Add a GraphQL endpoint

[patch0]

This is the start of a new GraphQL API that can be used by the editor-ui to fetch projects, components, images. GraphQL provides a documented, explorable API that allows the client to pull just the data it requires to fulfill the user's request.

This PR implements the ability to query the whole schema (Project, Component, Image), and provides just one mutation CreateProject.

Authorization is performed in the same way as the existing REST API, i.e. using a HTTP header Authorization: to provide the Hydra (v1) token.

Example queries

Fetch all projects the user can read", showing fields useful for the "my projects" page

{
  projects(first: 2) {
    edges {
      node {
        id
        name
        identifier
        updatedAt
      }
    }
  }
}

returns something like:

{
  "data": {
    "projects": {
      "edges": [
        {
          "node": {
            "id": "Z2lkOi8vYXBwL1Byb2plY3QvMGMzYjM1ODItODhjYi00NDdmLTk1OTYtMGVhZWU3MTQ2NDkw",
            "name": "Codebreaker",
            "identifier": "codebreaker-project-starter",
            "updatedAt": "2023-02-16T20:57:59Z"
          }
        },
        {
          "node": {
            "id": "Z2lkOi8vYXBwL1Byb2plY3QvOTVlNTdmM2MtNzlhYy00NmNmLWFiNDQtNjUxMzhjYzAwNjJh",
            "name": "Rocket Launch Example",
            "identifier": "rocket-launch-example",
            "updatedAt": "2023-02-16T20:57:59Z"
          }
        }
      ]
    }
  }
}

Note the use of obfuscated IDs, which is usual for GraphQL.

Here is a query to fetch a project that I've not given the auth token for:

{
  project(identifier: "wok-boss-drift") {
    id
    name
    identifier
    updatedAt
  }
}

The HTTP response is a 200, but the project is null, and data contains an errors array.

{
  "data": {
    "project": null
  },
  "errors": [
    {
      "message": "An object of type Project was hidden due to permissions",
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "path": [
        "project"
      ]
    }
  ]
}

If the project doesn't exist, no errors are returned, the project is simply null.

Example mutation

This is an example of a mutation. This requires the Authorization header to be correctly set.

mutation CreateProject($project: CreateProjectInput!) {
  createProject(input: $project) {
    project {
      id
      identifier
      name
      userId
    }
  }
}

Then here are the variables

{
  "project": {
    "components": [
      {
        "content": "# Hello world!",
        "default": true,
        "extension": "py",
        "name": "main"
      }
    ],
    "name": "Project created via GraphQL!",
    "projectType": "python"
  }
}

And you have to set a header (which you can pinch from an existing editor-ui session).

 {
  "Authorization": "0xdeadbeef-redacted-secret"
}

This will then return

{
  "data": {
    "createProject": {
      "project": {
        "id": "Z2lkOi8vYXBwL1Byb2plY3QvOWJhMGNlM2EtOTAyOS00NWQxLTljYzAtZTAxN2IwYzc5Y2Rm",
        "identifier": "wok-boss-drift",
        "name": "Project created via GraphQL!",
        "userId": "132c698c-9934-48e8-b8ac-b80dfddf6ae9"
      }
    }
  }
}

Tests

Tests have been added to cover the new code.

With the GraphQL queries and mutations, I've tried to split the tests at sensible boundaries. E.g. the project_query_spec tests the ProjectType and tries to draw a line between that and any sub types, e.g. the ComponentType, ImageType. I'd anticipate those being tested separately.

Similarly the projects_query_spec doesn't test the ProjectType , but tests that an array of items with the correct __typename is returned.

[loiswells97]

Looks great! 🚢