// API REST claire et prévisible
GET    /api/v1/users          // Liste users
GET    /api/v1/users/123      // User spécifique
POST   /api/v1/users          // Créer user
PUT    /api/v1/users/123      // Modifier user
DELETE /api/v1/users/123      // Supprimer user

// Réponses standardisées
{
  "data": { "id": 123, "name": "John Doe" },
  "meta": { "timestamp": "2024-10-22T10:00:00Z" },
  "links": {
    "self": "/api/v1/users/123",
    "posts": "/api/v1/users/123/posts"
  }
}

// Headers de cache optimisés
app.get('/api/v1/users/:id', (req, res) => {
  const user = getUserById(req.params.id)
  
  res.set({
    'Cache-Control': 'public, max-age=300', // 5min
    'ETag': `"${user.updatedAt}"`,
    'Last-Modified': new Date(user.updatedAt).toUTCString()
  })
  
  // Cache conditionnel
  if (req.headers['if-none-match'] === `"${user.updatedAt}"`) {
    return res.sendStatus(304) // Not Modified
  }
  
  res.json(user)
})

// Mobile a besoin de: id, name, avatar
// Desktop a besoin de: tout + permissions + stats
// Widget a besoin de: juste name, status

// REST retourne toujours tout
GET /api/v1/users/123
{
  "id": 123,
  "name": "John Doe",
  "email": "john@example.com",        // Pas utilisé mobile
  "address": {...},                   // Pas utilisé mobile  
  "preferences": {...},               // Pas utilisé mobile
  "permissions": [...],               // Gros objet inutile mobile
  "stats": {...}                      // Calculs coûteux non utilisés
}

// Explosion d'endpoints spécialisés
GET /api/v1/users/123/mobile       // Version mobile
GET /api/v1/users/123/widget       // Version widget
GET /api/v1/users/123/dashboard     // Version dashboard
GET /api/v1/users/123/profile      // Version profil

// Maintenance cauchemardesque
// Documentation dispersée  
// Versionning complexe

# Mobile: données minimales
query MobileUser($id: ID!) {
  user(id: $id) {
    id
    name
    avatar
    isOnline
  }
}

# Dashboard: données complètes
query DashboardUser($id: ID!) {
  user(id: $id) {
    id
    name
    email
    avatar
    stats {
      postsCount
      followersCount
      lastActive
    }
    permissions {
      canPost
      canModerate
      canAdmin
    }
    recentActivity {
      id
      type
      createdAt
    }
  }
}

# Widget: juste l'essentiel
query WidgetUser($id: ID!) {
  user(id: $id) {
    name
    status
  }
}

# Une seule requête pour données interconnectées
query UserWithContent($userId: ID!) {
  user(id: $userId) {
    name
    avatar
    posts(first: 10) {
      edges {
        node {
          title
          excerpt
          publishedAt
          comments(first: 3) {
            edges {
              node {
                content
                author {
                  name
                  avatar
                }
              }
            }
          }
        }
      }
    }
    followers(first: 5) {
      edges {
        node {
          name
          avatar
          mutualFriends {
            count
          }
        }
      }
    }
  }
}

# Schema définition avec bonnes pratiques
type User {
  id: ID!
  name: String!
  email: String
  avatar: String
  
  # Relations avec pagination
  posts(
    first: Int = 10
    after: String
    orderBy: PostOrderBy = CREATED_AT_DESC
  ): PostConnection!
  
  # Champs calculés
  fullName: String!
  isOnline: Boolean!
  
  # Métadonnées
  createdAt: DateTime!
  updatedAt: DateTime!
}

type PostConnection {
  edges: [PostEdge!]!
  pageInfo: PageInfo!
  totalCount: Int!
}

type PostEdge {
  node: Post!
  cursor: String!
}

type Post {
  id: ID!
  title: String!
  content: String!
  author: User!
  
