@everystack/api 0.2.1 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/api",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "PostgREST-compatible HTTP handler + typed fetch client for Drizzle ORM",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/handler/index.ts

@@ -547,6 +547,12 @@ export function createHandler(db: DrizzleDb, schema: Schema, options?: HandlerOp
         const result = await verifyUserToken(request, options.auth);
         if (result.error) return result.error;
         user = result.user;
+      } else if (request.headers.get('authorization')) {
+        // Public route with token present — verify opportunistically.
+        // If valid, the request runs as authenticated (better RLS access).
+        // If invalid, ignore and fall through as anonymous.
+        const result = await verifyUserToken(request, options.auth);
+        if (!result.error) user = result.user;
       }
 
       if (user && options.auth.onAuthenticated) {
@@ -812,7 +818,7 @@ async function handleGet(
     };
     if (cacheControl) aggHeaders['Cache-Control'] = cacheControl;
 
-    return new Response(JSON.stringify(transformResponse(stripHiddenColumns(serialized, tableName, options), options)), {
+    return new Response(JSON.stringify(stripHiddenColumns(transformResponse(serialized, options), tableName, options)), {
       status: 200,
       headers: aggHeaders,
     });
@@ -926,7 +932,7 @@ async function handleGet(
   };
   if (cacheControl) getHeaders['Cache-Control'] = cacheControl;
 
-  return new Response(JSON.stringify(transformResponse(stripHiddenColumns(responseData, tableName, options), options)), {
+  return new Response(JSON.stringify(stripHiddenColumns(transformResponse(responseData, options), tableName, options)), {
     status: 200,
     headers: getHeaders,
   });
@@ -1228,7 +1234,7 @@ async function handlePost(
     try { await hook.afterCreate(rows[0], user, client); } catch {}
   }
 
-  return json(transformResponse(stripHiddenColumns(rows[0], tableName, options), options), 201);
+  return json(stripHiddenColumns(transformResponse(rows[0], options), tableName, options), 201);
 }
 
 async function handlePatch(
@@ -1305,7 +1311,7 @@ async function handlePatch(
     try { await hook.afterUpdate(rows, user, client); } catch {}
   }
 
-  return json(transformResponse(stripHiddenColumns(rows, tableName, options), options), 200);
+  return json(stripHiddenColumns(transformResponse(rows, options), tableName, options), 200);
 }
 
 async function handleDelete(
@@ -1375,7 +1381,7 @@ async function handleDelete(
         try { await hook.afterDelete(rows, user, client); } catch {}
       }
 
-      return json(transformResponse(stripHiddenColumns(rows, tableName, options), options), 200);
+      return json(stripHiddenColumns(transformResponse(rows, options), tableName, options), 200);
     }
   }
 
@@ -1394,7 +1400,7 @@ async function handleDelete(
     try { await hook.afterDelete(rows, user, client); } catch {}
   }
 
-  return json(transformResponse(stripHiddenColumns(rows, tableName, options), options), 200);
+  return json(stripHiddenColumns(transformResponse(rows, options), tableName, options), 200);
 }
 
 interface JsonPath {