Re:PostGraphQL: PostgreSQL meets GraphQL
by vbezhenar on Tuesday December 13, 2016 @02:10AM
(#13165114)
You can allow predefined SQL strings and define security rules for each string. If you need new query, you have to write new security rule for it. Won't work for dynamically generated SQL, but for most CRUD SQL it should work.
[ Parent
| on HN ]
Re:PostGraphQL: PostgreSQL meets GraphQL
by dkersten on Tuesday December 13, 2016 @05:46AM
(#13165937)
If you have N predefined SQL queries, then why not just wrap them in REST endpoints (it sounded to me that untog was suggesting that SQL be the interface to the data). If the user can write whatever query they want, then validating by string isn't really a good idea...