@everystack/api 0.2.1 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/api",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "PostgREST-compatible HTTP handler + typed fetch client for Drizzle ORM",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/handler/index.ts

@@ -431,14 +431,12 @@ export function createHandler(db: DrizzleDb, schema: Schema, options?: HandlerOp
     //   1. Header-based (native/server): X-Client-Id + X-Client-Secret
     //   2. Referer-based (web): Referer or Origin header (no secrets in browser source)
     // The verifyClient callback receives all three and decides which path to validate.
-    // Skipped for publicRoutes methods (e.g. GET) and publicRpc functions — no credentials needed.
+    // Skipped for publicRoutes methods (e.g. GET) — no credentials needed.
+    // publicRpc skips JWT verification only, NOT client auth.
     let user: Record<string, unknown> | null = null;
     let client: Record<string, unknown> | null = null;
     const isPublicRoute = options?.auth?.publicRoutes?.includes(method) ?? false;
-    const isPublicRpc = pathSegments[0] === 'rpc'
-      && !!pathSegments[1]
-      && (options?.auth?.publicRpc?.includes(pathSegments[1]) ?? false);
-    if (options?.auth?.verifyClient && !isPublicRoute && !isPublicRpc) {
+    if (options?.auth?.verifyClient && !isPublicRoute) {
       const idHeader = options.auth.clientHeaders?.id ?? 'X-Client-Id';
       const secretHeader = options.auth.clientHeaders?.secret ?? 'X-Client-Secret';
       const clientId = request.headers.get(idHeader);
@@ -547,6 +545,12 @@ export function createHandler(db: DrizzleDb, schema: Schema, options?: HandlerOp
         const result = await verifyUserToken(request, options.auth);
         if (result.error) return result.error;
         user = result.user;
+      } else if (request.headers.get('authorization')) {
+        // Public route with token present — verify opportunistically.
+        // If valid, the request runs as authenticated (better RLS access).
+        // If invalid, ignore and fall through as anonymous.
+        const result = await verifyUserToken(request, options.auth);
+        if (!result.error) user = result.user;
       }
 
       if (user && options.auth.onAuthenticated) {
@@ -812,7 +816,7 @@ async function handleGet(
     };
     if (cacheControl) aggHeaders['Cache-Control'] = cacheControl;
 
-    return new Response(JSON.stringify(transformResponse(stripHiddenColumns(serialized, tableName, options), options)), {
+    return new Response(JSON.stringify(stripHiddenColumns(transformResponse(serialized, options), tableName, options)), {
       status: 200,
       headers: aggHeaders,
     });
@@ -926,7 +930,7 @@ async function handleGet(
   };
   if (cacheControl) getHeaders['Cache-Control'] = cacheControl;
 
-  return new Response(JSON.stringify(transformResponse(stripHiddenColumns(responseData, tableName, options), options)), {
+  return new Response(JSON.stringify(stripHiddenColumns(transformResponse(responseData, options), tableName, options)), {
     status: 200,
     headers: getHeaders,
   });
@@ -1228,7 +1232,7 @@ async function handlePost(
     try { await hook.afterCreate(rows[0], user, client); } catch {}
   }
 
-  return json(transformResponse(stripHiddenColumns(rows[0], tableName, options), options), 201);
+  return json(stripHiddenColumns(transformResponse(rows[0], options), tableName, options), 201);
 }
 
 async function handlePatch(
@@ -1305,7 +1309,7 @@ async function handlePatch(
     try { await hook.afterUpdate(rows, user, client); } catch {}
   }
 
-  return json(transformResponse(stripHiddenColumns(rows, tableName, options), options), 200);
+  return json(stripHiddenColumns(transformResponse(rows, options), tableName, options), 200);
 }
 
 async function handleDelete(
@@ -1375,7 +1379,7 @@ async function handleDelete(
         try { await hook.afterDelete(rows, user, client); } catch {}
       }
 
-      return json(transformResponse(stripHiddenColumns(rows, tableName, options), options), 200);
+      return json(stripHiddenColumns(transformResponse(rows, options), tableName, options), 200);
     }
   }
 
@@ -1394,7 +1398,7 @@ async function handleDelete(
     try { await hook.afterDelete(rows, user, client); } catch {}
   }
 
-  return json(transformResponse(stripHiddenColumns(rows, tableName, options), options), 200);
+  return json(stripHiddenColumns(transformResponse(rows, options), tableName, options), 200);
 }
 
 interface JsonPath {