@everystack/api 0.2.9 → 0.2.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/api",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "PostgREST-compatible HTTP handler + typed fetch client for Drizzle ORM",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -30,6 +30,11 @@
       "default": "./src/client/index.ts"
     }
   },
+  "scripts": {
+    "test": "jest",
+    "build": "tsc --build",
+    "lint": "tsc --noEmit"
+  },
   "peerDependencies": {
     "drizzle-orm": "0.41.0"
   },
@@ -40,10 +45,5 @@
     "jest": "29.7.0",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3"
-  },
-  "scripts": {
-    "test": "jest",
-    "build": "tsc --build",
-    "lint": "tsc --noEmit"
   }
-}
+}

package/src/handler/index.ts

@@ -564,9 +564,16 @@ export function createHandler(db: DrizzleDb, schema: Schema, options?: HandlerOp
           const result = await verifyUserToken(request, options.auth);
           if (result.error) return result.error;
           user = result.user;
-          if (user && options.auth.onAuthenticated) {
-            options.auth.onAuthenticated(user);
-          }
+        } else if (request.headers.get('authorization')) {
+          // Public RPC with token present — verify opportunistically, same
+          // policy as public table routes below. If valid, the request runs
+          // as authenticated (RLS self-visibility, PII self-tiers). If
+          // invalid, ignore and fall through as anonymous.
+          const result = await verifyUserToken(request, options.auth);
+          if (!result.error) user = result.user;
+        }
+        if (user && options.auth.onAuthenticated) {
+          options.auth.onAuthenticated(user);
         }
       }
 
@@ -610,7 +617,14 @@ export function createHandler(db: DrizzleDb, schema: Schema, options?: HandlerOp
             kind: 'rpc', name: fnName, user, client,
             result: 'allow', requestId, body: body as Record<string, unknown>,
           });
-          return json(result, 200);
+          // Same cache discipline as table GETs: with pgSettings configured the
+          // response can vary by identity (opportunistic auth on public RPCs),
+          // so it must forbid shared caching ITSELF — never rely on the CDN
+          // config (the cache key carries no identity; a consumer overriding
+          // the stock defaultTtl:0 policy would otherwise cache one user's
+          // personalized response and serve it to everyone).
+          const rpcCacheControl = getCacheControl(options);
+          return json(result, 200, rpcCacheControl ? { 'Cache-Control': rpcCacheControl } : undefined);
         } catch (error) {
           const pgCode = (error as any)?.code;
           let status = 500;
@@ -1933,9 +1947,9 @@ function buildAllConditions(table: DrizzleTable, params: URLSearchParams): { con
   return { conditions };
 }
 
-function json(data: unknown, status: number): Response {
+function json(data: unknown, status: number, headers?: Record<string, string>): Response {
   return new Response(JSON.stringify(data), {
     status,
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', ...headers },
   });
 }