@plutocms/supabase 0.13.0 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.14.0](https://github.com/plutocms/supabase/compare/v0.13.0...v0.14.0) (2026-10-27)
+
+
+### ⚠ BREAKING CHANGES
+
+* the routes `/api/access/**`, `/api/auth/signup`, `/api/migrations/**`, `/api/permissions/me`, `/api/profile/locale`, `/api/settings/**`, `/api/setup/create` and `/api/users/**` moved under `/api/_pluto/supabase/` (see the README), and failures are HTTP errors.
+
+### Features
+
+* move the internal routes under /api/_pluto/supabase, and support the public API ([#104](https://github.com/plutocms/supabase/issues/104)) ([e7bf91c](https://github.com/plutocms/supabase/commit/e7bf91cd5a802247b4ec3b6938389b94a06ce3e3))
+
 ## [0.13.0](https://github.com/plutocms/supabase/compare/v0.12.0...v0.13.0) (2026-10-25)
 
 

package/FEATURES.md

@@ -15,7 +15,8 @@ policies shared by every project here.
   link, roles editor), invites through Pluto mail, and a guide for the Supabase sign-in emails.
   @.claude/skills/users-and-roles/SKILL.md
 - Content adapter: a Supabase/PostgREST-backed `PlutoContentAdapter`, plugging any layer's
-  declared content type into `@plutocms/pluto`'s generic content routes.
+  declared content type into `@plutocms/pluto`'s generic content routes. It supports query
+  filters, puts the timestamps on items, and reads the public API of core with an anonymous client.
   @.claude/skills/content-adapter/SKILL.md
 - Auth driver: plugs Supabase sign-in into the admin shell that pluto core owns (navbar, sign-in
   page, route guard), and keeps the setup guard in the driver.

package/README.md

@@ -1,6 +1,6 @@
-# Supabase Layer for Pluto CMS
+# Supabase Layer for Pluto
 
-This layer integrates Supabase as a backend service for Pluto CMS, providing a robust and scalable solution for managing content and data.
+This layer integrates Supabase as a backend service for Pluto, providing a robust and scalable solution for managing content and data.
 
 ## Installation
 
@@ -50,7 +50,7 @@ entries. See "Migrating an app" in that skill.
 ### Invite users (access API)
 
 An admin invites a user by email and gives the user one or more roles. The routes are under
-`/api/access/**`. Every write needs an admin. This needs the migration
+`/api/_pluto/supabase/access/**`. Every write needs an admin. This needs the migration
 `008_users_and_roles_admin.sql`, which the admin applies from `/admin/migrations`.
 
 Invites need no setup. Check one thing: in the Supabase dashboard (Authentication, then URL
@@ -107,24 +107,36 @@ come from Supabase. The Email tab has a guide to send them through Resend too.
 
 ### API Routes
 
-The layer includes API routes for interacting with Supabase services, such as authentication and media management.
-
-- GET `/api/settings`
-- POST `/api/settings/update`
-- POST `/api/auth/signup`
-- GET `/api/users`, GET `/api/users/:id`
-- GET `/api/migrations/status`, POST `/api/migrations/run` (admin)
-- GET `/api/permissions/me`
-- GET and POST `/api/profile/locale`
-- GET `/api/settings/first_setup`, POST `/api/setup/create`
-- GET `/api/access/users`, GET `/api/access/roles` (permission `users:read`)
-- POST `/api/access/users/invite`, POST `/api/access/users/:id/resend` (admin; `locale` is the
+The layer includes API routes for interacting with Supabase services, such as authentication and settings.
+Every route lives under `/api/_pluto/supabase/`. Core blocks a cross-site write to `/api/_pluto/**`, so
+a page of another site cannot call them. A failure is an HTTP error with a translation key, never a
+`200` with `success: false`. These routes serve the admin. They are not a public API.
+
+### Public content API
+
+The public content of the Supabase layers is read through the public API of core,
+`GET /api/pluto/v1/content/<type>` (and `/<id or slug>`). See
+[the public API](https://pluto.vulmix.dev/core/public-api). The routes are anonymous. This layer
+reads for them with an anon client that has no user session, so Row Level Security applies as for
+an anonymous visitor, and the answer is the same for everyone. A CDN can cache it. The adapter
+never uses the service role key for a read. The adapter also supports the `filters` of a public
+query, and puts the created, updated and published-at columns on each item, so a public list can
+sort by date.
+
+- GET and PUT `/api/_pluto/supabase/settings` (PUT needs `settings:manage`; it answers `{ message, data }`)
+- POST `/api/_pluto/supabase/auth/signup`
+- GET `/api/_pluto/supabase/migrations`, POST `/api/_pluto/supabase/migrations/run` (admin)
+- GET `/api/_pluto/supabase/me/capabilities`
+- GET and PUT `/api/_pluto/supabase/me/locale`
+- GET `/api/_pluto/supabase/setup` (the setup state), POST `/api/_pluto/supabase/setup` (runs the first setup)
+- GET `/api/_pluto/supabase/access/users`, GET `/api/_pluto/supabase/access/roles` (permission `users:read`)
+- POST `/api/_pluto/supabase/access/users/invite`, POST `/api/_pluto/supabase/access/users/:id/resend` (admin; `locale` is the
   optional language of the email)
-- POST `/api/access/users/invite-link` (admin; needs the service role key; returns a one-time link
+- POST `/api/_pluto/supabase/access/users/invite-link` (admin; needs the service role key; returns a one-time link
   and sends no email)
-- GET `/api/access/capabilities` (admin; says whether the service key and Pluto mail are set)
-- PUT and DELETE `/api/access/users/:id/roles` (admin; DELETE revokes the access)
-- POST `/api/access/roles`, PUT and DELETE `/api/access/roles/:key` (admin)
+- GET `/api/_pluto/supabase/access/capabilities` (admin; says whether the service key and Pluto mail are set)
+- PUT and DELETE `/api/_pluto/supabase/access/users/:id/roles` (admin; DELETE revokes the access)
+- POST `/api/_pluto/supabase/access/roles`, PUT and DELETE `/api/_pluto/supabase/access/roles/:key` (admin)
 
 ### Types
 

package/app/components/access/DeleteRoleModal.vue

@@ -23,7 +23,7 @@ async function remove() {
   working.value = true
 
   try {
-    await $fetch(`/api/access/roles/${props.role.key}`, { method: 'DELETE' })
+    await $fetch(`/api/_pluto/supabase/access/roles/${props.role.key}`, { method: 'DELETE' })
 
     toast.add({
       title: t('supabase.access.toasts.roleDeleted'),

package/app/components/access/EditRolesSlideover.vue

@@ -61,7 +61,7 @@ async function save() {
   saving.value = true
 
   try {
-    await $fetch(`/api/access/users/${props.user.id}/roles`, {
+    await $fetch(`/api/_pluto/supabase/access/users/${props.user.id}/roles`, {
       method: 'PUT',
       body: { roleKeys: roleKeys.value },
     })

package/app/components/access/InviteModal.vue

@@ -85,7 +85,7 @@ async function submit() {
   mailProblem.value = null
 
   try {
-    const result = await $fetch<AccessInviteResult>('/api/access/users/invite', {
+    const result = await $fetch<AccessInviteResult>('/api/_pluto/supabase/access/users/invite', {
       method: 'POST',
       body: { ...body(), locale: emailLocale.value },
     })
@@ -140,7 +140,7 @@ async function copyLink() {
 
   try {
     const result = await $fetch<{ status: 'invited' | 'granted', link: string | null }>(
-      '/api/access/users/invite-link',
+      '/api/_pluto/supabase/access/users/invite-link',
       { method: 'POST', body: body() }
     )
 

package/app/components/access/RevokeModal.vue

@@ -27,7 +27,7 @@ async function revoke() {
   working.value = true
 
   try {
-    await $fetch(`/api/access/users/${props.user.id}/roles`, { method: 'DELETE' })
+    await $fetch(`/api/_pluto/supabase/access/users/${props.user.id}/roles`, { method: 'DELETE' })
 
     toast.add({
       title: t('supabase.access.toasts.revoked'),

package/app/components/access/RoleSlideover.vue

@@ -131,12 +131,12 @@ async function save() {
 
   try {
     if (creating.value) {
-      await $fetch('/api/access/roles', {
+      await $fetch('/api/_pluto/supabase/access/roles', {
         method: 'POST',
         body: { ...body, key: key.value },
       })
     } else {
-      await $fetch(`/api/access/roles/${props.role!.key}`, { method: 'PUT', body })
+      await $fetch(`/api/_pluto/supabase/access/roles/${props.role!.key}`, { method: 'PUT', body })
     }
 
     toast.add({

package/app/composables/migrations.ts

@@ -53,7 +53,7 @@ export function useMigrations() {
     error,
     status: fetchStatus,
     refresh,
-  } = useFetch<MigrationsStatusResponse>('/api/migrations/status', {
+  } = useFetch<MigrationsStatusResponse>('/api/_pluto/supabase/migrations', {
     key: 'pluto-migrations-status',
   })
 
@@ -70,10 +70,30 @@ export function useMigrations() {
   const pendingCount = computed(() => status.value?.pending.length ?? 0)
 
   async function runMigrations(connectionString?: string) {
-    const result = await $fetch<RunMigrationsResponse>('/api/migrations/run', {
-      method: 'POST',
-      body: connectionString ? { connectionString } : undefined,
-    })
+    let result: RunMigrationsResponse
+
+    try {
+      result = await $fetch<RunMigrationsResponse>('/api/_pluto/supabase/migrations/run', {
+        method: 'POST',
+        body: connectionString ? { connectionString } : undefined,
+      })
+    } catch (error) {
+      // The route answers a failed run with an HTTP error that carries
+      // `needsConnectionString` or `error` in its data. Turn it back into
+      // a failed result, so the page shows it as before. Any other error
+      // (for example a dropped connection) goes on to the caller.
+      const failure = failureData(error)
+
+      if (failure?.needsConnectionString !== true && typeof failure?.error !== 'string') {
+        throw error
+      }
+
+      result = {
+        success: false,
+        needsConnectionString: failure.needsConnectionString === true ? true : undefined,
+        error: typeof failure.error === 'string' ? failure.error : undefined,
+      }
+    }
 
     await refresh()
 

package/app/pages/admin/(auth)/signup.vue

@@ -3,7 +3,7 @@ definePageMeta({
   layout: 'auth',
 })
 
-const { t } = usePlutoI18n()
+const { t, te } = usePlutoI18n()
 const errorText = usePlutoErrorText()
 
 useHead({
@@ -36,7 +36,7 @@ async function submitForm() {
   isSubmitting.value = true
 
   try {
-    await $fetch('/api/auth/signup', {
+    await $fetch('/api/_pluto/supabase/auth/signup', {
       method: 'POST',
       body: {
         email: form.value.email,
@@ -59,7 +59,14 @@ async function submitForm() {
 
     toast.add({
       title: t('supabase.auth.signup.failed'),
-      description: errorText(error, 'supabase.auth.errors.unknown'),
+      description: resolveAuthErrorText(
+        {
+          code: failureData(error)?.code,
+          message: (error as { data?: { statusMessage?: string } }).data?.statusMessage
+            ?? errorText(error, 'supabase.auth.errors.unknown'),
+        },
+        { t, te }
+      ),
       icon: 'lucide:circle-x',
       color: 'error',
     })

package/app/pages/admin/settings/roles.vue

@@ -29,7 +29,7 @@ async function load() {
   }
 
   try {
-    const response = await $fetch<{ roles: AccessRole[] }>('/api/access/roles')
+    const response = await $fetch<{ roles: AccessRole[] }>('/api/_pluto/supabase/access/roles')
 
     roles.value = response.roles
     status.value = 'ready'

package/app/pages/admin/settings/users.vue

@@ -50,8 +50,8 @@ async function load() {
 
   try {
     const [usersResponse, rolesResponse] = await Promise.all([
-      $fetch<{ users: AccessUser[] }>('/api/access/users'),
-      $fetch<{ roles: AccessRole[] }>('/api/access/roles'),
+      $fetch<{ users: AccessUser[] }>('/api/_pluto/supabase/access/users'),
+      $fetch<{ roles: AccessRole[] }>('/api/_pluto/supabase/access/roles'),
     ])
 
     users.value = usersResponse.users
@@ -65,7 +65,7 @@ async function load() {
 
 async function loadCapabilities() {
   try {
-    capabilities.value = await $fetch<AccessCapabilities>('/api/access/capabilities')
+    capabilities.value = await $fetch<AccessCapabilities>('/api/_pluto/supabase/access/capabilities')
   } catch {
     // The invite works without it. Only the "Copy invite link" action hides.
     capabilities.value = null
@@ -134,7 +134,7 @@ async function copyLink(user: AccessUser) {
   }
 
   try {
-    const result = await $fetch<{ link: string | null }>('/api/access/users/invite-link', {
+    const result = await $fetch<{ link: string | null }>('/api/_pluto/supabase/access/users/invite-link', {
       method: 'POST',
       body: { email: user.email, roleKeys: user.roles },
     })
@@ -164,7 +164,7 @@ async function copyLink(user: AccessUser) {
 async function resend(user: AccessUser) {
   try {
     const result = await $fetch<{ emailSent?: boolean, link?: string }>(
-      `/api/access/users/${user.id}/resend`,
+      `/api/_pluto/supabase/access/users/${user.id}/resend`,
       { method: 'POST', body: { locale: locale.value } }
     )
 

package/app/pages/admin/setup.vue

@@ -74,7 +74,7 @@ const currentStepSubmitLabel = computed(() => {
 })
 
 /**
- * Polls /api/settings/first_setup until the dev server responds again, and
+ * Polls /api/_pluto/supabase/setup until the dev server responds again, and
  * advances the stepper once it does.
  *
  * Used only to wait out the restart described in the `catch` block of
@@ -89,7 +89,7 @@ async function waitForServerAndAdvance(): Promise<boolean> {
     await new Promise((resolve) => setTimeout(resolve, delayMs))
 
     try {
-      await $fetch('/api/settings/first_setup')
+      await $fetch('/api/_pluto/supabase/setup')
 
       toast.add({
         title: t('supabase.connection.reconnected'),
@@ -118,24 +118,13 @@ async function completeDatabaseSetup() {
       encodeURIComponent(databaseForm.value.password)
     )
 
-    const data = await $fetch<any>('/api/setup/create', {
+    const data = await $fetch<any>('/api/_pluto/supabase/setup', {
       method: 'POST',
       body: {
         connectionString,
       },
     })
 
-    if (data.success === false) {
-      toast.add({
-        title: t('supabase.setup.failed'),
-        description: t('supabase.setup.failedDescription'),
-        icon: 'lucide:circle-x',
-        color: 'error',
-      })
-
-      return
-    }
-
     if (data.persisted === false) {
       envNotPersisted.value = true
       submittedConnectionString.value = connectionString
@@ -150,7 +139,20 @@ async function completeDatabaseSetup() {
 
     stepper.value?.next()
   } catch (error) {
-    // Writing DATABASE_URL to .env (the last step of /api/setup/create,
+    // The route answers a failed setup with an HTTP error that carries the
+    // scrubbed database error in its data.
+    if (typeof failureData(error)?.error === 'string') {
+      toast.add({
+        title: t('supabase.setup.failed'),
+        description: t('supabase.setup.failedDescription'),
+        icon: 'lucide:circle-x',
+        color: 'error',
+      })
+
+      return
+    }
+
+    // Writing DATABASE_URL to .env (the last step of /api/_pluto/supabase/setup,
     // after the schema and every layer migration already succeeded)
     // restarts the dev server. The response can be cut off by that
     // restart even though the setup itself worked. A dropped connection
@@ -326,7 +328,7 @@ function handleStepChange(step: number) {
                                 >
                                   <template #route>
                                     <ULink
-                                      to="https://github.com/plutocms/supabase/blob/feat/setup-wizard/server/api/setup/create.post.ts"
+                                      to="https://github.com/plutocms/supabase/blob/main/server/api/_pluto/supabase/setup/index.post.ts"
                                       target="_blank"
                                       class="underline"
                                     >

package/app/plugins/pluto-extension.ts

@@ -36,7 +36,7 @@ export default defineNuxtPlugin(() => {
   async function loadSiteSettings() {
     try {
       const response = await $fetch<{ settings: Record<string, string> }>(
-        '/api/settings'
+        '/api/_pluto/supabase/settings'
       )
       siteSettings.value = response.settings
     } catch {
@@ -53,7 +53,7 @@ export default defineNuxtPlugin(() => {
     let state: SetupState = 'unknown'
     try {
       state = setupStateFromResponse(
-        await $fetch('/api/settings/first_setup')
+        await $fetch('/api/_pluto/supabase/setup')
       )
     } catch (error) {
       if (import.meta.dev) {
@@ -200,13 +200,13 @@ export default defineNuxtPlugin(() => {
       id: 'supabase',
       load: async () => {
         const response = await $fetch<{ settings: Record<string, string> }>(
-          '/api/settings'
+          '/api/_pluto/supabase/settings'
         )
         return response.settings
       },
       save: async (patch) => {
-        await $fetch('/api/settings/update', {
-          method: 'POST',
+        await $fetch('/api/_pluto/supabase/settings', {
+          method: 'PUT',
           body: patch,
         })
 
@@ -229,12 +229,12 @@ export default defineNuxtPlugin(() => {
     localeDriver: {
       id: 'supabase',
       load: async () => {
-        const response = await $fetch<{ locale: string | null }>('/api/profile/locale')
+        const response = await $fetch<{ locale: string | null }>('/api/_pluto/supabase/me/locale')
         return response.locale
       },
       save: async (locale) => {
         try {
-          await $fetch('/api/profile/locale', { method: 'POST', body: { locale } })
+          await $fetch('/api/_pluto/supabase/me/locale', { method: 'PUT', body: { locale } })
         } catch (error) {
           throw new Error(errorText(error))
         }
@@ -243,7 +243,7 @@ export default defineNuxtPlugin(() => {
     permissionsDriver: {
       id: 'supabase',
       load: async () => {
-        const response = await $fetch<{ capabilities: string[] }>('/api/permissions/me')
+        const response = await $fetch<{ capabilities: string[] }>('/api/_pluto/supabase/me/capabilities')
         return response.capabilities
       },
     },

package/app/utils/api-failure.ts

@@ -0,0 +1,16 @@
+// Reads the extra data of a failed call to this layer's routes. This file does
+// not use Nuxt auto-imports, so plain Vitest can import it.
+
+/**
+ * Returns the `data` that a route put in its `createPlutoError`. A `$fetch`
+ * error holds the whole response body in `data`, so the extra data sits in
+ * `data.data`. Returns `undefined` when the error has none.
+ */
+export function failureData(error: unknown): Record<string, unknown> | undefined {
+  const body = (error as { data?: unknown } | null | undefined)?.data
+  const data = (body as { data?: unknown } | null | undefined)?.data
+
+  return typeof data === 'object' && data !== null
+    ? (data as Record<string, unknown>)
+    : undefined
+}

package/app/utils/auth-driver.ts

@@ -67,11 +67,11 @@ export const SUPABASE_PUBLIC_PATHS: PlutoAuthPublicPath[] = [
 /** The page that opens after a sign-in with no (safe) redirect. */
 export const SUPABASE_SIGN_IN_FALLBACK = '/admin/home'
 
-/** The setup state that the setup guard reads from `/api/settings/first_setup`. */
+/** The setup state that the setup guard reads from `/api/_pluto/supabase/setup`. */
 export type SetupState = 'pending' | 'done' | 'unknown'
 
 /**
- * Reads the answer of `/api/settings/first_setup`. A failed call, or a
+ * Reads the answer of `/api/_pluto/supabase/setup`. A failed call, or a
  * response with no `is_first_setup` flag, is `unknown`.
  */
 export function setupStateFromResponse(data: unknown): SetupState {

package/i18n/locales/en.json

@@ -9,12 +9,17 @@
       "missingPermission": "Your account is missing the \"{capability}\" permission.",
       "setupCompleted": "Setup has already been completed.",
       "coreSchemaMissing": "Core schema not found. Reinstall @plutocms/supabase and restart the dev server.",
-      "fetchUsers": "Error fetching users: {message}",
-      "fetchUser": "Error fetching user: {message}",
       "localeUnsupported": "This language is not supported.",
       "duplicateRecord": "A record with this value already exists.",
       "missingReference": "This references a record that does not exist.",
-      "migrationStatus": "Error reading migration status: {message}"
+      "migrationStatus": "Error reading migration status: {message}",
+      "signupFailed": "Could not create the account.",
+      "connectionStringRequired": "A database connection string is required.",
+      "migrationsFailed": "Migrations failed: {message}",
+      "setupFailed": "Database setup failed: {message}",
+      "setupStateRead": "Could not read the setup state: {message}",
+      "settingsSave": "Could not save the settings: {message}",
+      "localeSave": "Could not save your language: {message}"
     },
     "auth": {
       "backToLogin": "Back to Login",

package/i18n/locales/pt-BR.json

@@ -9,12 +9,17 @@
       "missingPermission": "Sua conta não tem a permissão \"{capability}\".",
       "setupCompleted": "A configuração já foi concluída.",
       "coreSchemaMissing": "Esquema principal não encontrado. Reinstale @plutocms/supabase e reinicie o servidor de desenvolvimento.",
-      "fetchUsers": "Erro ao buscar os usuários: {message}",
-      "fetchUser": "Erro ao buscar o usuário: {message}",
       "localeUnsupported": "Este idioma não está disponível.",
       "duplicateRecord": "Já existe um registro com este valor.",
       "missingReference": "Isto aponta para um registro que não existe.",
-      "migrationStatus": "Erro ao ler o status das migrações: {message}"
+      "migrationStatus": "Erro ao ler o status das migrações: {message}",
+      "signupFailed": "Não foi possível criar a conta.",
+      "connectionStringRequired": "Informe a string de conexão do banco de dados.",
+      "migrationsFailed": "As migrações falharam: {message}",
+      "setupFailed": "A configuração do banco de dados falhou: {message}",
+      "setupStateRead": "Não foi possível ler o estado da configuração: {message}",
+      "settingsSave": "Não foi possível salvar as configurações: {message}",
+      "localeSave": "Não foi possível salvar o seu idioma: {message}"
     },
     "auth": {
       "backToLogin": "Voltar para o login",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "trustedDependencies": [
     "@parcel/watcher",
     "@plutocms/pluto",
@@ -11,7 +11,7 @@
     "unrs-resolver",
     "vue-demi"
   ],
-  "description": "Supabase backend layer for Pluto CMS",
+  "description": "Supabase backend layer for Pluto",
   "author": "Victor Ribeiro",
   "homepage": "https://github.com/plutocms/supabase#readme",
   "repository": {
@@ -39,7 +39,7 @@
     "@nuxt/eslint": "^1.17.0",
     "@nuxt/ui": "^4.12.0",
     "@nuxtjs/supabase": "^2.1.0",
-    "@plutocms/pluto": "^0.20.0",
+    "@plutocms/pluto": "^0.27.0",
     "@plutocms/utils": "^0.2.1",
     "@supabase/supabase-js": "^2.117.3",
     "postgres": "^3.4.9",

package/server/api/{access → _pluto/supabase/access}/capabilities.get.ts

@@ -1,6 +1,6 @@
-import { plutoMailReady } from '../../utils/access-mail'
-import { requireAdminRole } from '../../utils/admin-role-guard'
-import { optionalServiceClient } from '../../utils/service-client'
+import { plutoMailReady } from '../../../../utils/access-mail'
+import { requireAdminRole } from '../../../../utils/admin-role-guard'
+import { optionalServiceClient } from '../../../../utils/service-client'
 
 /**
  * What the invite UI can offer, for an admin: whether the service role key is

package/server/api/{access → _pluto/supabase/access}/roles/[key].delete.ts

@@ -1,6 +1,6 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../../utils/access-errors'
-import { requireAdminRole } from '../../../utils/admin-role-guard'
+import { mapAccessError } from '../../../../../utils/access-errors'
+import { requireAdminRole } from '../../../../../utils/admin-role-guard'
 
 /** Deletes a role. It answers with the number of users who lost the role. */
 export default defineEventHandler(async (event) => {

package/server/api/{access → _pluto/supabase/access}/roles/[key].put.ts

@@ -1,8 +1,8 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../../utils/access-errors'
-import { roleBodySchema } from '../../../utils/access-invite'
-import { requireAdminRole } from '../../../utils/admin-role-guard'
-import { parseBody } from '../../../utils/validate'
+import { mapAccessError } from '../../../../../utils/access-errors'
+import { roleBodySchema } from '../../../../../utils/access-invite'
+import { requireAdminRole } from '../../../../../utils/admin-role-guard'
+import { parseBody } from '../../../../../utils/validate'
 
 /** Edits a role and replaces its capabilities. The `admin` role is refused. */
 export default defineEventHandler(async (event) => {

package/server/api/{access → _pluto/supabase/access}/roles.get.ts

@@ -1,6 +1,6 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../utils/access-errors'
-import { requireCapability } from '../../utils/capability-guard'
+import { mapAccessError } from '../../../../utils/access-errors'
+import { requireCapability } from '../../../../utils/capability-guard'
 
 /** The roles, with their capabilities and the number of users. */
 export default defineEventHandler(async (event) => {

package/server/api/{access → _pluto/supabase/access}/roles.post.ts

@@ -1,8 +1,8 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../utils/access-errors'
-import { createRoleBodySchema } from '../../utils/access-invite'
-import { requireAdminRole } from '../../utils/admin-role-guard'
-import { parseBody } from '../../utils/validate'
+import { mapAccessError } from '../../../../utils/access-errors'
+import { createRoleBodySchema } from '../../../../utils/access-invite'
+import { requireAdminRole } from '../../../../utils/admin-role-guard'
+import { parseBody } from '../../../../utils/validate'
 
 /** Creates a role. A new role cannot hold the wildcard. */
 export default defineEventHandler(async (event) => {

package/server/api/{access → _pluto/supabase/access}/users/[id]/resend.post.ts

@@ -1,16 +1,16 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../../../utils/access-errors'
-import { inviteRedirectUrl, isEmailExistsError, requireUserId, resendBodySchema } from '../../../../utils/access-invite'
+import { mapAccessError } from '../../../../../../utils/access-errors'
+import { inviteRedirectUrl, isEmailExistsError, requireUserId, resendBodySchema } from '../../../../../../utils/access-invite'
 import {
   assertInviteLocale,
   generateAcceptLink,
   inviterNameOf,
   plutoMailReady,
   sendInviteMail,
-} from '../../../../utils/access-mail'
-import { requireAdminRole } from '../../../../utils/admin-role-guard'
-import { enforceInviteRateLimit } from '../../../../utils/rate-limit'
-import { optionalServiceClient } from '../../../../utils/service-client'
+} from '../../../../../../utils/access-mail'
+import { requireAdminRole } from '../../../../../../utils/admin-role-guard'
+import { enforceInviteRateLimit } from '../../../../../../utils/rate-limit'
+import { optionalServiceClient } from '../../../../../../utils/service-client'
 import {
   emailInvalidError,
   emailNotAuthorizedError,
@@ -20,8 +20,8 @@ import {
   isEmailRateLimitError,
   sendSignInLink,
   signInLinkError,
-} from '../../../../utils/sign-in-link'
-import { parseBody } from '../../../../utils/validate'
+} from '../../../../../../utils/sign-in-link'
+import { parseBody } from '../../../../../../utils/validate'
 
 function notFound() {
   return createPlutoError({

package/server/api/{access → _pluto/supabase/access}/users/[id]/roles.delete.ts

@@ -1,7 +1,7 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../../../utils/access-errors'
-import { requireUserId } from '../../../../utils/access-invite'
-import { requireAdminRole } from '../../../../utils/admin-role-guard'
+import { mapAccessError } from '../../../../../../utils/access-errors'
+import { requireUserId } from '../../../../../../utils/access-invite'
+import { requireAdminRole } from '../../../../../../utils/admin-role-guard'
 
 /** Revokes the access of a user: it removes every role. The account stays. */
 export default defineEventHandler(async (event) => {

package/server/api/{access → _pluto/supabase/access}/users/[id]/roles.put.ts

@@ -1,8 +1,8 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../../../utils/access-errors'
-import { requireUserId, rolesBodySchema } from '../../../../utils/access-invite'
-import { requireAdminRole } from '../../../../utils/admin-role-guard'
-import { parseBody } from '../../../../utils/validate'
+import { mapAccessError } from '../../../../../../utils/access-errors'
+import { requireUserId, rolesBodySchema } from '../../../../../../utils/access-invite'
+import { requireAdminRole } from '../../../../../../utils/admin-role-guard'
+import { parseBody } from '../../../../../../utils/validate'
 
 /** Replaces the roles of a user. An empty list revokes the access. */
 export default defineEventHandler(async (event) => {

package/server/api/{access → _pluto/supabase/access}/users/invite-link.post.ts

@@ -1,10 +1,10 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { inviteBodySchema, inviteRedirectUrl } from '../../../utils/access-invite'
-import { provisionAccess, serviceKeyRequiredError } from '../../../utils/access-mail'
-import { requireAdminRole } from '../../../utils/admin-role-guard'
-import { enforceInviteRateLimit } from '../../../utils/rate-limit'
-import { optionalServiceClient } from '../../../utils/service-client'
-import { parseBody } from '../../../utils/validate'
+import { inviteBodySchema, inviteRedirectUrl } from '../../../../../utils/access-invite'
+import { provisionAccess, serviceKeyRequiredError } from '../../../../../utils/access-mail'
+import { requireAdminRole } from '../../../../../utils/admin-role-guard'
+import { enforceInviteRateLimit } from '../../../../../utils/rate-limit'
+import { optionalServiceClient } from '../../../../../utils/service-client'
+import { parseBody } from '../../../../../utils/validate'
 
 /**
  * Grants the roles and returns a one-time sign-in link. No email is sent, so

package/server/api/{access → _pluto/supabase/access}/users/invite.post.ts

@@ -1,10 +1,10 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../../utils/access-errors'
+import { mapAccessError } from '../../../../../utils/access-errors'
 import {
   inviteBodySchema,
   inviteRedirectUrl,
   isEmailExistsError,
-} from '../../../utils/access-invite'
+} from '../../../../../utils/access-invite'
 import {
   addRoles,
   assertInviteLocale,
@@ -13,10 +13,10 @@ import {
   plutoMailReady,
   provisionAccess,
   sendInviteMail,
-} from '../../../utils/access-mail'
-import { requireAdminRole } from '../../../utils/admin-role-guard'
-import { enforceInviteRateLimit } from '../../../utils/rate-limit'
-import { optionalServiceClient } from '../../../utils/service-client'
+} from '../../../../../utils/access-mail'
+import { requireAdminRole } from '../../../../../utils/admin-role-guard'
+import { enforceInviteRateLimit } from '../../../../../utils/rate-limit'
+import { optionalServiceClient } from '../../../../../utils/service-client'
 import {
   emailInvalidError,
   emailNotAuthorizedError,
@@ -26,8 +26,8 @@ import {
   isEmailRateLimitError,
   sendSignInLink,
   signInLinkError,
-} from '../../../utils/sign-in-link'
-import { parseBody } from '../../../utils/validate'
+} from '../../../../../utils/sign-in-link'
+import { parseBody } from '../../../../../utils/validate'
 
 /**
  * Invites a user by email and grants the roles.

package/server/api/{access → _pluto/supabase/access}/users.get.ts

@@ -1,6 +1,6 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../utils/access-errors'
-import { requireCapability } from '../../utils/capability-guard'
+import { mapAccessError } from '../../../../utils/access-errors'
+import { requireCapability } from '../../../../utils/capability-guard'
 
 /** The staff: users with a role, or with the admin flag. */
 export default defineEventHandler(async (event) => {

package/server/api/{auth → _pluto/supabase/auth}/signup.post.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod'
 import { serverSupabaseClient } from '#supabase/server'
-import { parseBody } from '../../utils/validate'
+import { parseBody } from '../../../../utils/validate'
 
 // Supabase Auth (GoTrue) rejects a password under 6 characters with its own
 // opaque error. Matching that minimum here turns an empty/short password
@@ -30,11 +30,16 @@ export default defineEventHandler(async (event) => {
   })
 
   if (error) {
-    return {
-      success: false,
+    // A 4xx from Supabase Auth keeps its status (for example 429 for a rate
+    // limit). Any other status becomes a 502. The code goes in `data`, so
+    // the signup page can show the translated text of a known code.
+    const status = error.status ?? 400
+    throw createPlutoError({
+      statusCode: status >= 400 && status < 500 ? status : 502,
       message: error.message,
-      error,
-    }
+      key: 'supabase.errors.signupFailed',
+      data: { code: error.code },
+    })
   }
 
   return {

package/server/api/{profile → _pluto/supabase/me}/locale.get.ts

@@ -27,7 +27,7 @@ export default defineEventHandler(async (event) => {
     // upgraded this package but not yet applied that migration has no such
     // column. That state is expected and temporary, so degrade to
     // "Automatic" instead of a 500. The same choice is made in
-    // server/api/permissions/me.get.ts.
+    // server/api/_pluto/supabase/me/capabilities.get.ts.
     console.error(
       'profiles.locale read failed, returning no locale:',
       error.message

package/server/api/{profile/locale.post.ts → _pluto/supabase/me/locale.put.ts}

@@ -1,6 +1,6 @@
 import { z } from 'zod'
 import { serverSupabaseClient, serverSupabaseUser } from '#supabase/server'
-import { parseBody } from '../../utils/validate'
+import { parseBody } from '../../../../utils/validate'
 
 const localeSchema = z.object({
   locale: z.string().nullable(),
@@ -64,7 +64,12 @@ export default defineEventHandler(async (event) => {
       })
     }
 
-    throw createError({ statusCode: 500, statusMessage: error.message })
+    throw createPlutoError({
+      statusCode: 500,
+      message: `Could not save your language: ${error.message}`,
+      key: 'supabase.errors.localeSave',
+      params: { message: error.message },
+    })
   }
 
   return { locale }

package/server/api/{migrations/status.get.ts → _pluto/supabase/migrations/index.get.ts}

@@ -1,5 +1,5 @@
-import { requireAdmin } from '../../utils/admin-guard'
-import { getMigrationStatus } from '../../utils/pending-migrations'
+import { requireAdmin } from '../../../../utils/admin-guard'
+import { getMigrationStatus } from '../../../../utils/pending-migrations'
 
 export default defineEventHandler(async (event) => {
   // requireAdmin specifically, not a named capability — see admin-guard.ts

package/server/api/{migrations → _pluto/supabase/migrations}/run.post.ts

@@ -1,12 +1,12 @@
-import type { PlutoMigrationFile } from '../../../shared/types/migrations'
-import type { MigrationFileResult } from '../../utils/migrations'
+import type { PlutoMigrationFile } from '../../../../../shared/types/migrations'
+import type { MigrationFileResult } from '../../../../utils/migrations'
 import { z } from 'zod'
-import { requireAdmin } from '../../utils/admin-guard'
-import { persistDatabaseUrl } from '../../utils/env-file'
-import { resolveConnectionString, runPendingMigrations } from '../../utils/migrations'
-import { scrubConnectionString } from '../../utils/scrub-connection-string'
-import { regenerateSupabaseTypes } from '../../utils/typegen'
-import { parseBody } from '../../utils/validate'
+import { requireAdmin } from '../../../../utils/admin-guard'
+import { persistDatabaseUrl } from '../../../../utils/env-file'
+import { resolveConnectionString, runPendingMigrations } from '../../../../utils/migrations'
+import { scrubConnectionString } from '../../../../utils/scrub-connection-string'
+import { regenerateSupabaseTypes } from '../../../../utils/typegen'
+import { parseBody } from '../../../../utils/validate'
 
 // The whole body is optional: an already-configured DATABASE_URL means the
 // caller need not (and, per resolveConnectionString, cannot) supply one.
@@ -33,10 +33,12 @@ export default defineEventHandler(async (event) => {
     resolveConnectionString(body?.connectionString)
 
   if (!connStr) {
-    return {
-      success: false as const,
-      needsConnectionString: true,
-    }
+    throw createPlutoError({
+      statusCode: 400,
+      message: 'A database connection string is required.',
+      key: 'supabase.errors.connectionStringRequired',
+      data: { needsConnectionString: true },
+    })
   }
 
   const config = useRuntimeConfig()
@@ -102,9 +104,12 @@ export default defineEventHandler(async (event) => {
 
     console.error('Error applying migrations:', errorMessage)
 
-    return {
-      success: false as const,
-      error: errorMessage,
-    }
+    throw createPlutoError({
+      statusCode: 500,
+      message: `Migrations failed: ${errorMessage}`,
+      key: 'supabase.errors.migrationsFailed',
+      params: { message: errorMessage },
+      data: { error: errorMessage },
+    })
   }
 })

package/server/api/{settings/update.post.ts → _pluto/supabase/settings/index.put.ts}

@@ -1,7 +1,7 @@
 import { z } from 'zod'
 import { serverSupabaseClient } from '#supabase/server'
-import { requireCapability } from '../../utils/capability-guard'
-import { parseBody } from '../../utils/validate'
+import { requireCapability } from '../../../../utils/capability-guard'
+import { parseBody } from '../../../../utils/validate'
 
 // A key is lowercase segments separated by dots, e.g. 'website_title' or
 // 'blog.posts_per_page'. Mirrors the settings_setting_key_format check
@@ -39,12 +39,16 @@ export default defineEventHandler(async (event) => {
     .select()
 
   if (error) {
-    throw createError({ statusMessage: error.message })
+    throw createPlutoError({
+      statusCode: 500,
+      message: `Could not save the settings: ${error.message}`,
+      key: 'supabase.errors.settingsSave',
+      params: { message: error.message },
+    })
   }
 
   return {
     message: 'Settings updated successfully.',
-    statusCode: 200,
     data,
   }
 })

package/server/api/{settings/first_setup.get.ts → _pluto/supabase/setup/index.get.ts}

@@ -9,11 +9,12 @@ export default defineEventHandler(async (event) => {
   const { data, error } = await client.from('healthcheck').select('*')
 
   if (error) {
-    return {
-      success: false as const,
-      message: 'Error retrieving healthcheck settings',
-      error: error.message,
-    }
+    throw createPlutoError({
+      statusCode: 500,
+      message: `Could not read the setup state: ${error.message}`,
+      key: 'supabase.errors.setupStateRead',
+      params: { message: error.message },
+    })
   }
 
   // @ts-expect-error: Object.fromEntries may not infer the correct type

package/server/api/{setup/create.post.ts → _pluto/supabase/setup/index.post.ts}

@@ -1,10 +1,10 @@
-import type { PlutoMigrationFile } from '../../../shared/types/migrations'
+import type { PlutoMigrationFile } from '../../../../../shared/types/migrations'
 import postgres from 'postgres'
 import { z } from 'zod'
-import { persistDatabaseUrl } from '../../utils/env-file'
-import { runPendingMigrations } from '../../utils/migrations'
-import { scrubConnectionString } from '../../utils/scrub-connection-string'
-import { parseBody } from '../../utils/validate'
+import { persistDatabaseUrl } from '../../../../utils/env-file'
+import { runPendingMigrations } from '../../../../utils/migrations'
+import { scrubConnectionString } from '../../../../utils/scrub-connection-string'
+import { parseBody } from '../../../../utils/validate'
 
 // Only checks that a connection string was actually sent. A Postgres
 // connection string can take many valid forms (postgres:// URL, key=value
@@ -20,7 +20,7 @@ export default defineEventHandler(async (event) => {
   // before setup creates the profiles table — so once real setup has run,
   // this check is the only thing stopping anyone from re-running it against
   // an arbitrary database. Mirrors the same precedence rule in
-  // server/api/migrations/run.post.ts, which calls it "the whole security
+  // server/api/_pluto/supabase/migrations/run.post.ts, which calls it "the whole security
   // model for this endpoint."
   if (process.env.DATABASE_URL) {
     throw createPlutoError({
@@ -120,9 +120,12 @@ export default defineEventHandler(async (event) => {
 
     console.error('Error setting up the database:', message)
 
-    return {
-      success: false,
-      error: message,
-    }
+    throw createPlutoError({
+      statusCode: 500,
+      message: `Database setup failed: ${message}`,
+      key: 'supabase.errors.setupFailed',
+      params: { message },
+      data: { error: message },
+    })
   }
 })

package/server/utils/admin-guard.ts

@@ -10,7 +10,7 @@ import { serverSupabaseClient, serverSupabaseUser } from '#supabase/server'
  * `004_roles_and_capabilities.sql` respectively); a genuinely fresh site
  * that has never applied any migration beyond the original baseline
  * schema — an expected, normal state, not a broken one — has neither
- * function. `/api/migrations/*` (the only routes that call `requireAdmin`
+ * function. `/api/_pluto/supabase/migrations/*` (the only routes that call `requireAdmin`
  * today) are the one place this actually bites: they are the routes that
  * apply a pending migration, so they must work with zero migrations
  * applied, not just with `002`+ already in place. An earlier version of

package/server/utils/content-adapter.ts

@@ -1,5 +1,6 @@
 import type { PostgrestError, SupabaseClient } from '@supabase/supabase-js'
 import type { H3Event } from 'h3'
+import { createClient } from '@supabase/supabase-js'
 import { serverSupabaseClient } from '#supabase/server'
 import { requireCapability } from './capability-guard'
 
@@ -31,9 +32,44 @@ import { requireCapability } from './capability-guard'
  * type, not to assert against one.
  */
 async function getClient(event: H3Event): Promise<SupabaseClient> {
+  if (isPublicRead(event)) {
+    return getAnonymousClient(event)
+  }
+
   return (await serverSupabaseClient(event)) as unknown as SupabaseClient
 }
 
+/** The anonymous client and the url/key pair it was built from. */
+let anonymousClient: { url: string, key: string, client: SupabaseClient } | undefined
+
+/**
+ * A Supabase client with no user session, for public reads of the public
+ * API. It uses the anon key from the runtime config of `@nuxtjs/supabase`,
+ * reads no cookies and keeps no session. Row Level Security then applies as
+ * for an anonymous visitor, so the answer is the same for everyone and a CDN
+ * can cache it. It never uses the service role key. One client serves the
+ * whole process.
+ */
+function getAnonymousClient(event: H3Event): SupabaseClient {
+  const { url, key } = useRuntimeConfig(event).public.supabase as { url: string, key: string }
+
+  if (!anonymousClient || anonymousClient.url !== url || anonymousClient.key !== key) {
+    anonymousClient = {
+      url,
+      key,
+      client: createClient(url, key, {
+        auth: {
+          persistSession: false,
+          autoRefreshToken: false,
+          detectSessionInUrl: false,
+        },
+      }),
+    }
+  }
+
+  return anonymousClient.client
+}
+
 /**
  * Resolves the storage column for a content type's created/updated
  * timestamp. Returns `undefined` when timestamps are disabled entirely
@@ -70,6 +106,70 @@ export function resolveStatusColumn(type: PlutoContentType): string | undefined
   return type.status.column ?? 'status'
 }
 
+/**
+ * Resolves a sort field to its column. A timestamp column (the created, the
+ * updated or the published-at column) sorts directly, because it is not a
+ * declared field. Any other name must be a declared field.
+ */
+function resolveSortColumn(type: PlutoContentType, fieldName: string): string {
+  if (timestampColumns(type).includes(fieldName)) {
+    return fieldName
+  }
+
+  return resolveFieldColumn(type, fieldName, 'sort')
+}
+
+/** The columns of the created, updated and published-at timestamps that this type has. */
+function timestampColumns(type: PlutoContentType): string[] {
+  const { created, updated, published } = timestampKeys(type)
+
+  return [created, updated, published].filter((column): column is string => column !== undefined)
+}
+
+/**
+ * The item keys of the timestamps of a type. They are the column names,
+ * because a timestamp is not a declared field. A key is missing when its
+ * timestamp is off. Core uses this to sort and to show the public dates.
+ */
+function timestampKeys(type: PlutoContentType): { created?: string, updated?: string, published?: string } {
+  const keys: { created?: string, updated?: string, published?: string } = {}
+
+  const created = resolveTimestampColumn(type, 'created')
+  if (created) {
+    keys.created = created
+  }
+
+  const updated = resolveTimestampColumn(type, 'updated')
+  if (updated) {
+    keys.updated = updated
+  }
+
+  const published = type.status ? type.status.publishedAtColumn : undefined
+  if (published) {
+    keys.published = published
+  }
+
+  return keys
+}
+
+/**
+ * Maps a row to an item, then copies the timestamp columns onto it under
+ * their column names. `mapColumnsToFields` drops every column that no field
+ * declares, and a timestamp is not a field. A field with the same name as a
+ * timestamp column keeps its own value.
+ */
+function toItem(type: PlutoContentType, row: Record<string, unknown>): PlutoContentItem {
+  const item = mapColumnsToFields(type, row)
+
+  for (const column of timestampColumns(type)) {
+    if (!Object.hasOwn(item, column) && Object.hasOwn(row, column)) {
+      item[column] = row[column]
+    }
+  }
+
+  return item
+}
+
 /**
  * Maps a raw PostgREST error to an H3/Nuxt error safe to send to a
  * client. Logs the raw error first, so the real message always reaches
@@ -128,6 +228,10 @@ async function list(ctx: PlutoContentContext, query: PlutoContentQuery): Promise
     builder = builder.eq(statusColumn, publishedValue)
   }
 
+  for (const [field, value] of Object.entries(query.filters ?? {})) {
+    builder = builder.eq(resolveFieldColumn(ctx.type, field, 'filter'), value)
+  }
+
   if (query.search) {
     const titleColumn = resolveFieldColumn(ctx.type, ctx.type.titleField, 'titleField')
     builder = builder.ilike(titleColumn, `%${query.search}%`)
@@ -135,7 +239,7 @@ async function list(ctx: PlutoContentContext, query: PlutoContentQuery): Promise
 
   const sort = query.sort ?? ctx.type.defaultSort
   if (sort) {
-    const sortColumn = resolveFieldColumn(ctx.type, sort.field, 'sort')
+    const sortColumn = resolveSortColumn(ctx.type, sort.field)
     builder = builder.order(sortColumn, { ascending: sort.direction !== 'desc' })
   } else {
     const createdColumn = resolveTimestampColumn(ctx.type, 'created')
@@ -156,7 +260,7 @@ async function list(ctx: PlutoContentContext, query: PlutoContentQuery): Promise
   }
 
   return {
-    data: (data ?? []).map((row: Record<string, unknown>) => mapColumnsToFields(ctx.type, row)),
+    data: (data ?? []).map((row: Record<string, unknown>) => toItem(ctx.type, row)),
     total: count ?? undefined,
   }
 }
@@ -190,7 +294,7 @@ async function get(ctx: PlutoContentContext, idOrSlug: string | number): Promise
   }
 
   if (data) {
-    return mapColumnsToFields(ctx.type, data)
+    return toItem(ctx.type, data)
   }
 
   if (ctx.type.slug) {
@@ -207,7 +311,7 @@ async function get(ctx: PlutoContentContext, idOrSlug: string | number): Promise
     }
 
     if (bySlug.data) {
-      return mapColumnsToFields(ctx.type, bySlug.data)
+      return toItem(ctx.type, bySlug.data)
     }
   }
 
@@ -252,7 +356,7 @@ async function create(ctx: PlutoContentContext, values: Record<string, unknown>)
     throw toContentError(error)
   }
 
-  return mapColumnsToFields(ctx.type, data)
+  return toItem(ctx.type, data)
 }
 
 async function update(
@@ -319,7 +423,7 @@ async function update(
     throw toContentError(error)
   }
 
-  return mapColumnsToFields(ctx.type, data)
+  return toItem(ctx.type, data)
 }
 
 async function remove(ctx: PlutoContentContext, id: string | number): Promise<void> {
@@ -378,5 +482,6 @@ export function createSupabaseContentAdapter(): PlutoContentAdapter {
     remove,
     authorize,
     countCreated,
+    timestampKeys,
   }
 }

package/server/api/users/[id].get.ts

@@ -1,26 +0,0 @@
-import { serverSupabaseClient } from '#supabase/server'
-import { requireCapability } from '../../utils/capability-guard'
-
-export default defineEventHandler(async (event) => {
-  await requireCapability(event, 'users:read')
-
-  const client = await serverSupabaseClient<Database>(event)
-
-  const id = event.context.params?.id as string
-
-  const { data: user, error } = await client
-    .from('profiles')
-    .select('*')
-    .eq('id', id)
-
-  if (error) {
-    throw createPlutoError({
-      statusCode: 500,
-      message: `Error fetching user: ${error.message}`,
-      key: 'supabase.errors.fetchUser',
-      params: { message: error.message },
-    })
-  }
-
-  return user
-})

package/server/api/users/index.get.ts

@@ -1,21 +0,0 @@
-import { serverSupabaseClient } from '#supabase/server'
-import { requireCapability } from '../../utils/capability-guard'
-
-export default defineEventHandler(async (event) => {
-  await requireCapability(event, 'users:read')
-
-  const client = await serverSupabaseClient<Database>(event)
-
-  const { data: users, error } = await client.from('profiles').select('*')
-
-  if (error) {
-    throw createPlutoError({
-      statusCode: 500,
-      message: `Error fetching users: ${error.message}`,
-      key: 'supabase.errors.fetchUsers',
-      params: { message: error.message },
-    })
-  }
-
-  return users
-})