insforge 1.3.0 → 1.4.8

package/backend/src/api/routes/auth/index.routes.ts

@@ -10,11 +10,7 @@ import { successResponse } from '@/utils/response.js';
 import { AuthRequest, verifyAdmin, verifyToken } from '@/api/middlewares/auth.js';
 import oauthRouter from './oauth.routes.js';
 import { sendEmailOTPLimiter, verifyOTPLimiter } from '@/api/middlewares/rate-limiters.js';
-import {
-  REFRESH_TOKEN_COOKIE_NAME,
-  setAuthCookie,
-  clearAuthCookie,
-} from '@/utils/cookies.js';
+import { REFRESH_TOKEN_COOKIE_NAME, setAuthCookie, clearAuthCookie } from '@/utils/cookies.js';
 import {
   userIdSchema,
   createUserRequestSchema,
@@ -27,6 +23,7 @@ import {
   sendResetPasswordEmailRequestSchema,
   exchangeResetPasswordTokenRequestSchema,
   resetPasswordRequestSchema,
+  updateProfileRequestSchema,
   type CreateUserResponse,
   type CreateSessionResponse,
   type VerifyEmailResponse,
@@ -34,6 +31,7 @@ import {
   type ResetPasswordResponse,
   type CreateAdminSessionResponse,
   type GetCurrentSessionResponse,
+  type GetProfileResponse,
   type ListUsersResponse,
   type DeleteUsersResponse,
   type GetPublicAuthConfigResponse,
@@ -74,6 +72,60 @@ router.get('/public-config', async (req: Request, res: Response, next: NextFunct
   }
 });
 
+// PATCH /api/auth/profiles/current - Update current user's profile (authenticated)
+router.patch(
+  '/profiles/current',
+  verifyToken,
+  async (req: AuthRequest, res: Response, next: NextFunction) => {
+    try {
+      if (!req.user) {
+        throw new AppError('User not authenticated', 401, ERROR_CODES.AUTH_INVALID_CREDENTIALS);
+      }
+
+      const validationResult = updateProfileRequestSchema.safeParse(req.body);
+      if (!validationResult.success) {
+        throw new AppError(
+          validationResult.error.issues.map((e) => `${e.path.join('.')}: ${e.message}`).join(', '),
+          400,
+          ERROR_CODES.INVALID_INPUT
+        );
+      }
+
+      const { profile } = validationResult.data;
+      const result = await authService.updateProfile(req.user.id, profile);
+
+      const response: GetProfileResponse = result;
+
+      successResponse(res, response);
+    } catch (error) {
+      next(error);
+    }
+  }
+);
+
+// GET /api/auth/profiles/:userId - Get user profile by ID (public endpoint)
+router.get('/profiles/:userId', async (req: Request, res: Response, next: NextFunction) => {
+  try {
+    const userIdValidation = userIdSchema.safeParse(req.params.userId);
+    if (!userIdValidation.success) {
+      throw new AppError('Invalid user ID format', 400, ERROR_CODES.INVALID_INPUT);
+    }
+
+    const userId = userIdValidation.data;
+    const userProfile = await authService.getProfileById(userId);
+
+    if (!userProfile) {
+      throw new AppError('User not found', 404, ERROR_CODES.NOT_FOUND);
+    }
+
+    const response: GetProfileResponse = userProfile;
+
+    successResponse(res, response);
+  } catch (error) {
+    next(error);
+  }
+});
+
 // Email Authentication Configuration Routes
 // GET /api/auth/config - Get authentication configurations (admin only)
 router.get('/config', verifyAdmin, async (req: AuthRequest, res: Response, next: NextFunction) => {
@@ -128,16 +180,15 @@ router.post('/users', async (req: Request, res: Response, next: NextFunction) =>
       );
     }
 
-    const { email, password, name } = validationResult.data;
-    const result: CreateUserResponse = await authService.register(email, password, name);
+    const { email, password, name, options } = validationResult.data;
+    const result: CreateUserResponse = await authService.register(email, password, name, options);
 
     // Set refresh token in httpOnly cookie and generate CSRF token
-    let csrfToken: string | null = null;
     if (result.accessToken && result.user) {
       const tokenManager = TokenManager.getInstance();
       const refreshToken = tokenManager.generateRefreshToken(result.user.id);
-      setAuthCookie(res, REFRESH_TOKEN_COOKIE_NAME, refreshToken);
-      csrfToken = tokenManager.generateCsrfToken(refreshToken);
+      setAuthCookie(req, res, REFRESH_TOKEN_COOKIE_NAME, refreshToken);
+      result.csrfToken = tokenManager.generateCsrfToken(refreshToken);
     }
 
     const socket = SocketManager.getInstance();
@@ -148,7 +199,7 @@ router.post('/users', async (req: Request, res: Response, next: NextFunction) =>
       'system'
     );
 
