@protobase/server 0.32.0 → 0.33.0

package/dist/functions/define-function.d.ts

@@ -47,6 +47,11 @@ export type CorsOptions = {
 type SharedOptions = {
   /** Answers CORS preflights before authentication and adds the CORS headers to every response, problems included. */
   cors?: CorsOptions;
+  /**
+   * Also answers at `/api/sb/functions/v1/<name>`, as Supabase's `verify_jwt` does, where the app's publishable key alone
+   * admits a caller. For functions moved from Supabase; not together with `roles` or `capability`.
+   */
+  supabase?: boolean;
 };
 /** A function anyone may call, such as a webhook; it can still ask for a caller with `context.caller()`. */
 export type PublicFunctionOptions = SharedOptions & {
@@ -78,7 +83,7 @@ export type FunctionSource = ApiFunction | FunctionHandler | FunctionApp;
 /**
  * A function of your own, served at `/api/functions/<name>`. Without options it needs a signed-in caller, through the
  * app's `authenticate`, and with the app's `roles` one whose roles hold `*`; `{ roles }` or `{ capability }` opens it
- * to more, `{ public: true }` to anyone, as for a webhook.
+ * to more, `{ public: true }` to anyone, as for a webhook. `{ supabase: true }` serves it at `/api/sb/functions/v1/<name>` too.
  */
 export declare function defineFunction(handler: FunctionHandler | FunctionApp): ApiFunction;
 export declare function defineFunction(options: PublicFunctionOptions, handler: PublicFunctionHandler | FunctionApp<PublicFunctionContext>): ApiFunction;

package/dist/functions/supabase-routes.js

@@ -7,11 +7,12 @@ import { Hono } from "hono";
 import { cors } from "hono/cors";
 //#region src/functions/supabase-routes.ts
 /**
-* The app's functions again at `/api/sb/functions/v1/<name>`, as Supabase serves Edge Functions. A protected function lets in
-* a request its app's keys admit, as Supabase's `verify_jwt` does, and a public one anyone. Either gets the key-made
-* caller, not the app's session, so a function with `roles` is served at `/api/functions/<name>` only. As on Supabase,
-* the function sees the path from its name on, `/<name>/more/parts`, and a CORS preflight, which carries no key,
-* reaches it unchecked.
+* The functions with `supabase: true` again at `/api/sb/functions/v1/<name>`, as Supabase serves Edge Functions. A
+* protected one lets in a request its app's keys admit, as Supabase's `verify_jwt` does, the publishable key alone
+* included, and a public one anyone. Either gets the key-made caller, not the app's session, so neither may have
+* `roles` or `capability`: that stops startup. As on Supabase, the function sees the path from its name on,
+* `/<name>/more/parts`, and a CORS preflight, which carries no key, reaches it unchecked. Every other function is a 404
+* here, and none of its code runs.
 */
 const supabaseFunctionRoutes = ({ functions, db, keys, caller, onError }) => {
 	const app = new Hono().basePath(supabaseFunctionsPath);
@@ -19,9 +20,17 @@ const supabaseFunctionRoutes = ({ functions, db, keys, caller, onError }) => {
 	const hasKeys = keys.publishable !== void 0 || keys.secret !== void 0;
 	for (const [name, fn] of Object.entries(functions)) {
 		const { options } = fn;
+		if (options.supabase !== true) {
+			app.all(`/${name}/*`, () => {
+				throw notFound(`The function "${name}" answers at /api/functions/${name} only: give it supabase: true to answer here too`);
+			});
+			continue;
+		}
+		const { roles, capability } = options;
+		const gated = roles !== void 0 ? "roles" : capability !== void 0 ? "a capability" : void 0;
+		if (gated) throw new Error(`The function "${name}" has supabase: true and ${gated}, which /api/sb/functions/v1 cannot check: drop one`);
 		if (options.cors) app.use(`/${name}/*`, cors(options.cors));
 		app.all(`/${name}/*`, (c) => runInBackground(async () => {
-			if (!options.public && options.roles) throw notFound(`The function "${name}" checks roles, so it is served at /api/functions/${name} only`);
 			const request = relativeRequest(c.req.raw, supabaseFunctionsPath);
 			if (options.public || c.req.method === "OPTIONS") {
 				let resolved;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.32.0",
-    "@protobase/query": "0.32.0",
-    "@protobase/schema": "0.32.0",
+    "@protobase/layout": "0.33.0",
+    "@protobase/query": "0.33.0",
+    "@protobase/schema": "0.33.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",