HN Explorer

48 comments

[ 11.0 ms ] story [ 114 ms ] thread
skeep
Super excited that this is finally released! It's been a great project to work on, can't wait to see what people build with it.
captn3m0
The REST API connector docs is blank right now, but curious about it. How does it work (how is it configured?), and what’s the usecase for it?
krosaen
Anyone have experience with this and postgraphile? The additional data sources is clearly a benefit of graphweaver, but wondering for the postgres use case how they compare.
graphweaver
We have used postgres with every client deployment so far, it's our go to relational db.

We have also needed to connect to a 2nd or 3rd data source on every project. So the power is when you combine these data sources.

crubier
Do you know about Postgraphile? Your comment did not address that part, I’m curious too
graphweaver
Yeah sorry will address it directly. Graphweaver is different in a number of ways:

- Graphweaver is not just Postgres, you can run it connected to only MySQL - Graphweaver can connect to one or more datasources. You can even connect both MySQL and Postgres together. Sounds crazy but could be good for a migration. - Graphweaver has two layers the API layer and the Data layer. Both of these are represented by coding classes in Typescript. You have full control over how these are exposed and defined in the entity files. - Graphweaver does not automatically reflect the database. Instead you run an import command in our CLI tool that creates Typescript class files for your database. From there you can edit them as needed.

crubier
Nice, interesting approach. I like Mikro ORM, I was thinking about building on top of it recently, I think it's a good idea.

Looks like you went for the ORM equivalent of the Shadcn/ui approach. "We generate your code so you can customize it" instead of the more traditional "You use a library and can provide options to it to customize it". I like it!

Postgraphile has a bunch of very cool filtering/grouping capabilities (with plugins), would be nice to have that at some point

ehutch79
I didn't go to deep, but I don't immediately see how you add business logic and custom validation.

Not like this varchar can only be these values, but like if this field is X, then field Y can only by these values, and field Z is now required.

Or, if this date has changed, then it must be a week or more in the future.

ushakov
What’s the difference between GraphQL Mesh?

Is this thing any relevant if I’m using React Server Components to fetch the data from the db directly?

graphweaver
The main difference is Graphweaver is code-only approach with Typescript. GraphQL Mesh is a schema-first approach.

Both great projects, different philosophies.

gedy
Nice, is this comparable to Hasura? What are some differences if so?
graphweaver
Yeah it is comparable:

- We are 100% open source. - Written in Typescript. - We support any data source directly in the server process, either with pre-built data providers or build your own. - We support cross data source filtering (get orders from database with CRM username)

cpursley
Backend being written in TS is a big downside vs. Hasura’s blazing fast Haskell backend.
graphweaver
Not everyone will see TS as an advantage but there are many who will.
andy_ppp
Every piece of magic in your application has the possibility of completely screwing you over when you least expect it. This includes all your dependencies and especially your backend. Given how trivial it is to write a real GraphQL API in frameworks these days, where you have complete control, it’s likely better to add that to your skill set rather than trusting a one size fits all solution that unlikely to solve every problem.
graphweaver
This is true but like with any build there are many decisions to make. We have settled on this stack for our API's and we think others will find it useful.
andy_ppp
Cool! How does security and multi-tenancy work in graph weaver? These were a really excruciating afterthought in Postgraphile…
crubier
Could you expand on how security is an afterthought in Postgraphile? My experience of using RLS and the graphile pro plugin was nice and secure imo. Curious if I missed something here
andy_ppp
So I have a list of my own stuff but I want for other people who are in my circle to be able to see outfits I've shared with them. If all the lists of stuff are created in an automated way doing things like this is somewhat harder than the default crud stuff and managing passing tokens and doing the filtering is fine but feels like a use case that should be as automatic as possible. I haven't used the Pro plugin, I'm not sure if we knew about it or what it does.
jrockway
I don't think a GraphQL to SQL compiler is strictly a bad idea. It is kind of like allowing forum users to post HTML-formatted comments; you absolutely can't pass it through unmolested, but you can parse the HTML and walk the AST to emit a safe subset when you're displaying the comment. Basically, this sort of thing is very easy to get wrong, but it's not an intrinsically unworkable idea. At the end of the day, the backend database does the same thing; a connection says "SELECT foo FROM bar" and it has to decide whether or not the current user is allowed to do that.

To some extent, this is kind of reverting to "old times". Back in the day, client applications connected directly to the database and the database handled auth. There is no real reason to not let Javascript apps running in the browser to do that, modulo implementation details (hello popular database with a 100 connection limit out of the box). With that said, I remain unconvinced about whether the modern SPA architecture is the right thing. In a day and age where everyone has gigabit fiber or 5G running over HTTP/3 to a replica of your website hosted in the same city as your ISP, is downloading HTML on every click really that bad compared to making power-savvy devices parse and compile your application every time they visit it?

manquer
Bandwidth is not the only factor affecting the thick/thin client economics [2]

Compute is the big factor , unless your app needs fast load times to make money like e-commerce, cmses etc the trade off of paying for additional compute on the server side is not worth it .[1]

Today the browser handles most of the app and Auth state token refreshes, inflating data into an UI, a lot of the validations , all these components on the server costs more compute cycles which someone has to pay for.

If is always cheaper for the user than application developer , the app developer is renting every cycle compared to the user who has already bought a powerful device

Same reason Stadia and similar stacks have hard time proving their economic viability, if they are not able to create a large enough market of users who will not buy a high end device but will be ready to pay for a sub for somewhat poorer experience then they fail .

Also from development point of view you would need to likely maintain a separate API anyway for your native mobile apps , building a server rendered [1] app and API is not worth the development cost usually.

[1] SSR and various hydration tooling blur this line ever in favor of SPAs but I am ignoring that to keep the point simple

[2] hardly everyone has always on 5G or fiber access in developed G-20 economies let alone the world , YouTube and dozens app charge for downloading for a reason

pyrolistical
Watch somebody use this as a public API and complain they got hacked
graphweaver
We agree, with any GraphQL API you need to make sure it is hardened for production.

We are looking to add more on documentation on this soon and maybe a tutorial series on exactly this.

SoftwareDev4
How is this different from WunderGraph?

https://wundergraph.com/

graphweaver
With Wundergraph, you define schema first. This generates types and hooks that you can then use on the front end. The production API is not a GraphQL API its Rest I believe.

Graphweaver also generate types and react hooks for the front end, when running `graphweaver watch`. But Graphweaver is a GraphQL API and that is deployed into production. We wrap GraphQL Codegen and also do our own datasource introspection. More on that in this article:

https://dev.to/tnodell/exploring-the-benefits-of-graphql-cod...

gumballindie
How does this lib handle GQL Injections?
skeep
We use MikroORM behind the scenes and keep up-to-date with versions and vulnerabilities.

There is always more to do and we do accept PRs for improvements!

gumballindie
Thats pretty aweosme and this seems to be one of the first gql based projects that factor in gql injections that i stumbled upon. Nicely done!
anonzzzies
Are there any tools that do this dynamically? Seems all are code generators.
graphweaver
We actually do that with the Contentful integration we’ve built. It dynamically reads the schema then creates the API.
old_hat
This looks really interesting. I'm regularly building systems that are plugged into multiple SaaS things, and would love a way to make that easier.

I'll give this a go with a toy project and see if I can find the edges.

Do you have any performance benchmarks available to compare to other similar tools?

graphweaver
We have done performance testing when releasing client projects but nothing that directly compares Graphweaver to competitors.

I will add this to the list for us to do.