  # Relations complexes
  comments(first: Int = 10): CommentConnection!
  tags: [Tag!]!
  
  # État
  status: PostStatus!
  publishedAt: DateTime
}

enum PostStatus {
  DRAFT
  PUBLISHED
  ARCHIVED
}

// Resolvers avec DataLoader pour éviter N+1
import DataLoader from 'dataloader'

const userLoader = new DataLoader(async (userIds) => {
  const users = await User.findByIds(userIds)
  return userIds.map(id => users.find(user => user.id === id))
})

const resolvers = {
  Query: {
    user: (_, { id }) => userLoader.load(id),
    
    users: async (_, { first, after }) => {
      const result = await User.paginate({ first, after })
      return {
        edges: result.users.map(user => ({ 
          node: user, 
          cursor: user.id 
        })),
        pageInfo: result.pageInfo,
        totalCount: result.totalCount
      }
    }
  },
  
  User: {
    posts: (user, { first, after }) => 
      Post.findByUser(user.id, { first, after }),
    
    followers: (user, { first }) =>
      Relationship.getFollowers(user.id, { first }),
    
    isOnline: (user) => 
      OnlineStatus.isUserOnline(user.id),
    
    fullName: (user) => 
      `${user.firstName} ${user.lastName}`
  },
  
  Post: {
    author: (post) => userLoader.load(post.authorId),
    
    comments: (post, { first }) =>
      Comment.findByPost(post.id, { first }),
    
    tags: (post) =>
      TagLoader.loadMany(post.tagIds)
  }
}

import { createComplexityLimitRule } from 'graphql-query-complexity'

const server = new ApolloServer({
  typeDefs,
  resolvers,
  validationRules: [
    createComplexityLimitRule(1000) // Limite complexité
  ],
  plugins: [
    {
      requestDidStart() {
        return {
          didResolveOperation(requestContext) {
            const complexity = getComplexity({
              estimators: [
                fieldExtensionsEstimator(),
                simpleEstimator({ maximumComplexity: 1000 })
              ],
              query: requestContext.document,
              variables: requestContext.request.variables
            })
            
            if (complexity > 1000) {
              throw new Error(`Query too complex: ${complexity}`)
            }
          }
        }
      }
    }
  ]
})

// Cache avec Redis et DataLoader
import Redis from 'ioredis'
const redis = new Redis(process.env.REDIS_URL)

const createCachedLoader = (batchLoadFn, keyFn, ttl = 300) => {
  return new DataLoader(async (keys) => {
    // 1. Vérifier cache Redis
    const cacheKeys = keys.map(key => `loader:${keyFn(key)}`)
    const cached = await redis.mget(cacheKeys)
    
    const uncachedIndices = []
    const uncachedKeys = []
    
    cached.forEach((value, index) => {
      if (value === null) {
        uncachedIndices.push(index)
        uncachedKeys.push(keys[index])
      }
    })
    
    // 2. Charger données manquantes
    let freshData = []
    if (uncachedKeys.length > 0) {
      freshData = await batchLoadFn(uncachedKeys)
      
      // 3. Mettre en cache
      const pipeline = redis.pipeline()
      freshData.forEach((item, index) => {
        const cacheKey = `loader:${keyFn(uncachedKeys[index])}`
        pipeline.setex(cacheKey, ttl, JSON.stringify(item))
      })
      await pipeline.exec()
    }
    
    // 4. Reconstituer résultat ordonné
    const result = new Array(keys.length)
    let freshIndex = 0
    
    cached.forEach((value, index) => {
      if (value !== null) {
        result[index] = JSON.parse(value)
      } else {
        result[index] = freshData[freshIndex++]
      }
    })
    
    return result
  })
}

// Usage
const userLoader = createCachedLoader(
  (ids) => User.findByIds(ids),
  (id) => `user:${id}`,
  600 // 10min cache
)

// Gateway GraphQL devant APIs REST existantes
const { RESTDataSource } = require('apollo-datasource-rest')

class UserAPI extends RESTDataSource {
  constructor() {
    super()
    this.baseURL = 'https://api.internal.com/v1/'
  }
  
  willSendRequest(request) {
    request.headers.set('Authorization', this.context.token)
  }
  
  async getUser(id) {
    const data = await this.get(`users/${id}`)
    return this.userReducer(data)
  }
  
  async getUserPosts(userId, { first, after }) {
    const params = { limit: first, offset: after }
    const data = await this.get(`users/${userId}/posts`, params)
    return this.postsReducer(data)
  }
  
  userReducer(user) {
    return {
      id: user.id,
      name: user.full_name, // Mapping champs
      email: user.email_address,
      avatar: user.profile_image_url
    }
  }
}

// Resolvers utilisant APIs REST
const resolvers = {
  Query: {
    user: (_, { id }, { dataSources }) =>
      dataSources.userAPI.getUser(id)
  },
  
  User: {
    posts: (user, args, { dataSources }) =>
      dataSources.userAPI.getUserPosts(user.id, args)
  }
}

