Hacker News Reader

Hacker News

Comment by Cieplak | Hacker News Reader

Full thread

Cieplak

Just wanted to give a huge shout-out to PostgREST:

https://postgrest.com

https://github.com/begriffs/postgrest

You can get many of the benefits of GraphQL using postgrest's resource embedding:

https://postgrest.com/en/v4.1/api.html#resource-embedding

We're using it in production.

PS: To be clear, you can't expose it directly to your users. We wrap it in a proxy service that provides authentication and authorization, and parses and transforms the users' URL queries destined for PostgREST. We also apply some transformations to the data coming back from PostgREST, such as encoding our internal UUIDs. It may sound complicated, but it's actually only about 200 lines of Erlang.

View on HN

IMO modeling your api directly off of your database tables is often an anti-pattern. One of the biggest mistakes I see people make is assuming their api's data model has to match their database's. It's common to introduce resources on the api side that may not have their own table in the database. For example, you could have a table that has a "type" flag (to model some kind of inheritance), but on the api you expose these as separate resources. Or you could have a larger resource on the api, but it's actually backed by several tables.

Graphql is also more generic and allows you to fetch from multiple data sources. These could be databases, apis, or wherever. You write code that fulfills each column and graphql assembles a single object.

I could see postgrest being ok for prototyping or simple apis, but it seems like one of those things that you'd grow out of eventually.

Have you heard of views and FDW?

Views are only a solution for reads, not writes. FDWs are not an elegant solution to anything related to this. Think microservices that already have an api defined.

Your original comment said it's bad to couple your api with tables so I am agreeing with you, use views to decouple. for writes, you can use stored procedures for corner cases although most of the apps work with one model at a time, so auto-updatable views work most of the time. So if we take into account that most apps talk to one database, i have most of it covered with simple views since usually you have a 80/20 read/write split? I'll take that.

FDW are very elegant for reading data from other systems. If you can read from twitter https://github.com/umitanuki/twitter_fdw you can read from anything although I don't understand why you brought up microservices, this is one one of the microservices (that is talking to the db), it's not the thing trying to unite all microservices. You can have GraphQL on top of PostgREST just fine (https://subzero.cloud).

Also doesn't PostgREST handle PostgreSQL custom upgradable view?

For instance, I already use this feature to present jsonb attributes as columns and edit them with a tool that is unaware of jsonb (QGIS). (NB: But not in a PostgREST context, using native connection)

Many views are "auto updatable" in Postgres, meaning the db knows how to seamlessly pass updates down to the underlying relation. https://www.postgresql.org/docs/current/static/rules-views.h...

For more updates to more complicated views (such as some joins), you can use a trigger as also described in the linked docs above.

If you treat PostgREST as an ORM, then you can easily decouple the database data model from the API representation. I imagine there are scenarios in which PostgREST would outperform certain ORMs implemented in dynamically-typed languages.

This is exactly my usecase. I replaced my NodeJs ORM layer with PostgREST and express apis layer with Aws ApiGateway.

Why can't you expose it to your users and why is PostgreSQL bases authorization not good enough?

I looked at PosgREST for a backend for my Startup. Documentation was confusing, I couldn't see a coherent way to use it securely and the examples of other sites on Github were confusing. GraphQL at this time seems higher quality and also would be a good feature for PostgREST.

working on a coherent way here https://github.com/subzerocloud/postgrest-starter-kit/wiki

writing docs is hard but what do you expect :), GraphQL is FB funded, PostgREST is 3-4 guys, no backing.

Fair point about the docs, I've been putting reference information in them over time, but it could use more guided tutorials.

Last week I began working to improve that, by writing a series of tutorials. Here's the first: https://postgrest.com/en/v4.1/tutorials/tut0.html

More to come, including tutorials about row-level security and authentication.

where are you using it? (and you can even get GraphQL on top of it :P https://subzero.cloud)

when you say proxy do you mean literally nginx/something or some go/java/etc. http server?

i don't understand how one would use this? obviously you're not just exposing this api to users right? are you just using it as a substitute for an orm or data access layer in your own app?

I bet they ar doing exactly that, exposing the api supported by PostgREST :)

https://github.com/subzerocloud/postgrest-starter-kit/wiki/P...

Edit: seems they are not, ... oh well :)

business logic in sql seems like a bad idea (especially since you can't connect it to other services? or can you make ajax requests in sql?).

you can if you really want to, but you are not supposed to. this tool gives you a way to talk to your database, not other systems. to talk to 3rd party systems you use other components in the stack (openresty/rabbitmq) https://github.com/subzerocloud/postgrest-starter-kit

Business logic in SQL is a bad idea because it's much easier (for most people, anyway) to write and test it in a normal programming language. Especially if you want to have nice things like logging, breakpoints / inspection, composition / reuse, nice exception handling, etc..

developer tooling is indeed not on the same level as other languages but don't say it does not exist https://www.pgadmin.org/docs/pgadmin3/1.22/debugger.html

logic that directly relates to the data being stored is much easier to express in the database (constraints), resulting in a big reduction of code which means small simple functions that almost don't need debugging.

also what people call business logic often means fetching data from the db, processing it in some way and returning it. This is what views are for, they are definitions, so there's nothing to test there, except performance maybe.

> logic that directly relates to the data being stored is much easier to express in the database (constraints), resulting in a big reduction of code which means small simple functions that almost don't need debugging.

I think this is true for SQL experts (provided you're on the right database platform, of course - Postgres probably, MySQL and SQLite I doubt it) but it's not true for people with expertise in other language(s), which is the majority of people using the database. I can write arbitrarily complex business logic in Python and Javascript, which I am very familiar with. I would struggle to do that with SQL, and I know that all of my colleagues would struggle to understand what I had done. And I'm not unfamiliar with RDBMS - I've been working with them for years. Maybe that's a reflection on me, but I'd say it's been true of 95% of people I've ever worked with.

PostgreSQL vs Sqlie - sure, no argument there, i am talking about a reasonably complex thing like PG/Oracle/MsSql.

Well, of course, it's easy to use what you already know as opposed to the thing you don't, and i agree that most of the people don't know the capabilities of the databases but your comment implied that it's a bad idea in general and i can't agree with that.

The places where you would use SQL would be for reading data and some of them (views/queries) might get big, a bit complex but i doubt the equivalent code in any other language doing the same thing would be any simpler/easier to understand. I would bet the view code would be an order of magnitude shorter than the expression of the same problem in any other language, also you can use stored procedures (in any supported language) for reading.

For writing ... you don't have to use Pl/pgSql ... use your beloved Python/Perl/JavaScript :) the only difference the code is running in your database.

til there's a debugger in pgadmin3. will very much come in handy i'm sure. thanks.

but i don't agree with this

>also what people call business logic often means fetching data from the db, processing it in some way and returning it. This is what views are for, they are definitions, so there's nothing to test there, except performance maybe.

i see business logic as things that connect disparate parts of the domain. not all of my business is in my db. a lot of it is somewhere else, in someone else's db, accessible only through their api. like i said in my op: unless you want to hack postgres (or whatever rdbms) into a full-fledged general use dev environment you're not going to be able to marshal all of these disparate resources.

And why do you say that you don't have composition/reuse when you very well can use JS/Perl/Python to write your stored procedures (or even C and load it as a extension).

Well, you can write stored procedures in JS/Perl/Python for Postgres, but not necessarily for other databases. And if you do it's probably not portable. And the fact that this capability exists I think is some evidence that sometimes you can't do enough with SQL to do everything you need in SQL.

Anyway, I was talking in generalities, not about Postgres specifically. I would argue that if you're going to use Python to write stored procedures, why not just write a traditional Python script/app with SQLAlchemy? That SQLAlchemy has an ORM capability doesn't mean it needs to be used that way, as it's creator takes pains to point out. And this is a much more common pattern for using Python with a database, which is to my original point that its easier for most people to do.

python for stored procedures: bring code to the data, not data to the code, i.e. it's much much faster because there is no overhead for shuffling data over the network, a few serializing steps and everything in between.

It's much more probable that you will switch your language/framework then changing the database. This fear of "database lock-in" is unreasonable and the source of many not so good patterns ( as in ORM :) ). The only reasonable rationale for fear of lock-in is Oracle :) but you again, it's unreasonable, and you even semi-automated processes for migrating https://aws.amazon.com/dms/

As I see it PostgREST might finally be a way for backend database developer to easily provide and manage external web API that can then be used by all magical multi-headed unicorn powered and sparkling star enabled web framework of next month.

Errr... sorry... I ranted...

Another point of view would be that it could help frontend developer hook to a well defined API and never again have to dive into the seven hell madness of the underlying database ruled by a crazy monk that call himself dbadmin and draw mysterious SQL optimisation spell on the walls while yelling ACCCCIIIIDDDD! in the darkest hour of the night.

Humm... Damn... I guess I will be downvoted... Sorry --'

Reply on news.ycombinator.com