graphqltypegraphqltypegoose

Protect fields from GraphQL querying

I have this User model in TypeGraphQL with TypeGoose:

@index({ email: 1 })
@queryMethod(findByEmail)
@ObjectType()
export class User {
  @Field(() => String)
  _id: string;

  @Field(() => String)
  @prop({ required: true })
  name: string;

  @Field(() => String)
  @prop({ required: true })
  email: string;

  @Field(() => String)
  @prop({ required: true })
  password: string;
}

But what currently one could query the (albeit encrypted) password using the GraphQL querying. Is there a way to make the password field not queryable?

Solution

  • As @W.S. pointed out, removing the @Field(() => String) annotation from the password property made the field not queryable.