gotrue VS storage

If you’ve been following us from the start, you will know that Supabase Auth started by forking Netlify’s GoTrue server. A lot has changed since then and we’ve diverged from the upstream repository. At this stage it makes sense to rename the project to something else (cues drumroll) — Auth.

I am testing gotrue netlift module https://github.com/netlify/gotrue

I guess since it's a deviation of it

To answer point 1: Maybe to start out, but in the long run, having only social logins may cause your app to lose a segment of the market (I don't know how much). If you're fine with that, then by all means only support social logins.

However, I strongly suggest having it (or some way for someone not to use a social provider) if you want to have as many users a possible.

Personally, I don't have a google account, I'm wary to use my Apple account for non-Apple sites, and I don't have facebook, instagram, new gen z hotness app, etc... And I can confidently say I am not alone in choosing to use apps which don't require a social login.

At the end of the day though, password auth isn't a non-trivial problem. It is a solved problem of which there are numerous articles/papers and many libraries for most languages/frameworks. For example, the Phoenix framework for Elixir has a built in command which scaffolds auth, and it works really well (I have used it in a personal project): https://hexdocs.pm/phoenix/mix_phx_gen_auth.html. For JS, you can use something like passport: https://www.passportjs.org/packages/passport-local/. If you want a separate service entirely (even though it would be more complex to have a separate service to start out), there is GoTrue: https://github.com/netlify/gotrue. These are just a few suggestions of tech I have come across. There is so much more out there, I encourage you to research options to see what may be a best fit.

If you're worried about password auth, maybe give one time passwords a try. They don't require any password reset flow, and are generally secure when implemented correctly. As an example, I don't have a password for my craigslist account. Every time I want to login, I can choose to get a magic link/otp which gets exchanged for a session. In practice (and this is my personal opinion), I prefer magic links. They are one time, hard to guess (again dependent on implementation), can be time limited, and most likely won't be intercepted in transit (though it could be in a rare circumstance).

To answer point 2: yes.

If your app is to order things (I use things in a general term) it sounds like eCommerce. And if you're in eCommerce, you better have a way for a user to track what they have ordered and how much they have paid for it at a minimum. Otherwise, your site may come across as a scam, even though it uses Stripe. Sketchy sites can use Stripe to get your money (albeit, it'll be a one time payment).

In conclusion, auth for your application seems crucial. Email/password auth is still relevant for applications. While not necessary for an MVP, there is a segment of the market you will lose if you don't have an email/password option, or even an email/OTP/magic link option (I don't know how much, really going off an educated guess).

Best of wishes in building your app! I genuinely hope it is successful and safe for people to leverage :)

Use a self-hostable auth microservice like gotrue or authelia, ORY's suite of products, etc.

Any examples for implementation like https://github.com/netlify/gotrue for Actix-web?

[3] https://github.com/supabase/storage/issues/439

The Supabase Storage Engine is fully open source and is one of the few storage solutions that offer 3 interoperable protocols to manage your files:

For instance, consider a supabase setup where you place your photos in storage and your orders in a table. Then, have a function run automatically whenever a new row is added to the orders table. That function would be responsible for identifying what the customer bought and delivering it to them.

