Using @include with fields that have conditional visibility

[mroach]

Some parts of our schema are guarded by feature toggles. When the toggles are off, we use visible? to control the field's visibility. Trying to resolve some fields guarded by toggles would cause server-side errors, so we don't want that.

We expose the feature toggles and their state to callers so they know which ones are on and off. We had thought that they could use this to conditionally include fields in the query, but this doesn't work.

As an example

field :chat_widget_user_hash, String, null: false, guarded_by_toggle: :chat_widget

# `guarded_by_feature_toggle` affects `visible?` on the field

query Me($chat_widget: Boolean!) {
  me {
    id
    email
    chatWidgetUserHash @include(if: $chat_widget)
  }
}

The problem is that when the field is not visible, trying to run that query doesn't work since the field doesn't exist.

The question is: is this considered to be correct? I can imagine it from both ways. You could argue that @include should prevent the field from being considered at all. On the other hand, this protects you from referencing something that isn't valid. This strikes me as a similar behavioural distinction between interpreted and compiled languages.

In Ruby you could write code like this and your app will work fine:

if false
  SomeBogusClassThatDoesNotExist.to_i / 0
end

But in Java, C#, Rust, etc, you can't do that and you'll get compiler errors.

Is there a standard for this in GraphQL?

Our solution for now is to isolate this field into its own query and make execution of the query itself conditional.

[rmosolgo]

Is this considered to be correct?

Yes, it's required that all fields in a query exist in the schema, see: https://spec.graphql.org/draft/#sec-Field-Selections.Formal-Specification

How about using def authorized? instead of def visible? for these fields? def authorized? is only called if a field will actually be executed. So you could include it in a query but guard it with @include, and use authorized? to make sure it's never run when it shouldn't be.

[mroach]

Thanks for the link to the docs. Good to know what the proper behaviour is :)

We're using Pundit integration. Will overriding authorized? interfere with that at all?

[rmosolgo]

As long as you call super, everything should keep working just fine 👍