Is there any validation or authorization for changes being merged back into the root database? In a traditional client / server model, the server has an opportunity to validate each request and optionally reject it. The lower level you go with the sync protocol (data changes vs high level requests) the more difficult that becomes. Have you addressed that and, if so, how? What prevents a malicious client from send arb…
Hey, You can see our database rules spec here: https://electric-sql.com/docs/api/ddlx We haven't implemented it all yet but you can see the intention / direction. It's similar to RLS but adapted for the context. Connections are authenticated by signed JWT: https://electric-sql.com/docs/usage/auth We also auto-generate a type-safe data access client from the electrified subset of the Postgres schema. This applies type…
What's the alternative in cases where I need more advanced checking before doing an INSERT/UPDATE that is not possible in SQL?
This is usually done in the backend. The frontend is not a trusted environment.
So, I'd just send a request to the backend, perform the checks, modify the data in Postgres and then it'd sync to the clients?