Building GraphQL APIs on DomainIndia: Apollo Server, Hasura, and Best Practices

# Building GraphQL APIs on DomainIndia: Apollo Server, Hasura, and Best Practices ## GraphQL vs REST — when to pick which **Pick GraphQL when:** - Multiple clients (web + iOS + Android) need different fields - Deep nested data (user → posts → comments) where REST would need 3+ requests - Rapidly evolving frontend — backend doesn't need to deploy new endpoints **Stick with REST when:** - Simple CRUD - HTTP caching is critical - Team is small and REST-experienced ## Option A — Apollo Server (Node.js) Full control, custom resolvers, flexible auth. ```bash mkdir gql-api && cd gql-api npm init -y npm install @apollo/server graphql @as-integrations/express4 express ``` `server.js`: ```javascript import { ApolloServer } from '@apollo/server'; import { expressMiddleware } from '@as-integrations/express4'; import express from 'express'; const typeDefs = `#graphql type User { id: ID! name: String! email: String! posts: [Post!]! } type Post { id: ID! title: String! author: User! } type Query { user(id: ID!): User posts: [Post!]! } type Mutation { createPost(title: String!, authorId: ID!): Post! } `; const resolvers = { Query: { user: async (_, { id }, { db }) => db.user.findUnique({ where: { id } }), posts: async (_, __, { db }) => db.post.findMany(), }, User: { posts: async (user, _, { db }) => db.post.findMany({ where: { authorId: user.id } }), }, Post: { author: async (post, _, { db }) => db.user.findUnique({ where: { id: post.authorId } }), }, Mutation: { createPost: async (_, args, { db }) => db.post.create({ data: args }), }, }; const apollo = new ApolloServer({ typeDefs, resolvers }); await apollo.start(); const app = express(); app.use('/graphql', express.json(), expressMiddleware(apollo, { context: async ({ req }) => ({ db: prismaClient, user: req.user }), })); app.listen(4000, () => console.log('http://localhost:4000/graphql')); ``` Deploy on DomainIndia: - Shared cPanel: "Setup Node.js App" — same pattern as any Express API - VPS: systemd + nginx reverse proxy (see our [Node.js Development articles](https://domainindia.com/support/kb/category/dev-nodejs)) ## Option B — Hasura (instant GraphQL over PostgreSQL) Hasura reads your PostgreSQL schema and exposes a full GraphQL API — no resolvers to write. Install on VPS: ```bash # Docker-based (easiest) docker run -d -p 8080:8080 -e HASURA_GRAPHQL_DATABASE_URL=postgres://user:pass@localhost/mydb -e HASURA_GRAPHQL_ENABLE_CONSOLE=true -e HASURA_GRAPHQL_ADMIN_SECRET=supersecret hasura/graphql-engine:v2.36.0 ``` Visit `http://your-vps:8080/console`, log in with the admin secret, and every table is now queryable via GraphQL. Permissions, subscriptions (real-time), derived relationships — all via UI. ## The N+1 problem (and DataLoader fix) Classic GraphQL trap. Query: ```graphql { posts { title author { name } } } ``` Naive resolver runs: - 1 query for all posts - 1 query per post to get each author 100 posts = 101 queries. Disaster. **Fix: batch with DataLoader** ```javascript import DataLoader from 'dataloader'; const userLoader = new DataLoader(async (ids) => { const users = await db.user.findMany({ where: { id: { in: ids } } }); return ids.map(id => users.find(u => u.id === id)); }); // In resolver: author: async (post) => userLoader.load(post.authorId) ``` Now 100 posts = 2 queries (all posts + all authors batched). ## Authentication patterns Three common approaches: **JWT in Authorization header:** ```javascript context: async ({ req }) => { const token = req.headers.authorization?.replace('Bearer ', ''); const user = token ? jwt.verify(token, JWT_SECRET) : null; return { user, db }; } ``` **Session cookie:** use express-session middleware before Apollo. **Hasura JWT mode:** Hasura validates JWT issued by your auth service (Auth0, Firebase Auth, custom). Claims map to PostgreSQL roles for row-level permissions. ## Rate limiting GraphQL's flexibility lets clients ask for deeply nested data — one query can become expensive. Defend: **Query complexity analysis** (graphql-query-complexity): ```javascript import { createComplexityRule } from 'graphql-query-complexity'; plugins: [{ async requestDidStart() { return { async didResolveOperation({ request, document }) { const complexity = getComplexity({ schema, query: document, variables: request.variables, estimators: [simpleEstimator({ defaultComplexity: 1 })], }); if (complexity > 1000) throw new Error(`Query too complex: ${complexity}`); }, }; } }] ``` **Depth limiting:** ```javascript import depthLimit from 'graphql-depth-limit'; validationRules: [depthLimit(7)] ``` ## Common pitfalls ## FAQ