graphql-schema

Use DataLoader to batch and cache database queries per request. Instead of querying posts for each user individually, DataLoader collects all author IDs and runs a single WHERE author_id IN (...) query, returning results in the requested order.

Follow the Relay Connection spec with edges, nodes, and PageInfo containing hasNextPage and endCursor. Resolvers fetch first+1 records using the cursor as a database offset, then slice the extra record to determine if more pages exist.

Yes, subscriptions use PubSub from graphql-subscriptions to publish events from mutations and deliver them to subscribed clients. Resolvers return pubsub.asyncIterator for channels, and clients connect via WebSocket using Apollo Client's useSubscription hook.

Implement authorization in field resolvers by checking the context user before returning sensitive fields, or use schema directives like @auth(requires: ADMIN). Field-level checks let different users see different fields on the same object type.

Malicious or poorly written nested queries can overwhelm the server with exponential database load. Use graphql-depth-limit and complexity validation rules to reject queries exceeding thresholds like depth 5 or complexity 1000.