-    successResponse(res, { ...result, csrfToken });
+    successResponse(res, result);
   } catch (error) {
     next(error);
   }
@@ -172,10 +223,10 @@ router.post('/sessions', async (req: Request, res: Response, next: NextFunction)
     // Set refresh token in httpOnly cookie and generate CSRF token
     const tokenManager = TokenManager.getInstance();
     const refreshToken = tokenManager.generateRefreshToken(result.user.id);
-    setAuthCookie(res, REFRESH_TOKEN_COOKIE_NAME, refreshToken);
-    const csrfToken = tokenManager.generateCsrfToken(refreshToken);
+    setAuthCookie(req, res, REFRESH_TOKEN_COOKIE_NAME, refreshToken);
+    result.csrfToken = tokenManager.generateCsrfToken(refreshToken);
 
-    successResponse(res, { ...result, csrfToken });
+    successResponse(res, result);
   } catch (error) {
     next(error);
   }
@@ -206,7 +257,7 @@ router.post('/refresh', async (req: Request, res: Response, next: NextFunction)
 
     if (!user) {
       logger.warn('[Auth:Refresh] User not found for valid refresh token', { userId: payload.sub });
-      clearAuthCookie(res, REFRESH_TOKEN_COOKIE_NAME);
+      clearAuthCookie(req, res, REFRESH_TOKEN_COOKIE_NAME);
       throw new AppError('User not found', 401, ERROR_CODES.AUTH_UNAUTHORIZED);
     }
 
@@ -220,7 +271,7 @@ router.post('/refresh', async (req: Request, res: Response, next: NextFunction)
     // Generate new refresh token (token rotation for security)
     const newRefreshToken = tokenManager.generateRefreshToken(user.id);
 
-    setAuthCookie(res, REFRESH_TOKEN_COOKIE_NAME, newRefreshToken);
+    setAuthCookie(req, res, REFRESH_TOKEN_COOKIE_NAME, newRefreshToken);
     const newCsrfToken = tokenManager.generateCsrfToken(newRefreshToken);
 
     successResponse(res, {
@@ -230,15 +281,15 @@ router.post('/refresh', async (req: Request, res: Response, next: NextFunction)
     });
   } catch (error) {
     // Clear invalid cookie on error
-    clearAuthCookie(res, REFRESH_TOKEN_COOKIE_NAME);
+    clearAuthCookie(req, res, REFRESH_TOKEN_COOKIE_NAME);
     next(error);
   }
 });
 
 // POST /api/auth/logout - Logout and clear refresh token cookie
-router.post('/logout', (_req: Request, res: Response, next: NextFunction) => {
+router.post('/logout', (req: Request, res: Response, next: NextFunction) => {
   try {
-    clearAuthCookie(res, REFRESH_TOKEN_COOKIE_NAME);
+    clearAuthCookie(req, res, REFRESH_TOKEN_COOKIE_NAME);
 
     successResponse(res, {
       success: true,
@@ -307,18 +358,19 @@ router.post('/admin/sessions', (req: Request, res: Response, next: NextFunction)
 router.get(
   '/sessions/current',
   verifyToken,
-  (req: AuthRequest, res: Response, next: NextFunction) => {
+  async (req: AuthRequest, res: Response, next: NextFunction) => {
     try {
       if (!req.user) {
         throw new AppError('User not authenticated', 401, ERROR_CODES.AUTH_INVALID_CREDENTIALS);
       }
 
+      const user = await authService.getUserSchemaById(req.user.id);
+      if (!user) {
+        throw new AppError('User not found', 401, ERROR_CODES.AUTH_INVALID_CREDENTIALS);
+      }
+
       const response: GetCurrentSessionResponse = {
-        user: {
-          id: req.user.id,
-          email: req.user.email,
-          role: req.user.role as 'authenticated' | 'project_admin',
-        },
+        user,
       };
 
       successResponse(res, response);
@@ -359,7 +411,7 @@ router.get('/users', verifyAdmin, async (req: Request, res: Response, next: Next
   }
 });
 
