Declare an allowlist
Map public column IDs to database fields and explicitly enable search, filtering, sorting, facets, and aggregation. Never accept table or field identifiers from a request.
Choose an adapter
Use native PostgreSQL, MySQL, or SQLite adapters for SQL control; Knex for query-builder portability; or Prisma for an injected model.
Keyset cursors and editing
Provide a primary key and secret for signed keyset cursors. Editor-option loaders and multipart upload handlers reuse the same authorization boundary.
const database = createDataTablePostgreSqlAdapter({
client: pgPool,
table: 'people',
primaryKey: 'id',
cursorSecret: process.env.CURSOR_SECRET,
columns: [
{ id: 'name', field: 'name', facet: true },
{ id: 'score', field: 'score', type: 'number' }
]
});