// Router intelligent selon client
app.use('/api', (req, res, next) => {
  const clientType = req.headers['x-client-type']
  const acceptsGraphQL = req.headers.accept?.includes('application/graphql')
  
  if (clientType === 'mobile-v2' || acceptsGraphQL) {
    return graphqlHandler(req, res, next)
  }
  
  return restHandler(req, res, next)
})

// Headers pour guider les clients
app.use((req, res, next) => {
  res.set({
    'X-API-Version': 'v1',
    'X-GraphQL-Endpoint': '/graphql',
    'X-Rest-Endpoint': '/api/v1'
  })
  next()
})

// Exemple: Dashboard admin avec widgets configurables
query DashboardData($widgets: [WidgetType!]!) {
  user {
    name
    permissions
  }
  
  # Chargement conditionnel selon configuration
  stats @include(if: { widgets: { contains: STATS } }) {
    usersCount
    postsCount
    revenue
  }
  
  recentUsers(first: 10) @include(if: { widgets: { contains: USERS } }) {
    edges {
      node {
        name
        createdAt
        status
      }
    }
  }
  
  systemHealth @include(if: { widgets: { contains: MONITORING } }) {
    cpu
    memory
    diskSpace
  }
}

// API claire pour partenaires externes
GET /api/v1/products?category=electronics&limit=20
{
  "data": [...],
  "pagination": { "next": "/api/v1/products?page=2" },
  "meta": { "total": 1234, "page": 1 }
}

// Documentation OpenAPI/Swagger native
// Cache HTTP standard
// Rate limiting par endpoint simple

// Page produit = 7 requêtes
GET /api/products/123           // Produit
GET /api/products/123/images    // Images  
GET /api/products/123/reviews   // Avis
GET /api/categories/456         // Catégorie
GET /api/brands/789            // Marque
GET /api/users/321             // Vendeur
GET /api/products/related      // Produits liés

// Total: 7 round-trips, 2.1s chargement mobile

# Une seule requête optimisée
query ProductPage($id: ID!) {
  product(id: $id) {
    name
    price
    description
    images { url, alt }
    
    category { name, slug }
    brand { name, logo }
    seller { name, rating, verified }
    
    reviews(first: 5) {
      edges {
        node {
          rating
          comment
          author { name }
          createdAt
        }
      }
      totalCount
    }
    
    relatedProducts(first: 4) {
      id
      name  
      price
      image
    }
  }
}

# Résultat: 1 requête, 0.8s chargement mobile (-62%)

// ❌ Problème N+1 (1 + N requêtes)
const resolvers = {
  User: {
    // Appelé pour chaque user dans une liste
    posts: (user) => Post.findByUserId(user.id) // ⚠️ 1 query par user
  }
}

// Query liste users = 1 + 100 requêtes si 100 users

// ✅ Solution avec DataLoader
const postsByUserLoader = new DataLoader(async (userIds) => {
  const posts = await Post.findByUserIds(userIds) // 1 seule query
  
  // Grouper par userId pour retour ordonné
  const postsByUser = userIds.map(userId => 
    posts.filter(post => post.userId === userId)
  )
  
  return postsByUser
})

const resolvers = {
  User: {
    posts: (user) => postsByUserLoader.load(user.id)
  }
}

# Attaque par requête trop profonde
query MaliciousQuery {
  user(id: "1") {
    posts {
      author {
        posts {
          author {
            posts {
              author {
                posts {
                  # ... 50 niveaux de profondeur
                }
              }
            }
          }
        }
      }
    }
  }
}

import depthLimit from 'graphql-depth-limit'

const server = new ApolloServer({
  typeDefs,
  resolvers,
  validationRules: [
    depthLimit(10), // Max 10 niveaux
    costAnalysis({
      maximumCost: 1000,
      defaultCost: 1,
      scalars: {
        String: 1,
        Int: 1,
        Float: 2,
      },
      createError: (max, actual) => {
        return new Error(`Query cost ${actual} exceeds maximum cost ${max}`)
      }
    })
  ]
})

# Génération types TypeScript depuis schema
npm install -D @graphql-codegen/cli @graphql-codegen/typescript

# Configuration codegen.yml
schema: "src/schema.graphql"
generates:
  src/generated/graphql.ts:
    plugins:
      - typescript
      - typescript-resolvers

# Test compatibilité breaking changes
npm install -D @graphql-inspector/cli
graphql-inspector diff old-schema.graphql new-schema.graphql