Then you need to validate, authorize, etc. queries correctly. I see no reason why anyone would want this.

Instead use GraphQL which is a thin layer, and hide all the business logic behind it. Way more manageable.