Join Data from PostgreSQL Declaratively in GraphQL Without Writing SQL

https://stepzen.com/blog/join-data-postgresql-declarative-graphql-without-sql

by hwhelan • 4 years ago

33 12 4 years ago

mdaniel• 4 years ago

Since "@dbquery" is attacker controlled, isn't that @exfiltrate?

The examples use Int! for params, so it's unclear how the framework/product deals with interpolation. While looking up the docs <https://stepzen.com/docs/custom-graphql-directives/directive...> I noticed that your blog uses "$1" and the docs uses ordered "?"

Then, I saw this one <https://stepzen.com/docs/custom-graphql-directives/directive...> and wondered what happens if I send `@rest(endpoint="http://169.254.169.254")`

killingtime74• 4 years ago

How is it declarative when you literally declare how you build the data iteratively

potamic• 4 years ago

At this point you may as well expose SQL to the client?

piaste3• 4 years ago

GraphQL and REST are safer for the backend. You can trivially hog up a server with a single SQL query, even without any permissions.

Or, more innocently, you can write some hilariously wasteful queries in SQL (join on string replacements? create absurdly unnecessary temp tables? seen both). GraphQL queries have a much more limited ability to fuck up the server.

jasfi2• 4 years ago

If persisted GraphQL queries are safest and likely more performant, then persisted SQL would have the same benefits. Not that I'm advocating for that, but there's not much difference once you've accounted for all factors.

manv1• 4 years ago

"Use our tool's language instead of the other tool's language because you don't understand the other tool's language well enough to use it effectively and efficiently."

Uh, what?

SQL allows you to do many things more effectively and faster than in-code. It's more than just a persistent store; it uses the power of math to do things faster. As an example, aggregation can be faster in the DB if your data is the correct shape (via group by).

owow123• 4 years ago

Love how they condensed the first SQL query example onto one line and then gave their example over multiple, deliberately making the SQL hard to read and obscure.

What about N-N relations? How hard has doing LEFT / INNER / OUTTER JOIN become - is learning SQL really to much for the modern dev (Somewhat sincerely asking)?

Join Data from PostgreSQL Declaratively in GraphQL Without Writing SQL

Related Stories