4 ms·
See my comments on Auth here: https://news.ycombinator.com/item?id=23320443 https://news.ycombinator.com/item?id=23320443 > We want to nail the auth and we're
by kiwicopple 6y ago
See my comments on Auth here: https://news.ycombinator.com/item?id=23320443 https://news.ycombinator.com/item?id=23320443
> We want to nail the auth and we're looking at leveraging Postgres' native Row Level Security. This is a tricky task to "generalize" for all businesses but we have some good ideas (we're discussing in our repo if you want to follow - https://github.com/supabase/supabase https://github.com/supabase/supabase)
> RESTful APIs I can of course get with PostgREST
That's what we use! See our supporting libraries:
https://github.com/supabase/postgrest-js https://github.com/supabase/postgrest-js
https://github.com/supabase/postgrest-rs https://github.com/supabase/postgrest-rs
https://github.com/supabase/postgrest-py https://github.com/supabase/postgrest-py (coming soon)
Also, I'm a long time user and a huge fan. My previous company is featured on their docs (blog post: https://paul.copplest.one/blog/nimbus-tech-2019-04.html#api-layer https://paul.copplest.one/blog/nimbus-tech-2019-04.html#api-...)
- 2mol 6y agoOh, that's super cool! I'm even more excited for your project in that case. I hope I can make the time to build a prototype, right now I'm doing the same for retool, and I feel very spoiled for good choices all of a sudden when it comes to backend abstractions.
- kiwicopple 6y agonice - if you build something and want it featured, let us know: alpha@supabase.io
- nicoburns 6y agoYou might want to look into how Hasura does auth. IMO it's really well thought through. However, it doesn't handle the actual authentication, just the access permissions afterwards. If you could layer firebase-style auth "strategies" (email/password, Facebook, Open ID, etc) on top of that kind of system, while keeping everything accessible directly in the main database, that'd be pretty awsome.
- chrisweekly 6y agoIOW, Hasura does authZ vs authN, right?
- wastedhours 6y agoFor a little more context for those scrolling past, I'm assuming this is around: authentication vs authorization. Check the person is who they say they are (authenticate), and then check they're allowed to access the thing they want to view (authorize). The first is quite easy to abstract, the latter is basically custom to most applications (for different definitions of "custom").
- pdimitar 6y agoJust FYI, making a good auth solution in Supabase will instantly make me a customer.
- keyle 6y agoJust chiming in... Auth, free hosting and SSL is what drove me to Firebase in the first place. DB is the last thing. Just thought you should know, when I read "Firebase alternative", I got excited about something else.
- kiwicopple 6y agoGood feedback - thanks. Stay excited! It's something we will build and we will make the experience as simple (simpler?) than Firebase
- cltsang 6y agoLikewise. Firestore client API is nice and convenient, but it is so limiting on queries. One has to know the limitations and plan ahead on how to model the data around them, or risk the ability to do even some fundamental queries [0]. [0] https://stackoverflow.com/questions/47251919/firestore-how-to-perform-a-query-with-inequality-not-equals https://stackoverflow.com/questions/47251919/firestore-how-t...
- fulafel 6y agoAre you also using PostgREST in the backend to provide the APIs, or are your REST APIs and hence client libs PostgREST compatible?
- kiwicopple 6y agoEach database gets it's own PostgREST instance, a realtime server, an API proxy, and a Postgres admin api (which we are building) to manage their schema programatically. We have client libraries for PostgREST, which then gets installed as a dependency in our main client library.