Cannot override or deactivate certain GraphQL resolvers for plugins (users-permissions & upload)

System Information
  • Strapi Version: 3.3.4
  • Operating System: Ubuntu WSL / Docker
  • Database: postgres 12
  • Node Version: v14.15.0
  • NPM Version: 6.14.9
  • Yarn Version: /


Hope someone can help me here, I am slowly going insane…

I’m trying to exclude the autogenerated GraphQL endpoints for plugins. Specifically, users, roles and files - so that my end-users wouldn’t be able to even see that they exist.
I don’t need them and they are a blocker to integrating the API into my Hasura setup, because they collide with my own schema.

I’ve gone and updated the schema files (/extensions/users-permissions/config/schema.graphql.js and /extensions/upload/config/schema.graphql.js), setting all existing resolvers for Query and Mutation to false.

However, that works ONLY for those resolvers that have not been defined under the mutation or query key in their respective plugin’s schema (so, under node_modules/strapi-plugin-users-permissions/config/schema.graphql.js and node_modules/strapi-plugin-upload/config/schema.graphql.js).

The following resolvers do not go away, however I try to override them:

(on users-permissions plugin schema)

  query: `
    me: UsersPermissionsMe
  mutation: `
    login(input: UsersPermissionsLoginInput!): UsersPermissionsLoginPayload!
    register(input: UsersPermissionsRegisterInput!): UsersPermissionsLoginPayload!
    forgotPassword(email: String!): UserPermissionsPasswordPayload
    resetPassword(password: String!, passwordConfirmation: String!, code: String!): UsersPermissionsLoginPayload
    emailConfirmation(confirmation: String!): UsersPermissionsLoginPayload

(on upload plugin schema)

  mutation: `
    upload(refId: ID, ref: String, field: String, source: String, file: Upload!): UploadFile!  
    multipleUpload(refId: ID, ref: String, field: String, source: String, files: [Upload]!): [UploadFile]!  
    updateFileInfo(id: ID!, info: FileInfoInput!): UploadFile!  

Even if I override them, as on the example of the “upload” plugin…

module.exports = {
  resolver: {
    Query: {
      files: false,
      filesConnection: false
    Mutation: {
      createFile: false,
      updateFile: false,
      upload: false,
      multipleUpload: false,
      updateFileInfo: false,
      deleteFile: false

…the GraphQL Schema still contains the three mutations upload, multipleUpload & updateFileInfo.

I have just not found any way to get rid of them.
It seems I can only extend, but not remove anything that has been defined under mutation or query within the plugin modules.
Is that correct? Is it desired behavior?

I’m open for any hack to deactivate the plugin GraphQL, but keep the autogenerated API for my own custom Content Types…

Have tried overwriting the files from my Dockerfile after running yarn install, but that seems to be “too late” - the schema is generated regardless, including these queries & mutations…

Thank you for your help!
Greatly appreciated :slight_smile:

Your schema looks correct, have you created it in ./extensions/upload/config/schema.graphql.js?

Just tested your schema, it works ok. Files can’t be accessed through GraphQL.

The correct path is ‘/extensions/upload/config/schema.graphql.js’

API and GraphQL are not related. You can delete the graphql with no stress.

yarn strapi uninstall graphql

Hi Sunny, thanks for the quick reply.

In order :slight_smile: :

  1. my bad, I did update the file in the correct path. just messed up my post.
    it is indeed in ‘/extensions/upload/config/schema.graphql.js’
  2. yes, filesCAN’T be accessed. so far so good.
    but the mutations I mentioned, upload , multipleUpload & updateFileInfo are still there, right?
  3. I need the GraphQL API, so can’t deactivate it.

I am now getting into hooks and will try to install one either before the graphql initialize to remove the plugin schemas or afterwards, to delete them from the unified base schema thats being created…
But it would’ve been nicer if it just worked as described in the docs. Seems a little like a bug to me, so I also opened an issue on Github where I added some screenshots to illustrate my problem.


Hi? Did you resolve this problem yet? I have the same issue. I want to create a public facing api to display geographic data. I am using GraphQL, but I do not know how to disable the uploadfile and user permissions entities. Any help?

I want to remove all queries and mutations related to these

1 Like