like
              // checking which fields were requested
) => {
  // Return data (or a Promise)
};

// Given this query:
// query {
//   user(id: "1") {     ← Query.user resolver
//     name              ← User.name resolver (often default)
//     posts {           ← User.posts resolver
//       title           ← Post.title resolver (often default)
//       author {        ← Post.author resolver
//         name          ← User.name resolver (often default)
//       }
//     }
//   }
// }

const resolvers = {
  // Step 1: Top-level query resolver
  Query: {
    user: async (parent, args, context) => {
      // parent is undefined for root queries
      // args = { id: "1" }
      return await context.db.user.findUnique({
        where: { id: args.id }
      });
      // Returns: { id: "1", name: "Yatin", email: "..." }
      // This return value becomes "parent" for child resolvers
    },
  },

  // Step 2: User type resolvers
  User: {
    // "name" doesn't need a resolver!
    // GraphQL has a DEFAULT resolver that does:
    // (parent) => parent["name"]
    // So if parent.name exists, it just works.

    // "posts" DOES need a resolver because it's a relationship
    posts: async (parent, args, context) => {
      // parent = the user object from step 1
      // parent = { id: "1", name: "Yatin", email: "..." }
      return await context.db.post.findMany({
        where: { authorId: parent.id }
      });
      // Returns: [{ id: "101", title: "...", authorId: "1" }, ...]
    },
  },

  // Step 3: Post type resolvers
  Post: {
    // "title" uses default resolver: parent.title

    author: async (parent, args, context) => {
      // parent = a single post from step 2
      // parent = { id: "101", title: "...", authorId: "1" }
      return await context.db.user.findUnique({
        where: { id: parent.authorId }
      });
    },
  },
};

# Initialize project
mkdir graphql-api && cd graphql-api
npm init -y

# Core dependencies
npm install @apollo/server graphql express cors

# Database (Prisma ORM)
npm install prisma @prisma/client
npx prisma init

# Authentication
npm install jsonwebtoken bcryptjs

# Performance
npm install dataloader

# Subscriptions (real-time)
npm install graphql-ws ws graphql-subscriptions

# Dev dependencies
npm install -D nodemon typescript @types/node ts-node

graphql-api/
├── prisma/
│   └── schema.prisma          # Database schema
├── src/
│   ├── index.js               # Server entry point
│   ├── schema/
│   │   ├── typeDefs.js        # GraphQL schema definitions
│   │   └── resolvers/
│   │       ├── index.js       # Merge all resolvers
│   │       ├── userResolver.js
│   │       ├── postResolver.js
│   │       └── commentResolver.js
│   ├── middleware/
│   │   └── auth.js            # JWT authentication
│   ├── utils/
│   │   ├── dataLoaders.js     # DataLoader setup
│   │   └── errors.js          # Custom error classes
│   └── context.js             # Context builder
├── .env
└── package.json

// prisma/schema.prisma
// This defines your DATABASE tables.
// Prisma generates a type-safe client from this.

generator client {
  provider = "prisma-client-js"
}

datasource db {
  provider = "postgresql"  // or "mysql", "sqlite"
  url      = env("DATABASE_URL")
}

model User {
  id        String   @id @default(cuid())
  email     String   @unique
  password  String             // Hashed, never exposed in GraphQL
  name      String
  role      Role     @default(USER)
  avatar    String?           // ? means nullable
  posts     Post[]             // One-to-many relation
  comments  Comment[]
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt
}

model Post {
  id        String     @id @default(cuid())
  title     String
  body      String
  status    PostStatus @default(DRAFT)
  tags      String[]
  author    User       @relation(fields: [authorId], references: [id])
  authorId  String
  comments  Comment[]
  createdAt DateTime   @default(now())
  updatedAt DateTime   @updatedAt

  @@index([authorId])  // Index for faster lookups
}

model Comment {
  id        String   @id @default(cuid())
  text      String
  author    User     @relation(fields: [authorId], references: [id])
  authorId  String
  post      Post     @relation(fields: [postId], references: [id])
  postId    String
  createdAt DateTime @default(now())

  @@index([postId])
  @@index([authorId])
}

enum Role {
  USER
  ADMIN
  MODERATOR
}

enum PostStatus {
  DRAFT
  PUBLISHED
  ARCHIVED
}

// src/schema/typeDefs.js
// This is where we define our GraphQL schema using SDL.
// The `gql` tag parses the string into an AST that Apollo understands.

const typeDefs = `#graphql
  # ===== Custom Scalars =====
  scalar DateTime

  # ===== Enums =====
  enum Role {
    USER
    ADMIN
    MODERATOR
  }

  enum PostStatus {
    DRAFT
    PUBLISHED
    ARCHIVED
  }

  enum SortOrder {
    ASC
    DESC
  }

  # ===== Types =====
  type User {
    id: ID!
    name: String!
    email: String!
    role: Role!
    avatar: String
    posts(limit: Int, offset: Int): [Post!]!
    postCount: Int!
    createdAt: DateTime!
  }

  type Post {
    id: ID!
    title: String!
    body: String!
    status: PostStatus!
    tags: [String!]!
    author: User!
    comments: [Comment!]!
    commentCount: Int!
    createdAt: DateTime!
    updatedAt: DateTime!
  }

  type Comment {
    id: ID!
    text: String!
    author: User!
    post: Post!
    createdAt: DateTime!
  }

  # ===== Pagination Types =====
  type PageInfo {
    hasNextPage: Boolean!
    hasPreviousPage: Boolean!
    startCursor: String
    endCursor: String
  }

  type PostEdge {
    node: Post!
    cursor: String!
  }

  type PostConnection {
    edges: [PostEdge!]!
    pageInfo: PageInfo!
    totalCount: Int!
  }

  # ===== Input Types =====
  input CreatePostInput {
    title: String!
    body: String!
    tags: [String!]
    status: PostStatus
  }

  input UpdatePostInput {
    title: String
    body: String
    tags: [String!]
    status: PostStatus
  }

  input RegisterInput {
    name: String!
    email: String!
    password: String!
  }

  input LoginInput {
    email: String!
    password: String!
  }

  input PostFilters {
    status: PostStatus
    authorId: ID
    tag: String
    search: String
  }

  # ===== Payload Types (Mutation Responses) =====
  type AuthPayload {
    token: String!
    user: User!
  }

  type PostPayload {
    post: Post
    errors: [UserError!]!
  }

  type DeletePayload {
    success: Boolean!
    errors: [UserError!]!
  }

  type UserError {
    field: [String!]!
    message: String!
  }

  # ===== Queries (Read Operations) =====
  type Query {
    # User queries
    me: User                              # Current logged-in user
    user(id: ID!): User                   # Get user by ID
    users(limit: Int, offset: Int): [User!]!

    # Post queries
    post(id: ID!): Post
    posts(
      filters: PostFilters
      first: Int
      after: String
      orderBy: SortOrder
    ): PostConnection!
  }

  # ===== Mutations (Write Operations) =====
  type Mutation {
    # Auth
    register(input: RegisterInput!): AuthPayload!
    login(input: LoginInput!): AuthPayload!

    # Posts (require authentication)
    createPost(input: CreatePostInput!): PostPayload!
    updatePost(id: ID!, input: UpdatePostInput!): PostPayload!
    deletePost(id: ID!): DeletePayload!

    # Comments
    addComment(postId: ID!, text: String!): Comment!
  }

  # ===== Subscriptions (Real-time) =====
  type Subscription {
    postCreated: Post!
    commentAdded(postId: ID!): Comment!
  }
`;

module.exports = { typeDefs };

// src/middleware/auth.js
// Extracts and verifies the JWT token from the request header.
// This runs on EVERY request to build the context object.

const jwt = require('jsonwebtoken');

// This function extracts the user from the JWT token.
// It does NOT throw if there's no token — some queries are public.
// Authorization (who can do what) happens in the resolvers.
function getUser(token) {
  if (!token) return null;

  try {
    // Remove "Bearer " prefix if present
    const cleanToken = token.startsWith('Bearer ')
      ? token.slice(7)
      : token;

    // jwt.verify() does two things:
    // 1. Checks the signature (was this token created by us?)
    // 2. Checks expiration (is the token still valid?)
    const decoded = jwt.verify(cleanToken, process.env.JWT_SECRET);
    return decoded; // { userId: "...", role: "..." }
  } catch (err) {
    return null; // Invalid/expired token = no user
  }
}

// Helper to generate tokens
function generateToken(user) {
  return jwt.sign(
    {
      userId: user.id,
      role: user.role,
    },
    process.env.JWT_SECRET,
    { expiresIn: '7d' } // Token expires in 7 days
  );
}

// Helper: throw if not authenticated
function requireAuth(context) {
  if (!context.user) {
    throw new GraphQLError('Authentication required', {
      extensions: { code: 'UNAUTHENTICATED' },
    });
  }
  return context.user;
}

module.exports = { getUser, generateToken, requireAuth };

// src/utils/dataLoaders.js
// DataLoader batches and caches database queries within a single request.
// Instead of N individual queries, it batches them into 1 query.
//
// WITHOUT DataLoader (N+1 problem):
//   SELECT * FROM users WHERE id = '1'
//   SELECT * FROM users WHERE id = '2'
//   SELECT * FROM users WHERE id = '3'  ... N queries!
//
// WITH DataLoader (batched):
//   SELECT * FROM users WHERE id IN ('1', '2', '3')  ... 1 query!

const DataLoader = require('dataloader');

// IMPORTANT: Create new DataLoader instances PER REQUEST
// because the cache should not leak between requests.
function createLoaders(prisma) {
  return {
    // User loader: batch-fetch users by their IDs
    user: new DataLoader(async (userIds) => {
      // userIds = ['1', '2', '3'] (collected from all resolvers)

