postgres-typed VS slonik

This is really cool, will look into using it in future projects!

I also made a tool (https://github.com/vramework/schemats) that generates the types directly from the db, which means whenever you do a DB migration your database types automatically update. Was forked from the original schemats library a couple years ago.

I also created a lightweight library ontop of pg that is less of a query builder and more of a typed CRUD + SQL for non trivial queries (https://github.com/vramework/postgres-typed). Most queries I deal with in a day to day is usually crud so I find it a little easier, but it's much less powerful then Kysely! I fall more into the camp of writing complex queries in SQL with small helpers and writing simple ones with util functions and typescript

I'm working on a few projects, from one/two days to platforms.

The first is OS and is a simple nodeJS environment to deploy applications via lambda and express quickly. Sort of like nestJS except less decorators and more functional (https://vramework.io/). I already know of a few other colleagues that rolled their own propriety versions of this to support enterprise and cloud deployments so decided to OS it.

The other OS project is a strongly typed postgres/mysql driver. The idea is to generate typescript definitions directly from postgres (https://github.com/vramework/schemats) and then have a think layer ontop of pg-node that gives you strongly typed queries (https://github.com/vramework/postgres-typed).

An open-source project I spent a few years on the core team is https://deepstream.io/, a realtime-server that allows you to mix and match multiple streaming protocols (mqtt/websocket/others) and allow those clients to talk to each other using pub-sub and records. I'm not longer working for it but wanted to give it a shout out!

On a non OS project, I have been working on an immersive audio platform for a while now. The main goal is to allow users to pick and choose how audio books progress, and also have a live session mode which allows users to record their pulse / answer questions and a few other metrics and associate it with sentences. I pretty much built and deployed all of it but require some advice/brainstorming on how to proceed now. I built it to satisfy an itch when I was practicing shamanism during the first lockdown when I was in-between contracts / taking time off.

I also want to build a simple web-pages strategy game based around eco-education, but don't have the bandwidth . If anyone is interested in mixing together gamification and eco-village building might be a fun conversion to bounce ideas!

All the OS projects above were used to support my personal/a couple professional projects over the last few years.

Email in profile

I agree with your point that adding multiple layers = more attack vectors and abstraction of a really good domain specific language. But what seems to happen on most of the projects I work on is we end up hiding away extremely common logic behind helper functions. It always starts off with SQL and then slowly gets moved into higher level functions that offer a better developer experience.

Shameless plug, but I just posted a library I wrote (for node https://github.com/vramework/postgres-typed/blob/master/READ...) which pretty much is a tiny layer ontop of pg-node (which is query based / with value parameters) and provides small util functions with typescript support derived straight from postgres tables.

In an ideal world (one I think we are getting very close to) I think we will end up having SQL queries validated in our code against the actual DB structure the same way we have any other compilation error. But until then we'll need to rely on tests or helper libraries, and for the purpose of refactoring and development I find the latter more enjoyable (although still far from perfect).

And sometimes invest instead in learning a technology rather than hide it: for example slonik encourages you to write normal SQL queries by making SQL templating easier and safer. In turn, your IDE would be able to understand those queries and give you support based on the database schemas you actually have.

I'd push you to consider using postgres, slonik or similar for database queries. With these libraries, you just write SQL, but they perform input sanitization for you. So you can safely write:

You can already use postgres with Slonik.

https://github.com/gajus/slonik#user-content-slonik-how-are-...

It is not going to be the default because it is way slower.

https://github.com/gajus/slonik/actions/runs/6616647651

Test node_version:18 test_only:postgres-integration is taking 3 minutes.

Test node_version:18 test_only:pg-integration is taking 38 seconds.

For those uninitiated, Slonik is a battle-tested SQL query building and execution library for Node.js. Its primary goal is to allow you to write and compose SQL queries in a safe and convenient way. Now, let's see how it pairs with Express.js.

I am the maintainer of Slonik and I am trying to understand what portion of this sub-users are using Slonik vs other libraries, and if they are using anything else – what are their reasons for it.

It's nice that they implemented string templates essentially exactly the same way Javascript template literals and tag functions work. They even give an example of using it to create a prepared statement (e.g. DB."SELECT * FROM foo WHERE bar = \{inputParam}") which is exactly what many NodeJS libraries due, e.g. Slonik https://github.com/gajus/slonik, like sql`SELECT * FROM foo WHERE bar = ${inputParam}`;

I've found libraries like Zod useful when interacting with external data sources like a database. Slonik[1] uses Zod to define the types expected from a SQL query and then performs runtime validation on the data to ensure that the query is yielding the expected type.

I don't think it's necessary to use Zod/runtime validation everywhere, but it's a nice tool to have on hand.

[1]https://github.com/gajus/slonik

Demonstrate how easily and accidentally one can make an SQL injection with these:

https://github.com/porsager/postgres

https://github.com/gajus/slonik

Have you tried Slonik (https://github.com/gajus/slonik)? It won't generate types from queries automatically, but it encourages writing SQL vs. a query builder and allows type annotations of queries with Zod. Query results are validated at runtime to ensure the queries are typed correctly.