friendly engineer. works at https://xitter.cf/t.co/W72Fib5QYx former infra lead for previews @ Dropbox 🦋 https://xitter.cf/t.co/MrHlnAMxBj
California
Joined April 2008
- Tweets519
- Following182
- Followers1.3K
- Likes342
Grok did a decent job, but to make it more concrete I've built two components to do this.
Workpool - durable functions with steps, suspension until time/event & more
Workpool - general-purpose queues w/ parallelism limits, retry configs, exactly-once execution of onComplete
I feel clever subbing `return await fn()` with `return fn()`
But gotchas don't seem worth it anymore
• Breaks try/catch/finally expectations
• Loses stack trace context
My default is now to always await. Change my mind.
try {
return foo(); // async function
} finally {
// executes before foo finishes*
}
* code in foo prior to the first await may run first
Big updates to the Agent Component:
- Abort an async stream remotely
- Pending, failed, and aborted streamed messages auto-save
- AI SDK v5 support
- Easier to use alongside AI SDK vs. wrapping
- Type-safe custom context passed to tools
- <SmoothText>msg.text</SmoothText>
[Authorization 1/]
I realized after adding better parametrization to my middleware-ish library, that I have a lot of opinions on authorization!
For one, the highest leverage place to enforce authn & authz is at the boundary between untrusted & trusted environments. Why? 🧵
[Authorization 5/]
Nothing is absolute. Defense in depth is a sign of maturity, but can also slow you down and give you a false sense of security. If it's "everyone responsibility," no one layer feels pressure to be responsible. Also: compliance is a real thing.
Full Stack post on Authorization is out!
stack.convex.dev/authorizati…
RLS should be the last line of defense, not first. Defense in depth is great, but the most precise authorization can happen where the user intent is most clear (& within a trusted environment). Have already started a Stack post on Auth{n,z}- will publish soon!
Public DBs with rules at the row level is a security anti-pattern.
The right way to do things is to make the DB private and only accessible by your backend.
Then, implement access rules in the API.
@kiwicopple why push this pattern rather than correct private auth ?
I love working here; there's always high leverage things to do.
I especially like that the approach is principled, opinionated, and (imo) starting with the right primitives.
Who do you know that cares a lot about API design?
Not an official roadmap but re this job role: redesigning pagination, client-side ID allocation, better optimistic updates, a query primitive with ~no execution time/size limits, better index syntax, a new scheduling primitive for triggering execution when data changes, simplify the Convex helpers into an official “standard library”, better aggregates support, _updatedAt and _sequenceNumber fields, new useQuery with options for skip/suspend/etc, split up our global api object so tsc runs faster, separate compilation for larger codebases, easy component authoring, local query caching, the ability for functions to tell clients to back off, websocket http actions, partial object validators, first-class Zod support, type-safe query builder with nice join ergonomics, consistent server rendering that doesn't suck, excellent auth… and lots more we haven’t figured out yet :)
Met the team recently - very impressed how fast they've built this. And giving more control over the underly Convex app / data feels like a really good model for graduating vibe apps into scalable businesses 👏
VibeFlow (@vibeflowai) is the fastest way to build robust full-stack apps without code, giving you full control over your backend with visual, n8n-style workflows.
Build your app visually with VibeFlow: app.vibeflow.ai