6 ms·

Supabase Beta: Auth, SQL Editor, Benchmarks

217 points by kiwicopple 6y ago

kiwicopple 6y ago
Hey HN, Supabase is an open source Firebase alternative. We're building the features of Firebase using enterprise-grade open source tools. We're particularly focused on scalability. We take proven tools like Postgres, and we make them as easy to use as Firebase. Supabase had an Alpha launch [1] six months ago. This time we're more stable and feature-full. For the past 2 months we've run benchmarks [2] and security audits and we're confident to take on production workloads. Our current feature-set includes a realtime engine [3] on top of Postgres, auto-generated APIs using PostgREST [4], and Auth with Row Level Security, OAuth, and magic links [5] . We have a full dashboard, with built-in SQL Editor (full Monaco editor) and a Table View (like Airtable) [6]. Next we are focused Storage & Functions, as well as the local development experience - making sure developers can go quickly from dev to prod. A few of the team will be here to answer any questions - my cofounder @awalias and @steve-chavez from PostgREST, @inian, and @1_over_n [1] Alpha launch - https://news.ycombinator.com/item?id=23319901 https://news.ycombinator.com/item?id=23319901 [2] Benchmarks - https://github.com/supabase/benchmarks https://github.com/supabase/benchmarks [3] Elixir Realtime engine - https://github.com/supabase/realtime https://github.com/supabase/realtime [4] PostgREST - http://postgrest.org/ http://postgrest.org/ [5] Auth: https://supabase.io/docs/guides/auth https://supabase.io/docs/guides/auth [6] Dashboard: https://supabase.io/docs/guides/database https://supabase.io/docs/guides/database
- nwienert 6y ago
  Really nicely done beta page, and the product is something that's needed to exist for a long time now. I remember talking with the RethinkDB guys before they closed and being worried they were making a bad decision not getting a cloud service in place earlier, so good on doing that. I have two points of feedback: 1. How open source is it? I didn't get a great feel from the beta page, but will you make it as easy as setting up a docker container or helm chart? I'd suggest that if you want to align incentives as best as possible, consider one of those new-fangled OSS licenses that has the most recent updates closed-source, then auto-open sourcing after a time period. That way you can give away a really nice, well-packaged version for free, not worry about Amazon, and still capture a big chunk of revenue from bigger clients who need the newest. 2. What are your plans/thoughts on denormalization [0]? Liron is a friend of mine and we've had interesting discussions on this since way back, I'd encourage you all to reach out to him, and consider it strongly. The "holy grail" for many years now has been obvious: a subscribable DB engine that handles denormalization. I hope you guys achieve it. Good luck! [0] https://lironshapira.medium.com/data-denormalization-is-broken-7b697352f405 https://lironshapira.medium.com/data-denormalization-is-brok...
  - kiwicopple 6y ago
    These are great questions. > will you make it as easy as setting up a docker container or helm chart? Yes, likely docker-compose in the short term (for our "local emulator"), and then something more prod-friendly later. Licensing is always a tough decision - we build client libraries for every tool we use, which are MIT licensed. Tools we build ourselves (like the Realtime server), are licensed under Apache 2.0. As you point out, we've started with our hosted platform because we feel this is important (as a business). This par is not yet public (also for security) and we may have to license it with a BSD license when we do open source it. > a subscribable DB engine that handles denormalization One of my favourite topics, and something we've been thinking about for months. It's incredibly hard to solve, especially when you add in Row Level Security and conflict resolution. Our current thinking is some sort of client store, using CRDTs that infer types from the database. We have some ideas for this but it's very early days. I'd love to talk to Liron - I'll reach out.
    - robertlagrant 6y ago
      Just make sure cloud companies can't just host your solution and make easy money from it. The Timescale licence is worth a look.
    - sixdimensional 6y ago
      I like the direction you guys seem to be taking here with Supabase. Regarding the comment about subscription-based DB engine and denormalization, I posted this [1] on the post about Materialize although I don't think anyone read it. I am right there that there is a new unified data architecture evolving and I think it is difficult but doable. CQRS and event-sourcing are core elements and the decoupling of the database continues. I also believe Flow Based Programming [2] and reactive programming (observables on top of streams of events) are other key concepts. I've worked on federated database query engines and it turns out that federation has some relationships to this problem. I recently saw this article about Netflix's approach to federated GraphQL (which to me feels like API composition) and found it interesting [3]. I don't know if anything of this helps you but hope it might :) I don't claim to be an expert here but if you're interested in talking more, my email's in my profile. [1] https://news.ycombinator.com/item?id=25285890 https://news.ycombinator.com/item?id=25285890 [2] https://wiki.c2.com/?FlowBasedProgramming https://wiki.c2.com/?FlowBasedProgramming [3] https://netflixtechblog.com/how-netflix-scales-its-api-with-graphql-federation-part-1-ae3557c187e2 https://netflixtechblog.com/how-netflix-scales-its-api-with-...
- michelpp 6y ago
  Congratulations! As a long time fan of PostgREST I love seeing a well thought out product take flight and support their community at the same time by openly hiring key open source members who have done great work.
  - kiwicopple 6y ago
    We're huge fans of PostgREST, and Steve has been amazing - building in performance and security improvements as fast as we can identify them
- swyx 6y ago
  excited about Storage and Functions! for storage, a common pain point is whether or not images (or video) hosted in storage will be CDNified for fast delivery. my dream wish is that there'd be an easy option to specify whether an image should be put on that optimized path, so that when i access it i know whether i'm getting the CDN or the origin version. itd also be nice to do things like specify dimensions or compression quality (basically making it an image optimizing CDN) for functions - both scheduling and durable functions would be cool :) both are tricky things to do right for local dev. wishing you all the best!!
  - kiwicopple 6y ago
    all great ideas swyx. We'll start with something basic for storage (probably min.io), but hoping to solve some of these more advanced scenarios once we're up and running. > scheduling and durable functions would be cool :) agreed!
- Scarbutt 6y ago
  The "Stripe SaaS starter" example seems to be missing.
  - kiwicopple 6y ago
    thanks for the heads-up - will fix. It's on Thor's github right now: https://github.com/thorwebdev/nextjs-subscription-payments https://github.com/thorwebdev/nextjs-subscription-payments
- mstade 6y ago
  I saw Supabase mentioned in another thread and signed up for the alpha. It's really cool stuff, kudos! We are currently writing an application where we already have auth set up using AWS Cognito. I haven't been able to find any documentation about it, but is it possible for us to keep using Cognito while still integrating with Supabase and taking advantage of the very nice row level security features, or would we essentially have to roll over to use Supabase for auth as well? Also, let me just say that it's a huge selling point for us that you're running with Postgres, thank you!
  - kiwicopple 6y ago
    thanks for signing up so early mstade > is it possible for us to keep using Cognito while still integrating with Supabase and taking advantage of the very nice row level security features Yes, this should be possible, as long as the JWT secret is the same, so that your database (and PostgREST) can determine the user. We can help to figure this out if you want - perhaps in a github discussion? https://github.com/supabase/supabase/discussions https://github.com/supabase/supabase/discussions
    - mstade 6y ago
      Absolutely, many thanks for the swift response and the relevant link! Keep up the great work!
- johnx123-up 6y ago
  https://github.com/supabase/realtime https://github.com/supabase/realtime looks very interesting. Can this be used to replace Debezium & Kafka for syncing Elasticsearch?
  - kiwicopple 6y ago
    Yes, it could be a replacement - we will add "connectors" to tools like kafka/elastic (and other systems) in the future
- hamandcheese 6y ago
  This looks really cool, but one thing I can't find an answer to is: how do I manage database migrations from version control?
