graphql-tools

The #1 missing piece for graphql to be clearly way better than alternatives (IMHO), is a functional authorization rule engine. Basically, we need a way to easily write fine-grained attribute-based access control functions like “allow authors to edit and delete the content field of their posts” or “only allow doctors to see records for their patients” — inspired by Nader Dabit’s (et al) interesting work on AWS amplify auth directive here: [packages/graphql-auth-transformer/src/ModelAuthTransformer.ts](https://github.com/aws-amplify/amplify-cli/blob/master/packa...) I carped on the Apollo folks about this and provided a [hackish Ramda solution](https://github.com/ardatan/graphql-tools/issues/1234#issueco...) which seems to have helped lead to [functional directives in graphql-tools](https://www.graphql-tools.com/docs/schema-directives#at-le

The ecosystem is rather new, but the folks from Apollo have been doing amazing work. Between graphql-tools, graphql-server and Apollo Client most of the big chunks are done for you. (including very bleeding edge stuff like subscriptions) The one big unsolved issue right now is Authorization, i.e. how do you handle permissions? (everything else, like authentication, you can handle with the server itself or there's tooling for it) I'm collaborating with the Apollo folks on some possible solutions, if you're interested read this issue and chime in: https://github.com/apollographql/graphql-tools/issues/313