      // One query fetches all users
      const users = await prisma.user.findMany({
        where: { id: { in: [...userIds] } },
      });

      // CRITICAL: DataLoader requires results in the SAME ORDER
      // as the input IDs. If a user is not found, return null.
      const userMap = new Map(users.map(u => [u.id, u]));
      return userIds.map(id => userMap.get(id) || null);
    }),

    // Posts by author loader
    postsByAuthor: new DataLoader(async (authorIds) => {
      const posts = await prisma.post.findMany({
        where: { authorId: { in: [...authorIds] } },
      });

      // Group posts by authorId
      const postsByAuthor = {};
      posts.forEach(post => {
        if (!postsByAuthor[post.authorId]) {
          postsByAuthor[post.authorId] = [];
        }
        postsByAuthor[post.authorId].push(post);
      });

      return authorIds.map(id => postsByAuthor[id] || []);
    }),

    // Comment count by post loader
    commentCountByPost: new DataLoader(async (postIds) => {
      const counts = await prisma.comment.groupBy({
        by: ['postId'],
        where: { postId: { in: [...postIds] } },
        _count: { id: true },
      });

      const countMap = new Map(
        counts.map(c => [c.postId, c._count.id])
      );
      return postIds.map(id => countMap.get(id) || 0);
    }),
  };
}

module.exports = { createLoaders };

// src/schema/resolvers/index.js
// Complete resolver implementation with explanations.

const { GraphQLError } = require('graphql');
const bcrypt = require('bcryptjs');
const { generateToken, requireAuth } = require('../../middleware/auth');
const { PubSub } = require('graphql-subscriptions');

// PubSub for subscriptions (use Redis-based in production!)
const pubsub = new PubSub();

const resolvers = {

  // ==========================================
  // CUSTOM SCALAR: DateTime
  // ==========================================
  DateTime: {
    // How to serialize (server -> client)
    serialize(value) {
      return value.toISOString();
    },
    // How to parse from variable (client -> server)
    parseValue(value) {
      return new Date(value);
    },
  },

  // ==========================================
  // QUERIES (Read Operations)
  // ==========================================
  Query: {
    // Get the currently logged-in user
    me: async (_parent, _args, context) => {
      // context.user was set by our auth middleware
      if (!context.user) return null;
      return context.prisma.user.findUnique({
        where: { id: context.user.userId },
      });
    },

    // Get user by ID
    user: async (_parent, { id }, { prisma }) => {
      // Destructuring: { id } from args, { prisma } from context
      return prisma.user.findUnique({ where: { id } });
    },

    // List users with basic pagination
    users: async (_parent, { limit = 10, offset = 0 }, { prisma }) => {
      return prisma.user.findMany({
        take: Math.min(limit, 50), // Cap at 50 to prevent abuse
        skip: offset,
        orderBy: { createdAt: 'desc' },
      });
    },

    // Get single post
    post: async (_parent, { id }, { prisma }) => {
      return prisma.post.findUnique({ where: { id } });
    },

    // Get posts with cursor-based pagination + filters
    posts: async (_parent, args, { prisma }) => {
      const {
        filters = {},
        first = 10,
        after,
        orderBy = 'DESC',
      } = args;

      // Build WHERE clause from filters
      const where = {};
      if (filters.status) where.status = filters.status;
      if (filters.authorId) where.authorId = filters.authorId;
      if (filters.tag) where.tags = { has: filters.tag };
      if (filters.search) {
        where.OR = [
          { title: { contains: filters.search, mode: 'insensitive' } },
          { body: { contains: filters.search, mode: 'insensitive' } },
        ];
      }

      // Cursor-based pagination with Prisma
      const queryArgs = {
        where,
        take: Math.min(first, 50) + 1, // +1 to check hasNextPage
        orderBy: { createdAt: orderBy.toLowerCase() },
      };

      if (after) {
        // Decode cursor (base64-encoded ID)
        const decodedCursor = Buffer.from(after, 'base64').toString();
        queryArgs.cursor = { id: decodedCursor };
        queryArgs.skip = 1; // Skip the cursor item itself
      }

      const [posts, totalCount] = await Promise.all([
        prisma.post.findMany(queryArgs),
        prisma.post.count({ where }),
      ]);

      // Check if we got more than requested (means there's a next page)
      const hasNextPage = posts.length > first;
      const edges = posts.slice(0, first).map(post => ({
        node: post,
        // Cursor = base64-encoded ID (opaque to client)
        cursor: Buffer.from(post.id).toString('base64'),
      }));

      return {
        edges,
        pageInfo: {
          hasNextPage,
          hasPreviousPage: !!after,
          startCursor: edges[0]?.cursor || null,
          endCursor: edges[edges.length - 1]?.cursor || null,
        },
        totalCount,
      };
    },
  },

  // ==========================================
  // MUTATIONS (Write Operations)
  // ==========================================
  Mutation: {
    // Register a new user
    register: async (_parent, { input }, { prisma }) => {
      const { name, email, password } = input;

      // Check if email already exists
      const existingUser = await prisma.user.findUnique({
        where: { email },
      });
      if (existingUser) {
        throw new GraphQLError('Email already in use', {
          extensions: { code: 'BAD_USER_INPUT' },
        });
      }

      // Hash the password (NEVER store plain text!)
      // bcrypt adds a random salt automatically
      const hashedPassword = await bcrypt.hash(password, 12);

      // Create the user
      const user = await prisma.user.create({
        data: { name, email, password: hashedPassword },
      });

      // Generate JWT and return
      const token = generateToken(user);
      return { token, user };
    },

    // Login
    login: async (_parent, { input }, { prisma }) => {
      const { email, password } = input;

      const user = await prisma.user.findUnique({
        where: { email },
      });

      if (!user) {
        throw new GraphQLError('Invalid credentials', {
          extensions: { code: 'UNAUTHENTICATED' },
        });
      }

      // Compare provided password with stored hash
      const validPassword = await bcrypt.compare(password, user.password);
      if (!validPassword) {
        throw new GraphQLError('Invalid credentials', {
          extensions: { code: 'UNAUTHENTICATED' },
        });
      }

      const token = generateToken(user);
      return { token, user };
    },

    // Create a new post (requires auth)
    createPost: async (_parent, { input }, context) => {
      const authUser = requireAuth(context);

      try {
        const post = await context.prisma.post.create({
          data: {
            title: input.title,
            body: input.body,
            tags: input.tags || [],
            status: input.status || 'DRAFT',
            authorId: authUser.userId,
          },
        });

        // Publish event for subscriptions
        pubsub.publish('POST_CREATED', { postCreated: post });

        return { post, errors: [] };
      } catch (error) {
        return {
          post: null,
          errors: [{
            field: ['input'],
            message: error.message,
          }],
        };
      }
    },

    // Update a post (only author or admin)
    updatePost: async (_parent, { id, input }, context) => {
      const authUser = requireAuth(context);

      // Check ownership
      const post = await context.prisma.post.findUnique({
        where: { id },
      });

      if (!post) {
        return {
          post: null,
          errors: [{ field: ['id'], message: 'Post not found' }],
        };
      }

      // Authorization: only author or admin can update
      if (post.authorId !== authUser.userId && authUser.role !== 'ADMIN') {
        throw new GraphQLError('Not authorized', {
          extensions: { code: 'FORBIDDEN' },
        });
      }

      // Build update data (only include provided fields)
      const data = {};
      if (input.title !== undefined) data.title = input.title;
      if (input.body !== undefined) data.body = input.body;
      if (input.tags !== undefined) data.tags = input.tags;
      if (input.status !== undefined) data.status = input.status;

      const updated = await context.prisma.post.update({
        where: { id },
        data,
      });

      return { post: updated, errors: [] };
    },

    // Delete a post
    deletePost: async (_parent, { id }, context) => {
      const authUser = requireAuth(context);

      const post = await context.prisma.post.findUnique({
        where: { id },
      });

      if (!post) {
        return {
          success: false,
          errors: [{ field: ['id'], message: 'Post not found' }],
        };
      }

      if (post.authorId !== authUser.userId && authUser.role !== 'ADMIN') {
        throw new GraphQLError('Not authorized', {
          extensions: { code: 'FORBIDDEN' },
        });
      }

      // Delete comments first (cascade), then post
      await context.prisma.comment.deleteMany({ where: { postId: id } });
      await context.prisma.post.delete({ where: { id } });

      return { success: true, errors: [] };
    },

    // Add a comment
    addComment: async (_parent, { postId, text }, context) => {
      const authUser = requireAuth(context);

      const comment = await context.prisma.comment.create({
        data: {
          text,
          postId,
          authorId: authUser.userId,
        },
      });

      // Publish for real-time subscriptions
      pubsub.publish(`COMMENT_ADDED_${postId}`, {
        commentAdded: comment,
      });

      return comment;
    },
  },

  // ==========================================
  // SUBSCRIPTIONS (Real-time)
  // ==========================================
  Subscription: {
    postCreated: {
      // subscribe returns an AsyncIterator
      subscribe: () => pubsub.asyncIterableIterator(['POST_CREATED']),
    },
    commentAdded: {
      subscribe: (_parent, { postId }) => {
        return pubsub.asyncIterableIterator([`COMMENT_ADDED_${postId}`]);
      },
    },
  },

  // ==========================================
  // TYPE RESOLVERS (Nested Field Resolution)
  // ==========================================

  // These resolve fields that don't directly exist on the
  // database model (relationships, computed fields).

