Schema visibility control in GraphQL - Step-by-Step Execution

Concept Flow - Schema visibility control

Define full schema

↓

Apply visibility rules

↓

Filter schema elements

↓

Expose filtered schema to client

↓

Client queries visible schema only

Start with the full schema, apply rules to hide or show parts, then expose only visible parts to clients.

Execution Sample

GraphQL

type Query {
  publicData: String
  privateData: String @private
}

schemaVisibility: {
  privateData: false
}

This schema hides 'privateData' field from clients by marking it private and setting visibility to false.

Execution Table

Step	Schema Element	Visibility Rule	Visible to Client	Reason
1	Query type	No rule	Yes	Root type always visible
2	publicData field	No rule	Yes	No visibility restriction
3	privateData field	@private directive	No	Marked private, visibility false
4	Expose schema	Filtered	Only publicData visible	privateData filtered out
5	Client query	Sees only publicData	Yes	privateData hidden

💡 All schema elements processed; privateData hidden due to visibility rule

Variable Tracker

Schema Element	Initial Visibility	After Rule Applied	Final Visibility
Query type	Visible	Visible	Visible
publicData	Visible	Visible	Visible
privateData	Visible	Hidden	Hidden

Key Moments - 2 Insights

Why is 'privateData' not visible to the client even though it is defined in the schema?

Because the visibility rule '@private' and schemaVisibility setting false hide it, as shown in execution_table step 3 and 4.

Does the root Query type ever get hidden by visibility rules?

No, the root Query type remains visible to allow clients to query public fields, as shown in execution_table step 1.

Visual Quiz - 3 Questions

Look at the execution table, which schema element is hidden from the client?

A Query type

B privateData field

C publicData field

D None

💡 Hint

Check execution_table row 3 where privateData is marked not visible

At which step does the schema get filtered to hide private fields?

A Step 4

B Step 3

C Step 1

D Step 5

💡 Hint

Look at execution_table step 4 where schema is exposed filtered

If the '@private' directive is removed from 'privateData', what happens to its visibility?

A It remains hidden

B Query type becomes hidden

C It becomes visible

D publicData becomes hidden

💡 Hint

Refer to variable_tracker where visibility changes after rule applied

Concept Snapshot

Schema visibility control in GraphQL:
- Define full schema with all fields
- Use directives like @private to mark hidden fields
- Apply visibility rules to filter schema
- Expose only visible parts to clients
- Clients can query only visible schema elements

Full Transcript

Schema visibility control means starting with a full GraphQL schema and then applying rules to hide some parts from clients. For example, fields marked with a @private directive can be hidden by setting their visibility to false. The system filters out these hidden fields before sending the schema to clients. This way, clients only see and can query the parts of the schema that are allowed. The root Query type always stays visible so clients have an entry point. This process ensures sensitive or internal data is not exposed unintentionally.