@pikku/inspector 0.12.88 → 0.12.89

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## 0.12.89
+
+### Patch Changes
+
+- bc488cf: fix(inspector): an explicit `auth: false` declares an exposed sessionless function public, so PKU574 no longer warns about it
+
+  A genuinely public endpoint — a published programme, a health check — had no
+  honest way to quiet PKU574: the only options were an always-true permission or
+  `permissionsInBody: true`, both of which claim a gate that does not exist. The
+  inspector now records `auth` on function meta exactly as written instead of
+  dropping `false`, and the check treats an explicit `auth: false` as the author
+  declaring the function public on purpose. A sessionless function that leaves
+  `auth` out still warns.
+
+- Updated dependencies [50b59a3]
+- Updated dependencies [2b946e9]
+- Updated dependencies [bc488cf]
+  - @pikku/core@0.12.123
+
 ## 0.12.88
 
 ### Patch Changes

package/dist/add/add-functions.js

@@ -397,10 +397,11 @@ export const addFunctions = (logger, node, checker, state, options) => {
     let remote;
     let mcp;
     /**
-     * A sessionless function's own `auth: true`. `sessionless` records the
-     * baseline — a `pikkuFunc` always needs a session — while this records the
-     * tightening a `pikkuSessionlessFunc` applies to itself, which is otherwise
-     * invisible to anything reading meta.
+     * A sessionless function's own `auth`, exactly as written. `sessionless`
+     * records the baseline — a `pikkuFunc` always needs a session — while this
+     * records what a `pikkuSessionlessFunc` says about itself: `true` tightens it
+     * to require a session, `false` declares it public on purpose. Both are
+     * otherwise invisible to anything reading meta; left out, it stays undefined.
      */
     let auth;
     /** The author's claim that the body authorizes its own callers. */
@@ -998,7 +999,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         inputs: inputNames.filter((n) => n !== 'void') ?? null,
         outputs: outputNames.filter((n) => n !== 'void') ?? null,
         expose: expose || undefined,
-        auth: auth || undefined,
+        auth: typeof auth === 'boolean' ? auth : undefined,
         permissionsInBody: permissionsInBody || undefined,
         audit,
         remote: remote || undefined,

package/dist/utils/validate-exposed-functions-gated.js

@@ -64,8 +64,9 @@ export function validateExposedFunctionsGated(logger, state) {
             (rest > 0 ? `, and ${rest} more` : '') +
             `. Add permissions to the function, set \`auth: true\` if a session is ` +
             `required after all, gate the whole addon with ` +
-            `wireAddon({ auth: true }), or drop \`expose: true\` if ` +
-            `${one ? 'it was' : 'they were'} not meant to be callable from outside.`,
+            `wireAddon({ auth: true }), drop \`expose: true\` if ` +
+            `${one ? 'it was' : 'they were'} not meant to be callable from outside, ` +
+            `or set \`auth: false\` to declare ${one ? 'it' : 'them'} public on purpose.`,
     });
 }
 const gatesItself = (meta) => 
@@ -79,6 +80,11 @@ meta.sessionless === false ||
     // and a warning that is usually wrong stops being read.
     meta.permissionsInBody === true ||
     meta.auth === true ||
+    // The author wrote `auth: false` on a sessionless function: public on
+    // purpose — a health check, a sign-up, a published catalogue. A declaration,
+    // like `permissionsInBody`, so the default-open function nobody thought
+    // about still warns and the one somebody decided about does not.
+    meta.auth === false ||
     (meta.scopes?.length ?? 0) > 0 ||
     (meta.permissions?.length ?? 0) > 0;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.88",
+  "version": "0.12.89",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -55,10 +55,10 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.121"
+    "@pikku/core": "^0.12.123"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.121",
+    "@pikku/core": "^0.12.123",
     "@types/node": "^24.13.3"
   },
   "engines": {