Today we take Day 1's single API and turn it into a production-grade supergraph: federated services behind Apollo Router, schema management with Rover and GraphQL Inspector, authorization for PII, caching, and error handling — capped with a capstone track you choose.
- Slides: slides.com/moonhighway/graphql-day2
- Eve Porcello: Twitter | Email
- Moon Highway Training: Website | Mailing List | Articles
-
Node 20+ (
node --version) -
Rover CLI:
curl -sSL https://rover.apollo.dev/nix/latest | sh rover --version -
Clone this repo — each project in
projects/installs independently withnpm install
OR
Use GitHub Codespaces for an "in cloud" version!
No accounts needed today — every lab runs locally with open-source tools.
| # | Lesson | Hands-on |
|---|---|---|
| 01 | Microservices & Federation Overview | — |
| 02 | Subgraphs, Entities & Reference Resolvers | 03-snowtooth-supergraph demo · Lab 01: Pet Library Supergraph |
| 03 | The Router, Rover & Schema Management | Lab 02: Evolve a schema without breaking clients |
| 04 | Graph Security & Authorization Strategies | Lab 03: Attack and protect |
| 05 | Caching, Error Handling & Performance | 01-snowtooth-monolith npm run cached demo |
| — | Capstone | Lab 04: Capstone — pick your track |
Every lab has a start/ folder (work here) and a complete/ folder (the finished state — diff against it or catch up from it). The capstone has neither: that one's yours.
| Project | What it is | Ports |
|---|---|---|
01-snowtooth-monolith |
Day 1's API as one graph + response-caching demo | 4000 |
02-coffee-shop-api |
Tiny monolith for the schema-evolution lab | 4000 |
03-snowtooth-supergraph |
Lifts + Trails subgraphs composed by Apollo Router | 4001, 4002 → router 4000 |
04-federated-pets |
Pet Library as a two-subgraph lab | 4003, 4004 → router 4000 |
05-snowtooth-security |
Unprotected start/ vs. hardened complete/ |
4000 |
06-capstone |
Runnable subgraph template + composition config for your capstone track | 4005, 4006 |
Projects that share port 4000 are used in different sessions — stop one before starting the next.
- Apollo Federation docs
- Apollo Router
- Rover CLI
- Entities &
@key - GraphQL Inspector — schema diffing & CI checks
- OWASP GraphQL Cheat Sheet
- Router authorization (
@authenticated,@requiresScopes) - Demand control (depth & cost limits in the router)
- Persisted queries / trusted documents
- Server-side caching
- Apollo Client caching
- Subgraph error inclusion
- 200 OK! Error handling in GraphQL (Sasha Solomon)
- DataLoader
| Package | Version | Notes |
|---|---|---|
@apollo/server |
^5 | Node 20+, graphql ≥ 16.11 |
@apollo/subgraph |
^2.14 | Federation 2.9 schemas |
| Rover | latest | rover dev runs a local router |
Thanks for a great two days — keep in touch! ✉️ eve@moonhighway.com