@everystack/api 0.2.2 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/api",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "PostgREST-compatible HTTP handler + typed fetch client for Drizzle ORM",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/handler/index.ts

@@ -431,14 +431,12 @@ export function createHandler(db: DrizzleDb, schema: Schema, options?: HandlerOp
     //   1. Header-based (native/server): X-Client-Id + X-Client-Secret
     //   2. Referer-based (web): Referer or Origin header (no secrets in browser source)
     // The verifyClient callback receives all three and decides which path to validate.
-    // Skipped for publicRoutes methods (e.g. GET) and publicRpc functions — no credentials needed.
+    // Skipped for publicRoutes methods (e.g. GET) — no credentials needed.
+    // publicRpc skips JWT verification only, NOT client auth.
     let user: Record<string, unknown> | null = null;
     let client: Record<string, unknown> | null = null;
     const isPublicRoute = options?.auth?.publicRoutes?.includes(method) ?? false;
-    const isPublicRpc = pathSegments[0] === 'rpc'
-      && !!pathSegments[1]
-      && (options?.auth?.publicRpc?.includes(pathSegments[1]) ?? false);
-    if (options?.auth?.verifyClient && !isPublicRoute && !isPublicRpc) {
+    if (options?.auth?.verifyClient && !isPublicRoute) {
       const idHeader = options.auth.clientHeaders?.id ?? 'X-Client-Id';
       const secretHeader = options.auth.clientHeaders?.secret ?? 'X-Client-Secret';
       const clientId = request.headers.get(idHeader);