Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Harden and extend a GraphQL API for production. Add AUTHENTICATION/AUTHORIZATION enforced in resolvers via context (not just at a gateway), a real-time SUBSCRIPTION over WebSocket using graphql-ws (not the deprecated transport), and SECURITY controls: query depth + complexity/cost limiting, disabling introspection in production, and rate limiting. Then build a TYPED client (Apollo Client or urql) that consumes it, generating typed operations with GraphQL Code Generator. Document the threat model (a single deep query can be expensive) and how each control mitigates it.
AuthN/AuthZ enforced in resolvers/context per field or object; the client is never trusted; no gateway-only auth.
A working subscription over WebSocket via graphql-ws (modern protocol); pushes updates on a real event.
Query depth + complexity limits, introspection disabled in prod, rate limiting; threat model articulated.
A client consumes the API with codegen-typed operations; cache + variables used correctly.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A production GraphQL API: auth, subscriptions & security ## Goal Harden and extend a GraphQL API for production. Add AUTHENTICATION/AUTHORIZATION enforced in resolvers via context (not just at a gateway), a real-time SUBSCRIPTION over WebSocket using graphql-ws (not the deprecated transport), and SECURITY controls: query depth + complexity/cost limiting, disabling introspection in production, and rate limiting. Then build a TYPED client (Apollo Client or urql) that consumes it, generating typed operations with GraphQL Code Generator. Document the threat model (a single deep query can be expensive) and how each control mitigates it. ## Acceptance criteria - [ ] Auth in resolvers: AuthN/AuthZ enforced in resolvers/context per field or object; the client is never trusted; no gateway-only auth. - [ ] Subscriptions: A working subscription over WebSocket via graphql-ws (modern protocol); pushes updates on a real event. - [ ] Security controls: Query depth + complexity limits, introspection disabled in prod, rate limiting; threat model articulated. - [ ] Typed client: A client consumes the API with codegen-typed operations; cache + variables used correctly. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.