10 ms·
Show HN: Hasura – Fast, instant GraphQL APIs on Postgres
- tango12 8y agoHi HN! Super happy to announce the first open-source release of the Hasura GraphQL engine. This is a standalone service that gives you GraphQL on Postgres. It comes with fine-grained access control that can integrate with any auth provider. It can also work with any existing postgres database as is, and allows you to expose select tables/views across your postgres schemas over GraphQL. Looking forward to your feedback!
- minxomat 8y agoHow does this project relate to prisma?
- tirumaraiselvan 8y agoPrisma doesn't work with existing postgres or access-controls.
- sorenbs 8y agoHi Tirumari :-) (https://twitter.com/Tirumarai https://twitter.com/Tirumarai) As you work at Hasura I assume you are aware that Prisma does work with existing postgres databases. You can look up the documentation for introspecting an existing database at https://www.prisma.io/docs/reference/service-configuration/data-model/introspection-aeb6diethe https://www.prisma.io/docs/reference/service-configuration/d... Full disclosure - I am the co-founder of Prisma.
- tirumaraiselvan 8y agoMy bad. I was looking at this page which says 'coming soon': https://www.prisma.io/docs/tutorials/setup-prisma/connect-db-with-data/postgres-chie5yui7r https://www.prisma.io/docs/tutorials/setup-prisma/connect-db...
- vsurabhi 8y agoHi, I'm one of the core contributors to the project. Hasura and Prisma have very different approaches and end-goals at the moment. TL;DR: Very simply put, Hasura is postgres first and adds an access-control layer to make it possible to query from the front end directly. The longer version: Prisma is intended to be a GraphQL ORM to Postgres (and several other databases with a common API) whereas Hasura is more database first and intended to let you leverage Postgres features over GraphQL. Hasura comes with and lets you use any postgres migration system and then gives you GraphQL on top of it. This is what allows Hasura to give you GraphQL over any existing Postgres database and application even. Hasura also comes with an optional access-control layer that makes it feasible to be used by frontend clients directly. This access control is inspired from postgres's RLS but does not depend on or use postgres RLS and can be coupled with application logic/auth.
- filleokus 8y ago> Prisma is intended to be a GraphQL ORM to Postgres Sorry to be hijacking this thread, but how would you say Prisma compares to something like Graphene (with an appropriate ORM adapter). I've only used Graphene with Python and the SQLAlchemy adapter, but it sounds pretty similar? Is Prisma typically used as the only ORM in project, or is it used in conjunction with some other ORM?
- vsurabhi 8y agoI think you should be able to use it alongside SQLAlchemy if you manage your schema through Prisma. Someone from Prisma team should be able to give you a more thorough answer.
- sorenbs 8y agoHappy to provide a more thorough answer :-) You should think of Prisma as the data layer for your applications. If you look at large tech companies who are typically ahead of the status quo for how to build applications, then you see that there is a trend to move away from traditional ORMs. Twitter has a service called Strato that manages data access for all their services. Facebook has TAO that serves a similar role. Prisma is an open source implementation of that pattern. If you are building a GraphQL API using for example Graphene, then you could use Prisma as your data layer, but Prisma can also be used in non-GraphQL applications. If you are using the Nodejs implementation, then you can take advantage of schema delegation to simplify the implementation of your resolvers. The GraphQL ecosystem is still evolving, so these capabilities will come to more languages in the future. So in short - Prisma replaces SQLAlchemy, not Graphene. Hope that provides some clarity :-)
- bsaul 8y agoThanks for releasing such a project. Your website is really well done, it immediately made me want to dig in the tech, congrats ! PS: as a sidenote and since i'm sure you'll get the question a lot : when i saw it was coded in haskell i was a bit nervous, but at the same time a bit more confident this wasn't another junior-level spaghetti code base.
- tango12 8y agoHaha, yes we do this get this a lot! We're also planning to release a lot of cool GraphQL OSS stuff for the haskell community because of our work over the last year.
- vetinari 8y agoAny comparison with PostGraphile?
- vsurabhi 8y agoVery similar projects ! The emphasis of Hasura is to make it seamless to work with existing databases. The primary difference is how authorization is handled. In Postgraphile, you map your application roles to Postgres users and define policies using Postgres's RLS. With Hasura, you define rules on roles (similar to Postgres's RLS) but it integrates into your existing auth system using webhooks.