  User: {
    // Resolve the "posts" field on a User
    posts: (parent, { limit = 10, offset = 0 }, { loaders }) => {
      // Use DataLoader to batch this!
      return loaders.postsByAuthor.load(parent.id);
    },

    // Computed field: count of user's posts
    postCount: async (parent, _args, { prisma }) => {
      return prisma.post.count({
        where: { authorId: parent.id },
      });
    },
  },

  Post: {
    // Resolve the "author" field on a Post
    author: (parent, _args, { loaders }) => {
      // parent.authorId exists on the Post record
      // DataLoader batches all author lookups into one query
      return loaders.user.load(parent.authorId);
    },

    // Resolve the "comments" field on a Post
    comments: (parent, _args, { prisma }) => {
      return prisma.comment.findMany({
        where: { postId: parent.id },
        orderBy: { createdAt: 'desc' },
      });
    },

    // Computed field: comment count (uses DataLoader)
    commentCount: (parent, _args, { loaders }) => {
      return loaders.commentCountByPost.load(parent.id);
    },
  },

  Comment: {
    author: (parent, _args, { loaders }) => {
      return loaders.user.load(parent.authorId);
    },
    post: (parent, _args, { prisma }) => {
      return prisma.post.findUnique({
        where: { id: parent.postId },
      });
    },
  },
};

module.exports = { resolvers, pubsub };

// src/index.js
// This is the main server file that ties everything together.

const { ApolloServer } = require('@apollo/server');
const { expressMiddleware } = require('@apollo/server/express4');
const {
  ApolloServerPluginDrainHttpServer,
} = require('@apollo/server/plugin/drainHttpServer');
const express = require('express');
const http = require('http');
const cors = require('cors');
const { WebSocketServer } = require('ws');
const { useServer } = require('graphql-ws/lib/use/ws');
const { makeExecutableSchema } = require('@graphql-tools/schema');
const { PrismaClient } = require('@prisma/client');

const { typeDefs } = require('./schema/typeDefs');
const { resolvers } = require('./schema/resolvers');
const { getUser } = require('./middleware/auth');
const { createLoaders } = require('./utils/dataLoaders');

// Initialize Prisma Client (database connection)
const prisma = new PrismaClient({
  log: ['query'], // Log SQL queries in development
});

async function startServer() {
  // 1. Create Express app and HTTP server
  const app = express();
  const httpServer = http.createServer(app);

  // 2. Create executable schema (combines typeDefs + resolvers)
  const schema = makeExecutableSchema({ typeDefs, resolvers });

  // 3. Set up WebSocket server for subscriptions
  const wsServer = new WebSocketServer({
    server: httpServer,
    path: '/graphql',      // Same path as HTTP endpoint
  });
  const serverCleanup = useServer(
    {
      schema,
      // Context for subscription connections
      context: async (ctx) => {
        const token = ctx.connectionParams?.authorization;
        const user = getUser(token);
        return { user, prisma, loaders: createLoaders(prisma) };
      },
    },
    wsServer
  );

  // 4. Create Apollo Server
  const server = new ApolloServer({
    schema,
    plugins: [
      // Graceful shutdown for HTTP server
      ApolloServerPluginDrainHttpServer({ httpServer }),
      // Graceful shutdown for WebSocket server
      {
        async serverWillStart() {
          return {
            async drainServer() {
              await serverCleanup.dispose();
            },
          };
        },
      },
    ],
    // Format errors for the client
    formatError(formattedError, error) {
      // Don't expose internal errors in production
      if (process.env.NODE_ENV === 'production') {
        if (formattedError.extensions?.code === 'INTERNAL_SERVER_ERROR') {
          return { message: 'Internal server error' };
        }
      }
      return formattedError;
    },
  });

  // 5. Start Apollo Server
  await server.start();

  // 6. Mount middleware
  app.use(
    '/graphql',
    cors({
      origin: ['http://localhost:3000', 'https://yourdomain.com'],
      credentials: true,
    }),
    express.json({ limit: '10mb' }),
    expressMiddleware(server, {
      // CONTEXT FUNCTION: runs on EVERY request
      // This is where we set up everything resolvers need
      context: async ({ req }) => {
        // Extract JWT from Authorization header
        const token = req.headers.authorization || '';
        const user = getUser(token);

        return {
          // Current authenticated user (or null)
          user,
          // Prisma client for database queries
          prisma,
          // DataLoaders (fresh per request!)
          loaders: createLoaders(prisma),
          // Raw request (for IP, headers, etc.)
          req,
        };
      },
    })
  );

  // 7. Health check endpoint (for load balancers)
  app.get('/health', (_req, res) => {
    res.json({ status: 'ok' });
  });

  // 8. Start listening
  const PORT = process.env.PORT || 4000;
  httpServer.listen(PORT, () => {
    console.log(`Server ready at http://localhost:${PORT}/graphql`);
    console.log(`Subscriptions at ws://localhost:${PORT}/graphql`);
  });
}

// Start the server
startServer().catch(console.error);

# Database
DATABASE_URL="postgresql://user:password@localhost:5432/graphql_db"

# Auth
JWT_SECRET="your-super-secret-key-change-in-production"

# Server
PORT=4000
NODE_ENV=development

# Create React app
npx create-react-app graphql-client
# OR with Vite (recommended)
npm create vite@latest graphql-client -- --template react

# Install Apollo Client
npm install @apollo/client graphql

// src/lib/apolloClient.js
// Apollo Client is the brain of GraphQL on the frontend.
// It handles: sending queries, caching, real-time, and state management.

import {
  ApolloClient,
  InMemoryCache,
  createHttpLink,
  split,
} from '@apollo/client';
import { setContext } from '@apollo/client/link/context';
import { GraphQLWsLink } from '@apollo/client/link/subscriptions';
import { getMainDefinition } from '@apollo/client/utilities';
import { createClient } from 'graphql-ws';

// ===== HTTP Link (for queries & mutations) =====
const httpLink = createHttpLink({
  uri: 'http://localhost:4000/graphql',
});

// ===== Auth Link (adds JWT to every request) =====
const authLink = setContext((_, { headers }) => {
  // Read token from localStorage
  const token = localStorage.getItem('token');
  return {
    headers: {
      ...headers,
      // If token exists, add it to the Authorization header
      authorization: token ? `Bearer ${token}` : '',
    },
  };
});

// ===== WebSocket Link (for subscriptions) =====
const wsLink = new GraphQLWsLink(
  createClient({
    url: 'ws://localhost:4000/graphql',
    connectionParams: {
      // Send auth token through WebSocket connection
      authorization: localStorage.getItem('token') || '',
    },
  })
);

// ===== Split Link (routes to HTTP or WS based on operation) =====
const splitLink = split(
  ({ query }) => {
    const definition = getMainDefinition(query);
    return (
      definition.kind === 'OperationDefinition' &&
      definition.operation === 'subscription'
    );
  },
  wsLink,      // Subscriptions go through WebSocket
  authLink.concat(httpLink)  // Everything else goes through HTTP
);

// ===== Apollo Client Instance =====
const client = new ApolloClient({
  link: splitLink,

  // InMemoryCache is a normalized cache.
  // It stores data by __typename + id, so if you fetch
  // the same user in two different queries, it's stored once.
  cache: new InMemoryCache({
    typePolicies: {
      Query: {
        fields: {
          // Custom merge for paginated queries
          posts: {
            keyArgs: ['filters'], // Cache separately per filter
            merge(existing, incoming, { args }) {
              if (!args?.after) return incoming; // Fresh query
              // Merge edges for infinite scroll
              return {
                ...incoming,
                edges: [...(existing?.edges || []), ...incoming.edges],
              };
            },
          },
        },
      },
    },
  }),

  // Default options for all queries
  defaultOptions: {
    watchQuery: {
      // fetchPolicy determines where data comes from:
      // 'cache-first' - check cache, then network (default)
      // 'network-only' - always hit the network
      // 'cache-and-network' - return cache, then update from network
      // 'cache-only' - only use cache
      fetchPolicy: 'cache-and-network',
    },
  },
});

export default client;

// src/graphql/operations.js
// Define all GraphQL operations in one place.
// The `gql` tag parses these strings into document ASTs.

import { gql } from '@apollo/client';

// ===== FRAGMENTS (reusable field sets) =====
export const USER_FIELDS = gql`
  fragment UserFields on User {
    id
    name
    email
    avatar
    role
  }
`;

export const POST_FIELDS = gql`
  fragment PostFields on Post {
    id
    title
    body
    status
    tags
    commentCount
    createdAt
    author {
      ...UserFields
    }
  }
  ${USER_FIELDS}
`;

// ===== QUERIES =====
export const GET_ME = gql`
  query GetMe {
    me {
      ...UserFields
    }
  }
  ${USER_FIELDS}
`;

export const GET_POSTS = gql`
  query GetPosts($first: Int, $after: String, $filters: PostFilters) {
    posts(first: $first, after: $after, filters: $filters) {
      edges {
        node {
          ...PostFields
        }
        cursor
      }
      pageInfo {
        hasNextPage
        endCursor
      }
      totalCount
    }
  }
  ${POST_FIELDS}
`;

export const GET_POST = gql`
  query GetPost($id: ID!) {
    post(id: $id) {
      ...PostFields
      comments {
        id
        text
        createdAt
        author {
          ...UserFields
        }
      }
    }
  }
  ${POST_FIELDS}
`;

// ===== MUTATIONS =====
export const LOGIN = gql`
  mutation Login($input: LoginInput!) {
    login(input: $input) {
      token
      user {
        ...UserFields
      }
    }
  }
  ${USER_FIELDS}
`;

export const CREATE_POST = gql`
  mutation CreatePost($input: CreatePostInput!) {
    createPost(input: $input) {
      post {
        ...PostFields
      }
      errors {
        field
        message
      }
    }
  }
  ${POST_FIELDS}
`;

export const DELETE_POST = gql`
  mutation DeletePost($id: ID!) {
    deletePost(id: $id) {
      success
      errors {
        field
        message
      }
    }
  }
`;

