GraphQL instead of API resources ?

Certainly! GraphQL can indeed be used as an alternative to traditional REST API resources, and it offers a lot of flexibility in terms of fetching exactly the data you need. To answer your questions:

1. Retrieving data according to the role of the user: Yes, it is possible to retrieve data according to the user's role in GraphQL. This is typically handled in the resolver functions, where you can implement your authorization logic to determine what data a user is allowed to see based on their role.

2. Adding can_update / can_delete properties to each model retrieved: You can also add properties like can_update and can_delete to your GraphQL types. These would be computed fields that you resolve based on the user's permissions.

Here's a simplified example of how you might implement this in a GraphQL schema using a JavaScript server with GraphQL.js:

type Query {
  posts: [Post]
}

type Post {
  id: ID!
  title: String!
  content: String!
  can_update: Boolean
  can_delete: Boolean
}

# ... other type definitions ...

And in your resolver functions:

const resolvers = {
  Query: {
    posts: (parent, args, context) => {
      // context.user would be your authenticated user
      const user = context.user;
      const posts = getPostsForUser(user); // Implement this to fetch posts based on user role
      return posts;
    },
  },
  Post: {
    can_update: (post, args, context) => {
      // Implement your logic to determine if the user can update the post
      return canUserUpdatePost(context.user, post);
    },
    can_delete: (post, args, context) => {
      // Implement your logic to determine if the user can delete the post
      return canUserDeletePost(context.user, post);
    },
  },
  // ... other resolvers ...
};

function getPostsForUser(user) {
  // Fetch posts from your database or service, filtering by user role if necessary
  // ...
}

function canUserUpdatePost(user, post) {
  // Your logic to determine if the user can update the post
  // For example, check if the user is the author of the post or an admin
  // ...
}

function canUserDeletePost(user, post) {
  // Your logic to determine if the user can delete the post
  // Similar to canUserUpdatePost, but for deletion
  // ...
}

In this example, getPostsForUser would be a function that retrieves the posts a user is allowed to see based on their role. The can_update and can_delete fields are computed for each Post object in the resolver functions, based on the current user's permissions.

Remember that GraphQL is just a query language and runtime for executing those queries, so you have to implement the logic for permissions and data retrieval yourself, just like you would with a REST API. The difference is that GraphQL allows you to query for exactly what you need in a single request, which can be more efficient and flexible than predefined API endpoints.