- fictorial 8y agoWould you mind expanding on this a bit? It seems HGE makes a call to a webhook for every GraphQL query/mutation [1]? This sounds rather expensive to me. Thanks! [1] https://docs.hasura.io/1.0/graphql/manual/auth/index.html https://docs.hasura.io/1.0/graphql/manual/auth/index.html
- tango12 8y agoWe're adding support for JWT soon too which should prevent this overhead for applications that support JWT. But basically the idea here is to be equivalent to session cache hit. Another deployment pattern is to make everything go through an API gateway which would usually do the auth resolution for all microservices, and thus can set the dynamic variables required for access control for HGE directly too. In this case, auth-webhook is disabled.
- rogerrohrbach 8y agoAnother salient difference (and, for me, a deal-breaker): PostGraphile exposes user-defined functions in the GraphQL API, making it possible to define application logic and build a complete service without recourse to any other server-side technology.
- tango12 8y ago
- ASTP001 8y agoThis looks great! Is there any interface for extracting encrypted columns through this? For example, decrypting fernet encrypted values, given the key?
- kilburn 8y agoThis is very impressive. Congratulations! What I'm not seeing is how do you envision enforcement of complex business rules when using this API. Examples (silly, but you get the idea): - The price is only visible for projects of type "whatever". - The price may only be updated when it is not closed (closed_date is null) - The project is only visible on mondays The other point I don't see is how do you expect to trigger side-actions when changes are made. For instance: - Send an e-mail when a project is created - Call a webhook when a post is modified Finally, and this may be from my lack of expertise with GraphQL, how do you deal with recursive data structures? For instance, how would you store and fetch a tree of categories?
- marksomnian 8y agoFor the latter, GraphQL itself explicitly forbids recursivity [0], as it's impossible to guarantee that in all cases the data isn't infinitely recursive, especially with cyclic queries, which could lead to a denial-of-service. Postgres has its own support for recursive queries [1], however you'd need to strap a pagination layer on top in order to make it work with GraphQL. [0]: https://github.com/facebook/graphql/issues/91#issuecomment-254895093 https://github.com/facebook/graphql/issues/91#issuecomment-2... [1]: https://www.postgresql.org/docs/9.1/static/queries-with.html https://www.postgresql.org/docs/9.1/static/queries-with.html
- dustingetz 8y agoWhat a cop-out. Datomic Pull, which predates Graphql by two years and does not have an impedance mismatch problem, handles recursion perfectly fine. https://docs.datomic.com/on-prem/pull.html#recursive-specifications https://docs.datomic.com/on-prem/pull.html#recursive-specifi...
- deleted 8y ago[deleted]
- vsurabhi 8y ago> What I'm not seeing is how do you .. You can write fairly complex rules with the access control layer ! The first two conditions are possible (except for the project is only visible on Mondays). allow select on rows which satisfy this property: { "project_type" : { "_eq" : "whatever" } } allow update on rows which satisfy this property: { "closed_data" : { "_is_null" : true } } The idea is simple, we provide a boolean expression based access control layer which can use variables from headers. When you can't specify it using the access control layer, you can write this in your own graphql layer and schema stitch with hasura. So you only have to write what is not possible with the access control layer. > The other point I don't see is how do you ... You can use the tooling around Postgres ! You can create an `ON INSERT` trigger on the table and listen to these events. We're launching something very cool in the subscriptions/event-source to solve these kinds of problems. We also have 2 nice projects that work independent of the graphql-engine to help with change subscription on postgres (skor[1], pgdeltastream[2]) [1] https://github.com/hasura/skor https://github.com/hasura/skor [2] https://github.com/hasura/pgdeltastream https://github.com/hasura/pgdeltastream
- mikl 8y agoFirst glance reaction: Awesome, just the thing I need. Then I saw the fine print: AGPL. Haskell. The thing might be awesome, but the combination of the legal risk from AGPL (very little legal precedent for AGPL, especially outside the US, so the real legal implications of the license are very murky) and maintenance risk from Haskell (finding good Haskell developers is hard, and the learning curve is brutal), makes it a lot harder to choose.
- tango12 8y agoHm...Haskell was an important initial choice for us because of our team's comfort with the language and also because it's neat to implement parsers and compilers. The Hasura engine is essentially a GraphQL to SQL compiler :) I'm not sure I understand your point about AGPL? Do you have the same issue with the MongoDB license and would hesitate to use Mongo because of their AGPL? Why is this different? Just curious, would love to understand where you're coming from!
- seddona 8y agoHaskell seems like the perfect fit for this particular problem.