  - dcsan 6y ago
    Good question! not OP but one of the projects here provides a full PG api if you are self-hosting. Presumably the plan is to provide a similar but secure API for supabase hosted instances in future? https://github.com/supabase/pg-api https://github.com/supabase/pg-api
    - kiwicopple 6y ago
      Yes, you're right. Eventually we will be adding migrations and a better local dev experience. For now you can use any tool you'd usually use with postgre - dbmate, seqlize etc
awalias 6y ago
Hey everyone! We put a lot of work over the last few months into performance benchmarking. We're very keen for people to run the benchmarks themselves and report your results: https://github.com/supabase/benchmarks https://github.com/supabase/benchmarks
snarkypixel 6y ago
The landing page is great too, congrats on the beta launch!
- kiwicopple 6y ago
  The landing page was a last minute decision, but we're happy that we did it. No doubt there are a few broken links tying our old and new sites together.
  - mmczaplinski 6y ago
    Just to let you know that e.g. https://supabase.io/oss/ https://supabase.io/oss/ is broken. Regardless, congrats on the launch! :)
avree 6y ago
There's something about this company's design and font/logo choice that makes it "feel" exactly like Robinhood. Also, this feels really similar to another project that launched on HN this month, https://news.ycombinator.com/item?id=25059133 https://news.ycombinator.com/item?id=25059133 (although Supabase focuses more on scalability, while Etebase focuses more on privacy?). Might be some interesting discussion there.
- kiwicopple 6y ago
  That's interesting - we didn't look at Robinhood during the redesign, but the Beta page is inspired by the Stack Overflow surveys: https://insights.stackoverflow.com/survey/2020 https://insights.stackoverflow.com/survey/2020 We're quite different from Etebase - I'll copy over the maintainer's comment from this thread[1]: I think it's very different to supabase.io. They are focusing on being a Firebase alternative, we are focusing on making it easy to build encrypted applications. [1] https://news.ycombinator.com/item?id=25071545 https://news.ycombinator.com/item?id=25071545
tjchear 6y ago
Congrats on the beta launch! Thoughts on supporting multi-tenant auth?
- steve-chavez 6y ago
  Supabase team member here. Multi-tenant is already possible with PostgreSQL RLS policies[1]. We provide a nice UI[2] to make them simpler to use. [1]: https://www.postgresql.org/docs/current/ddl-rowsecurity.html https://www.postgresql.org/docs/current/ddl-rowsecurity.html [2]: https://supabase.io/blog/2020/08/05/supabase-auth#policies https://supabase.io/blog/2020/08/05/supabase-auth#policies
- kiwicopple 6y ago
  thanks! Supabase is "just" Postgres under the hood, so it could be used for multi-tenant already. But I assume you have a particular architecture in mind - something we don't offer yet? We're very open to feedback, our roadmap is often guided by HN comments
  - tjchear 6y ago
    Yeah, I'm looking for something like this: https://cloud.google.com/identity-platform/docs/multi-tenancy-authentication https://cloud.google.com/identity-platform/docs/multi-tenanc...
throwaway32953 6y ago
Nice! Any timeline on Functions? I saw it's marked as "coming soon".
- kiwicopple 6y ago
  Hard to know an exact timeline - we will first ship Storage, and Functions after that. I think it will be ~Q2 2021. Surprisingly we don't have too many people asking for this at the moment. A lot of Supabase devs are using Next.js/Vercel or Netlify to write their function code, or using Stored Procedures: https://supabase.io/docs/client/rpc https://supabase.io/docs/client/rpc
  - nicoburns 6y ago
    Would you consider offering some kind of VM or container hosting (perhaps similar to Heroku - maybe even built on top of Dokku)? Serverless Functions are very popular for some reason but (much like the firebase databases) they seem to have a lot of downsides (cold starts, hard to test locally), and not a lot of upsides (a simple always-on VM is cheap anyway).
yekta 6y ago
Congrats on the launch. Waiting for the realtime API to be capable of filtering based on row level security and I'll definitely try it on some "serious" side projects afterwards. Small suggestion regarding the Firebase comparison: Including a package size comparison for various Firebase packages (realtime, auth etc.) vs Supabase.js might be useful.
- kiwicopple 6y ago