// ===== SUBSCRIPTIONS =====
export const COMMENT_ADDED = gql`
  subscription OnCommentAdded($postId: ID!) {
    commentAdded(postId: $postId) {
      id
      text
      createdAt
      author {
        ...UserFields
      }
    }
  }
  ${USER_FIELDS}
`;

// src/App.jsx
import { ApolloProvider } from '@apollo/client';
import client from './lib/apolloClient';
import PostList from './components/PostList';

// ApolloProvider makes the client available to all components
// via React Context. Similar to Redux's Provider.
function App() {
  return (
    <ApolloProvider client={client}>
      <div className="app">
        <h1>My Blog</h1>
        <PostList />
      </div>
    </ApolloProvider>
  );
}

// src/components/PostList.jsx
// Demonstrates: useQuery, loading/error states, pagination

import { useQuery } from '@apollo/client';
import { GET_POSTS } from '../graphql/operations';

function PostList() {
  // useQuery automatically:
  // 1. Sends the query when component mounts
  // 2. Returns loading/error/data states
  // 3. Re-renders when data changes
  // 4. Caches the result
  const { loading, error, data, fetchMore } = useQuery(GET_POSTS, {
    variables: {
      first: 10,
      filters: { status: 'PUBLISHED' },
    },
    // notifyOnNetworkStatusChange: true // for loading on fetchMore
  });

  // Loading state (first load)
  if (loading && !data) return <p>Loading...</p>;

  // Error state
  if (error) return <p>Error: {error.message}</p>;

  const { edges, pageInfo, totalCount } = data.posts;

  // Load More handler (cursor-based pagination)
  const handleLoadMore = () => {
    fetchMore({
      variables: {
        after: pageInfo.endCursor, // "Give me items after this cursor"
      },
      // The merge function in cache config handles combining results
    });
  };

  return (
    <div>
      <h2>Posts ({totalCount})</h2>
      {edges.map(({ node: post }) => (
        <article key={post.id}>
          <h3>{post.title}</h3>
          <p>By {post.author.name}</p>
          <p>{post.commentCount} comments</p>
          <div>{post.tags.map(t => <span key={t}>#{t}</span>)}</div>
        </article>
      ))}

      {pageInfo.hasNextPage && (
        <button onClick={handleLoadMore}>
          Load More
        </button>
      )}
    </div>
  );
}

// src/components/CreatePost.jsx
// Demonstrates: useMutation, optimistic UI, cache update

import { useState } from 'react';
import { useMutation } from '@apollo/client';
import { CREATE_POST, GET_POSTS } from '../graphql/operations';

function CreatePost() {
  const [title, setTitle] = useState('');
  const [body, setBody] = useState('');

  // useMutation returns: [mutationFunction, { data, loading, error }]
  const [createPost, { loading, error }] = useMutation(CREATE_POST, {
    // OPTION 1: refetchQueries - simple but slower
    // Refetches the posts list after mutation completes
    // refetchQueries: [{ query: GET_POSTS }],

    // OPTION 2: update - manual cache update (faster, more control)
    update(cache, { data: { createPost: result } }) {
      if (!result.post) return; // Don't update cache on error

      // Read existing posts from cache
      const existing = cache.readQuery({
        query: GET_POSTS,
        variables: { first: 10, filters: { status: 'PUBLISHED' } },
      });

      if (existing) {
        // Write updated data to cache
        cache.writeQuery({
          query: GET_POSTS,
          variables: { first: 10, filters: { status: 'PUBLISHED' } },
          data: {
            posts: {
              ...existing.posts,
              edges: [
                { node: result.post, cursor: btoa(result.post.id) },
                ...existing.posts.edges,
              ],
              totalCount: existing.posts.totalCount + 1,
            },
          },
        });
      }
    },

    // OPTION 3: Optimistic Response (instant UI update)
    // Shows the new post immediately, before server responds.
    // If the mutation fails, Apollo reverts the optimistic update.
    optimisticResponse: {
      createPost: {
        __typename: 'PostPayload',
        post: {
          __typename: 'Post',
          id: 'temp-id-' + Date.now(), // Temporary ID
          title,
          body,
          status: 'DRAFT',
          tags: [],
          commentCount: 0,
          createdAt: new Date().toISOString(),
          author: {
            __typename: 'User',
            id: 'current-user-id',
            name: 'You',
            email: '',
            avatar: null,
            role: 'USER',
          },
        },
        errors: [],
      },
    },
  });

  const handleSubmit = async (e) => {
    e.preventDefault();
    try {
      await createPost({
        variables: {
          input: { title, body },
        },
      });
      setTitle('');
      setBody('');
    } catch (err) {
      console.error('Failed to create post:', err);
    }
  };

  return (
    <form onSubmit={handleSubmit}>
      <input
        value={title}
        onChange={e => setTitle(e.target.value)}
        placeholder="Post title"
        required
      />
      <textarea
        value={body}
        onChange={e => setBody(e.target.value)}
        placeholder="Post body"
        required
      />
      <button type="submit" disabled={loading}>
        {loading ? 'Creating...' : 'Create Post'}
      </button>
      {error && <p className="error">{error.message}</p>}
    </form>
  );
}

// src/components/PostComments.jsx
// Demonstrates: useSubscription for real-time updates

import { useQuery, useSubscription } from '@apollo/client';
import { GET_POST, COMMENT_ADDED } from '../graphql/operations';

function PostComments({ postId }) {
  // Fetch initial comments
  const { data } = useQuery(GET_POST, {
    variables: { id: postId },
  });

  // Subscribe to new comments in real-time
  useSubscription(COMMENT_ADDED, {
    variables: { postId },
    // onData fires every time the server pushes a new comment
    onData({ client, data: subData }) {
      const newComment = subData.data.commentAdded;

      // Update the cache with the new comment
      const existing = client.cache.readQuery({
        query: GET_POST,
        variables: { id: postId },
      });

      if (existing) {
        client.cache.writeQuery({
          query: GET_POST,
          variables: { id: postId },
          data: {
            post: {
              ...existing.post,
              comments: [newComment, ...existing.post.comments],
            },
          },
        });
      }
    },
  });

  return (
    <div>
      <h3>Comments</h3>
      {data?.post?.comments.map(comment => (
        <div key={comment.id}>
          <strong>{comment.author.name}</strong>
          <p>{comment.text}</p>
        </div>
      ))}
    </div>
  );
}

// PATTERN 1: Direct in resolver (simple)
const resolvers = {
  Mutation: {
    deleteUser: (_, { id }, context) => {
      if (!context.user) throw new AuthenticationError('Login required');
      if (context.user.role !== 'ADMIN') throw new ForbiddenError('Admin only');
      // ... delete user
    },
  },
};

// PATTERN 2: Schema directive (scalable, used in production)
// In schema: type Mutation { deleteUser(id: ID!): User @auth(requires: ADMIN) }
// A directive transformer checks the role before the resolver runs.

// PATTERN 3: Middleware layer (using graphql-shield)
const { shield, rule, allow, deny } = require('graphql-shield');

const isAuthenticated = rule()((_, __, ctx) => ctx.user !== null);
const isAdmin = rule()((_, __, ctx) => ctx.user?.role === 'ADMIN');
const isOwner = rule()((_, { id }, ctx) => ctx.user?.userId === id);

const permissions = shield({
  Query: {
    me: isAuthenticated,
    users: isAdmin,
  },
  Mutation: {
    createPost: isAuthenticated,
    deletePost: isOwner,
  },
});

{
  // Data can be PARTIALLY present even with errors!
  "data": {
    "user": {
      "name": "Yatin",
      "email": null   // This field errored
    }
  },
  "errors": [
    {
      "message": "Not authorized to view email",
      "locations": [{ "line": 4, "column": 5 }],
      "path": ["user", "email"],  // Which field errored
      "extensions": {
        "code": "FORBIDDEN",        // Machine-readable error code
        "timestamp": "2024-01-15T10:30:00Z"
      }
    }
  ]
}

const { GraphQLError } = require('graphql');

// Standard error codes that Apollo/clients understand:
// GRAPHQL_PARSE_FAILED    - Query syntax error
// GRAPHQL_VALIDATION_FAILED - Query doesn't match schema
// BAD_USER_INPUT          - Invalid argument values
// UNAUTHENTICATED         - Not logged in
// FORBIDDEN               - Logged in but not authorized
// PERSISTED_QUERY_NOT_FOUND
// INTERNAL_SERVER_ERROR   - Catch-all

throw new GraphQLError('Post not found', {
  extensions: {
    code: 'NOT_FOUND',
    argumentName: 'id',
    // Add any extra context you want
  },
});

// A malicious query could look like this:
// query {
//   users {
//     posts {
//       author {
//         posts {
//           author {
//             posts { ... 50 levels deep ... }
//           }
//         }
//       }
//     }
//   }
// }

// Solution 1: Depth limiting
const depthLimit = require('graphql-depth-limit');

const server = new ApolloServer({
  validationRules: [depthLimit(7)], // Max 7 levels deep
});

// Solution 2: Query complexity analysis
const { createComplexityLimitRule } = require('graphql-validation-complexity');

const server = new ApolloServer({
  validationRules: [
    createComplexityLimitRule(1000), // Max complexity score of 1000
  ],
});

// Without APQ (every request):
// POST /graphql
// Body: { query: "query GetUser($id: ID!) { user(id: $id) { name email ... } }" }
// ^^ This string can be HUGE for complex queries

// With APQ (first request sends hash + query, subsequent just hash):
// POST /graphql
// Body: { extensions: { persistedQuery: { sha256Hash: "abc123..." } } }
// ^^ Much smaller payload

// Client setup:
import { createPersistedQueryLink } from '@apollo/client/link/persisted-queries';
import { sha256 } from 'crypto-hash';

const link = createPersistedQueryLink({ sha256 }).concat(httpLink);

                    ┌─────────────┐
                    │   Clients   │
                    │ Web/Mobile  │
                    └──────┬──────┘
                           │
                    ┌──────▼──────┐
                    │     CDN     │  ← APQ cache, static assets
                    │ CloudFront  │
                    └──────┬──────┘
                           │
                    ┌──────▼──────┐
                    │    Load     │  ← Rate limiting, WAF
                    │  Balancer   │
                    └──────┬──────┘
                           │
              ┌────────────┼────────────┐
              │            │            │
        ┌─────▼────┐ ┌────▼─────┐ ┌────▼─────┐
        │ GraphQL  │ │ GraphQL  │ │ GraphQL  │  ← Multiple instances
        │ Server 1 │ │ Server 2 │ │ Server 3 │     (horizontal scaling)
        └─────┬────┘ └────┬─────┘ └────┬─────┘
              │            │            │
              └────────────┼────────────┘
                           │
           ┌───────────────┼───────────────┐
           │               │               │
     ┌─────▼────┐   ┌─────▼────┐   ┌──────▼─────┐
     │ Postgres │   │  Redis   │   │ Upstream   │
     │    DB    │   │  Cache   │   │ REST APIs  │
     └──────────┘   └──────────┘   └────────────┘

// ===== 1. HTTP Caching (CDN-level) =====
// For public queries, you can use GET requests + HTTP cache headers
// Apollo Server supports this for queries (not mutations)

// In schema, add cache hints:
// type User @cacheControl(maxAge: 300) {
//   name: String!     # Inherits 300s
//   email: String! @cacheControl(maxAge: 0) # Never cache
// }

// ===== 2. Server-side Redis Cache =====
const Redis = require('ioredis');
const redis = new Redis();

// In resolver:
async function getUser(id) {
  // Check Redis first
  const cached = await redis.get(`user:${id}`);
  if (cached) return JSON.parse(cached);

  // Not in cache, fetch from DB
  const user = await prisma.user.findUnique({ where: { id } });

  // Store in Redis with TTL (Time To Live)
  await redis.setex(`user:${id}`, 300, JSON.stringify(user)); // 5 min

  return user;
}

// ===== 3. Client-side (Apollo Cache) =====
// Already covered in the React section.
// Apollo's InMemoryCache is a normalized cache that
// deduplicates entities by __typename + id.

// __tests__/posts.test.js
const { ApolloServer } = require('@apollo/server');
const { typeDefs } = require('../src/schema/typeDefs');
const { resolvers } = require('../src/schema/resolvers');

// Create a test server
const testServer = new ApolloServer({ typeDefs, resolvers });

describe('Posts API', () => {
  it('should fetch published posts', async () => {
    const result = await testServer.executeOperation(
      {
        query: `
          query GetPosts($first: Int) {
            posts(first: $first) {
              edges {
                node { id title }
              }
              totalCount
            }
          }
        `,
        variables: { first: 5 },
      },
      {
        // Provide mock context
        contextValue: {
          prisma: mockPrisma,
          user: { userId: '1', role: 'USER' },
          loaders: mockLoaders,
        },
      }
    );

    // Assert
    expect(result.body.singleResult.errors).toBeUndefined();
    expect(result.body.singleResult.data.posts.edges.length)
      .toBeLessThanOrEqual(5);
  });

  it('should require auth for createPost', async () => {
    const result = await testServer.executeOperation(
      {
        query: `
          mutation { createPost(input: { title: "Test", body: "..." }) {
            post { id } errors { message }
          }}
        `,
      },
      {
        contextValue: {
          prisma: mockPrisma,
          user: null,  // No auth!
          loaders: mockLoaders,
        },
      }
    );

    // Should get UNAUTHENTICATED error
    expect(result.body.singleResult.errors[0].extensions.code)
      .toBe('UNAUTHENTICATED');
  });
});

import { render, screen } from '@testing-library/react';
import { MockedProvider } from '@apollo/client/testing';
import PostList from './PostList';
import { GET_POSTS } from '../graphql/operations';

const mocks = [
  {
    request: {
      query: GET_POSTS,
      variables: { first: 10, filters: { status: 'PUBLISHED' } },
    },
    result: {
      data: {
        posts: {
          edges: [
            {
              node: {
                id: '1',
                title: 'Test Post',
                // ... all required fields
              },
              cursor: 'abc',
            },
          ],
          pageInfo: { hasNextPage: false, endCursor: 'abc' },
          totalCount: 1,
        },
      },
    },
  },
];

test('renders posts', async () => {
  render(
    <MockedProvider mocks={mocks} addTypename={false}>
      <PostList />
    </MockedProvider>
  );

  // Wait for data to load
  const post = await screen.findByText('Test Post');
  expect(post).toBeInTheDocument();
});

                    ┌─────────────┐
                    │   Client    │  Sees ONE unified schema
                    └──────┬──────┘
                           │
                    ┌──────▼──────┐
                    │   Apollo    │  The "router" that composes
                    │   Gateway   │  subgraphs into one API
                    └──────┬──────┘
                           │
          ┌────────────────┼────────────────┐
          │                │                │
    ┌─────▼────┐    ┌─────▼────┐    ┌──────▼─────┐
    │  Users   │    │  Posts   │    │ Comments   │
    │ Subgraph │    │ Subgraph │    │ Subgraph   │
    │ (Team A) │    │ (Team B) │    │ (Team C)   │
    └──────────┘    └──────────┘    └────────────┘

# Users subgraph (owned by Team A)
type User @key(fields: "id") {
  id: ID!
  name: String!
  email: String!
}

type Query {
  user(id: ID!): User
}

# Posts subgraph (owned by Team B)
# Can EXTEND the User type from another subgraph!
type User @key(fields: "id") {
  id: ID!
  posts: [Post!]!   # Team B adds posts to User
}

type Post @key(fields: "id") {
  id: ID!
  title: String!
  author: User!
}

# Create project folder and initialize
mkdir graphql-mongoose-crud && cd graphql-mongoose-crud
npm init -y

# Install core dependencies
npm install @apollo/server graphql express cors
# @apollo/server  → GraphQL server engine
# graphql         → GraphQL JS reference implementation
# express         → HTTP server framework
# cors            → Cross-Origin Resource Sharing middleware

# Install Mongoose (MongoDB ODM)
npm install mongoose
# mongoose → Object Document Mapper for MongoDB

# Dev dependencies
npm install -D nodemon
# nodemon → Auto-restarts server on file changes

const mongoose = require('mongoose');
// ↑ Import mongoose — the library that lets us talk to MongoDB
//   using JavaScript objects instead of raw MongoDB commands

const userSchema = new mongoose.Schema({
// ↑ Create a new Schema — this defines the STRUCTURE of every
//   document in the "users" collection. Like a blueprint.

  name: {
    type: String,        // Data type is String
    required: true,      // This field MUST be provided (validation)
    trim: true,          // Removes whitespace from both ends before saving
  },
  // ↑ name field: required string, auto-trimmed

  email: {
    type: String,
    required: true,
    unique: true,        // Creates a unique INDEX in MongoDB — no duplicates allowed
    lowercase: true,     // Converts to lowercase before saving (Bob@Mail.com → bob@mail.com)
  },
  // ↑ email field: required, must be unique across all users, stored lowercase

  age: {
    type: Number,
    min: 0,              // Validation: age cannot be negative
    max: 150,            // Validation: age cannot exceed 150
  },
  // ↑ age field: optional number with min/max validation

  role: {
    type: String,
    enum: ['USER', 'ADMIN', 'MODERATOR'],  // Only these values are allowed
    default: 'USER',                          // If not provided, defaults to 'USER'
  },
  // ↑ role field: restricted to specific values using enum

  posts: [{
    type: mongoose.Schema.Types.ObjectId,  // Stores MongoDB ObjectId references
    ref: 'Post',                           // References the 'Post' model (for .populate())
  }],
  // ↑ posts: array of references to Post documents
  //   This creates a ONE-TO-MANY relationship (one user → many posts)
  //   We use .populate('posts') later to load the actual post data

}, {
  timestamps: true,
  // ↑ Automatically adds createdAt and updatedAt fields
  //   createdAt = when document was first created
  //   updatedAt = when document was last modified
  //   Both are managed by Mongoose automatically
});

module.exports = mongoose.model('User', userSchema);
// ↑ Create and export the Model
//   'User' → name of the model (MongoDB creates a 'users' collection)
//   userSchema → the schema we just defined
//   The model gives us methods like .find(), .findById(), .create(), etc.

const mongoose = require('mongoose');

const postSchema = new mongoose.Schema({
  title: {
    type: String,
    required: true,
    trim: true,
  },
  // ↑ title: required string, whitespace trimmed

  body: {
    type: String,
    required: true,
  },
  // ↑ body: the main content of the post

  published: {
    type: Boolean,
    default: false,
  },
  // ↑ published: defaults to false (draft state)
  //   Only published posts should be shown to other users

  author: {
    type: mongoose.Schema.Types.ObjectId,
    ref: 'User',
    required: true,
  },
  // ↑ author: reference to the User who created this post
  //   This is the "belongs to" side of the relationship
  //   required: true means every post MUST have an author