- mikl 8y agoI’m sure Haskell is great, just saying its a bit of a risk to add to your stack if you don’t already have Haskell developers in house. That, and the AGPL issue are both more important in this case (compared to MongoDB), because of the position in the stack that Hasura GraphQL Engine (HGE) would have. In the MongoDB case, we would almost always have an application server between Mongo and the GraphQL client, where custom business logic could be implemented, so Mongo can be treated as an external system whose source code we do not need to modify (like PostgreSQL in the case of HGE). In case of HGE, the GraphQL client would talk directly to HGE, and thus any customisation would most likely need to happen inside HGE, whether by plugins or patches or whatnot, making it tricky to avoid having to open source your custom business logic (as well as probably having to write it in Haskell).
- 8y ago
- HugoDaniel 8y agoReally cool! Congrats. It would be awesome if it could be made compatible with Postgraphile (https://www.graphile.org/postgraphile/introduction/ https://www.graphile.org/postgraphile/introduction/)
- 11235813213455 8y agoThat 2 different projects with same goal, why would they have to be compatible?
- sheeshkebab 8y agoGraphQL is interesting although it doesn’t appear to be answer to designing better APIs (poor modularaization, monitoring, and tooling come to mind). “Mutations” look to be an afterthought, and schema/ui are not impressive either. Above plus companies tripping hard to monetize tooling around something that you get completely for free with REST... Even as UI engineer I don’t get the appeal of it - state, caching and all the “performance” tuning make it too complicated.
- jarym 8y agoGreat to see another project at this problem! We've been internally building something very similar but it uses Kotlin (Java) instead of Haskell.
- zapita 8y agoThis is exactly what I was looking for. I will give it a try on my next project.
- alberteinstein 8y agoPlease do reach out to us on discord [1] if you have any questions whatsoever :) [1]: https://discord.gg/vBPpJkS https://discord.gg/vBPpJkS
- michaelmcmillan 8y agoI am very hesitant to couple the business logic of any application to the transport layer (GraphQL) or the persistence layer (Postgres) for that matter.
- M_Bakhtiari 8y agoIf you're not going to couple any business logic to the persistence layer, then what the hell is the point of using a RDBMS?
- Anchor 8y agoData consistency with concurrency (transactions).
- M_Bakhtiari 8y agoWhat is your data supposed to be consistent with, then?
- michaelmcmillan 8y agoYour reply suggests you either couple everything or nothing. It’s more nuanced than that. Everything is a trade off. With that said, it looks like this library will position itself in the center of your architecture — and I would be very hesitant to do that.
- M_Bakhtiari 8y agoOf course anyone should be hesitant to over-model the business domain in any part of the application including the database, but the entire reason of existence of the RDBMS is to maintain consistency with something, and if that something isn't the business domain, then what good does it do?
- michaelmcmillan 8y agoI don't know where over-modeling fits in the argument. Business logic in an isolated part of an application is likely to age better than something that is intertwined with a database or other external dependencies.
- Alex3917 8y agoGraphQL is basically the new Mongo, so of course someone will try doing it in Postgres.
- dberg 8y agoHeh i kind of agree here. Reasonable docs , easy to bootstrap and completely unaware of the underlying performance probs you are about to create bc it “just works”. Curious to your reasons though ?
- Alex3917 8y agoIt’s seemingly a complete nightmare from a security and architecture perspective. And front end devs and bootcamps love it. I’ve never used it so my opinion isn’t fully baked, but every time I look at the docs I’m just like wtf.
- tango12 8y agoApparently the facebook team (and others in production I'm guessing) addresses some of this by only having a whitelisted set of queries in production. So you get the GraphQL flexibility during development, but a effectively a static set of APIs in production.
- deleted 8y ago[deleted]
- castis 8y agobut GraphQL isn't a storage engine. or are you saying that in a few years we'll realize we've been using to solve a whole lot of things that really didnt need solving?
- no-such-address 8y agoThis is a good trend. Will we see more work aimed at separating the data model and human interface (to make programming with attributed graphs safe and convenient) from back end issues (how to store data and process queries efficiently, where traditional databases are already very advanced.)
- victor106 8y agoGreat job!!! Looks awesome I see that one of the ways you want to monetize this is by offering support. Providing support is a good approach to monetize an open source project but it’s not very scalable. Have you thought of any other ways you can monetize this? If others in the HN community can pitch in with any ideas they have on how to monetize an open source project that would be great as well.