-// GET /api/auth/users/:id - Get specific user (admin only)
+// GET /api/auth/users/:userId - Get specific user (admin only)
 router.get(
   '/users/:userId',
   verifyAdmin,
@@ -375,7 +427,7 @@ router.get(
       const user = await authService.getUserSchemaById(userId);
 
       if (!user) {
-        throw new AppError('User not found', 404, ERROR_CODES.NOT_FOUND);
+        throw new AppError('User does not exist', 404, ERROR_CODES.NOT_FOUND);
       }
 
       successResponse(res, user);
@@ -458,7 +510,7 @@ router.post(
         );
       }
 
-      const { email } = validationResult.data;
+      const { email, options } = validationResult.data;
 
       // Get auth config to determine verification method
       const authConfig = await authConfigService.getAuthConfig();
@@ -467,7 +519,8 @@ router.post(
       // Note: User enumeration is prevented at service layer
       // Service returns gracefully (no error) if user not found
       if (method === 'link') {
-        await authService.sendVerificationEmailWithLink(email);
+        const redirectTo = authConfig.signInRedirectTo || options?.emailRedirectTo;
+        await authService.sendVerificationEmailWithLink(email, redirectTo);
       } else {
         await authService.sendVerificationEmailWithCode(email);
       }
@@ -536,9 +589,9 @@ router.post(
       // Set refresh token in httpOnly cookie and generate CSRF token
       const tokenManager = TokenManager.getInstance();
       const refreshToken = tokenManager.generateRefreshToken(result.user.id);
-      setAuthCookie(res, REFRESH_TOKEN_COOKIE_NAME, refreshToken);
-      const csrfToken = tokenManager.generateCsrfToken(refreshToken);
-      successResponse(res, { ...result, csrfToken });
+      setAuthCookie(req, res, REFRESH_TOKEN_COOKIE_NAME, refreshToken);
+      result.csrfToken = tokenManager.generateCsrfToken(refreshToken);
+      successResponse(res, result);
     } catch (error) {
       next(error);
     }

package/backend/src/api/routes/auth/oauth.routes.ts

@@ -1,6 +1,7 @@
 import { Router, Request, Response, NextFunction } from 'express';
 import { AuthService } from '@/services/auth/auth.service.js';
 import { OAuthConfigService } from '@/services/auth/oauth-config.service.js';
+import { AuthConfigService } from '@/services/auth/auth-config.service.js';
 import { AuditService } from '@/services/logs/audit.service.js';
 import { TokenManager } from '@/infra/security/token.manager.js';
 import { AppError } from '@/api/middlewares/error.js';
@@ -20,6 +21,7 @@ import { isOAuthSharedKeysAvailable } from '@/utils/environment.js';
 
 const router = Router();
 const authService = AuthService.getInstance();
+const authConfigService = AuthConfigService.getInstance();
 const oAuthConfigService = OAuthConfigService.getInstance();
 const auditService = AuditService.getInstance();
 
@@ -246,14 +248,17 @@ router.get('/:provider', async (req: Request, res: Response, next: NextFunction)
     }
 
     const validatedProvider = providerValidation.data;
+    const authConfig = await authConfigService.getAuthConfig();
 
-    if (!redirect_uri) {
+    const redirectUri = authConfig.signInRedirectTo || redirect_uri;
+
+    if (!redirectUri) {
       throw new AppError('Redirect URI is required', 400, ERROR_CODES.INVALID_INPUT);
     }
 
     const jwtPayload = {
       provider: validatedProvider,
-      redirectUri: redirect_uri ? (redirect_uri as string) : undefined,
+      redirectUri,
       createdAt: Date.now(),
     };
     const jwtSecret = validateJwtSecret();
@@ -346,7 +351,7 @@ router.get('/shared/callback/:state', async (req: Request, res: Response, next:
     // Set refresh token in httpOnly cookie and generate CSRF token
     const tokenManager = TokenManager.getInstance();
     const refreshToken = tokenManager.generateRefreshToken(result.user.id);
-    setAuthCookie(res, REFRESH_TOKEN_COOKIE_NAME, refreshToken);
+    setAuthCookie(req, res, REFRESH_TOKEN_COOKIE_NAME, refreshToken);
     const csrfToken = tokenManager.generateCsrfToken(refreshToken);
 
     const params = new URLSearchParams();
@@ -354,7 +359,7 @@ router.get('/shared/callback/:state', async (req: Request, res: Response, next:
     params.set('access_token', result.accessToken);
     params.set('user_id', result.user.id);
     params.set('email', result.user.email);
-    params.set('name', result.user.name);
+    params.set('name', String(result?.user?.profile?.name));
     params.set('csrf_token', csrfToken);
 
     res.redirect(`${redirectUri}?${params.toString()}`);
@@ -425,7 +430,7 @@ const handleOAuthCallback = async (req: Request, res: Response, next: NextFuncti
       // Set refresh token in httpOnly cookie and generate CSRF token
       const tokenManager = TokenManager.getInstance();
       const refreshToken = tokenManager.generateRefreshToken(result.user.id);
-      setAuthCookie(res, REFRESH_TOKEN_COOKIE_NAME, refreshToken);
+      setAuthCookie(req, res, REFRESH_TOKEN_COOKIE_NAME, refreshToken);
       const csrfToken = tokenManager.generateCsrfToken(refreshToken);
 