  > Including a package size comparison That's a great idea. A developer recently tweeted[1]: 3.gkB gziped vs firebase which is 218.2kB > Waiting for the realtime API to be capable of filtering based on row level security and I'll definitely try it on some "serious" We have a solution for this underway, and it's great to get this feedback because it helps us prioritise. [1] https://twitter.com/chiubaca/status/1328654022832758786 https://twitter.com/chiubaca/status/1328654022832758786
  - ngyekta 6y ago
    I have looked at Firebase core + realtime + auth vs Supabase.js and results were very much in Supabase's favor :) Understandable though since Firebase is doing a bunch of other things under the hood. I would still call it a relatively fair comparison. Also, I think the primary buttons on the website has an easily fixable contrast problem. I just created an issue for it.
    - kiwicopple 6y ago
      To be fair to Firebase, they have a lot more functionality in their client libraries than ours. But they are definitely bloated, and I think they are working on reducing their bundle sizes. This is something we are very cognisant of - we will keep our bundles modular and easy to tree-shake (keeping admin functions separate). > the primary buttons on the website has an easily fixable contrast problem Thanks for the fix! We'll merge tomorrow, because the whole team is asleep..
axbytg 6y ago
Hello! Emails to work@supabase are getting kicked back. I've been working on something similar for hobby use @ apime.dev since the pandemic started and would love to chat :).
- kiwicopple 6y ago
  Awesome, thanks for the heads-up @axbytg. Fixed. I think I saw an email from you in my inbox but we've been swamped trying to wrap up the Beta. Let's chat next week?
  - axbytg 6y ago
    No worries at all, would love to! I am available anytime Wed-Fri. I can reach back out via email as well if that makes scheduling easier.
freeqaz 6y ago
Are you using Monaco for the SQL Editor in the browser? If so, how did you setup the language server for enabling auto-completion/intellisense in the editor?
- kiwicopple 6y ago
  We are using Monaco - we have big plans for it. > did you setup the language server Most of this was baked into the editor. Feel free to open a discussion [1] and I can get our team member to share the technical implementation [1] Discussions: https://github.com/supabase/supabase/discussions https://github.com/supabase/supabase/discussions
rickdg 6y ago
Congratulations on the current state of the project, it seems very promising. Do you plan on having some fallback to websockets for the realtime database? The thing about google is that it can be viable to request getting it whitelisted on corporate firewalls.
- kiwicopple 6y ago
  > fallback to websockets Just to make sure I understand your question, do you mean falling back from websockets to something like long polling (on https port)?
buu700 6y ago
Sounds awesome! Does it have an equivalent to Firebase security rules (https://firebase.google.com/docs/rules https://firebase.google.com/docs/rules)?
- steve-chavez 6y ago
  Yes! We leverage PostgreSQL Policies[1], which give you the same flexibility(more actually) as Firebase security rules. [1]: https://supabase.io/docs/guides/auth#policies https://supabase.io/docs/guides/auth#policies
lh15 6y ago
Does the Supabase client library store the JWTs in localstorage? How does the auth front end work?
- kiwicopple 6y ago
  Our client library is completely modular, so the authentication part works with gotrue (Netlify's auth server). Our client library is here (and yes, stored in local storage): https://github.com/supabase/gotrue-js https://github.com/supabase/gotrue-js > How does the auth front end work? Once we authenticate the user, the JWT is passed as a header and you can use it in Postgres within Policies (for Row Level Security). We add some helper functions in an auth schema to make this easier
keithnz 6y ago
From another post today in HN, would it be possible to hook timescaledb and this together?
- kiwicopple 6y ago
  We wanted to add timescale into our platform but unfortunately their license doesn't allow it (which is completely fair). Once we bring out a better self-hosted solution you should be able to point it towards your own Postgres server with Timescale installed.
dcsan 6y ago
is there any way to get typechecking on supabase queries? eg if using typescript? the queries seems to be just strings: https://supabase.io/docs/client/select https://supabase.io/docs/client/select

