Repository navigation
Remove GraphQL, user following, and the global activity feed - #2929
Merged
Merged
Conversation
GraphQL support is being removed from the backend, so move its last frontend consumers to existing REST endpoints and drop Apollo. - Teams: memberships, members, create/update/delete, invite, accept/decline, role changes and removal now use the /team routes. Memberships are joined with GET /team/:id for name, description and avatar. - Following: following/followers lists and follow, unfollow, block and unblock use the /user/:id routes. - Activity (Following widget, Global Activity): use /data/user/activity with includeDetails=true. GraphQL's offset was a page number, so pass page * limit. An empty user list meant "all users" in GraphQL; send osmUserIds=-1 for that. Global Activity only queries once a user is signed in, since the endpoint requires authentication. - Queries and mutations move from Apollo to react-query, which is already in use. Apollo's normalized cache refreshed views after each mutation; affected queries are now invalidated explicitly. - Team edits send the team's existing avatarURL back, because the REST update replaces it while the GraphQL mutation left it alone. - Remove @apollo/client, graphql and REACT_APP_MAP_ROULETTE_SERVER_GRAPHQL_URL. Requires the backend's includeDetails support on /data/user/activity.
…r/contributions /data/user/activity is being removed along with GraphQL, and feeds of other users' activity are being dropped to reduce the user data the app exposes. - Remove the profile page's "Recent activity from mappers you follow" feed, its API hook and its type. - Load the dashboard Contributions section from GET /user/contributions, typed from the generated API types instead of a hand-written interface. - Skip contributions with no date or challenge in the aggregation. The generated type marks both optional, and the challenge is absent when it has been deleted. Requires the backend's /user/contributions endpoint.
Contributor
|
Thanks for putting this up. I actually think this PR can be revised to:
Once this is done we can drop the GraphQL endpoint and the following and activity endpoints from the backend. My goal as mentioned in https://community.openstreetmap.org/t/maproulette-security-incident-october-2026/148566 is to reduce the number of endpoints that return data about individual users. The current follow feature and global activity feed aren't essential to MapRoulette and removing them reduces the surface area that we need to keep secure. |
CollinBeczak
marked this pull request as ready for review
October 10, 2026 01:57
jake-low
changed the title
jake-low
approved these changes
Oct 10, 2026
jake-low
left a comment
jake-low
left a comment
Contributor
There was a problem hiding this comment.
I modified this to remove the user follow features too
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requires the backend's includeDetails support on /data/user/activity. maproulette/maproulette-backend#1290