waterline

It's been about four years since we touched it. When we used Waterline (the Sails ORM), we discovered two distinct SQL injection vulnerabilities in it, without intentionally looking. I would link the related issues, but they seem to have disabled Github issues in the waterline repository[1]. That--and lots more--scared us away. We switched happily to Hapi[2] with about a week of work and never looked back. 1. https://github.com/balderdashy/waterline 2. https://hapijs.com/

> I don't know, perhaps sails is riddled with unfixed bugs? I wrote about a fair amount of unexpected behavior with Sails/Waterline. Some of these have since been fixed, some of them (Waterline defaults to dropping tables unless you have NODE_ENV=production in an env var) are deliberate decisions and hence not "fixable". https://kev.inburke.com/kevin/dont-use-sails-or-waterline/ There's a fair amount of other stuff I would hope to change and that we've just ripped out of our fork. - If count() isn't implemented in an adapter Waterline will fetch the entire table into memory to count the number of rows. - Sails by default creates a route for every function in a controller, which makes it easy for an attacker to bypass policies - blueprints routinely 500 server error based on user input - https://github.com/balderdashy/waterline/issues/1248

So basically their biggest problem was that node.js machine-gun hammers the filesystem with stat calls when looking for modules. This was made worse by running on a shared folder. Vagrant has a mode called rsync-auto which will synchronize directories into a local vm. Or you could just always have the code local to the node process. It makes more sense to have your editor work with remote files. Next biggest problem was relational database. I think that tests requiring a SQL database are usually a bad sign, and the statement "we'd like to use transactions but our orm doesn't support them" makes me sad. To paraphrase Ben Franklin, "those who would give up transactions for a framework deserve neither". Here's some ideas for speeding up your tests, in order from best to worst. - Make most business code rely on a service or interface. Swap

This is a nice guide on setting up integration with a PostgreSQL database from Node. I've come across a few projects recently that make similar attempts, as an ORM: Bookshelf: http://bookshelfjs.org/ Sequelize: http://sequelizejs.com/ Waterline: https://github.com/balderdashy/waterline

I just recently split out the ORM, Waterline into a new project. The first step was to get API compatibility with the current ORM and a bit of sugar like lifecycle callbacks and custom instance methods. Associations are next on the list of to-dos. It's still a very new ORM but I'm working on making it better. Check it out I'd love feedback or better yet pull requests. https://github.com/balderdashy/waterline