217 points by kiwicopple 6y ago

Hey HN, Supabase is an open source Firebase alternative. We're building the features of Firebase using enterprise-grade open source tools. We're particularly focused on scalability. We take proven tools like Postgres, and we make them as easy to use as Firebase. Supabase had an Alpha launch [1] six months ago. This time we're more stable and feature-full. For the past 2 months we've run benchmarks [2] and security audits and we're confident to take on production workloads. Our current feature-set includes a realtime engine [3] on top of Postgres, auto-generated APIs using PostgREST [4], and Auth with Row Level Security, OAuth, and magic links [5] . We have a full dashboard, with built-in SQL Editor (full Monaco editor) and a Table View (like Airtable) [6]. Next we are focused Storage & Functions, as well as the local development experience - making sure developers can go quickly from dev to prod. A few of the team will be here to answer any questions - my cofounder @awalias and @steve-chavez from PostgREST, @inian, and @1_over_n [1] Alpha launch - https://news.ycombinator.com/item?id=23319901 https://news.ycombinator.com/item?id=23319901 [2] Benchmarks - https://github.com/supabase/benchmarks https://github.com/supabase/benchmarks [3] Elixir Realtime engine - https://github.com/supabase/realtime https://github.com/supabase/realtime [4] PostgREST - http://postgrest.org/ http://postgrest.org/ [5] Auth: https://supabase.io/docs/guides/auth https://supabase.io/docs/guides/auth [6] Dashboard: https://supabase.io/docs/guides/database https://supabase.io/docs/guides/database

nwienert 6y ago
Really nicely done beta page, and the product is something that's needed to exist for a long time now. I remember talking with the RethinkDB guys before they closed and being worried they were making a bad decision not getting a cloud service in place earlier, so good on doing that. I have two points of feedback: 1. How open source is it? I didn't get a great feel from the beta page, but will you make it as easy as setting up a docker container or helm chart? I'd suggest that if you want to align incentives as best as possible, consider one of those new-fangled OSS licenses that has the most recent updates closed-source, then auto-open sourcing after a time period. That way you can give away a really nice, well-packaged version for free, not worry about Amazon, and still capture a big chunk of revenue from bigger clients who need the newest. 2. What are your plans/thoughts on denormalization [0]? Liron is a friend of mine and we've had interesting discussions on this since way back, I'd encourage you all to reach out to him, and consider it strongly. The "holy grail" for many years now has been obvious: a subscribable DB engine that handles denormalization. I hope you guys achieve it. Good luck! [0] https://lironshapira.medium.com/data-denormalization-is-broken-7b697352f405 https://lironshapira.medium.com/data-denormalization-is-brok...
- kiwicopple 6y ago
  These are great questions. > will you make it as easy as setting up a docker container or helm chart? Yes, likely docker-compose in the short term (for our "local emulator"), and then something more prod-friendly later. Licensing is always a tough decision - we build client libraries for every tool we use, which are MIT licensed. Tools we build ourselves (like the Realtime server), are licensed under Apache 2.0. As you point out, we've started with our hosted platform because we feel this is important (as a business). This par is not yet public (also for security) and we may have to license it with a BSD license when we do open source it. > a subscribable DB engine that handles denormalization One of my favourite topics, and something we've been thinking about for months. It's incredibly hard to solve, especially when you add in Row Level Security and conflict resolution. Our current thinking is some sort of client store, using CRDTs that infer types from the database. We have some ideas for this but it's very early days. I'd love to talk to Liron - I'll reach out.
  - robertlagrant 6y ago
    Just make sure cloud companies can't just host your solution and make easy money from it. The Timescale licence is worth a look.
  - sixdimensional 6y ago
    I like the direction you guys seem to be taking here with Supabase. Regarding the comment about subscription-based DB engine and denormalization, I posted this [1] on the post about Materialize although I don't think anyone read it. I am right there that there is a new unified data architecture evolving and I think it is difficult but doable. CQRS and event-sourcing are core elements and the decoupling of the database continues. I also believe Flow Based Programming [2] and reactive programming (observables on top of streams of events) are other key concepts. I've worked on federated database query engines and it turns out that federation has some relationships to this problem. I recently saw this article about Netflix's approach to federated GraphQL (which to me feels like API composition) and found it interesting [3]. I don't know if anything of this helps you but hope it might :) I don't claim to be an expert here but if you're interested in talking more, my email's in my profile. [1] https://news.ycombinator.com/item?id=25285890 https://news.ycombinator.com/item?id=25285890 [2] https://wiki.c2.com/?FlowBasedProgramming https://wiki.c2.com/?FlowBasedProgramming [3] https://netflixtechblog.com/how-netflix-scales-its-api-with-graphql-federation-part-1-ae3557c187e2 https://netflixtechblog.com/how-netflix-scales-its-api-with-...
michelpp 6y ago
Congratulations! As a long time fan of PostgREST I love seeing a well thought out product take flight and support their community at the same time by openly hiring key open source members who have done great work.
- kiwicopple 6y ago
  We're huge fans of PostgREST, and Steve has been amazing - building in performance and security improvements as fast as we can identify them
swyx 6y ago
excited about Storage and Functions! for storage, a common pain point is whether or not images (or video) hosted in storage will be CDNified for fast delivery. my dream wish is that there'd be an easy option to specify whether an image should be put on that optimized path, so that when i access it i know whether i'm getting the CDN or the origin version. itd also be nice to do things like specify dimensions or compression quality (basically making it an image optimizing CDN) for functions - both scheduling and durable functions would be cool :) both are tricky things to do right for local dev. wishing you all the best!!
- kiwicopple 6y ago
  all great ideas swyx. We'll start with something basic for storage (probably min.io), but hoping to solve some of these more advanced scenarios once we're up and running. > scheduling and durable functions would be cool :) agreed!
Scarbutt 6y ago
The "Stripe SaaS starter" example seems to be missing.
- kiwicopple 6y ago
  thanks for the heads-up - will fix. It's on Thor's github right now: https://github.com/thorwebdev/nextjs-subscription-payments https://github.com/thorwebdev/nextjs-subscription-payments
mstade 6y ago
I saw Supabase mentioned in another thread and signed up for the alpha. It's really cool stuff, kudos! We are currently writing an application where we already have auth set up using AWS Cognito. I haven't been able to find any documentation about it, but is it possible for us to keep using Cognito while still integrating with Supabase and taking advantage of the very nice row level security features, or would we essentially have to roll over to use Supabase for auth as well? Also, let me just say that it's a huge selling point for us that you're running with Postgres, thank you!
- kiwicopple 6y ago
  thanks for signing up so early mstade > is it possible for us to keep using Cognito while still integrating with Supabase and taking advantage of the very nice row level security features Yes, this should be possible, as long as the JWT secret is the same, so that your database (and PostgREST) can determine the user. We can help to figure this out if you want - perhaps in a github discussion? https://github.com/supabase/supabase/discussions https://github.com/supabase/supabase/discussions
  - mstade 6y ago
    Absolutely, many thanks for the swift response and the relevant link! Keep up the great work!
johnx123-up 6y ago
https://github.com/supabase/realtime https://github.com/supabase/realtime looks very interesting. Can this be used to replace Debezium & Kafka for syncing Elasticsearch?
- kiwicopple 6y ago
  Yes, it could be a replacement - we will add "connectors" to tools like kafka/elastic (and other systems) in the future
hamandcheese 6y ago
This looks really cool, but one thing I can't find an answer to is: how do I manage database migrations from version control?
- dcsan 6y ago
  Good question! not OP but one of the projects here provides a full PG api if you are self-hosting. Presumably the plan is to provide a similar but secure API for supabase hosted instances in future? https://github.com/supabase/pg-api https://github.com/supabase/pg-api
  - kiwicopple 6y ago
    Yes, you're right. Eventually we will be adding migrations and a better local dev experience. For now you can use any tool you'd usually use with postgre - dbmate, seqlize etc

awalias 6y ago

Hey everyone! We put a lot of work over the last few months into performance benchmarking. We're very keen for people to run the benchmarks themselves and report your results: https://github.com/supabase/benchmarks https://github.com/supabase/benchmarks

snarkypixel 6y ago

The landing page is great too, congrats on the beta launch!

kiwicopple 6y ago
The landing page was a last minute decision, but we're happy that we did it. No doubt there are a few broken links tying our old and new sites together.
- mmczaplinski 6y ago
  Just to let you know that e.g. https://supabase.io/oss/ https://supabase.io/oss/ is broken. Regardless, congrats on the launch! :)

avree 6y ago

There's something about this company's design and font/logo choice that makes it "feel" exactly like Robinhood. Also, this feels really similar to another project that launched on HN this month, https://news.ycombinator.com/item?id=25059133 https://news.ycombinator.com/item?id=25059133 (although Supabase focuses more on scalability, while Etebase focuses more on privacy?). Might be some interesting discussion there.

kiwicopple 6y ago
That's interesting - we didn't look at Robinhood during the redesign, but the Beta page is inspired by the Stack Overflow surveys: https://insights.stackoverflow.com/survey/2020 https://insights.stackoverflow.com/survey/2020 We're quite different from Etebase - I'll copy over the maintainer's comment from this thread[1]: I think it's very different to supabase.io. They are focusing on being a Firebase alternative, we are focusing on making it easy to build encrypted applications. [1] https://news.ycombinator.com/item?id=25071545 https://news.ycombinator.com/item?id=25071545

tjchear 6y ago

Congrats on the beta launch! Thoughts on supporting multi-tenant auth?

steve-chavez 6y ago
Supabase team member here. Multi-tenant is already possible with PostgreSQL RLS policies[1]. We provide a nice UI[2] to make them simpler to use. [1]: https://www.postgresql.org/docs/current/ddl-rowsecurity.html https://www.postgresql.org/docs/current/ddl-rowsecurity.html [2]: https://supabase.io/blog/2020/08/05/supabase-auth#policies https://supabase.io/blog/2020/08/05/supabase-auth#policies
kiwicopple 6y ago
thanks! Supabase is "just" Postgres under the hood, so it could be used for multi-tenant already. But I assume you have a particular architecture in mind - something we don't offer yet? We're very open to feedback, our roadmap is often guided by HN comments
- tjchear 6y ago
  Yeah, I'm looking for something like this: https://cloud.google.com/identity-platform/docs/multi-tenancy-authentication https://cloud.google.com/identity-platform/docs/multi-tenanc...

throwaway32953 6y ago

Nice! Any timeline on Functions? I saw it's marked as "coming soon".

kiwicopple 6y ago
Hard to know an exact timeline - we will first ship Storage, and Functions after that. I think it will be ~Q2 2021. Surprisingly we don't have too many people asking for this at the moment. A lot of Supabase devs are using Next.js/Vercel or Netlify to write their function code, or using Stored Procedures: https://supabase.io/docs/client/rpc https://supabase.io/docs/client/rpc
- nicoburns 6y ago
  Would you consider offering some kind of VM or container hosting (perhaps similar to Heroku - maybe even built on top of Dokku)? Serverless Functions are very popular for some reason but (much like the firebase databases) they seem to have a lot of downsides (cold starts, hard to test locally), and not a lot of upsides (a simple always-on VM is cheap anyway).

yekta 6y ago

Congrats on the launch. Waiting for the realtime API to be capable of filtering based on row level security and I'll definitely try it on some "serious" side projects afterwards. Small suggestion regarding the Firebase comparison: Including a package size comparison for various Firebase packages (realtime, auth etc.) vs Supabase.js might be useful.

