26 chapters, one continuous project, a complete events GraphQL API from the first schema declaration through to ACL and batch resolvers. This final chapter bundles the most important patterns as a reference for your own practice - no new content, just condensation.

Schema skeleton

type Query {
    myField(arg: String): MyType
        @resolver(class: "Vendor\\Module\\Model\\Resolver\\MyField")
        @doc(description: "...")
}

type Mutation {
    myMutation(input: MyMutationInput!): MyMutationOutput
        @resolver(class: "Vendor\\Module\\Model\\Resolver\\MyMutation")
}

extend type ExistingCoreType {
    my_extra_field: String @resolver(class: "...")
}

Resolver skeleton

final class MyField implements ResolverInterface
{
    public function __construct(
        private readonly MyDataProvider $dataProvider,
    ) {
    }

    public function resolve(
        Field $field,
        $context,
        ResolveInfo $info,
        ?array $value = null,
        ?array $args = null
    ): array {
        return $this->dataProvider->getData($args);
    }
}

The four GraphQL exceptions

• GraphQlInputException - business-invalid input.
• GraphQlAuthorizationException - missing permission.
• GraphQlNoSuchEntityException - entity doesn't exist.
• GraphQlAlreadyExistsException - unique value already taken.
• Always with __('...') instead of a raw string (translatable).

Authentication check in a resolver

if ($context->getUserType() !== UserContextInterface::USER_TYPE_CUSTOMER
    || !$context->getExtensionAttributes()->getIsCustomer()
) {
    throw new GraphQlAuthorizationException(__('...'));
}

$customerId = (int) $context->getUserId();

Batch resolver against N+1

final class MyBatchField implements BatchResolverInterface
{
    public function resolve(array $requests): BatchResponse
    {
        $response = new BatchResponse();
        // collect all IDs from $requests, ONE query, map results back
        foreach ($requests as $request) {
            $response->addResponse($request, /* ... */ null);
        }

        return $response;
    }
}

The ten golden rules of this series

1. Run bin/cache-clean config immediately after every schema.graphqls change - no setup:di:compile needed, but always a cache clean.
2. Keep resolvers thin, let DataProviders carry the actual logic - but only when the logic justifies it (chapter 15).
3. Extend existing core types with extend type instead of duplicating new, isolated types.
4. Reuse existing core input types (FilterTypeInput, SortEnum) instead of reinventing your own.
5. Use Non-Null (!) only for fields that genuinely can never be missing on the business level - null bubbling otherwise takes down entire response branches.
6. DataProviders use repositories, not bare collections - addFieldToFilter() always in array form ['eq' => $value].
7. Always throw one of the four GraphQL exceptions for error cases, never a generic exception that gets masked in production mode.
8. Use getExtensionAttributes()->getIsCustomer() instead of a plain getUserId() > 0 check for reliable customer detection.
9. For fields with foreseeably large lists, consider BatchResolverInterface over ResolverInterface from the start.
10. For any problem, check cache clean first, then introspection, then developer mode and exception.log - only suspect your own code after that.

That wraps up this series. From the first question, "What even is GraphQL?", to a complete, performant, tested, and secured events API - the patterns shown here carry over just as well to any other custom GraphQL project in Magento 2.