REST and GraphQL framework to build API-driven projects
api-platform.com
api-platform.com
The only argument I can think of is that you already have a team of PHP experts and they don't want to transition to Ruby, Node or Django.
Prior to taking up Laravel and Vue, it was becoming monotonous to build out websites.
However now with Vue taking up the bulk of work and relegating Laravel to effectively an API for:
- authentication and roles.
- database layer for retrieval and submission
- server side validation
- gateway to the message queue
Fact is, there's so little to use PHP for. I have contemplated moving to GoLang (and may do so in the future). But there is a reason why I stay with Laravel. It's just far easier and far quicker for me to code in PHP than using Javascript (node), GoLang and Python. Couple that with using composer which is a decent package manager. I can iterate very very quickly and have reliable robust code.
Of course, you can argue that the same can be achieved with Rails, GoLang, Python, Javascript, etc, etc. That's great, stick with what works for YOU.
I'm simply not going to put any effort in learning Rails or getting better at another language I know.
I'd rather put in more effort to building out more features and grinding out what matters and that's making sure code turns into $$$. Which is something I think we can all agree with. Use the best tool that you can work with that will do the job well.
But honestly, the main reason is that you can find PHP developers everywhere and they are cheap. Given that you want to build a project that grows and advances, that is maintainable, for which you require a vast ecosystem to kick-start your ideas and a lot of very good tooling and free sources of knowledge, you won't find a better platform than PHP.
Ok, Perl might be an alternatively hugely developed language but it is really complicated to find new developers for it. In contrast, you will find a lot of developers, testers, sysops that have the knowledge for working and administering the PHP tech stack. Yes, you could use the coolest language but how would you be able to pay super expensive Go/Kotlin/Node developers once your company has left start-up mode and is there really any gain from that? The risk to be betting on a dying horse might be too high or, less dramatic, everyone is just cooking with water.
If you want to earn money from your company and not just sell your expensive personell at some point it makes sense to start easy and advance the people you have. If you are building API based systems you are not locking yourself in a technology anyways. Given how flexible and fast-moving technology is today one could probably also find a good argument that you absolutely should always base your projects on PHP.
But now instead of exposing it as html pages, you expose your django/ruby models using an api like graphql or rest. So then you can use all new fancy js frameworks like react or vue.js.
Ruby and Django developers are as around as much as PHP developers.
So I'm not a PHP developer anymore, and haven't been for years. Neither is anyone else with options, I'd guess, unless they've found some rare shop that pays real money for them, which I'm sure do exist. I don't actually hate the language. It's OK for what it does. It's a helluva lot less yak-shavey than most of the other popular web languages, so that's nice. I'd work in it again if it paid alright and I wasn't worried the next role wouldn't (that is, that I was killing my earning potential by gaining yet more years of experience in it).
Anyhow.
One of my favourite things about the Ruby community is that nobody would ever suggest that we're popular because we're cheap. I don't want to work with people that are an easily replaced commodity. Nobody good is cheap.
Do you realize this sort of thing is no longer a reflection on the language (folks are immune to it). For people who want to hate just to hate, why are you here on HN? Seriously, go find a subreddit to flame on.
It should not be negative to ask why someone might choose a PHP framework given so many other options.
I do find it amazing how little credit Rails gets from other framework communities given how many of their features are directly lifted from concepts that Rails originated or popularized. It's possible that Laravel developers don't know migrations came from Rails, for example.
Anyhow, if you're asking about my opinion, personally... don't confuse hate with pity. I've had to make some changes to a Laravel backend for a client project lately, and if you honestly believe that it's nicer to work with than Rails, we have different working definitions of nice.
For a few cases off the top of my head where PHP/Laravel > Ruby/Rails IMO:
- Waaay less magic in Laravel. Controllers are explicitly named, and views are explicitly rendered from methods (Unlike in Rails where everything can be done based on the naming convention of the files).
- Ruby/Rails has too many ways of doing the same thing. Laravel is quite streamlined in that regard. A big part of this is Rails abusing meta-programming IMO (for example, compare ActiveRecord vs. Eloquent).
- I find Laravel's documentation to be top-tier - I rarely have additional questions after reading the relevant sections. And there's official built-in support for a ton of 3rd party services (e.g. Stripe subcriptions).
- Some support for static types in PHP (better than nothing, but nowhere near where I'd like them to be).
- Blade > ERB IMO. Less noise + easier to read. And again, explicit calls to view.render(["var" => $var]) vs. implicit @var insntance variables tacked on to the controller.
Apart from that, PHP is:
- Less prone to memory leaks due to it spinning up a process/thread per request (which can be quite a big advantage - since it means you don't need orchestration overhead for smaller projects).
- Fast enough that performance isn't really a concern (compared to the amount of stories I've heard about migrating away from Rails due to performance problems - I've never heard the same about Laravel).
It feels to me like Rails blazed the trail for developer happiness a few years ago - but these days it seems like a bit of a relic.
As compile-to-JS has matured, many of us have switched to things like TypeScript. That kinda ruins your glib analogy.
The improvements in both the language/community plus how people are using JS since The Good Parts was quite a significant improvement.
But people largely went through that whole process because of the ubiquity of browsers not because JS was a good idea. There are so many better alternatives on the server side for web, I don’t see the point in PHP going through that whole renovation unless it’s to hire more and cheaper developers.
and may be being cheaper to hire is a bigger importance than you'd care to admit. After all, the person paying the bills wants it to be as low as possible whilst still achieving the result. And they call the shots.
PHP developers are cheap because in general they're very junior. Junior Javascript developers are cheap too.
But Javascript is compiled in the browser, by many browsers, and so is hard to nail down an environment.
PHP runs on the server which is pretty much a fixed environment. It has more options to it yet it feels like it hasn't made use of it.
Weird, because thousands of developers are extremely happy building with Laravel.
EDIT: ok sure, it won't scale as well as Lambda without extra work.
You have several headless cms for almost any language, so you can start with your language and database of choice and move from there.
I particularly settled with this arquitecture: - Postgraphile as an api layer over the postgresql storage - prect client, as I work with old embedded systems and need something very small.
It doesn't have an automated admin as I don't need it, but if needed you could throw an admin built with react-admin or something similar
They both delegate the application entirely to Postgres, which can do everything all other GraphQL/REST frameworks can do, with no ORMs, data copying, restarting worker processes, poorly generated SQL, or worse. Both systems can have a dozen workers per gigabyte of RAM, vs a dozen gigabytes of RAM per worker for something like Django.
Postgres can do per-row security, can run functions in Python or Javascript or many other languages, can integrate with FDWs to many external services (like redis or mongo or what have you). Numerous extensions exist to trigger event streams (like to rabbit) work with advanced text analysis and searching, horizontal sharding of many different flavors, the list goes on.
If you have to write an API that's pure logic and no model, then pick your favorite language; I'd probably use either Flask or node. But when does that ever happen? Maybe a small sidecar API on what is generally a large CRUD application with analytics. Everything SQL is perfectly designed to serve. Stitch them together with GraphQL or route the REST off different path prefixes from the frontend ala microservices.
Furthermore, SQL is horribly un-composable; the lack of any real kind of metaprogramming means you end up repeating yourself quite a bit, or at the very least creating multiple layers of indirection in the form of views. I also find it much more painful to work with FDWs and all the various Postgres integration extensions to do simple things like queuing or caching, as opposed to just using a library in your language of choice (although, admittedly, that might be due to lack of experience).
At the end of the day, PostgREST and Postgraphile are great for quickly prototyping an API when all you have is the DB, but I would personally never use them on a project of significant size. YMMV, of course.
PS, assuming you are who I think you are: Hi! Hope you're doing well. :)
So far I like it quite a bit, no complaints. I found a couple other, similar projects when I was looking as well.
For the Djangonauts in the crowd, has anyone moved from REST to GraphQL in their teams? How's the transition been and what kind of tools did you use?
I'm giving a talk at this year's PyBay and am looking to solicit some stories / experiences.
Even outside of python many people seem to be on the fence when talking about actually implementing it.
I plan to open source it in the coming weeks. Email me if you're interested and I will reach out when it's on GitHub.
All the python graphql libraries are based on it, so your work is going to be very valuable I expect.
It was good, but comes with a lot of boilerplate. Then there is the learning curve of GrahphQL in the client. Also the bloated client with it's bucket of features (caching, etc).
We just tend to add GraphQL endpoints as we need. Found the best approach was to open the model, put in the GQL optimizer. Then when the client has settled, freeze the models by putting in some `only` settings to limit fields requested.
Only heard coworkers rant about the XML stuff...
As to XML: IMHO actually XML isn't a good fit for most API payloads. XML comes from markup languages/SGML which model semistructured data as regular content models, rather than co-inductive data structures of programming languages. The thing is, though, that the alternative, JSON, is really too basic (doesn't have schema-based validation, doesn't have date datatypes or enumerations, hell doesn't even have decimal numbers, etc.) Part of the story why JSON is so popular is that it's untyped and you don't have to agree on schemas, typed payloads, etc. upfront, and can just begin coding - but that also means you don't have typing, service contracts, etc. as your apps mature.
If the api is meant to be tightly coupled to an app, and is designed for that specific purpose, there's no reason to use anything like xml (or even, json) - it should be compact binary and minimal footprint.
If the api is meant to be general and apply across a range of client environments (e.g., you're selling this service api, and you dont know how or what your customer might use it for), it makes sense to make an api that's using an open format (like json, or xml) and have easily able clients in multitude of languages.
I love REST and JSON. The WSDL is one of the only things I like about SOAP. I’ve had issues where people didn’t give me the correct JSON or they update their scheme without notifying everyone and it breaks. You still need to notify people about WSDL changes.
Except that, it is mostly like REST. With a very convoluted specification that you can't hope to match on your own code (so, use tools), and tools disagree on the details (so, be careful to avoid the details).
So far it has slowed us down more than speed us up, except maybe right at the beginning, which in my experience is usually the case with these kind of tools.
From what I hear there was problems due excessive db queries for serializing entities and stuff. I do not work on that project though so I don't have more details and take all that with a grain of salt.
http -v https://demo.api-platform.com/books/526eea89-f98c-4dfc-80bb-... Accept:application/hal+json
* HAL-compliant link relations are included * OPTIONS is not part of the HAL Internet-Draft * JSON Merge Patch isn't part of the HAL I-D, however, it will be supported in the next major release * Pagination is supported: https://demo.api-platform.com/books.jsonhal. Range aren't part of the HAL I-D. * HTTP authentication schemes are documented using OpenAPI. The HAL I-D contains nothings about auth schemes.
The default, and first-class citizen in API Platform is JSON-LD (+ Hydra). But we know what we're doing and the HAL output is compliant with the I-D. Maybe should you read the spec before posting.
OpenAPI support
Developers seemed to oversee that there is an important spec-first trend with building apis. Currently there is no way to generate code / models from OpenAPI spec, only generates documentation - so the statement about "OpenAPI integration" is only partially true.
Instead you have to fall back to legacy technique of manually coding models - this is bad for teams that adapted OpenAPI as their single source of truth. With this project you will have to maintain php code on api updates and it breaks any established spec-first OpenAPI roundtrip workflow.
Security
Very weak support for expected security out of the box - you need to implement Symfony based security ideas - if you have already done this and know that dark planet, go for it, if you have never seen that before be prepared for lots of awkwardness:
/**
* Secured resource.
*
* @ApiResource(
* attributes={"access_control"="is_granted('ROLE_USER')"},
* collectionOperations={
* "get",
* "post"={"access_control"="is_granted('ROLE_ADMIN')"}
* },
* itemOperations={
* "get"={"access_control"="is_granted('ROLE_USER') and object.owner == user"},
* "put"={"access_control"="is_granted('ROLE_USER') and previous_object.owner == user"},
* }
* )
* @ORM\Entity
*/
Yes, that is a PHP comment - Symfony uses comments for simulation of the non-existing language feature of annotations. Anybody who needs to make money in the Symfony universe follows that awkward and evil cult. Privately you will always hate it, but if all your team says "cool" you just shut up and accept it (and start looking for the next better job).The whole security story with Symfony seems to be a horrible mess and after-thought, feels incredible tacked-on and will slowly grow into a maintenance nightmare. Badly maintained external libraries. Every software that uses it implements it in a different way.
But: because of large adaption in companies you will still find a solution for everything - be prepared for a long journey. You will end up with your very own solution and never be sure, if it is really secure - why did you want to use open source in the first place - was it for security reasons?
Interesting alternative security implementation: https://medium.com/@ordermind/better-authorization-for-symfo...
Integration
This is just Symfony, so luckily you will find libraries for everything. However, it seems to be somehow detached from the current API product market, so there are some overlapping and not so obvious integration points with tools that help with API management. Note: this is not a complete api platform like the name suggests - many basic features for API management are missing. Developers should stop simulation of "no other software exists" and instead offer nice integration with some of the advanced api management tools.
Nice: GraphQL output only needs import of one library, no additional coding needed.
Support: Better learn french if you are using this to build your company on.
There is an RFC[1] for builtin annotation but no one seems to care.
> Nice: GraphQL output only needs import of one library, no additional coding needed.
The GraphQL output is forced to a relay compliant format.
Previously I would use symfony / doctrine, or some other PHP / ORM combo, but the TypeScript environment is much more to my liking.
This will not convince anyone who dislikes node.js, but if anyone here is considering a node.js backend, give Nestjs a try. I did some tests and found it preferable than pure Express, Sails, or Ember.
Edit: I agree with softwarelimits comments. I absolutely hate synfony/doctrine comment annotations. TypeScript decorators are a better solution.
In API Platform you can just define an entity and it will automatically expose CRUD endpoints for that entity [1].
While in NestJS it seems you still need to define each action manually [2].
It's too bad cause I'm really looking for something like API Platform in Typescript.
[1] https://api-platform.com/docs/distribution/#bringing-your-ow...