TromBase

A simple backend for serverside js.

Install

npm install trombase

From source:

bun install
bun run build   # vp pack → dist/

The Lowdown

import { TromBase, createSchema, entity, field, DbId, PermissionError } from "trombase";
import type { Permitter } from "trombase";

// A permitter is an async function that returns null to allow, or PermissionError to deny.
// - session is the current auth session
// - sql is a database connection object that allows arbitrary queries against the db
// - operation is an object that describes what the user is trying to do
const ownerOnly: Permitter = async (session, sql, operation) => {
	const payload = operation?.payload as { userId?: string };
	if (payload?.userId === session.userId) return null;

	return new PermissionError("not your row");
};

const schema = createSchema({
	entities: {
		expenses: entity("expenses", {
			fields: {
				userId: field.dbId().immutable(),
				amount: field.number(),
			},
			permissions: {
				read: ownerOnly,
				create: ownerOnly,
				update: ownerOnly,
				delete: ownerOnly,
			},
		}),
	},
});

const trom = TromBase({
	databaseUrl: process.env.DATABASE_URL!,
	schema,
});

Example app

A fullstack reference app (HTTP API + React UI) lives in examples/notes_app/.

• Register, login, CRUD notes with ownership permitters.
• Reads via db.select and /api/db/select.

Setup and run instructions: examples/notes_app/README.md.

API overview

| Surface | Purpose | | ------------------------------------------------------------------- | -------------------------------------- | | TromBase({ databaseUrl, schema, emailSender? }) | Wire schema, database, and auth | | createSchema / entity / field / pointsTo / resolvesToMany | Schema DSL | | trom.auth.registerWithUsernamePassword | Create user + session | | trom.auth.loginWithUsernamePassword | Login | | trom.auth.requestPasswordReset | Start reset flow | | trom.auth.validatePasswordReset | Complete reset | | trom.auth.invalidateSessionToken | Log out | | trom.db.withSession | Bind session for DB calls | | trom.db.doMutations | Transactional insert / update / delete | | trom.db.select | Permissioned reads and joins |

Public exports are defined in src/main.ts.

Non-goals

• Database migrations or schema codegen
• Built-in HTTP / GraphQL server (bring your framework)
• Session token middleware in the library (validate sessions in your routes)
• Arbitrary raw SQL through the public db API
• Databases other than PostgreSQL