}, { timestamps: true });

module.exports = mongoose.model('Post', postSchema);
// ↑ Creates 'posts' collection in MongoDB

const typeDefs = `#graphql

  # ============ TYPES (what the API RETURNS) ============

  type User {
    id: ID!              # Unique identifier (mapped from MongoDB's _id)
    name: String!        # ! means non-nullable — server guarantees a value
    email: String!       # User's email — always present
    age: Int             # No ! → nullable — age might not be provided
    role: String!        # USER, ADMIN, or MODERATOR
    posts: [Post!]!      # Array of posts — the array itself and each post are non-null
    createdAt: String!   # ISO date string from Mongoose timestamps
    updatedAt: String!   # Last modification date
  }
  # ↑ User type: defines the SHAPE of user data returned by queries
  #   This is NOT the database schema — it's the API contract
  #   Some DB fields (like password) are intentionally excluded

  type Post {
    id: ID!
    title: String!
    body: String!
    published: Boolean!
    author: User!        # The author field returns a full User object (not just an ID)
    createdAt: String!
    updatedAt: String!
  }
  # ↑ Post type: notice author returns User! (resolved via .populate())

  # ============ INPUT TYPES (what the client SENDS) ============

  input CreateUserInput {
    name: String!        # Required for creation
    email: String!       # Required for creation
    age: Int             # Optional
    role: String         # Optional — defaults to USER in the model
  }
  # ↑ input types are for ARGUMENTS — separate from output types
  #   This separation lets read shape differ from write shape
  #   e.g., User output has 'id', 'posts', 'createdAt' but input doesn't

  input UpdateUserInput {
    name: String         # All fields optional for updates (partial update)
    email: String        # Only send the fields you want to change
    age: Int
    role: String
  }
  # ↑ Update input: no ! on any field — all optional
  #   This enables PATCH-style updates (only change what you send)

  input CreatePostInput {
    title: String!
    body: String!
    published: Boolean
    authorId: ID!        # ID of the user creating the post
  }

  input UpdatePostInput {
    title: String
    body: String
    published: Boolean
  }

  # ============ QUERIES (READ operations) ============

  type Query {
    users: [User!]!
    # ↑ Returns all users — no arguments needed
    #   [User!]! → non-null array of non-null users
    #   Even if empty, returns [] not null

    user(id: ID!): User
    # ↑ Returns a single user by ID
    #   Returns User (nullable) — returns null if not found
    #   id: ID! → the ID argument is required

    posts: [Post!]!
    # ↑ Returns all posts

    post(id: ID!): Post
    # ↑ Returns a single post by ID
  }

  # ============ MUTATIONS (CREATE, UPDATE, DELETE) ============

  type Mutation {
    createUser(input: CreateUserInput!): User!
    # ↑ Creates a new user
    #   Takes CreateUserInput (required) → returns the created User
    #   The ! after User means it always returns a user (or throws error)

    updateUser(id: ID!, input: UpdateUserInput!): User
    # ↑ Updates an existing user
    #   Takes id (which user) + input (what to change)
    #   Returns User (nullable) — null if user not found

    deleteUser(id: ID!): User
    # ↑ Deletes a user by ID
    #   Returns the deleted user data (so frontend can update cache)
    #   Nullable — null if user didn't exist

    createPost(input: CreatePostInput!): Post!
    updatePost(id: ID!, input: UpdatePostInput!): Post
    deletePost(id: ID!): Post
  }
`;

module.exports = typeDefs;
// ↑ Export so our Apollo Server can use this schema

const User = require('../models/User');
const Post = require('../models/Post');
// ↑ Import our Mongoose models — these give us database methods
//   User.find(), User.findById(), User.create(), etc.

const resolvers = {

  // ============================================
  // QUERY RESOLVERS (READ operations)
  // ============================================
  Query: {

    // -------- GET ALL USERS --------
    users: async () => {
    // ↑ async because database calls return Promises
    //   No arguments needed — returns all users

      return await User.find().populate('posts');
      // ↑ User.find() → MongoDB equivalent of SELECT * FROM users
      //   Returns ALL documents in the users collection
      //
      //   .populate('posts') → Mongoose "join"
      //   The 'posts' field in User schema stores ObjectId references
      //   .populate() replaces those IDs with actual Post documents
      //   Without populate: posts: ["507f1f77bcf86cd799439011"]
      //   With populate:    posts: [{ title: "Hello", body: "..." }]
    },

    // -------- GET SINGLE USER BY ID --------
    user: async (_, { id }) => {
    // ↑ Resolver arguments: (parent, args, context, info)
    //   _ → parent (unused here since this is a root Query)
    //   { id } → destructure 'id' from the args object
    //   When client sends: query { user(id: "123") { name } }
    //   args = { id: "123" }

      return await User.findById(id).populate('posts');
      // ↑ User.findById(id) → finds one document by its _id field
      //   MongoDB equivalent: db.users.findOne({ _id: ObjectId(id) })
      //   Returns null if no user found (which is fine — our schema says User is nullable)
    },

    // -------- GET ALL POSTS --------
    posts: async () => {
      return await Post.find().populate('author');
      // ↑ Post.find() → get all posts
      //   .populate('author') → replace the authorId ObjectId
      //   with the full User document
    },

    // -------- GET SINGLE POST BY ID --------
    post: async (_, { id }) => {
      return await Post.findById(id).populate('author');
    },
  },

  // ============================================
  // MUTATION RESOLVERS (CREATE, UPDATE, DELETE)
  // ============================================
  Mutation: {

    // -------- CREATE USER --------
    createUser: async (_, { input }) => {
    // ↑ { input } → destructured from args
    //   input = { name: "John", email: "john@mail.com", age: 25 }
    //   (comes from CreateUserInput in our schema)

      const user = new User(input);
      // ↑ Create a new Mongoose document instance
      //   This does NOT save to the database yet
      //   It applies schema defaults (role: 'USER')
      //   and validations (required fields, enum values)

      await user.save();
      // ↑ Actually persist to MongoDB
      //   This is where validation runs
      //   If validation fails, it throws an error
      //   If email is duplicate, MongoDB throws a duplicate key error
      //   Mongoose also sets createdAt and updatedAt here

      return user;
      // ↑ Return the saved user document
      //   It now has an _id, createdAt, updatedAt
      //   Apollo Server automatically maps _id → id for the ID! field
    },

    // -------- UPDATE USER --------
    updateUser: async (_, { id, input }) => {
    // ↑ id = which user to update
    //   input = fields to change { name: "New Name" }

      const user = await User.findByIdAndUpdate(
        id,           // Find user with this _id
        input,        // Apply these changes (only provided fields)
        { new: true, runValidators: true }
        // ↑ Options:
        //   new: true → return the UPDATED document (default returns the OLD one)
        //   runValidators: true → still run schema validations on update
        //   Without runValidators, you could set age: -5 on update!
      ).populate('posts');
      // ↑ Also populate the posts for the returned user

      return user;
      // ↑ Returns updated user, or null if ID not found
    },

    // -------- DELETE USER --------
    deleteUser: async (_, { id }) => {

      const user = await User.findByIdAndDelete(id);
      // ↑ Find the user by ID and remove from database
      //   Returns the deleted document (so frontend can update cache)
      //   Returns null if user not found

      if (user) {
        await Post.deleteMany({ author: id });
        // ↑ CASCADE DELETE: also delete all posts by this user
        //   Without this, we'd have orphaned posts in the database
        //   MongoDB doesn't have foreign key constraints like SQL
        //   So we handle cascading manually
      }

      return user;
    },

    // -------- CREATE POST --------
    createPost: async (_, { input }) => {
    // ↑ input = { title, body, published, authorId }

      const { authorId, ...postData } = input;
      // ↑ Destructure: pull out authorId, keep the rest as postData
      //   postData = { title, body, published }
      //   authorId = "507f1f77bcf86cd799439011"

      const post = new Post({ ...postData, author: authorId });
      // ↑ Create Post document, set author to the user's ObjectId

      await post.save();
      // ↑ Save to MongoDB

      await User.findByIdAndUpdate(authorId, {
        $push: { posts: post._id }
      });
      // ↑ MAINTAIN THE RELATIONSHIP
      //   $push adds post._id to the user's posts array
      //   This is manual — MongoDB doesn't auto-sync relations
      //   Now user.posts = [...existing, newPostId]

      return await post.populate('author');
      // ↑ Populate the author field before returning
      //   So the response includes full author data, not just an ID
    },

    // -------- UPDATE POST --------
    updatePost: async (_, { id, input }) => {
      return await Post.findByIdAndUpdate(
        id,
        input,
        { new: true, runValidators: true }
      ).populate('author');
    },

    // -------- DELETE POST --------
    deletePost: async (_, { id }) => {
      const post = await Post.findByIdAndDelete(id);
      // ↑ Remove the post from database

      if (post) {
        await User.findByIdAndUpdate(post.author, {
          $pull: { posts: post._id }
        });
        // ↑ $pull removes the post ID from the user's posts array
        //   This keeps the relationship consistent
        //   Without this, user.posts would contain a dead reference
      }

      return post;
    },
  },

  // ============================================
  // FIELD-LEVEL RESOLVERS (resolve relationships)
  // ============================================
  User: {
    id: (parent) => parent._id.toString(),
    // ↑ MongoDB uses _id (with underscore)
    //   GraphQL schema uses id (without underscore)
    //   This resolver maps _id → id
    //   .toString() converts ObjectId to a string
  },

