4 ms·

> Are there other reasons this hasn't seen more widespread adoption? Is there some inherent architectural flaw or just not enough incremental benefit? I'm a fa

> Are there other reasons this hasn't seen more widespread adoption? Is there some inherent architectural flaw or just not enough incremental benefit? I'm a fan of the concept and would love to have a middle layer as thin as postgrest, but authentication/authorization has been my roadblock. I still use node as an app server because of passport. I had not heard of the postgrest starter kit before today and will check out https://docs.subzero.cloud/athentication-authorization-flow/ https://docs.subzero.cloud/athentication-authorization-flow/ If they correct the typo before I get to reading it, it will be https://docs.subzero.cloud/authentication-authorization-flow/ https://docs.subzero.cloud/authentication-authorization-flow...

ruslan_talpa 7y ago
you could use Auth0 [1] to authenticate your clients using all the identity providers (FB/GOOGLE...etc) and then just have the api clients use that JWT token when talking to postgrest If however you do only want to authenticate the users yourself, the login function can be very simple [2] 1. http://postgrest.org/en/v6.0/auth.html#jwt-from-auth0 http://postgrest.org/en/v6.0/auth.html#jwt-from-auth0 2. https://github.com/subzerocloud/postgrest-starter-kit/blob/master/db/src/api/login.sql https://github.com/subzerocloud/postgrest-starter-kit/blob/m...
bowlingx 7y ago
I am using postgraphile in library mode with keycloak and passport.js (an open source project https://www.keycloak.org/ https://www.keycloak.org/) instead of auth0 and it works great.
bayesian_horse 7y ago
I would expect authorization and validation to be a real pain with PostgREST (I don't know enough about it to tell definitively, though). Even row-level access control, while not widespread any way, is often not enough. Complex validation in SQL can be done, of course, but SQL isn't exactly meant for these things, IMHO.
- ruslan_talpa 7y ago
  why would you "expect" that if you don't know about it?
  - bayesian_horse 7y ago
    I know more than basic SQL. Maybe I am indeed not an accomplished enough master in SQL, but I can't see why I would ever prefer SQL over Python in terms of defining application logic.
- ako 7y ago
  Stored procedures often offer a better and more efficient way to implement data validation than non database native alternatives.
  - bayesian_horse 7y ago
    It may indeed be efficient. Maybe I just don't like the idea of putting all my application logic into SQL statements. What I like about Django's ORM, for example, that you can declare a field to be an IP address, and this not only does the validation (which SQL can do easily, I am sure), but this declaration also carries over to HTML forms, admin interface, REST API serialization and HTML Templates.
- ako 7y ago
  This is an interesting read on validation in postgres: https://begriffs.com/posts/2017-10-21-sql-domain-integrity.html https://begriffs.com/posts/2017-10-21-sql-domain-integrity.h...

ruslan_talpa 7y ago

you could use Auth0 [1] to authenticate your clients using all the identity providers (FB/GOOGLE...etc) and then just have the api clients use that JWT token when talking to postgrest If however you do only want to authenticate the users yourself, the login function can be very simple [2] 1. http://postgrest.org/en/v6.0/auth.html#jwt-from-auth0 http://postgrest.org/en/v6.0/auth.html#jwt-from-auth0 2. https://github.com/subzerocloud/postgrest-starter-kit/blob/master/db/src/api/login.sql https://github.com/subzerocloud/postgrest-starter-kit/blob/m...

bowlingx 7y ago

I am using postgraphile in library mode with keycloak and passport.js (an open source project https://www.keycloak.org/ https://www.keycloak.org/) instead of auth0 and it works great.

bayesian_horse 7y ago

I would expect authorization and validation to be a real pain with PostgREST (I don't know enough about it to tell definitively, though). Even row-level access control, while not widespread any way, is often not enough. Complex validation in SQL can be done, of course, but SQL isn't exactly meant for these things, IMHO.

ruslan_talpa 7y ago
why would you "expect" that if you don't know about it?
- bayesian_horse 7y ago
  I know more than basic SQL. Maybe I am indeed not an accomplished enough master in SQL, but I can't see why I would ever prefer SQL over Python in terms of defining application logic.
ako 7y ago
Stored procedures often offer a better and more efficient way to implement data validation than non database native alternatives.
- bayesian_horse 7y ago
  It may indeed be efficient. Maybe I just don't like the idea of putting all my application logic into SQL statements. What I like about Django's ORM, for example, that you can declare a field to be an IP address, and this not only does the validation (which SQL can do easily, I am sure), but this declaration also carries over to HTML forms, admin interface, REST API serialization and HTML Templates.
ako 7y ago
This is an interesting read on validation in postgres: https://begriffs.com/posts/2017-10-21-sql-domain-integrity.html https://begriffs.com/posts/2017-10-21-sql-domain-integrity.h...