postgrest VS gotrue

wait till you find out https://github.com/PostgREST/postgrest.

Yes that's exactly what I'm reading here and there. It seems to be the approach that Supabase is taking itself when receiving queries via their API gateway, powered by PostgREST. I had a look at the source code for the latter and it's basically converting the claims in the received JWT into as many local set_config() calls (basically a wrapper function around SET LOCAL). See this related discussion.

I suspect this is the culprit (might be wrong): https://github.com/PostgREST/postgrest/blob/main/src/PostgREST/Config/PgVersion.hs

Pretty cool - wonder how it compares to Postgrest (https://postgrest.org/).

Generally been a fan of these sorts of models - SQL data is very malleable - and treating the tables as movable from the start really helps move faster as a developer - database migrations become easier as you don't need to do a lot of work with API.

I can see how this would cause problems if you always used this in production after finding a fit for the data model - but for rapid prototyping and development - big fan.

Just as an addendum, the supabase.com team are bullish on the power and value of leaning heavily into the database. iirc, they're also the team behind postgREST which makes it easy to spin up a full REST API on the back of a PostgREST database. I used to think this kind of approach was a disaster, but I've changed my mind significantly. When being willing to use stored procedures, you can spin up this REST API, AND use the same stored procedures for your application as well, to ensure consistency of business logic, all without needing a separate business logic API middleware service between DB and the rest of the world. It's not all roses, but it is pretty amazing.

At work, we've finally replaced a large part of a custom (mostly-)web backend with PostgREST recently, and that's quite a relief: considerably less code to maintain in that project now, and that was a rather awkward code. Something akin to PostgREST's "Embedding with Top-level Filtering" [1] had to be provided for all the tables, with OpenAPI schema and a typed API (Haskell + Servant); I avoided manually writing it all down, but at the cost of poking framework internals, and maintainability suffered. It was particularly annoying that the code doesn't really do anything useful, except for standing between a database and an HTTP client, and simply mimics the database anyway. Whenever a change had to be introduced, it was introduced into the database, the backend, and the frontend simultaneously, so it wasn't even useful for some kind of compatibility.

Now PostgREST handles all that, and only a few less trivial endpoints are handled by a custom backend (including streaming, which I'm considering replacing with postgrest-websocket [2] at some point).

During the switch to PostgREST, the encountered minor issues were those with inherited tables (had to set a bunch of computed/virtual columns [3] in order to "embed" those), and with a bug on filtering using such relations (turned out it was an already-fixed regression [4], so an update helped). Also a couple of helper stored procedures (to use via /rpc/) for updates in multiple tables at once (many-to-many relationships, to edit entities along with their relationships, using fewer requests) were added (though the old custom backend didn't have that), the security policies were set from the beginning, the frontend was rewritten (which allowed to finally switch without adding more work), so it was only left to cleanup the backend.

Not using views, since as mentioned above, database changes usually correspond to frontend changes, and the API doesn't have to be that stable yet.

Happy with it so far.

[1] https://postgrest.org/en/stable/api.html#embedding-with-top-...

[2] https://github.com/diogob/postgres-websockets

[3] https://postgrest.org/en/stable/api.html#computed-virtual-co...

[4] https://github.com/PostgREST/postgrest/issues/2530

For how often Nix is mentioned here on HackerNews, has anybody looked at the Nix config files for this repo to build it locally?

https://github.com/PostgREST/postgrest/blob/main/cabal.proje...

I don't know for the stack you're looking for but is this close enough ? https://github.com/PostgREST/postgrest

It's neither MySQL nor Go, but https://github.com/PostgREST/postgrest has figured out most of the patterns and API designs you could follow.

I guess since it's a deviation of it

Use a self-hostable auth microservice like gotrue or authelia, ORY's suite of products, etc.

Thanks but there is not Authentication in Oso If I understand correctly, is there something like GoTrue for Rust

The advantage of ORY was that it required this somewhat custom frontend (since it's not password based) -- I'm not sure how much easier that would have been with Keycloak (my guess is it would have been harder), and I haven't used Authentik before so I'm not sure.

Keycloak is definitely more setup and a bit more clunky. I've never deployed Authentik though, I really need to kick the wheels on it and see how it works.

BTW in the simple auth/login space there is also:

- Keratin[0]

- GoTrue[1] (and Supabase's improved version[2])

- Authelia[3]

[0]: https://keratin.github.io/authn-server/#/

[1]: https://github.com/netlify/gotrue

[2]: https://github.com/supabase/gotrue

[3]: https://github.com/authelia/authelia

Leveraging the open-source GoTrue API, Netlify Identity can be added to your site with the Netlify Identity widget by adding this

@supabase/gotrue-js for GoTrue (fork of Netlify's authentication and user management API)

I think you are saying about cold startups, but I do not see one is force to use serverless, you can use any API, for auth you can deploy gotrue yourself.

GoTrue is an open-source API maintained by Netlify that allows you to access Netlify’s identity membership signup and login features. These two packages directly integrate GoTrue into React and Gatsby allow us to easily use Netlify Identity in our project.

It's all open source: Supabase is built on top of other popular open-source packages, such as PostgREST for accessing your database directly from the client, and GoTrue for user authentication. All that, along with a nice admin interface so you can manage everything. If you wanted, you could host and manage these services on your own. If PostgREST does not fit your use case, you could host a server that will communicate with your Postgres database directly. And if you ever decide that Supabase is not for you, you could always migrate all your data somewhere else. At the end of the day, it's all in a Postgres database.