  Post: {
    id: (parent) => parent._id.toString(),
    // ↑ Same mapping for Post documents
  },
};

module.exports = resolvers;

const { ApolloServer } = require('@apollo/server');
// ↑ Import Apollo Server — the GraphQL engine that parses queries,
//   validates them against our schema, and calls the right resolvers

const { expressMiddleware } = require('@apollo/server/express4');
// ↑ Middleware adapter to plug Apollo Server into Express
//   Apollo v4 doesn't run standalone with Express — it uses middleware

const express = require('express');
const cors = require('cors');
const mongoose = require('mongoose');

const typeDefs = require('./schema/typeDefs');
const resolvers = require('./schema/resolvers');
// ↑ Our GraphQL schema and resolver functions

async function startServer() {
// ↑ Wrap in async function because Apollo Server startup is async

  const app = express();
  // ↑ Create Express application instance

  const server = new ApolloServer({
    typeDefs,      // Our GraphQL schema (type definitions)
    resolvers,     // Our resolver functions
  });
  // ↑ Create Apollo Server with our schema + resolvers
  //   It validates that every type/field in typeDefs
  //   has a corresponding resolver (or uses default resolver)

  await server.start();
  // ↑ MUST call start() before applying middleware
  //   This initializes the schema, plugins, and internal caches

  app.use(
    '/graphql',              // Route: all GraphQL requests go to POST /graphql
    cors(),                  // Allow cross-origin requests (needed for frontends on different ports)
    express.json(),          // Parse JSON request bodies (GraphQL sends JSON)
    expressMiddleware(server)  // Mount Apollo as Express middleware
  );
  // ↑ Chain of middleware:
  //   1. CORS headers added
  //   2. JSON body parsed
  //   3. Apollo processes the GraphQL query

  await mongoose.connect('mongodb://localhost:27017/graphql-crud');
  // ↑ Connect to MongoDB
  //   'graphql-crud' is the database name (created automatically)
  //   In production, use an environment variable for the connection string

  console.log('Connected to MongoDB');

  app.listen(4000, () => {
    console.log('Server running at http://localhost:4000/graphql');
  });
  // ↑ Start HTTP server on port 4000
  //   Open http://localhost:4000/graphql in browser for Apollo Sandbox
}

startServer();
// ↑ Call the async startup function

mutation {
  createUser(input: {
    name: "Yatin Dora"       # Required field
    email: "yatin@dev.com"   # Required, must be unique
    age: 25                   # Optional
    role: "ADMIN"             # Optional, defaults to USER
  }) {
    # ↓ Choose which fields you want back in the response
    id          # The generated MongoDB _id
    name        # Confirm the name was saved
    email       # Confirm email was lowercased
    age
    role
    createdAt   # Timestamp when created
  }
}

# Create project folder and initialize
mkdir graphql-prisma-crud && cd graphql-prisma-crud
npm init -y

# Install core dependencies
npm install @apollo/server graphql express cors
# Same as Mongoose setup — Apollo is the GraphQL engine

# Install Prisma
npm install prisma @prisma/client
# prisma        → CLI tool for migrations, schema management
# @prisma/client → auto-generated type-safe database client

# Initialize Prisma (creates prisma/ folder with schema.prisma)
npx prisma init
# This creates:
#   prisma/schema.prisma → your database schema file
#   .env                 → DATABASE_URL goes here

# Dev dependencies
npm install -D nodemon

// prisma/schema.prisma
// This file defines your DATABASE structure.
// Prisma reads this and generates:
//   1. SQL migrations (CREATE TABLE statements)
//   2. A type-safe JavaScript/TypeScript client

generator client {
  provider = "prisma-client-js"
}
// ↑ Tells Prisma to generate a JavaScript client
//   After running `npx prisma generate`, you get
//   a client with full autocompletion in your IDE

datasource db {
  provider = "postgresql"
  url      = env("DATABASE_URL")
}
// ↑ Database connection settings
//   provider: which database (postgresql, mysql, sqlite, mongodb)
//   url: connection string from .env file
//   Example: DATABASE_URL="postgresql://user:pass@localhost:5432/mydb"

model User {
  id        String   @id @default(cuid())
  // ↑ id: primary key, auto-generated CUID string
  //   @id → marks this as the primary key (like PRIMARY KEY in SQL)
  //   @default(cuid()) → auto-generates a unique ID
  //   CUID is like UUID but shorter and URL-safe
  //   You could also use @default(uuid()) or @default(autoincrement())

  name      String
  // ↑ name: required string column (NOT NULL by default in Prisma)
  //   In Prisma, fields are required unless you add ? (e.g., String?)
  //   Opposite of GraphQL where fields are nullable by default

  email     String   @unique
  // ↑ email: required + unique constraint
  //   @unique → creates a UNIQUE INDEX in the database
  //   INSERT with duplicate email will throw an error

  age       Int?
  // ↑ age: OPTIONAL integer (? makes it nullable)
  //   SQL: age INTEGER (no NOT NULL constraint)

  role      Role     @default(USER)
  // ↑ role: uses the Role enum defined below
  //   @default(USER) → defaults to USER if not provided

  posts     Post[]
  // ↑ posts: ONE-TO-MANY relationship — one user has many posts
  //   This is a VIRTUAL field — no column is created in the users table
  //   Prisma uses the Post.authorId foreign key to resolve this
  //   Accessed as: user.posts (returns array of Post objects)

  createdAt DateTime @default(now())
  // ↑ createdAt: auto-set to current timestamp when row is created
  //   SQL: created_at TIMESTAMP DEFAULT NOW()

  updatedAt DateTime @updatedAt
  // ↑ updatedAt: automatically updated whenever the row is modified
  //   Prisma handles this — no trigger needed
}

model Post {
  id        String   @id @default(cuid())
  title     String
  body      String
  published Boolean  @default(false)
  // ↑ published: defaults to false (draft state)

  author    User     @relation(fields: [authorId], references: [id], onDelete: Cascade)
  // ↑ author: MANY-TO-ONE relationship — each post belongs to one user
  //   @relation → tells Prisma HOW to join the tables:
  //     fields: [authorId] → "use the authorId column in THIS table"
  //     references: [id]   → "to match against the id column in User table"
  //     onDelete: Cascade  → if the user is deleted, delete their posts too
  //   SQL: FOREIGN KEY (author_id) REFERENCES users(id) ON DELETE CASCADE

  authorId  String
  // ↑ The actual foreign key column stored in the posts table
  //   This IS a real column (unlike the 'author' field above)

  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt

  @@index([authorId])
  // ↑ Create a database INDEX on authorId for faster lookups
  //   When querying "all posts by user X", this index makes it fast
  //   SQL: CREATE INDEX ON posts(author_id)
}

enum Role {
  USER
  ADMIN
  MODERATOR
}
// ↑ Enum type — only these three values are allowed for the role field
//   Prisma creates a real PostgreSQL ENUM type
//   SQL: CREATE TYPE "Role" AS ENUM ('USER', 'ADMIN', 'MODERATOR')

const { PrismaClient } = require('@prisma/client');
// ↑ Import the auto-generated Prisma Client
//   This client was generated by `npx prisma generate`
//   It has full TypeScript types matching your schema

const prisma = new PrismaClient();
// ↑ Create a single Prisma Client instance
//   IMPORTANT: only create ONE instance for the entire app
//   Each instance holds a connection pool (default: 5 connections)
//   Creating multiple instances wastes database connections

module.exports = prisma;
// ↑ Export the singleton — import this everywhere you need DB access

const typeDefs = `#graphql

  # Same output types as before — GraphQL schema doesn't change
  # whether you use Mongoose or Prisma underneath

  type User {
    id: ID!
    name: String!
    email: String!
    age: Int
    role: String!
    posts: [Post!]!
    createdAt: String!
    updatedAt: String!
  }

  type Post {
    id: ID!
    title: String!
    body: String!
    published: Boolean!
    author: User!
    createdAt: String!
    updatedAt: String!
  }

  # Input types stay the same too
  input CreateUserInput {
    name: String!
    email: String!
    age: Int
    role: String
  }

  input UpdateUserInput {
    name: String
    email: String
    age: Int
    role: String
  }

  input CreatePostInput {
    title: String!
    body: String!
    published: Boolean
    authorId: ID!
  }

  input UpdatePostInput {
    title: String
    body: String
    published: Boolean
  }

  type Query {
    users: [User!]!
    user(id: ID!): User
    posts: [Post!]!
    post(id: ID!): Post
  }

  type Mutation {
    createUser(input: CreateUserInput!): User!
    updateUser(id: ID!, input: UpdateUserInput!): User
    deleteUser(id: ID!): User
    createPost(input: CreatePostInput!): Post!
    updatePost(id: ID!, input: UpdatePostInput!): Post
    deletePost(id: ID!): Post
  }
`;

module.exports = typeDefs;
// ↑ Identical schema to Mongoose version
//   The ONLY thing that changes is the resolvers (database calls)
//   This is one of GraphQL's strengths: the API contract is ORM-agnostic

const prisma = require('../prisma/client');
// ↑ Import our singleton Prisma Client
//   prisma.user → access the User table
//   prisma.post → access the Post table
//   Every method returns a Promise (so we use async/await)

const resolvers = {

  // ============================================
  // QUERY RESOLVERS (READ operations)
  // ============================================
  Query: {

    // -------- GET ALL USERS --------
    users: async () => {
      return await prisma.user.findMany({
      // ↑ prisma.user.findMany() → SELECT * FROM users
      //   Returns an array of all users
      //   Like Mongoose's User.find() but with a type-safe API

        include: { posts: true },
        // ↑ include → Prisma's version of Mongoose's .populate()
        //   { posts: true } → also load related Post records
        //   Prisma generates a JOIN query (not N+1 separate queries)
        //   SQL: SELECT * FROM users LEFT JOIN posts ON posts.author_id = users.id
        //
        //   You can also do nested includes:
        //   include: { posts: { include: { comments: true } } }
      });
    },

