You basically define the schema, and for each method you want to support you implement pulling the data from your datastore.

Authentication is up to you - stick a bearer header on your requests and implement checks in your server and you have secure backends, etc.

I look forward to a sample that implements fine-grained (multi-role) security on a SQL database. Is there a .NET implementation already in development I can contribute to?

Edit: I'm interested more in GraphQL official JavaScript implementation, since that's the one most people are going to use.

Just implement resolve.

eg: { firstName, lastName } doesn't need to load new rows but { mother { name }, father { name } } does need to load new rows.

DataLoader (https://github.com/facebook/dataloader) is a small utility which makes batching and caching database requests straight forward.

If the JavaScript implementation doesn't have something like this, perhaps it can be hacked on top.

    query User {
      friends {
        friends {
          friends {
            ...
          }
        }
      }
    }