- Remove `FeatureConstrainer` call wrapping api endpoint
- Remove `Feature.enabled?(:graphql)` conditionals in back and frontend
- Modify graphql test to be graphql flag agnostic
- Remove api routing spec
- Remove frontend feature flag via `gon`
Enabling GraphQL batch requests allows for multiple queries
to be sent in 1 request reducing the amount of requests
we send to the server.
Responses come come back in the same order as the queries were
provided.
With this we allow authentication using a session or using personal
access token.
Authentication using a session, and CSRF token makes it easy to play
with GraphQL from the Graphiql endpoint we expose.
But we cannot enforce CSRF validity, otherwise authentication for
regular API clients would fail when they use personal access tokens to
authenticate.
[master] Resolve "Personal access token with only `read_user` scope can be used to authenticate any web request"
See merge request gitlab/gitlabhq!2583
charlie ablett