       // Construct redirect URL with query parameters
@@ -434,7 +439,7 @@ const handleOAuthCallback = async (req: Request, res: Response, next: NextFuncti
       params.set('access_token', result.accessToken);
       params.set('user_id', result.user.id);
       params.set('email', result.user.email);
-      params.set('name', result.user.name);
+      params.set('name', String(result?.user?.profile?.name));
       params.set('csrf_token', csrfToken);
 
       const finalRedirectUri = `${redirectUri}?${params.toString()}`;

package/backend/src/api/routes/database/index.routes.ts

@@ -1,6 +1,7 @@
 import { Router, Response, NextFunction } from 'express';
 import { databaseTablesRouter } from './tables.routes.js';
 import { databaseRecordsRouter } from './records.routes.js';
+import { databaseRpcRouter } from './rpc.routes.js';
 import databaseAdvanceRouter from './advance.routes.js';
 import { DatabaseService } from '@/services/database/database.service.js';
 import { verifyAdmin, AuthRequest } from '@/api/middlewares/auth.js';
@@ -13,6 +14,7 @@ const databaseService = DatabaseService.getInstance();
 // Mount database sub-routes
 router.use('/tables', databaseTablesRouter);
 router.use('/records', databaseRecordsRouter);
+router.use('/rpc', databaseRpcRouter);
 router.use('/advance', databaseAdvanceRouter);
 
 /**

package/backend/src/api/routes/database/records.routes.ts

@@ -1,80 +1,41 @@
 import { Router, Response, NextFunction } from 'express';
 import axios from 'axios';
-import http from 'http';
-import https from 'https';
 import { AuthRequest, extractApiKey } from '@/api/middlewares/auth.js';
 import { DatabaseManager } from '@/infra/database/database.manager.js';
-import { TokenManager } from '@/infra/security/token.manager.js';
 import { AppError } from '@/api/middlewares/error.js';
 import { ERROR_CODES } from '@/types/error-constants.js';
 import { validateTableName } from '@/utils/validations.js';
 import { DatabaseRecord } from '@/types/database.js';
 import { successResponse } from '@/utils/response.js';
-import logger from '@/utils/logger.js';
-import { SecretService } from '@/services/secrets/secret.service.js';
 import { SocketManager } from '@/infra/socket/socket.manager.js';
 import { DataUpdateResourceType, ServerEvents } from '@/types/socket.js';
 import { DatabaseResourceUpdate } from '@/utils/sql-parser.js';
+import { PostgrestProxyService } from '@/services/database/postgrest-proxy.service.js';
 
 const router = Router();
-const secretService = SecretService.getInstance();
-const postgrestUrl = process.env.POSTGREST_BASE_URL || 'http://localhost:5430';
+const proxyService = PostgrestProxyService.getInstance();
 
-// Create a dedicated HTTP agent with connection pooling for PostgREST
-// Optimized connection pool for Docker network communication
-const httpAgent = new http.Agent({
-  keepAlive: true,
-  keepAliveMsecs: 5000, // Shorter for Docker network
-  maxSockets: 20, // Reduced for stability
-  maxFreeSockets: 5,
-  timeout: 10000, // Match axios timeout
-});
-
-const httpsAgent = new https.Agent({
-  keepAlive: true,
-  keepAliveMsecs: 5000,
-  maxSockets: 20,
-  maxFreeSockets: 5,
-  timeout: 10000,
-});
-
-// Create axios instance with optimized configuration for PostgREST
-const postgrestAxios = axios.create({
-  httpAgent,
-  httpsAgent,
-  timeout: 10000, // Increased timeout for stability
-  maxRedirects: 0,
-  // Additional connection stability options
-  headers: {
-    Connection: 'keep-alive',
-    'Keep-Alive': 'timeout=5, max=10',
-  },
-});
-
-// Generate admin token once and reuse
-// If user request with api key, this token should be added automatically.
-const tokenManager = TokenManager.getInstance();
-const adminToken = tokenManager.generateAdminToken();
-
-// anonymous users can access the database, postgREST does not require authentication, however we seed to unwrap session token for better auth, thus
-// we need to verify user token below.
-// router.use(verifyUserOrApiKey);
+/**
+ * Helper to handle PostgREST proxy errors
+ */
+function handleProxyError(error: unknown, res: Response, next: NextFunction) {
+  if (axios.isAxiosError(error) && error.response) {
+    res.status(error.response.status).json(error.response.data);
+  } else {
+    next(error);
+  }
+}
 
