What problem does it solve? Local Apollo Server mocks and GraphQL resolvers often ship with unsafe defaults—client-writable IDs, leaked internal error details, unbounded queries, and drifting upstream contract versions—that become unsafe assumptions in production client code. This Skill enforces four non-negotiable hardening patterns whenever resolvers, error formatters, validation rules, or version pins change. ## Core Features & Use Cases - Server-owned identity: Generate primary keys in the resolver, reject client-supplied IDs and clientMutationId derivation, and build stored entities from an explicit input allow-list to prevent mass assignment. - Allow-listed responses: Rebuild error responses field by field with stable codes, generic messages, and correlation IDs, keeping stacktraces and internal details out of client-visible output. - Query budget enforcement: Apply depth, cost, page-size, and parser token limits so oversized or expensive operations are rejected with client errors instead of crashing the server. - Single version pin: Keep the GraphQL schema, OpenAPI spec, and mock fixtures interpolated from one upstream version variable, refreshed through the repository's contract targets. - Use Case: When adding a createUser mutation to the mock under docker/apollo-server, apply this Skill to generate the ID server-side, create the record unconfirmed, extend depth and page-size guards, and add a server-side unit test asserting only allow-listed fields appear in the response. ## Quick Start Ask the AI to review the resolver and error formatter changes in docker/apollo-server using the graphql-api-hardening skill before committing.