In this page, I used Supabase Storage to store the files uploaded by the users

-- Create a table for public profiles CREATE TABLE profiles ( id UUID REFERENCES auth.users ON DELETE CASCADE PRIMARY KEY, updated_at TIMESTAMP WITH TIME ZONE, username TEXT NULL, full_name TEXT, profile_image_url TEXT, bio TEXT, sex SMALLINT DEFAULT 0, CONSTRAINT username_length CHECK (CHAR_LENGTH(username) >= 3) ); -- Create a table for channeles CREATE TABLE channeles ( id SERIAL PRIMARY KEY, userRefId UUID REFERENCES auth.users(id), channel TEXT, updated_at TIMESTAMP WITH TIME ZONE ); -- Create a table for geo location CREATE TABLE user_geo ( id SERIAL PRIMARY KEY, userRefId UUID REFERENCES auth.users(id), location GEOGRAPHY(point) NOT NULL, updated_at TIMESTAMP WITH TIME ZONE ); create index user_geo_index on public.user_geo using GIST (location); -- Set up Row Level Security (RLS) -- See https://supabase.com/docs/guides/auth/row-level-security for more details. ALTER TABLE profiles ENABLE ROW LEVEL SECURITY; CREATE POLICY "Public profiles are viewable by everyone." ON profiles FOR SELECT USING (TRUE); CREATE POLICY "Users can insert their own profile." ON profiles FOR INSERT WITH CHECK (auth.uid() = id); CREATE POLICY "Users can update own profile." ON profiles FOR UPDATE USING (auth.uid() = id); -- Set up Row Level Security (RLS) -- See https://supabase.com/docs/guides/auth/row-level-security for more details. ALTER TABLE channeles ENABLE ROW LEVEL SECURITY; CREATE POLICY "Public channeles are viewable by everyone." ON channeles FOR SELECT USING (TRUE); CREATE POLICY "Users can insert their own channeles." ON channeles FOR INSERT WITH CHECK (auth.uid() = userRefId); CREATE POLICY "Users can update own channeles." ON channeles FOR UPDATE USING (auth.uid() = userRefId); -- Set up Row Level Security (RLS) -- See https://supabase.com/docs/guides/auth/row-level-security for more details. ALTER TABLE user_geo ENABLE ROW LEVEL SECURITY; CREATE POLICY "Public geo_location are viewable by everyone." ON user_geo FOR SELECT USING (TRUE); CREATE POLICY "Users can insert their own geo_location." ON user_geo FOR INSERT WITH CHECK (auth.uid() = userRefId); CREATE POLICY "Users can update own geo_location." ON user_geo FOR UPDATE USING (auth.uid() = userRefId); -- See https://supabase.com/docs/guides/auth/managing-user-data#using-triggers for more details. CREATE OR REPLACE FUNCTION public.handle_new_user() RETURNS TRIGGER AS $$ BEGIN INSERT INTO public.profiles ( id, updated_at, username, full_name, profile_image_url, bio, sex, ) VALUES ( NEW.id, NOW(), NEW.raw_user_meta_data->>'username', NEW.raw_user_meta_data->>'full_name', NEW.raw_user_meta_data->>'profile_image_url', NEW.raw_user_meta_data->>'bio', COALESCE(CAST(NEW.raw_user_meta_data->>'sex' AS SMALLINT), 0), ); INSERT INTO public.channeles (userRefId, channel, updated_at) VALUES (NEW.id, NEW.raw_user_meta_data->>'expoToken', NOW()); INSERT INTO public.user_geo (userRefId, location, updated_at) VALUES ( NEW.id, ST_Point(CAST(NEW.raw_user_meta_data->>'lat' AS FLOAT), CAST(NEW.raw_user_meta_data->>'lng' AS FLOAT)), NOW() ); RETURN NEW; END; $$ LANGUAGE plpgsql SECURITY DEFINER; CREATE TRIGGER on_auth_user_created AFTER INSERT ON auth.users FOR EACH ROW EXECUTE FUNCTION public.handle_new_user(); -- Set up Storage! INSERT INTO storage.buckets (id, name) VALUES ('profile_images', 'profile_images'); -- Set up access controls for storage. -- See https://supabase.com/docs/guides/storage#policy-examples for more details. CREATE POLICY "profile_image images are publicly accessible." ON storage.objects FOR SELECT USING (bucket_id = 'profile_images'); CREATE POLICY "Anyone can upload a profile_image." ON storage.objects FOR INSERT WITH CHECK (bucket_id = 'profile_images');

For example the storage-api. I was on version supabase/storage-api:v0.29.1 for a long time, until I realized, that there is a new version of it (0.40.1). Fast forward, upgraded everything, checked my application and everything storage related stopped working. From now on it's always the same procedure. Debugging the errors, digging through the code on GitHub, checking commits, issues, etc. After a while I found a bug from 2019 which had exactly the same error as I, tested the workaround and it worked again (partially, workaround).

Alternatively, we could use imagemagick (cli tool for image transforms) + supabase storage to do the same for free.

[5] https://supabase.com/docs/guides/storage

Storage

We'll probably need to upload other types of assets in the future, so having a way to set the limit per bucket would be nice... There's an issue for this - I may make a PR to implement it at some point.