[no0dles]

I had the same question a year ago and create a side project on that topic. The solution was is very close to the firebase approach, writing security rules. Those rules whitelist sql statements and give some some flexibility by defining query parameters and having a context object that contains userIds and so on. For example:

frontend sql statement as a json object:

  {
    select: { 
      name: field(Project, 'name') 
    },
    from: table(Project),
    where: equal(field(Project, 'ownerUsername'), '<my-user-id>'),
  }

and here a rule configured on the backend:

  const rules = [
    allow(authorized(), {
      select: {
        name: field(Project, 'name'),
      },
      from: table(Project),
      where: equal(field(Project, 'ownerUsername'), requestContext().userId),
    })
  ],

Sadly documentation is quite poor for now, but you can check it out here https://github.com/no0dles/daita

Edit: code formatting