kiwicopple 6y ago
> Including a package size comparison That's a great idea. A developer recently tweeted[1]: 3.gkB gziped vs firebase which is 218.2kB > Waiting for the realtime API to be capable of filtering based on row level security and I'll definitely try it on some "serious" We have a solution for this underway, and it's great to get this feedback because it helps us prioritise. [1] https://twitter.com/chiubaca/status/1328654022832758786 https://twitter.com/chiubaca/status/1328654022832758786
- ngyekta 6y ago
  I have looked at Firebase core + realtime + auth vs Supabase.js and results were very much in Supabase's favor :) Understandable though since Firebase is doing a bunch of other things under the hood. I would still call it a relatively fair comparison. Also, I think the primary buttons on the website has an easily fixable contrast problem. I just created an issue for it.
  - kiwicopple 6y ago
    To be fair to Firebase, they have a lot more functionality in their client libraries than ours. But they are definitely bloated, and I think they are working on reducing their bundle sizes. This is something we are very cognisant of - we will keep our bundles modular and easy to tree-shake (keeping admin functions separate). > the primary buttons on the website has an easily fixable contrast problem Thanks for the fix! We'll merge tomorrow, because the whole team is asleep..

axbytg 6y ago

Hello! Emails to work@supabase are getting kicked back. I've been working on something similar for hobby use @ apime.dev since the pandemic started and would love to chat :).

kiwicopple 6y ago
Awesome, thanks for the heads-up @axbytg. Fixed. I think I saw an email from you in my inbox but we've been swamped trying to wrap up the Beta. Let's chat next week?
- axbytg 6y ago
  No worries at all, would love to! I am available anytime Wed-Fri. I can reach back out via email as well if that makes scheduling easier.

freeqaz 6y ago

Are you using Monaco for the SQL Editor in the browser? If so, how did you setup the language server for enabling auto-completion/intellisense in the editor?

kiwicopple 6y ago
We are using Monaco - we have big plans for it. > did you setup the language server Most of this was baked into the editor. Feel free to open a discussion [1] and I can get our team member to share the technical implementation [1] Discussions: https://github.com/supabase/supabase/discussions https://github.com/supabase/supabase/discussions

rickdg 6y ago

Congratulations on the current state of the project, it seems very promising. Do you plan on having some fallback to websockets for the realtime database? The thing about google is that it can be viable to request getting it whitelisted on corporate firewalls.

kiwicopple 6y ago
> fallback to websockets Just to make sure I understand your question, do you mean falling back from websockets to something like long polling (on https port)?

buu700 6y ago

Sounds awesome! Does it have an equivalent to Firebase security rules (https://firebase.google.com/docs/rules https://firebase.google.com/docs/rules)?

steve-chavez 6y ago
Yes! We leverage PostgreSQL Policies[1], which give you the same flexibility(more actually) as Firebase security rules. [1]: https://supabase.io/docs/guides/auth#policies https://supabase.io/docs/guides/auth#policies

lh15 6y ago

Does the Supabase client library store the JWTs in localstorage? How does the auth front end work?

kiwicopple 6y ago
Our client library is completely modular, so the authentication part works with gotrue (Netlify's auth server). Our client library is here (and yes, stored in local storage): https://github.com/supabase/gotrue-js https://github.com/supabase/gotrue-js > How does the auth front end work? Once we authenticate the user, the JWT is passed as a header and you can use it in Postgres within Policies (for Row Level Security). We add some helper functions in an auth schema to make this easier

keithnz 6y ago

From another post today in HN, would it be possible to hook timescaledb and this together?

kiwicopple 6y ago
We wanted to add timescale into our platform but unfortunately their license doesn't allow it (which is completely fair). Once we bring out a better self-hosted solution you should be able to point it towards your own Postgres server with Timescale installed.

dcsan 6y ago

is there any way to get typechecking on supabase queries? eg if using typescript? the queries seems to be just strings: https://supabase.io/docs/client/select https://supabase.io/docs/client/select