1. The structure when a request responds successfully. See Figure 1.
mutation {
onlineStoreThemePreviewCodeGenerate(themeId: "vogue") {
themePreviewCode
}
}
{
"data": {
"onlineStoreThemePreviewCodeGenerate": {
"themePreviewCode": "eyJpdiI6IjZlZ3RpZzlyZmp6S3BzQWJcL0N1NVR3PT0iLCJ2YWx1ZSI6IkNGdVwvdGJMZFI2MWJPRXFMbTNhdmVOUVVCVDhzb1ZnSzFNQzd2Y1RoSElGMmw4VkxOWFppbnlNbmtjaFNnbG9FXC9Oa1hYSndRU1hlcmpFMktneFNkQmVoMjhENnoxb3dQY0lxNHZnemJrNXlLTlpNKzJmbEU4RTFXNnFza2dyVG4iLCJtYWMiOiI0NzcwZjllYjIxZDliOGFkMTU2OTdiZmVmYWViN2I2OTI5NWE0ZDFjOTBmOGU1MGMyZjI3MzBjNTQxMWE3ODQ2In0="
}
}
}
2. However, at this stage, no security validation is performed on the request parameters. Reference: https://lighthouse-php.com/master/security/validation.html#single-arguments . Lighthouse allows you to use Laravel’s validation in queries and mutations.
3. The mutation for this GraphQL API has only one request parameter, themeId, so I only need to validate whether this field exists in the table.
4. The simplest way to utilize built-in validation rules is to use the @rules directive. Use the Exists rule.
extend type Mutation {
"生成主题预览代码"
onlineStoreThemePreviewCodeGenerate(themeId: ID! @rules(apply: ["exists:theme_asset,theme_id"])): OnlineStoreThemePreviewCodeGeneratePayload @field(resolver: "Modules\\ThemeStore\\Resolver\\ThemePreview\\GenerateThemePreviewCodeResolver")
}
5. Test whether the validation rule is effective; it is confirmed to be effective. See Figure 2.
mutation {
onlineStoreThemePreviewCodeGenerate(themeId: "vogue1") {
themePreviewCode
}
}
{
"errors": [
{
"message": "Validation failed for the field [onlineStoreThemePreviewCodeGenerate].",
"extensions": {
"validation": {
"themeId": [
"The selected theme id is invalid."
]
},
"category": "validation"
},
"locations": [
{
"line": 2,
"column": 3
}
],
"path": [
"onlineStoreThemePreviewCodeGenerate"
],
"trace": ...
}
],
"data": {
"onlineStoreThemePreviewCodeGenerate": null
}
}
6. View the SQL statement in the request within Laravel Telescope.
select
count(*) as aggregate
from
`theme_asset`
where
`theme_id` = 'vogue1'
7. However, there is still a problem at this stage because the table name prefix happens to be ”. If it is set to ‘object_’, there might be an issue. I made another request and found that it threw an error, which is as expected. This indicates that the validation rule automatically reads the table prefix. No adjustment is needed. See Figure 3.
'mysql' => [
...
'prefix' => 'object_',
],
{
"errors": [
{
"debugMessage": "SQLSTATE[42S02]: Base table or view not found: 1146 Table 'object_store.object_theme_asset' doesn't exist (SQL: select count(*) as aggregate from `object_theme_asset` where `theme_id` = vogue1)",
"message": "Internal server error",
"extensions": {
"category": "internal"
},
"locations": [
{
"line": 2,
"column": 3
}
],
"path": [
"onlineStoreThemePreviewCodeGenerate"
],
"trace": [
...
]
}
],
"data": {
"onlineStoreThemePreviewCodeGenerate": null
}
}