Hello everyone!
I want to add a mutation to bulk-update several app entities at the same time.
For context: we use GraphQL internally, meaning S2S and not exposed to the outside (GraphQL assumes all calls were already authenticated).
The action itself requires three things:
- The obvious array of app update objects (with the app-id and any other input that will change in that app)
- A user ID for auditing purposes
- An account ID for checking that all the apps belong to the same account (to avoid any malicious updates on apps in another account)
My question is - how does this mutation get those parameters? In other words - what should be in the mutation’s signature in the schema?
My position is that the mutation itself should only receive the app update array, and send both the user-id and the acc-id as HTTP headers (which we use as our comms protocol). I’m in the opinion that the schema should only describe the action itself, and that user-id and acc-id are context. The way I see it, a mutation called “updateApps” should get an array of apps, and nothing more (schematically speaking).
As an example, the product may decide later on that it’s possible that someone can update apps from multiple accounts. This will not change the actual database query, but only the orchestration around it (maybe get a bunch of acc-id’s in the header, or stop getting them at all).
What do you think?
Thanks! 