
Security News
New Website “Is It Really FOSS?” Tracks Transparency in Open Source Distribution Models
A new site reviews software projects to reveal if they’re truly FOSS, making complex licensing and distribution models easy to understand.
GraphQL stitching composes a single schema from multiple underlying GraphQL resources, then smartly proxies portions of incoming requests to their respective locations in dependency order and returns the merged results. This allows an entire graph of locations to be queried through one combined GraphQL surface area.
Supports:
graphql-ruby
.NOT Supported:
@requires
).This Ruby implementation is designed as a generic library to join basic spec-compliant GraphQL schemas using their existing types and fields in a do-it-yourself capacity. The opportunity here is for a Ruby application to stitch its local schemas together or onto remote sources without requiring an additional proxy service running in another language. If your goal is a purely high-throughput federation gateway with managed schema deployments, consider more opinionated frameworks such as Apollo Federation.
Add to your Gemfile:
gem "graphql-stitching"
Run bundle install
, then require unless running an autoloading framework (Rails, etc):
require "graphql/stitching"
A stitched schema is composed from many subgraph schemas. These can be remote APIs expressed as Schema Definition Language (SDL), or local schemas built from Ruby classes. Subgraph type names that overlap become merged types, and require @stitch
directives to identify where each variant of the type can be fetched and what key field links them:
schemas/product_infos.graphql
directive @stitch(key: String!, arguments: String) repeatable on FIELD_DEFINITION
type Product {
id: ID!
name: String!
}
type Query {
product(id: ID!): Product @stitch(key: "id")
}
product_prices_schema.rb
class Product < GraphQL::Schema::Object
field :id, ID, null: false
field :price, Float, null: false
end
class Query < GraphQL::Schema::Object
field :products, [Product, null: true], null: false do |f|
f.directive(GraphQL::Stitching::Directives::Stitch, key: "id")
f.argument(ids: [ID, null: false], required: true)
end
def products(ids:)
products_by_id = ProductModel.where(id: ids).index_by(&:id)
ids.map { |id| products_by_id[id] }
end
end
class ProductPricesSchema < GraphQL::Schema
directive(GraphQL::Stitching::Directives::Stitch)
query(Query)
end
These subgraph schemas are composed into a supergraph, or, a single combined schema that can be queried as one. Remote schemas are mapped to their resolver locations using executables:
client = GraphQL::Stitching::Client.new(locations: {
infos: {
schema: GraphQL::Schema.from_definition(File.read("schemas/product_infos.graphql")),
executable: GraphQL::Stitching::HttpExecutable.new(url: "http://localhost:3001"),
},
prices: {
schema: ProductPricesSchema,
},
})
A stitching client then acts as a drop-in replacement for serving GraphQL queries using the combined schema. Internally, a query is broken down by location and sequenced into multiple requests, then all results are merged and shaped to match the original query.
query = %|
query FetchProduct($id: ID!) {
product(id: $id) {
name # from infos schema
price # from prices schema
}
}
|
result = client.execute(
query: query,
variables: { "id" => "1" },
operation_name: "FetchProduct",
)
Clone this repo, then cd
into each example and follow its README instructions.
bundle install
bundle exec rake test [TEST=path/to/test.rb]
FAQs
Unknown package
We found that graphql-stitching demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A new site reviews software projects to reveal if they’re truly FOSS, making complex licensing and distribution models easy to understand.
Security News
Astral unveils pyx, a Python-native package registry in beta, designed to speed installs, enhance security, and integrate deeply with uv.
Security News
The Latio podcast explores how static and runtime reachability help teams prioritize exploitable vulnerabilities and streamline AppSec workflows.