Hacker News Reader

Comment by steve-chavez | Hacker News Reader

> PostgREST has a scary "allow by default" permission model which is nearly enough to turn me off of the whole project.

PostgREST follows Postgres' "deny by default", you have to explicitly grant permissions for tables and views to be used. This is noted on the first tutorial[0].

Supabase overrides this default via `ALTER DEFAULT PRIVILEGES .. GRANT`[1]. This is done for easier onboarding of new users but you can turn this off with `ALTER DEFAULT PRIVILEGES .. REVOKE`.

PostgREST also encourages you to create a dedicated schema for your api[2].

[0]: https://postgrest.org/en/stable/tutorials/tut0.html#step-4-c...

[1]: See an example of this on https://supabase.com/docs/guides/api/using-custom-schemas.

[2]: https://postgrest.org/en/stable/explanations/schema_isolatio...

View on HN

> Supabase overrides this default

Ah, thank you for this clarification. I was wondering what that comment was referring to.

(and keep up the great work <3)

Thanks for the additional info!

Yep, I'm aware of the ability to revoke permissions, it's the design choice of "allow by default" that worries me - but I agree this is a Supabase thing, not PostgREST.

On a new project, if you look at the dashboard (pointing at an existing db) access to all tables and data is on by default, you have to explicitly deny access to those tables. That's a concerning design choice for my industry (healthcare).

> PostgREST also encourages you to create a dedicated schema for your api[2].

Yes, it does - but this isn't really called out strongly by Supabase (not PostgREST's fault).

As some other commenters mentioned, it's not a big deal to create views in the api schema, and I agree. The part I'm still evaluating is whether there will be actual time savings and efficiency vs just creating CRUD endpoints in NodeJS (for example).

The big "win" for PostgREST here is the ability to do deep querying and result shaping directly from the UI without needing to create a bunch of custom endpoints. If I have to create views anyway, it seems like I lose a lot of the benefits of using PostgREST in the first place, and add a layer of complication to the stack.

I like PostgREST a lot, and I've been hoping that Supabase would be an effective Directus replacement (now that Directus has gone closed source), but I'm still figuring out whether the juice is worth the squeeze on my project.

Would love any insight you or others have from using it in production with a medium-scale sized app.

Reply on news.ycombinator.com