Don’t we all just want to use SQL on the front end?

Everybody is focused on literally replicating the data model and using SQL which obviously won't work.

But the idea is directionally correct. Replicate the subset of data the user has access to and wants locally and work on it disconnected, then sync changes asynchronously to server. This is difficult, but necessary for fully responsive and collaborative applications.

Check out https://replicache.dev for a productization of this idea (disclosure: this is my product). We will eventually add a SQL frontend for the cached data.

I had the same question a year ago and create a side project on that topic. The solution was is very close to the firebase approach, writing security rules. Those rules whitelist sql statements and give some some flexibility by defining query parameters and having a context object that contains userIds and so on. For example:

frontend sql statement as a json object:

  {
    select: { 
      name: field(Project, 'name') 
    },
    from: table(Project),
    where: equal(field(Project, 'ownerUsername'), ''),
  }

and here a rule configured on the backend:

  const rules = [
    allow(authorized(), {
      select: {
        name: field(Project, 'name'),
      },
      from: table(Project),
      where: equal(field(Project, 'ownerUsername'), requestContext().userId),
    })
  ],

Sadly documentation is quite poor for now, but you can check it out here https://github.com/no0dles/daita

Edit: code formatting

Came here to say this. To expound a bit, you can use it as a highly pluggable/extensible express plugin which you can point at any postgres db and get all CRUD and other operations exposed in GraphQL, without writing any code.

You can easily hide or rename fields that you don't want exposed, override their behavior in Node, and add generated columns or fancy SQL mutations either in JS or directly in your DB and have them exposed as you'd expect in GQL.

With a commonly-used plugin, you can even do rich ORM-like queries directly from graphql, like:

    query {
      allPeople(filter: {
        firstName: { startsWith:"John" }
      }) {
        nodes {
          firstName
          lastName
          posts(filter: {
            createdAt: { greaterThan: "2016-01-01" }
          }) {
            nodes {
              title
              body
            }
          }
        }
      }
    }

More examples here: https://github.com/graphile-contrib/postgraphile-plugin-conn...

(Personally, I think their docs are good at telling you how to use it but fairly bad at showing how great the tool is)

PHP doesn't run in the browser. This is about client-side SQL.

Yeah; reading this the only 'gain' I saw was "we don't have to define an API". But instead you get to try and ensure that raw SQL from the client is always safe.

The former isn't THAT hard to do. The latter is extraordinarily hard.

Get the former wrong and you fix it before it ever goes live. Get the latter wrong and you fix it only after you're massively pwned.

This is just a bad tradeoff.