Hacker News Reader

Comment by brlewis | Hacker News Reader

> Are there other reasons this hasn't seen more widespread adoption? Is there some inherent architectural flaw or just not enough incremental benefit?

I'm a fan of the concept and would love to have a middle layer as thin as postgrest, but authentication/authorization has been my roadblock. I still use node as an app server because of passport. I had not heard of the postgrest starter kit before today and will check out https://docs.subzero.cloud/athentication-authorization-flow/

If they correct the typo before I get to reading it, it will be https://docs.subzero.cloud/authentication-authorization-flow...

View on HN

you could use Auth0 [1] to authenticate your clients using all the identity providers (FB/GOOGLE...etc) and then just have the api clients use that JWT token when talking to postgrest

If however you do only want to authenticate the users yourself, the login function can be very simple [2]

1. http://postgrest.org/en/v6.0/auth.html#jwt-from-auth0

2. https://github.com/subzerocloud/postgrest-starter-kit/blob/m...

I am using postgraphile in library mode with keycloak and passport.js (an open source project https://www.keycloak.org/) instead of auth0 and it works great.

I would expect authorization and validation to be a real pain with PostgREST (I don't know enough about it to tell definitively, though).

Even row-level access control, while not widespread any way, is often not enough. Complex validation in SQL can be done, of course, but SQL isn't exactly meant for these things, IMHO.

why would you "expect" that if you don't know about it?

I know more than basic SQL. Maybe I am indeed not an accomplished enough master in SQL, but I can't see why I would ever prefer SQL over Python in terms of defining application logic.

Stored procedures often offer a better and more efficient way to implement data validation than non database native alternatives.

It may indeed be efficient.

Maybe I just don't like the idea of putting all my application logic into SQL statements.

What I like about Django's ORM, for example, that you can declare a field to be an IP address, and this not only does the validation (which SQL can do easily, I am sure), but this declaration also carries over to HTML forms, admin interface, REST API serialization and HTML Templates.

This is an interesting read on validation in postgres: https://begriffs.com/posts/2017-10-21-sql-domain-integrity.h...

Reply on news.ycombinator.com