- faitswulff 8y agoHow does it handle batch execution of queries?
- vsurabhi 8y agoWe do not batch queries. We take a slightly different approach. We convert the GraphQL query AST into a single SQL query (no matter how nested the GraphQL query is).
- reilly3000 8y agoThis is going to get tested today for a project. Thanks!
- tango12 8y agoSo cool! Please do reach out to us on discord [1] if you have any questions whatsoever :) 1: https://discord.gg/vBPpJkS https://discord.gg/vBPpJkS
- miga 8y agoWhy does hasura.io block residential network providers in Poland? I need to use VPN to just check the docs. That does not bode well for users.
- deleted 8y ago[deleted]
- mydigitalself 8y agoI wouldn’t imagine that to be intentional, possibly upstream infrastructure is blocking somewhere.
- antigirl 8y agoAny subscription support?
- tango12 8y agoIt's in an early preview right now, and we should have something in a week or two! Just going through some performance and security checks over the next few days. Do feel free reach out to us via discord if you'd like to take it for a spin.
- mmanfrin 8y agoI have a bit of a dumb question: where does GraphQL fit in a stack? I've seen in used primarily as a means of aggregating a bunch of disparate microservices, but then I see things like this that put it in the role of app server, almost. What advantages does this give over, for example, a Rails API (also on Postgres)? If it is supposed to fill the role of app server, how do you handle things more involved than simple CRUD operations? Like, if I sign up a user, how -- in a GraphQL world -- would I send a welcome email, typically?
- FooBarWidget 8y agoI see GraphQL as a protocol replacement for REST. With REST you have the following problems: * Responses either contain more data than you need, or not enough data (e.g. you need data for related entities as well). * With REST, if you need data for related entities then you need to perform additional REST calls, resulting in more network roundtrips. With GraphQL you can specify exactly what you want, and the server responds with just that, in a single call.
- yashap 8y agoWe’re experimenting with it on a new product at my company, and this is how we use it. Specifically, we use it as an API gateway in front of a bunch of restful services. Another benefit is a more robust type system than you get with JSON. GraphQL supports union types, interfaces, etc., allows you to provide more strongly typed contracts between the backend and frontend. One downside though - while the responses can become smaller, with fewer round trips, the requests get A LOT bigger (than with REST), as you have to specify every field, subfield, etc. This is especially true if you make heavy use of union types - then you have to specify all the fields, sub fields, etc. of all the various concrete members you might get back. Like requests with payloads over 1KB is not uncommon. If you’re polling, and the result of the polling is generally an empty response, you may end up sending significantly MORE data over the wire, not less.
- slitchfield 8y agoIf you're sending large requests polling for an empty response most of the time, that might be a good use case for a custom directive.
- benoror 8y agoImpressive! How's it different from postgraphql (https://postgraphql.github.io/ https://postgraphql.github.io/) or postgraphile (https://www.graphile.org/postgraphile/ https://www.graphile.org/postgraphile/)?
- tango12 8y agoBroadly similar projects! The emphasis of Hasura is to make it seamless to work with existing databases. The primary difference is how authorization is handled. In Postgraphile, you map your application roles to Postgres users and define policies using Postgres's RLS. With Hasura, you define rules on roles (similar to Postgres's RLS) but it integrates into your existing auth system using webhooks. Also, peripherally, we have quite a bit of tooling with an admin UI and a rails-like migration system to make the dev workflows easier :)
- mathnmusic 8y ago> The emphasis of Hasura is to make it seamless to work with existing databases. Yet, I spent 15 minutes searching for example of using Hasura with an existing schema. Your "Getting Started" page has two examples: Deploy on Heroku and Run with Docker - in both cases, using a fresh database, not an existing one.
- tango12 8y agoBugger! Sorry for the inconvenience. We're updating the docs now to make this easier to navigate too. EDIT: Docs updated, we'll keep improving it too :)
- mathnmusic 8y agoCan you share the link? This page still refers to new database: https://docs.hasura.io/1.0/graphql/manual/getting-started/index.html https://docs.hasura.io/1.0/graphql/manual/getting-started/in... Homepage has the GitLab example, but not actual "Getting Started" page.
- rcdmd 8y agoNice work. There are several competitors in the automagic Postgres REST/GraphQL space, and you're nailing documentation and ergonomics here. Your site and the Hansura Console sets your project apart from the rest.
