April 2024 Summaries

Cosmo OSS Schema Registry Compatibility Mode for Apollo Router and Gateway is a feature that enables users to transition seamlessly from Apollo GraphOS to the open-source Cosmo schema registry without changing their existing Apollo Router or Gateway setup. This mode works by publishing Subgraphs to Cosmo, configuring WebHooks, using specific CLI commands to fetch Supergraph compositions, generating Supergraph Schema configuration files, and updating Apollo Router or Gateway configurations accordingly. The compatibility mode allows users to migrate from a closed-source solution (Apollo GraphOS) to an open-source one (Cosmo), enabling gradual migration without disrupting existing setups.

Monkey Factory, a SaaS company focused on mobility solutions like bus, bike rental, and car sharing, transitioned from Apollo Studio to WunderGraph Cosmo due to the need for cost-effective, real-time GraphQL subscriptions integral to their event-driven product. The company's extensive use of microservices necessitated GraphQL Federation for a unified front-end graph, but Apollo's pricing and subscription capabilities proved inadequate. Cosmo's event-driven federated subscriptions (EDFS) over NATS suited their asynchronous and event-sourcing needs, allowing for efficient user-specific data targeting via authentication claims. This shift has paved the way for further enhancements, such as wrapping external APIs and implementing fine-grained rate limiting for resource-intensive queries. WunderGraph's responsive support has facilitated this transition, ensuring quick resolution of potential issues, thereby aligning with Monkey Factory's need for a robust event-driven infrastructure.

Single Sign-On (SSO) is a crucial feature for modern SaaS applications and Enterprise software, allowing users to sign in once and access multiple applications without having to sign in again. OpenID Connect (OIDC) is an identity layer on top of OAuth 2.0 that allows clients to verify the identity of end-users based on authentication performed by an authorization server and obtain basic profile information. However, OIDC lacks a standardized way to manage user identities and their attributes across different applications, which can lead to manual management or implementing custom solutions. This is where SCIM (System for Cross-domain Identity Management) comes in, providing a standard protocol for automating the exchange of user identity information between identity domains, improving the user experience and security of SSO implementations. By using SCIM alongside OIDC, companies can automate the onboarding and offboarding of employees, manage user permissions across different applications, and provide a seamless and secure SSO experience for their users.

Distributed GraphQL Subscriptions with NATS and Event Driven Architecture is a powerful approach to implementing real-time updates in a distributed system. By combining the power of NATS messaging system with the flexibility of GraphQL, developers can create robust and scalable solutions for real-time data synchronization. The key benefits include reducing memory overhead, simplifying operational complexity, and enabling stateless Subgraphs. Event Driven Federated Subscriptions (EDFS) is a new approach that leverages Event-Driven Architecture to achieve real-time updates without tightly coupling the read and write operations. NATS JetStream can be used to add more advanced features such as time traveling, replaying events, deduplication, and more. By using EDFS and NATS JetStream, developers can build scalable, efficient, and resilient systems that provide real-time updates to clients without sacrificing developer experience on the client-side. Best practices for designing EDFS include emitting only keys of changed entities, using a consistent naming convention, and defining Entities with their keys in the EDFS Graph. As the field continues to evolve, we can expect to see more innovations such as advanced event handling, improved scalability, and enhanced security features.

When choosing an API style, consider the use case and requirements. GraphQL Federation is suitable for multiple teams working on different parts of the API, while tRPC is better suited for single-team development with TypeScript-only clients and servers. gRPC is ideal for server-to-server communication, WebHooks are useful for event-driven architectures, AsyncAPI is designed for long-running operations across companies, and REST / GraphQL can be used for public APIs. Ultimately, the choice of API style depends on the specific needs and constraints of each project, and a one-size-fits-all approach may not be effective.