I've tried doing this read & updates using Postgrest and row-level-security using Supabase. When it works its an amazing experience but even for semi complex stuff you would still need to use Postgres RPC, which is still another "API" layer. I find writing API using SQL a nigtmare.
Simple queries like this don't work on Postgrest:
`update likes set likes = likes + 1;`
Simple queries like this don't work on Postgrest: `update likes set likes = likes + 1;`