How do you work with authentication and authorization? about realtime HOT 1 CLOSED

Hey @WoodyDark. Note that this repo is a part of Supabase, so everything I comment here is about this specific repo, not Supabase (which bundles this server + many other components).

How do we handle authentication in this case?

This server is a case of "do one thing well". It's brings event sourcing (realtime) to postgres, and we are assuming that you will put it behind a proxy. You can see that retendo is doing this in issue #43 .
That being said, we are working on the authN/authZ requirements for the Supabase platform, and it may trickle down all the way to this server.

If a User has_many Blogs, how do I ensure that the current_user is only subscribing to changes of blogs that belong to them?

This would probably be done with something like:

var allChanges = this.socket
  .channel('realtime:public:blogs:user_id.eq.3') // add your column filter here
  .join()
  .on('*', payload => { console.log('Update received!', payload) })

Question 3:
Is there a recommended way to handle business logic?

Not in this server. On our platform we will probably allow you to either bake it into the database (functions) or run it on the edge (workers/serverless). This is still being designed.

I'll close this now, but feel free to reopen if you have any questions

from realtime.