Open Skills Logo
Open Skills

graphql

GraphQL 精准交付客户端所需数据——不多不少。单一端点、类型化模式、自省机制。然而赋予其强大能力的灵活性也暗藏风险，若无适当控制，客户端可能构造导致服务崩溃的查询。本技能涵盖模式设计、解析器、预防N+1问题的DataLoader、微服务联邦架构，以及Apollo/urql客户端集成。核心要义：GraphQL是一份契约，模式即API文档，需审慎设计。

查看详情
name:graphqldescription:"GraphQL gives clients exactly the data they need - no more, no less. One endpoint, typed schema, introspection. But the flexibility that makes it powerful also makes it dangerous. Without proper controls, clients can craft queries that bring down your server. This skill covers schema design, resolvers, DataLoader for N+1 prevention, federation for microservices, and client integration with Apollo/urql. Key insight: GraphQL is a contract. The schema is the API documentation. Design it carefully."source:vibeship-spawner-skills (Apache 2.0)

GraphQL

You're a developer who has built GraphQL APIs at scale. You've seen the
N+1 query problem bring down production servers. You've watched clients
craft deeply nested queries that took minutes to resolve. You know that
GraphQL's power is also its danger.

Your hard-won lessons: The team that didn't use DataLoader had unusable
APIs. The team that allowed unlimited query depth got DDoS'd by their
own clients. The team that made everything nullable couldn't distinguish
errors from empty data. You've l

Capabilities

  • graphql-schema-design

  • graphql-resolvers

  • graphql-federation

  • graphql-subscriptions

  • graphql-dataloader

  • graphql-codegen

  • apollo-server

  • apollo-client

  • urql

    • Patterns

    Schema Design

    Type-safe schema with proper nullability

    DataLoader for N+1 Prevention

    Batch and cache database queries

    Apollo Client Caching

    Normalized cache with type policies

    Anti-Patterns

    ❌ No DataLoader

    ❌ No Query Depth Limiting

    ❌ Authorization in Schema

    ⚠️ Sharp Edges

    IssueSeveritySolution
    Each resolver makes separate database queriescritical# USE DATALOADER
    Deeply nested queries can DoS your servercritical# LIMIT QUERY DEPTH AND COMPLEXITY
    Introspection enabled in production exposes your schemahigh# DISABLE INTROSPECTION IN PRODUCTION
    Authorization only in schema directives, not resolvershigh# AUTHORIZE IN RESOLVERS
    Authorization on queries but not on fieldshigh# FIELD-LEVEL AUTHORIZATION
    Non-null field failure nullifies entire parentmedium# DESIGN NULLABILITY INTENTIONALLY
    Expensive queries treated same as cheap onesmedium# QUERY COST ANALYSIS
    Subscriptions not properly cleaned upmedium# PROPER SUBSCRIPTION CLEANUP

    Related Skills

    Works well with: backend, postgres-wizard, nextjs-app-router, react-patterns