GraphQL Project — Build a Complete Full-Stack Application

# server/src/schema/typeDefs.graphql
enum Severity { LOW MEDIUM HIGH CRITICAL }
enum DeviceStatus { ONLINE OFFLINE QUARANTINED }
enum UserRole { ADMIN ANALYST VIEWER }

type User {
  id: ID!
  email: String!
  displayName: String!
  role: UserRole!
  devices: [Device!]!
  createdAt: DateTime!
}

type Device {
  id: ID!
  name: String!
  os: String!
  status: DeviceStatus!
  user: User!
  threats: [Threat!]!
  scans: [Scan!]!
  lastScan: DateTime
}

type Threat {
  id: ID!
  name: String!
  severity: Severity!
  detectedAt: DateTime!
  resolvedAt: DateTime
  device: Device!
}

type Scan {
  id: ID!
  device: Device!
  status: ScanStatus!
  threatsFound: Int!
  startedAt: DateTime!
  completedAt: DateTime
}

enum ScanStatus { PENDING RUNNING COMPLETED FAILED }

type Query {
  me: User
  devices(status: DeviceStatus): [Device!]!
  device(id: ID!): Device
  threats(severity: Severity, limit: Int = 20): [Threat!]!
  threat(id: ID!): Threat
  search(query: String!): [SearchResult!]!
}

union SearchResult = Device | Threat | User

input CreateDeviceInput { name: String! os: String! }
input UpdateDeviceInput { name: String os: String status: DeviceStatus }

type Mutation {
  login(email: String!, password: String!): AuthPayload!
  createDevice(input: CreateDeviceInput!): Device!
  updateDevice(id: ID!, input: UpdateDeviceInput!): Device!
  deleteDevice(id: ID!): Boolean!
  reportThreat(name: String!, severity: Severity!, deviceId: ID!): Threat!
  resolveThreat(id: ID!): Threat!
  startScan(deviceId: ID!): Scan!
}

type AuthPayload {
  token: String!
  user: User!
}

type Subscription {
  threatDetected(deviceId: ID): Threat!
  scanCompleted(deviceId: ID): Scan!
  deviceStatusChanged: Device!
}

// server/src/server.js
const { ApolloServer } = require('apollo-server');
const { loadFilesSync } = require('@graphql-tools/load-files');
const { mergeTypeDefs } = require('@graphql-tools/merge');

const typeDefs = mergeTypeDefs(loadFilesSync('src/schema/*.graphql'));
const resolvers = require('./resolvers');
const { createContext } = require('./context');
const { authDirectiveTransformer } = require('./directives/auth');

let schema = makeExecutableSchema({ typeDefs, resolvers });
schema = authDirectiveTransformer(schema);

const server = new ApolloServer({
  schema,
  context: createContext,
  csrfPrevention: true,
  introspection: process.env.NODE_ENV !== 'production',
  cache: 'bounded',
  plugins: [
    responseCachePlugin(),
  ],
  validationRules: [
    depthLimit(7),
    costAnalysis({ maximumCost: 1000, defaultCost: 1 }),
  ],
});

server.listen(4000).then(({ url }) => {
  console.log(`DodaTech GraphQL API at ${url}`);
});

// client/src/App.jsx
import { ApolloClient, InMemoryCache, ApolloProvider } from '@apollo/client';
import { setContext } from '@apollo/client/link/context';
import { createHttpLink } from '@apollo/client/link/http';
import { WebSocketLink } from '@apollo/client/link/ws';
import { split } from '@apollo/client/link';
import { getMainDefinition } from '@apollo/client/utilities';
import { Dashboard } from './components/Dashboard';

const httpLink = createHttpLink({ uri: 'http://localhost:4000/graphql' });

const authLink = setContext((_, { headers }) => {
  const token = localStorage.getItem('token');
  return {
    headers: { ...headers, authorization: token ? `Bearer ${token}` : '' },
  };
});

const wsLink = new WebSocketLink({
  uri: 'ws://localhost:4000/graphql',
  options: {
    reconnect: true,
    connectionParams: { authToken: localStorage.getItem('token') },
  },
});

const link = split(
  ({ query }) => {
    const def = getMainDefinition(query);
    return def.kind === 'OperationDefinition' && def.operation === 'subscription';
  },
  wsLink,
  authLink.concat(httpLink)
);

const client = new ApolloClient({ link, cache: new InMemoryCache() });

function App() {
  return (
    <ApolloProvider client={client}>
      <Dashboard />
    </ApolloProvider>
  );
}

// client/src/components/Dashboard.jsx
import { useQuery, gql } from '@apollo/client';

const DASHBOARD_QUERY = gql`
  query Dashboard {
    me { id displayName email role }
    devices { id name os status }
    threats(severity: CRITICAL, limit: 10) {
      id name severity detectedAt device { id name }
    }
  }
`;

function Dashboard() {
  const { loading, error, data } = useQuery(DASHBOARD_QUERY);
  
  if (loading) return <LoadingSpinner />;
  if (error) return <ErrorBanner error={error} />;
  
  return (
    <div className="dashboard">
      <UserProfile user={data.me} />
      <DeviceGrid devices={data.devices} />
      <ThreatFeed threats={data.threats} />
      <ScanProgress subscription />
    </div>
  );
}

const THREAT_SUBSCRIPTION = gql`
  subscription OnThreatDetected($deviceId: ID) {
    threatDetected(deviceId: $deviceId) {
      id name severity detectedAt device { id name }
    }
  }
`;

function ThreatFeed({ threats }) {
  const { data: subscriptionData } = useSubscription(
    THREAT_SUBSCRIPTION,
    { variables: { deviceId: selectedDeviceId } }
  );
  
  // Merge subscription updates into the feed
  const allThreats = useMemo(() => {
    const threatsList = [...threats];
    if (subscriptionData?.threatDetected) {
      threatsList.unshift(subscriptionData.threatDetected);
    }
    return threatsList.slice(0, 50);
  }, [threats, subscriptionData]);
  
  return (
    <div className="threat-feed">
      <h2>Live Threat Feed</h2>
      {allThreats.map(threat => (
        <ThreatCard key={threat.id} threat={threat} />
      ))}
    </div>
  );
}

// server/src/__tests__/resolvers.test.js
describe('Mutation.reportThreat', () => {
  it('creates a threat and publishes subscription event', async () => {
    const mockPubsub = { publish: jest.fn() };
    const mockDevice = { id: 'dev-001', userId: 'user-001' };
    
    const result = await resolvers.Mutation.reportThreat(
      null,
      { name: 'Emotet', severity: 'CRITICAL', deviceId: 'dev-001' },
      { user: { id: 'user-001' }, db: mockDb, pubsub: mockPubsub }
    );
    
    expect(result.name).toBe('Emotet');
    expect(result.severity).toBe('CRITICAL');
    expect(mockPubsub.publish).toHaveBeenCalledWith(
      'THREAT_DETECTED',
      expect.objectContaining({ threatDetected: expect.objectContaining({ name: 'Emotet' }) })
    );
  });
});