- spocklivelong 8y agoI work with a Django app on Postgres, and I'm not sure how I would migrate that to GraphQL. How things play out in terms of django specific tables? What about relationships between tables? We mostly use the Django app to expose REST APIs, which deal with making complex queries using QuerySets to Postgres. Moving this to GraphQL mean that all the business logic that sits on the REST APIs need to be moved to the frontend?
- tango12 8y agoWell it depends on your app. Technically, you have to rebuild your app to speak GraphQL to the frontend instead of REST. Internally, your GraphQL resolvers (like URL handlers) would then do similar work with using QuerySets as you're doing now. If you'd like to leverage Hasura, it would be a good fit to potentially replace the "read" portions of your app with GraphQL quite easily. And then eventually you would have to move to writing a GraphQL gateway to handle some of the transactional logic and delegate the other stuff to Hasura via schema-stitching.
- machbio 8y agothere is mention of GraphQL proxy - any idea about any available proxies for GraphQL at this moment ?
- garindra 8y agoWe at Sale Stock (fashion e-commerce in Indonesia) built an in-house system similar to this but more automatic and works with CockroachDB. Not open source yet, but might be interesting to you guys: https://speakerdeck.com/salestock/laskar-high-velocity-graphql-and-lambda-based-software-development-model https://speakerdeck.com/salestock/laskar-high-velocity-graph... (skip to around mid-way, first half is intro to GraphQL)
- uptime 8y agoInteresting. Does this mean you plan to release it?
- tango12 8y agoOops! GitHub is down :( We're on https://hasura.io https://hasura.io too.
- deleted 8y ago[deleted]
- SOLAR_FIELDS 8y agoHuh, I just tried it and Github is up (making this post 2 minutes after the parent). Located in EU if that makes a difference.
- SOLAR_FIELDS 8y agoAs a newbie to GraphQL who is having some growing pains adopting a UI for a data warehouse that was basically bolted onto a REST API designed for backend queries, can someone help me understand what the pros and cons are for something like this vs hand rolling all of the backend GraphQL stuff yourself? We have been evaluating switching/offering a GraphQL backend for our UI to consume for our product since it seems well suited to our use case but so far the effort required has outweighed the gain we would get from it. Because of this a somewhat turnkey solution like above might be more appealing.
- tango12 8y agoI think it depends on how much business logic you have in your REST API layer. If you can get away with using a turnkey solution like hasura with the right access control rules or by adding schema stitching then it would save a lot of effort. I think the best thing would be to try a turnkey solution for your appliaction's database and then evaluating the effort saved. Turnkey solutions also might end up partial effort if not all. For example, Hasura is a great fit for incrementally adding read-only GraphQL queries which is where a lot of benefit of GraphQL for the UI lies.
- jxub 8y agoAlmost a third of the codebase is written in Haskell, that's really nice to hear ;)
- alberteinstein 8y agoThe GraphQL Engine is written in Haskell, the Console in JavaScript and the CLI in Go. The repo contains all the three components. :) (I am one of the maintainers)
- uptime 8y agoThank you for releasing this. I am impressed with Hasura! No knock on postgraphile, I am trying that out too as well as prisma, but this looks very well done and the boundaries are clear (like postgraphile, views are important to make things work). Your UI is going to make people happy. I have two questions: 1. can I point the hasura cli at my local install? and 2. Can we have UUID fields? I'd like to use them as primary keys.
- tango12 8y agoYes and yes. 1. https://docs.hasura.io/1.0/graphql/manual/migrations/enable-migrations.html https://docs.hasura.io/1.0/graphql/manual/migrations/enable-... 2. For UUID just do what you would normally do. We don’t have it on the column drop down but you can create the table via the run_sql window with the right type and default value, if you’re generating the UUID server-side
- jamhan 8y ago"Fast, instant"? That's, err, just dumb. Fast perhaps. Instant, never.
- wjonas 8y agoI have been playing around with it. It's great. Better support for ENUMS and MANY TO MANY relationships would be very needed though.
- tango12 8y agoThanks :) We're adding docs for enums as we speak. What did you find lacking around the many-to-many?
- wjonas 8y agoFor 2 reasons inserting is tricky and querying is not super intuitive. Example: I have 3 tables pages, page_blocks, and blocks. - Inserting blocks into a page is tough. - To query it's not very intuitive I would like to do. pages { blocks { id } } & not pages { page_blocks { blocks { id } } }
- tango12 8y agoGot it! Thanks for the note, and we should be able to make this better very soon.