pgsql-http VS graphile-engine

I don’t understand the question https://github.com/pramsey/pgsql-http

I am trying to use the supabase http rest client extension to fetch data from an external API. Following the supabase docs and the GitHub repo readme, I have not been able to successfully make a request that requires auth, specifically an API key in the request header with key x-api-key.

- Hasura Remote Schema (https://hasura.io/blog/tagged/remote-schemas/)

If you want more control over the web API and you were going to fetch the data within your Python back-end and process it there, for some use-cases (not all, but some), there are options:

- pg_http (https://github.com/pramsey/pgsql-http)

Life is about trade-offs. Doing the work in SQL is not without its drawbacks, but it's also not without its benefits, and that's true for doing the work in a general-purpose language as well. Whatever the drawbacks of doing it in SQL, one of the benefits has got to be eliminating the impedance mismatch (for people who regard that mismatch as a problem, and the OP seems to be one such person). What I claim is that doing the work directly in the database shouldn't be ruled out in general (the specifics of a given use-case may rule it out in particular) any more the the other common patterns (API hand-written in Python, for instance) shouldn't be ruled out in general.

You could e.g. use the trigger to call http api using e.g. https://github.com/pramsey/pgsql-http

I do this all the time just with Postgres functions. Just turn on the following extensions: http (https://github.com/pramsey/pgsql-http) pg_cron (https://github.com/citusdata/pg\_cron)

But it doesn’t have to work this way. Some modern databases support a feature called "row-level security". It allows you to define access control policies at the row level based on the current user’s attributes (id, role, group membership, etc.). As long as the application can securely pass the current user’s identity to the database, it can leave all authorization checking to the database. And since the rules are defined at the table level instead of the API level, it has a much smaller surface to protect. The "row-level security" feature is the foundation of products like PostgREST, PostGraphile, and Supabase.

I really love the way pg-sql2 is going about that.

I've been enjoying developing on top of PostGraphile. https://www.graphile.org/

Good starter: https://github.com/graphile/starter

I can add a column the the db, and my frontend gets that autimagically (in dev mode, it generates a graphql schema out of the db, and from that it creates composables for my frontend wiht graphql-codegen). On the frontend I use Vue 3, the starter is build with nextjs/react.

I don't much direct knowledge on the internals, but here's a snippet from the graphile-engine repo README: