I don't understand in what apps it's acceptable for the client to be able to write to the database directly. Or how you can get away without any backend logic.
I have the same questions about Supabase and Firestore so it seems like I'm missing something.
Most things built 'out in the world' have hardly any business logic, they're all just CRUDs.
In enterprise this is obviously the opposite way around. It's actually super frustrating to watch discussions that ignore this, it's a really big problem on tech twitter etc especially, where people advocate for certain stacks or ways or working or whatever that make it clear as day they've never had to build a business system, they've just been building CRUDs, so they're incapable of understanding why experienced devs who have disagree with them.
I built a collaboration app using Firebase - it works okay for that sort of thing, where you're highly constraining what each person does to their own comments / cards, and they just have permission to do certain things. For things with a load of backend logic I can't imagine it working that well.
For both of these, there's backend-enforced access, so it's not without backend logic. With Supabase for example, the feature is called row-level security.
The client can fire requests to Supabase, but Supabase runs additional queries on the back-end that determine whether an incoming request is allowed or not.
A simple example would be that a client is only allowed to read, write or update a row if the value in the UserID column is the same as the requesting authenticated user's.
Comments
I don't understand in what apps it's acceptable for the client to be able to write to the database directly. Or how you can get away without any backend logic.
I have the same questions about Supabase and Firestore so it seems like I'm missing something.
Most things built 'out in the world' have hardly any business logic, they're all just CRUDs.
In enterprise this is obviously the opposite way around. It's actually super frustrating to watch discussions that ignore this, it's a really big problem on tech twitter etc especially, where people advocate for certain stacks or ways or working or whatever that make it clear as day they've never had to build a business system, they've just been building CRUDs, so they're incapable of understanding why experienced devs who have disagree with them.
I built a collaboration app using Firebase - it works okay for that sort of thing, where you're highly constraining what each person does to their own comments / cards, and they just have permission to do certain things. For things with a load of backend logic I can't imagine it working that well.
For both of these, there's backend-enforced access, so it's not without backend logic. With Supabase for example, the feature is called row-level security.
The client can fire requests to Supabase, but Supabase runs additional queries on the back-end that determine whether an incoming request is allowed or not.
A simple example would be that a client is only allowed to read, write or update a row if the value in the UserID column is the same as the requesting authenticated user's.