GraphQL Apollo Server — Production Configuration and Deployment

const { ApolloServer } = require('apollo-server');
const { ApolloServerPluginCacheControl } = require('apollo-server-core');
const responseCachePlugin = require('apollo-server-plugin-response-cache');

const server = new ApolloServer({
  typeDefs,
  resolvers,
  
  // Security
  csrfPrevention: true,
  introspection: process.env.NODE_ENV !== 'production',
  
  // Caching
  cache: 'bounded',        // Bounded in-memory cache (LRU)
  persistedQueries: {      // Automatic Persisted Queries
    ttl: 900,              // Cache persisted queries for 15 min
  },
  
  // Context
  context: async ({ req }) => ({
    user: await authenticate(req),
    db,
    loaders: createLoaders(),
  }),
  
  // Plugins
  plugins: [
    ApolloServerPluginCacheControl({ defaultMaxAge: 300 }),
    responseCachePlugin(),
  ],
  
  // Validation rules
  validationRules: [
    depthLimit(7),
  ],
  
  // Error handling
  formatError: (err) => ({
    message: err.message,
    extensions: {
      code: err.extensions?.code || 'INTERNAL_ERROR',
    },
  }),
});

server.listen(4000).then(({ url }) => console.log(`Server at ${url}`));

const express = require('express');
const { ApolloServer } = require('apollo-server-express');
const { ApolloServerPluginDrainHttpServer } = require('apollo-server-core');
const http = require('http');

async function startServer() {
  const app = express();
  const httpServer = http.createServer(app);
  
  // Express middleware
  app.use(express.json({ limit: '1mb' }));
  app.use(cors({ origin: ['https://dashboard.dodatech.com'] }));
  app.use(rateLimit({ windowMs: 60000, max: 100 }));
  
  const server = new ApolloServer({
    typeDefs,
    resolvers,
    csrfPrevention: true,
    plugins: [
      ApolloServerPluginDrainHttpServer({ httpServer }),
    ],
    context: ({ req }) => ({
      user: authenticate(req),
      db,
    }),
  });
  
  await server.start();
  server.applyMiddleware({ app, path: '/graphql' });
  
  httpServer.listen(4000, () => {
    console.log(`Server at http://localhost:4000${server.graphqlPath}`);
  });
}

startServer();

// Schema-level cache hints
type Threat @cacheControl(maxAge: 60) {
  id: ID!
  name: String!
  severity: Severity!
  # Real-time data — don't cache
  status: ThreatStatus @cacheControl(maxAge: 0)
}

type Query {
  # Cache threat lists for 5 minutes
  threats: [Threat!]! @cacheControl(maxAge: 300)
  # Cache device list for 30 seconds
  devices: [Device!]! @cacheControl(maxAge: 30)
  # Never cache user-specific data
  myProfile: User! @cacheControl(maxAge: 0)
}

const { ApolloServer } = require('apollo-server');
const responseCachePlugin = require('apollo-server-plugin-response-cache');

const server = new ApolloServer({
  typeDefs,
  resolvers,
  cache: 'bounded',
  plugins: [
    responseCachePlugin({
      // Custom cache key based on user role
      sessionId: (requestContext) => {
        const user = requestContext.context.user;
        return user ? `${user.role}:${user.id}` : 'anonymous';
      },
    }),
  ],
});

// Automatic Persisted Queries (APQ)
// Client sends hash instead of full query

// Server
const server = new ApolloServer({
  typeDefs,
  resolvers,
  persistedQueries: {
    ttl: 900,          // Cache for 15 minutes
    cache: 'bounded',   // Use server cache
  },
});

// First request: { query: "query { ... }", extensions: { persistedQuery: { version: 1, sha256Hash: "abc..." } } }
// Server: Registers query, returns result
// Subsequent requests: { extensions: { persistedQuery: { version: 1, sha256Hash: "abc..." } } }
// Server: Looks up cached query, returns result
// Benefits: Up to 90% bandwidth reduction for repeated queries

const depthLimit = require('graphql-depth-limit');
const { costAnalysis } = require('graphql-cost-analysis');

const server = new ApolloServer({
  typeDefs,
  resolvers,
  
  // Prevent deeply nested malicious queries
  validationRules: [
    depthLimit(7),  // Max 7 levels of nesting
    costAnalysis({
      maximumCost: 1000,
      defaultCost: 1,
      costMap: {
        "Device.threats": 10,    // Expensive field — higher cost
        "User.devices": 5,
        "Threat.analysis": 8,
      },
    }),
  ],
  
  // CSRF protection
  csrfPrevention: true,
  
  // Disable introspection in production
  introspection: process.env.NODE_ENV !== 'production',
  
  // Upload limits
  maxFileSize: 10 * 1024 * 1024, // 10MB
});

const { ApolloServerPluginUsageReporting } = require('apollo-server-core');

const server = new ApolloServer({
  typeDefs,
  resolvers,
  plugins: [
    // Apollo Studio reporting
    ApolloServerPluginUsageReporting({
      sendReportsImmediately: true,
      // Mask variables to avoid sending sensitive data
      sendVariableValues: { only: ['severity', 'limit', 'offset'] },
      sendHeaders: { except: ['Authorization'] },
    }),
    
    // Custom logging plugin
    {
      requestDidStart(requestContext) {
        const startTime = Date.now();
        const query = requestContext.request.query;
        
        return {
          didEncounterErrors(ctx) {
            logger.error('GraphQL errors:', ctx.errors);
          },
          willSendResponse(ctx) {
            const duration = Date.now() - startTime;
            logger.info({
              operation: ctx.operationName || 'anonymous',
              duration,
              errors: ctx.errors?.length || 0,
            });
            // Alert on slow queries
            if (duration > 1000) {
              logger.warn('Slow query detected', {
                operation: ctx.operationName,
                query: query?.substring(0, 200),
                duration,
              });
            }
          },
        };
      },
    },
  ],
});