GraphQL di Production

Checklist dan best practices untuk menjalankan GraphQL di production.

Security Checklist

• Query depth limiting — Prevent deep nesting attacks
• Query complexity analysis — Limit expensive queries
• Rate limiting — Per-user, per-query complexity
• Disable introspection — Di production, client tidak perlu schema discovery
• Persisted queries — Only allow known queries
• Input validation — Validate semua mutation input

Monitoring

// Track per-operation metrics
plugin: {
  requestDidStart() {
    const start = Date.now();
    return {
      didResolveOperation({ operationName }) {
        // Log operation name
      },
      willSendResponse() {
        const duration = Date.now() - start;
        metrics.histogram("graphql.duration", duration, {
          operation: operationName,
        });
      },
    };
  },
}

Schema Registry

Track schema changes seperti database migrations:

• Version schema di git
• CI check: breaking changes → block merge
• Changelog: auto-generate dari schema diff

Production Stack

Gateway:     Apollo Router / Yoga
Framework:   Apollo Server / Mercurius (Fastify)
ORM:         Prisma (generates types from DB)
Monitoring:  Apollo Studio / Grafana
Caching:     Redis + Apollo InMemoryCache
Auth:        JWT/PASETO in context
DataLoader:  Per-request batching

Migration from REST

1. Wrap existing REST endpoints di GraphQL resolvers
2. Client mulai pakai GraphQL untuk query baru
3. Gradually move data fetching dari REST ke direct DB/service calls
4. Deprecate REST endpoints yang tidak dipakai