    // -------- GET SINGLE USER BY ID --------
    user: async (_, { id }) => {
      return await prisma.user.findUnique({
      // ↑ findUnique → find ONE record by a unique field
      //   SQL: SELECT * FROM users WHERE id = $1 LIMIT 1
      //   Returns null if not found (perfect for our nullable return type)
      //
      //   findUnique vs findFirst:
      //   findUnique → only works on @unique or @id fields
      //   findFirst → works on any field (but slower, no index guarantee)

        where: { id },
        // ↑ where clause: { id: id } (shorthand: { id })
        //   Prisma generates: WHERE id = 'clx123...'

        include: { posts: true },
        // ↑ Include related posts in the result
      });
    },

    // -------- GET ALL POSTS --------
    posts: async () => {
      return await prisma.post.findMany({
        include: { author: true },
        // ↑ Include the author (User) for each post
        //   Prisma knows how to join because of the @relation in schema
      });
    },

    // -------- GET SINGLE POST BY ID --------
    post: async (_, { id }) => {
      return await prisma.post.findUnique({
        where: { id },
        include: { author: true },
      });
    },
  },

  // ============================================
  // MUTATION RESOLVERS (CREATE, UPDATE, DELETE)
  // ============================================
  Mutation: {

    // -------- CREATE USER --------
    createUser: async (_, { input }) => {
      return await prisma.user.create({
      // ↑ prisma.user.create() → INSERT INTO users (...) VALUES (...)
      //   Prisma validates against the schema automatically
      //   If email is duplicate, throws: Unique constraint failed on `email`

        data: input,
        // ↑ data: the values to insert
        //   input = { name: "John", email: "john@dev.com", age: 25 }
        //   Prisma auto-handles:
        //     id → generated by @default(cuid())
        //     role → defaults to USER via @default(USER)
        //     createdAt → set by @default(now())
        //     updatedAt → set by @updatedAt

        include: { posts: true },
        // ↑ Include posts in the response (will be empty [] for new user)
      });
    },

    // -------- UPDATE USER --------
    updateUser: async (_, { id, input }) => {
      try {
      // ↑ Wrap in try-catch because Prisma throws if record not found
      //   (unlike Mongoose which returns null)

        return await prisma.user.update({
        // ↑ prisma.user.update() → UPDATE users SET ... WHERE id = $1
        //   IMPORTANT: Prisma THROWS an error if the record doesn't exist
        //   This is different from Mongoose's findByIdAndUpdate (returns null)

          where: { id },
          // ↑ Which record to update

          data: input,
          // ↑ What to change — only provided fields are updated
          //   If input = { name: "New Name" }, only name changes
          //   Prisma automatically updates the updatedAt timestamp

          include: { posts: true },
          // ↑ Return the updated user with their posts
        });
      } catch (error) {
        if (error.code === 'P2025') return null;
        // ↑ P2025 = "Record to update not found"
        //   Return null instead of throwing (matches our nullable schema)
        //   Prisma error codes: P2025 (not found), P2002 (unique violation), etc.

        throw error;
        // ↑ Re-throw any other errors (real database errors)
      }
    },

    // -------- DELETE USER --------
    deleteUser: async (_, { id }) => {
      try {
        return await prisma.user.delete({
        // ↑ prisma.user.delete() → DELETE FROM users WHERE id = $1
        //   Returns the deleted record data
        //   Throws P2025 if record doesn't exist
        //
        //   CASCADE: Because we set onDelete: Cascade in the schema,
        //   Prisma/PostgreSQL automatically deletes all related posts!
        //   No manual cascade needed (unlike Mongoose)

          where: { id },
        });
      } catch (error) {
        if (error.code === 'P2025') return null;
        throw error;
      }
    },

    // -------- CREATE POST --------
    createPost: async (_, { input }) => {
      const { authorId, ...postData } = input;
      // ↑ Same destructuring as Mongoose version

      return await prisma.post.create({
        data: {
          ...postData,
          // ↑ Spread: title, body, published

          author: {
            connect: { id: authorId },
          },
          // ↑ connect → Prisma's way of setting a relationship
          //   Instead of: author: authorId (like Mongoose)
          //   Prisma uses: author: { connect: { id: authorId } }
          //   This sets the authorId foreign key in the posts table
          //   SQL: INSERT INTO posts (title, body, author_id) VALUES ($1, $2, $3)
          //
          //   No need to manually update the User's posts array!
          //   Prisma handles the relationship automatically
          //   (Unlike Mongoose where we had to $push to user.posts)
        },
        include: { author: true },
        // ↑ Return the post with full author data
      });
    },

    // -------- UPDATE POST --------
    updatePost: async (_, { id, input }) => {
      try {
        return await prisma.post.update({
          where: { id },
          data: input,
          include: { author: true },
        });
      } catch (error) {
        if (error.code === 'P2025') return null;
        throw error;
      }
    },

    // -------- DELETE POST --------
    deletePost: async (_, { id }) => {
      try {
        return await prisma.post.delete({
          where: { id },
          include: { author: true },
          // ↑ Include author in the returned deleted post
          //   No need to manually $pull from user.posts!
          //   Prisma manages the relationship automatically
        });
      } catch (error) {
        if (error.code === 'P2025') return null;
        throw error;
      }
    },
  },
};

module.exports = resolvers;

const { ApolloServer } = require('@apollo/server');
const { expressMiddleware } = require('@apollo/server/express4');
const express = require('express');
const cors = require('cors');

const typeDefs = require('./schema/typeDefs');
const resolvers = require('./schema/resolvers');

async function startServer() {
  const app = express();

  const server = new ApolloServer({ typeDefs, resolvers });
  await server.start();

  app.use(
    '/graphql',
    cors(),
    express.json(),
    expressMiddleware(server)
  );

  // ↑ Notice: NO database connection code here!
  //   Prisma connects lazily — the first query triggers a connection
  //   Mongoose required explicit mongoose.connect() before starting
  //   Prisma reads DATABASE_URL from .env automatically

  app.listen(4000, () => {
    console.log('Server running at http://localhost:4000/graphql');
  });
}

startServer();

# CREATE USER — exactly the same query
mutation {
  createUser(input: {
    name: "Yatin Dora"
    email: "yatin@dev.com"
    age: 25
    role: "ADMIN"
  }) {
    id
    name
    email
    role
  }
}

# READ ALL USERS — exactly the same query
query {
  users {
    id
    name
    posts {
      title
    }
  }
}

# UPDATE — exactly the same query
mutation {
  updateUser(
    id: "PASTE_ID"
    input: { name: "Updated Name" }
  ) {
    name
  }
}

# DELETE — exactly the same query
mutation {
  deleteUser(id: "PASTE_ID") {
    name
  }
}

// ==========================================
// FIND ALL
// ==========================================

// Mongoose:
await User.find().populate('posts');
// → Separate queries: 1 for users + 1 for posts (2 queries)
// → .populate() does a second query behind the scenes

// Prisma:
await prisma.user.findMany({ include: { posts: true } });
// → Single JOIN query (1 query, more efficient)
// → include replaces populate with better SQL generation

// ==========================================
// FIND BY ID
// ==========================================

// Mongoose:
await User.findById(id).populate('posts');
// → Works with MongoDB ObjectId strings

// Prisma:
await prisma.user.findUnique({ where: { id } });
// → findUnique only works on @id or @unique fields (optimized)

// ==========================================
// CREATE
// ==========================================

// Mongoose:
const user = new User(data);    // Create instance
await user.save();              // Save to DB (2 steps)
// OR: await User.create(data);  // 1 step shorthand

// Prisma:
await prisma.user.create({ data });
// → Always 1 step, returns the created record

// ==========================================
// UPDATE
// ==========================================

// Mongoose:
await User.findByIdAndUpdate(id, data, { new: true, runValidators: true });
// → Need { new: true } to get updated doc (quirky default)
// → Need { runValidators: true } to validate on update

// Prisma:
await prisma.user.update({ where: { id }, data });
// → Always returns updated record
// → Always validates (schema is enforced by the database)
// → THROWS if record not found (must catch P2025)

// ==========================================
// DELETE
// ==========================================

// Mongoose:
await User.findByIdAndDelete(id);
await Post.deleteMany({ author: id });  // Manual cascade!

// Prisma:
await prisma.user.delete({ where: { id } });
// → Cascade is automatic (onDelete: Cascade in schema)
// → No manual cleanup needed

// ==========================================
// RELATIONSHIPS
// ==========================================

// Mongoose — Creating a post requires 2 operations:
const post = await Post.create({ ...data, author: userId });
await User.findByIdAndUpdate(userId, { $push: { posts: post._id } });
// → Must manually sync BOTH sides of the relationship

// Prisma — Creating a post is 1 operation:
await prisma.post.create({
  data: { ...data, author: { connect: { id: userId } } }
});
// → Prisma handles the foreign key — no manual syncing

// CHOOSE MONGOOSE WHEN:
// ✓ Using MongoDB (document database)
// ✓ Data is unstructured or changes shape often
// ✓ Rapid prototyping — no migrations needed
// ✓ Storing nested documents (arrays of objects inside a document)
// ✓ Team already knows MongoDB
// ✓ Building CMS, IoT, logging, or analytics systems

// CHOOSE PRISMA WHEN:
// ✓ Using PostgreSQL, MySQL, or SQLite
// ✓ Need strong data integrity (foreign keys, constraints)
// ✓ Want type-safe queries with autocompletion
// ✓ Need database migrations (version-controlled schema changes)
// ✓ Complex relationships (many-to-many, self-referential)
// ✓ Building production apps with strict data requirements
// ✓ Want the cleaner API (include vs populate, connect vs $push)

// BOTH WORK GREAT WITH GRAPHQL
// The GraphQL schema + queries stay IDENTICAL
// Only the resolvers (database layer) change