Disable class mutations on GraphQL

Parse Server 📡 GraphQL API
1

Is there a way to disable the class mutations (like createClass) on the GraphQL server? I set allowClientClassCreation on new ParseServer(), but the mutations are still present in the schema and actually work.

2

Yes. It’s possible: GraphQL API Guide | Parse

But I believe you will have to list each of the classes on the config.

1 Like
3

Yes. It’s possible: GraphQL API Guide | Parse

Thank you, but I don’t mean operations to create entries on the DB, I mean the mutations to create actual new classes:

createClass(
input: CreateClassInput!
): CreateClassPayload
4

Got it. Sorry for the misunderstanding. I’ve just checked the code and there is currently no way to disable these mutations. They require sending master key though. So clients that do not have master key will actually not be able to use them.

5

Maybe it would be good to add an option to remove it either way. Would you be interested in working on this issue?

6

Yes, but I’ll only have time to tackle in a few weeks. If you can give me a quick rundown of what should be done I’ll be happy to send a PR later.

7

Sure.

This is the graphql config controller which you will probably have to change to include the new option: parse-server/ParseGraphQLController.js at alpha · parse-community/parse-server · GitHub

And this is where the default mutations are loaded: parse-server/ParseGraphQLSchema.js at alpha · parse-community/parse-server · GitHub

You will probably have to pass the option to this function to conditionally load the user class mutations. If you want to also include flags for queries and maybe to the other default mutations/queries, it would be very welcomed. :slight_smile: