@pylonsync/functions 0.3.116 → 0.3.118

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pylonsync/functions",
-  "version": "0.3.116",
+  "version": "0.3.118",
   "description": "TypeScript function runtime for pylon — defines server-side queries, mutations, and actions.",
   "type": "module",
   "main": "src/index.ts",

package/src/runtime.ts

@@ -593,6 +593,25 @@ async function handleCall(msg: CallMessage): Promise<void> {
     tenantId:
       ((rawAuth.tenantId ?? rawAuth.tenant_id) as string | null | undefined) ??
       null,
+    // `elevate` round-trips through the host runtime which mutates
+    // the per-call caller_is_admin flag — that's what subsequent
+    // scheduler.runAfter() reads. We also mutate the local
+    // `auth.isAdmin` so handler code that re-checks `ctx.auth.isAdmin`
+    // after elevation sees the new value (it would otherwise stay
+    // false even though scheduling now works, which is confusing).
+    async elevate(options: { admin: boolean; reason: string }) {
+      await rpc(msg.call_id, {
+        type: "elevate_auth",
+        admin: options.admin,
+        reason: options.reason,
+      });
+      if (options.admin) {
+        // Mutate in-place. AuthInfo isn't frozen and handlers hold a
+        // reference, so the read on the next line of their code
+        // reflects the elevated state.
+        (auth as { isAdmin: boolean }).isAdmin = true;
+      }
+    },
   };
 
   // Env is read-only config — safe to expose on every ctx variant. Without
@@ -712,9 +731,18 @@ async function main() {
     const name = basename(file, file.endsWith(".ts") ? ".ts" : ".js");
     try {
       const mod = await import(join(process.cwd(), fnDir, file));
-      const def = mod.default as FnDefinition;
-      if (def && def.type && def.handler) {
-        registry.set(name, def);
+      const def = mod.default as FnDefinition | undefined;
+      // Runtime shape check — a misnamed/malformed export should
+      // log + skip, not crash the loader. TS narrows `def.handler`
+      // as always-defined because the FnDefinition type says so,
+      // but at runtime we don't know what the user actually exported.
+      const anyDef = def as unknown as Record<string, unknown> | undefined;
+      if (
+        anyDef &&
+        typeof anyDef.type === "string" &&
+        typeof anyDef.handler === "function"
+      ) {
+        registry.set(name, def as FnDefinition);
       }
     } catch (err) {
       console.error(`[functions] Failed to load ${file}:`, err);

package/src/types.ts

@@ -12,6 +12,36 @@ export interface AuthInfo {
   /** Active tenant id (selected organization) for multi-tenant apps.
    *  Null when the session hasn't selected one. */
   tenantId: string | null;
+  /**
+   * Promote the call's auth context after the handler has done its
+   * own authentication check (HMAC signature verification on a
+   * webhook, JWT validation, custom token check). Used by webhook
+   * receivers — they're necessarily public (external systems POST
+   * to them) but want to schedule internal:true workers after
+   * they've proven the request came from a trusted source.
+   *
+   * The framework does NOT verify the developer actually checked
+   * anything before calling this — that's on you. The `reason` is
+   * mandatory and gets logged at INFO with the function name so
+   * every elevation is auditable.
+   *
+   * ```ts
+   * // Github webhook example:
+   * const ok = await verifyGithubSignature(secret, rawBody, sig);
+   * if (!ok) throw ctx.error("INVALID_SIGNATURE", "bad sig");
+   * await ctx.auth.elevate({
+   *   admin: true,
+   *   reason: "github webhook hmac verified",
+   * });
+   * // Now this works — caller_is_admin=true for the gate:
+   * await ctx.scheduler.runAfter(0, "deployProject", { deploymentId });
+   * ```
+   *
+   * After calling `elevate({ admin: true })`, `auth.isAdmin` is also
+   * mutated to true locally so subsequent reads in the same handler
+   * see the new value.
+   */
+  elevate(options: { admin: boolean; reason: string }): Promise<void>;
 }
 
 // ---------------------------------------------------------------------------