Hey everyone, I was wondering if there's anything planned in terms of allowing the client to not talk to Supabase via individual API calls, but to maybe establish a connection with the database and work from there? Or am I missing something

If you are working on the server-side, you can directly connect to the Supabase database which will pass any RLS setting you have. This way you could turn on RLS on every table and disable all access to them via regular requests, and only your server could have access to the tables. Not sure if this would work in your case though.

I'll mirror laznic' comments. If you're doing things server side, you can talk directly to Supabase DB and do whatever you want. This is a great setup if you're building an API around data and want to handle auth differently (e.g. a user generates an API key and uses that for requests they send). Connecting directly to a DB from a client usually sets off some alarm bells. The only feasible reason I can think to do that would be because the dev wants to run SQL directly from the client, which also means they're opening up their entire DB to people who just want to watch it burn. The current setup we have where things route through an API is a great middle-ground between accessing the DB and not exposing the DB. Having that auth layer in between the DB and the outside world really brings some huge benefits that would take a significant amount of work to do inside the DB (if it's even possible).