Skip to content

3.3.0: fragment masking and persisted documents - #17

Merged
ifmelate merged 5 commits into
masterfrom
feat/masking-persisted
Oct 25, 2026
Merged

ifmelate merged 5 commits into
masterfrom
feat/masking-persisted

Conversation

@ifmelate

Copy link
Copy Markdown
Owner

Two opt-in options, both off by default.

fragment_masking

A spread fragment's fields stay off the class that spreads it; the class gets one member with the fragment's data instead (me.userCard.avatarUrl). The member is parsed from the same JSON object and toJson() merges it back, so cache writes stay complete. Fragments mask the fragments they spread. Spreads under @skip/@include and fragments from fragment_imports stay unmasked.

persisted_documents

Every operation document gets an id (sha256 by default, or sha1/md5) and a JSON manifest maps ids to documents; directory: also writes <id>.graphql files (Hot Chocolate's file system storage). PersistedDocumentsSerializer for HttpLink sends the id as extensions.persistedQuery, documentId or id. The id hashes the text package:graphql actually sends: gql() adds a root __typename, which a first version missed.

Tests

  • Compile tests run the generated code: masking against GraphQLClient and its cache; persisted documents against a local HTTP server that only knows the manifest, in all three formats.
  • Checked by hand against a local Hot Chocolate 15.0.3 server allowing only persisted documents: queries and mutations by id and by the Apollo format (with the SHA-256 hex provider) run; text documents are refused. README describes the server setup.

A spread becomes one member holding the fragment's data, parsed from the
same JSON object; toJson merges it back. Conditional spreads and fragments
of other packages stay unmasked. Also reads the persisted_documents option.
Ids hash the text package:graphql sends (gql() adds root __typename).
PersistedDocumentsSerializer sends the id as extensions.persistedQuery,
documentId or id; directory: writes <id>.graphql files for Hot Chocolate.
…l server

The apollo format works with its SHA-256 hex provider, id with any;
documentId isn't read, and a document next to an id is refused when only
persisted documents are allowed. Moves a prune_types note back.
@ifmelate
ifmelate merged commit ac19859 into master Oct 25, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant