Schema visibility control in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

What is the result of querying a hidden field?

Consider a GraphQL schema where the field secretInfo is marked as hidden using schema visibility control. What will be the result when a client queries secretInfo?

GraphQL

query {
  secretInfo
}

A The query returns an error indicating <code>secretInfo</code> does not exist.

B The query returns the value of <code>secretInfo</code> as normal.

C The query returns <code>null</code> for <code>secretInfo</code> without error.

D The query returns all fields except <code>secretInfo</code> silently.

💡 Hint

Think about how schema visibility hides fields from clients.

If a field is hidden by schema visibility control, it is removed from the schema exposed to clients. Querying it causes an error because the client does not see it as a valid field.

🧠 Conceptual

intermediate

Why use schema visibility control in GraphQL?

Which of the following is the main reason to use schema visibility control in a GraphQL API?

A To improve query performance by caching hidden fields.

B To allow clients to modify the schema dynamically.

C To automatically generate documentation for all fields.

D To restrict access to sensitive fields based on client roles.

💡 Hint

Think about controlling what clients can see.

Schema visibility control is used to hide sensitive or restricted fields from clients who should not access them, often based on roles or permissions.

📝 Syntax

advanced

Identify the correct way to hide a field in GraphQL SDL

Given the following GraphQL SDL snippet, which option correctly hides the internalNotes field using a directive @hidden?

GraphQL

type Product {
  id: ID!
  name: String!
  internalNotes: String @hidden
}

A

type Product {
  id: ID!
  name: String!
  internalNotes: String @hidden
}

B

type Product {
  id: ID!
  name: String!
  internalNotes: String @private
}

C

type Product {
  id: ID!
  name: String!
  internalNotes: String hidden
}

D

type Product {
  id: ID!
  name: String!
  internalNotes: String #hidden
}

💡 Hint

Directives start with @ in SDL.

In GraphQL SDL, directives are prefixed with @. Using @hidden is the correct way to mark a field as hidden if the schema supports that directive.

❓ optimization

advanced

How does schema visibility control improve API security?

Which of the following best explains how schema visibility control enhances security in a GraphQL API?

A By limiting the number of queries a client can send per minute.

B By preventing clients from discovering and querying sensitive fields.

C By automatically validating all input data types.

D By encrypting all data sent over the network.

💡 Hint

Think about what clients can see in the schema.

Schema visibility control hides sensitive fields from the schema exposed to clients, so clients cannot even see or query those fields, reducing attack surface.

🔧 Debug

expert

Why does this query fail when using schema visibility control?

Given a GraphQL schema where the adminNotes field is hidden for non-admin users, a non-admin client runs this query:

query {
  product(id: "123") {
    id
    name
    adminNotes
  }
}

Why does this query fail?

A Because the query syntax is invalid due to missing brackets.

B Because the <code>product</code> type does not have an <code>adminNotes</code> field at all.

C Because <code>adminNotes</code> is not visible in the schema for this client, causing a validation error.

D Because the client does not have permission to query <code>id</code> and <code>name</code> fields.

💡 Hint

Consider what happens when a field is hidden from a client.

The adminNotes field is hidden for non-admin clients, so it is not part of the schema they see. Querying it causes a validation error because the field is unknown.

Practice

1. What is the main purpose of schema visibility control in GraphQL?

easy

A. To limit what parts of the schema users can see or access

B. To speed up query execution by caching results

C. To automatically generate schema documentation

D. To convert GraphQL queries into SQL queries

Solution

1. Step 1: Understand schema visibility control concept

   Schema visibility control is about restricting access to parts of the GraphQL schema based on user roles or permissions.

2. Step 2: Identify the main goal

   The goal is to protect sensitive data and tailor the API by limiting what users can see or use.

3. Final Answer:

   To limit what parts of the schema users can see or access -> Option A

4. Quick Check:

   Schema visibility control = limit schema access [OK]

Hint: Focus on access limits, not performance or docs [OK]

Common Mistakes:

• Confusing visibility control with caching
• Thinking it auto-generates docs
• Assuming it converts queries to SQL

2. Which of the following is a correct way to hide a field in a GraphQL schema using a directive?

easy

A. @deprecated(reason: "hidden") on the field

B. @private on the query operation

C. @skip(if: false) on the schema type

D. @hide(if: true) on the field definition

Solution

1. Step 1: Understand directive usage for visibility

   Directives like @hide(if: true) can be used on fields to conditionally hide them based on logic.

2. Step 2: Evaluate options

   @private is not a standard directive; @skip(if: false) means do not skip (show field); @deprecated marks fields as deprecated but does not hide them.

3. Final Answer:

   @hide(if: true) on the field definition -> Option D

4. Quick Check:

   Use conditional directives like @hide to control visibility [OK]

Hint: Look for conditional directive on field, not operation [OK]

Common Mistakes:

• Using @deprecated to hide fields
• Applying directives on queries instead of fields
• Misunderstanding @skip logic

3. Given this schema snippet with a visibility directive:

type User {
  id: ID!
  email: String @hide(if: $isGuest)
  name: String
}

What fields will a guest user see if $isGuest is true?

medium

A. id and name only

B. id, email, and name

C. email and name only

D. id and email only

Solution

1. Step 1: Analyze the directive condition

   The @hide(if: $isGuest) directive hides the email field when $isGuest is true.

2. Step 2: Determine visible fields for guest

   Since $isGuest is true, email is hidden. The visible fields are id and name.

3. Final Answer:

   id and name only -> Option A

4. Quick Check:

   @hide(if: true) hides field = id and name visible [OK]

Hint: True condition hides field, so exclude it [OK]

Common Mistakes:

• Including hidden fields in output
• Confusing @hide with @skip
• Ignoring variable values in directives

4. You wrote this directive to hide a field:

email: String @hide(if: isGuest)

But the field is always visible. What is the likely error?

medium

A. Using @hide on a field is not supported

B. Missing $ before variable name in directive condition

C. The field type String cannot have directives

D. The directive should be @skip, not @hide

Solution

1. Step 1: Check variable usage in directive

   GraphQL variables in directives must be prefixed with $. Here, isGuest is missing $.

2. Step 2: Understand impact of missing $

   Without $, the directive condition is invalid or always false, so the field is never hidden.

3. Final Answer:

   Missing $ before variable name in directive condition -> Option B

4. Quick Check:

   Variables need $ prefix in directives [OK]

Hint: Always prefix variables with $ in directives [OK]

Common Mistakes:

• Forgetting $ before variable in directive
• Assuming @hide is unsupported
• Thinking directives can't be on scalar fields

5. You want to create a GraphQL API that shows users' email only to admins and hides it from regular users. Which approach best implements this schema visibility control?

hard

A. Return null for email in resolver for regular users without schema changes

B. Remove the email field from the schema entirely

C. Use @hide(if: $isNotAdmin) on the email field and pass $isNotAdmin from server context

D. Use @deprecated directive on email field for regular users

Solution

1. Step 1: Identify requirement for conditional visibility

   The email field should be visible only to admins, so visibility depends on user role.

2. Step 2: Evaluate options for controlling visibility

   Use a directive like @hide(if: $isNotAdmin) on the email field and pass $isNotAdmin from server context. This uses a directive with a variable from server context to hide email for non-admins, which is the correct schema visibility control method.

3. Step 3: Understand why other options fail

   Removing the field removes it for all users; @deprecated only marks as outdated; returning null hides data but not schema field.

4. Final Answer:

   Use @hide(if: $isNotAdmin) on the email field and pass $isNotAdmin from server context -> Option C

5. Quick Check:

   Use conditional directives with server variables for visibility [OK]

Hint: Use directives with server variables for role-based hiding [OK]

Common Mistakes:

• Removing fields instead of hiding conditionally
• Using @deprecated to hide fields
• Returning null but not hiding schema field