 /**
- * Forward database requests to PostgREST
+ * Forward database table requests to PostgREST
  */
 const forwardToPostgrest = async (req: AuthRequest, res: Response, next: NextFunction) => {
   const { tableName } = req.params;
   const wildcardPath = req.params[0] || '';
-
-  // Build the target URL early so it's available in error handling
-  const targetPath = wildcardPath ? `/${tableName}/${wildcardPath}` : `/${tableName}`;
-  const targetUrl = `${postgrestUrl}${targetPath}`;
+  const path = wildcardPath ? `/${tableName}/${wildcardPath}` : `/${tableName}`;
 
   try {
-    // Validate table name with operation type
-    const method = req.method.toUpperCase();
-
+    // Validate table name
     try {
       validateTableName(tableName);
     } catch (error) {
@@ -84,11 +45,14 @@ const forwardToPostgrest = async (req: AuthRequest, res: Response, next: NextFun
       throw new AppError('Invalid table name', 400, ERROR_CODES.INVALID_INPUT);
     }
 
-    // Process request body for POST/PATCH/PUT operations
-    if (['POST', 'PATCH', 'PUT'].includes(method) && req.body && typeof req.body === 'object') {
+    // Process request body for POST/PATCH/PUT (filter empty values based on column types)
+    const method = req.method.toUpperCase();
+    let body = req.body;
+
+    if (['POST', 'PATCH', 'PUT'].includes(method) && body && typeof body === 'object') {
       const columnTypeMap = await DatabaseManager.getColumnTypeMap(tableName);
-      if (Array.isArray(req.body)) {
-        req.body = req.body.map((item) => {
+      if (Array.isArray(body)) {
+        body = body.map((item) => {
           if (item && typeof item === 'object') {
             const filtered: DatabaseRecord = {};
             for (const key in item) {
@@ -102,7 +66,6 @@ const forwardToPostgrest = async (req: AuthRequest, res: Response, next: NextFun
           return item;
         });
       } else {
-        const body = req.body as DatabaseRecord;
         for (const key in body) {
           if (columnTypeMap[key] === 'uuid' && body[key] === '') {
             delete body[key];
@@ -111,100 +74,31 @@ const forwardToPostgrest = async (req: AuthRequest, res: Response, next: NextFun
       }
     }
 
-    // Forward the request
-    const axiosConfig: {
-      method: string;
-      url: string;
-      params: unknown;
-      headers: Record<string, string | string[] | undefined>;
-      data?: unknown;
-    } = {
+    // Forward to PostgREST via service
+    const result = await proxyService.forward({
       method: req.method,
-      url: targetUrl,
-      params: req.query,
-      headers: {
-        ...req.headers,
-        host: undefined, // Remove host header
-        'content-length': undefined, // Let axios calculate
-      },
-    };
-
-    // Check for API key using shared logic
-    const apiKey = extractApiKey(req);
-
-    // If we have an API key, verify it and use admin token for PostgREST
-    if (apiKey) {
-      const isValid = await secretService.verifyApiKey(apiKey);
-      if (isValid) {
-        axiosConfig.headers.authorization = `Bearer ${adminToken}`;
-      }
-    }
-
-    // Add body for methods that support it
-    if (['POST', 'PUT', 'PATCH'].includes(req.method)) {
-      axiosConfig.data = req.body;
-    }
-
-    // Enhanced retry logic with improved error handling
-    let response;
-    let lastError;
-    const maxRetries = 3; // Increased retries for connection resets
-
-    for (let attempt = 1; attempt <= maxRetries; attempt++) {
-      try {
-        response = await postgrestAxios(axiosConfig);
-        break; // Success, exit retry loop
-      } catch (error) {
-        lastError = error;
-
-        // Retry on network errors (ECONNRESET, ECONNREFUSED, timeout) but not HTTP errors
-        const shouldRetry = axios.isAxiosError(error) && !error.response && attempt < maxRetries;
-
-        if (shouldRetry) {
-          logger.warn(`PostgREST request failed, retrying (attempt ${attempt}/${maxRetries})`, {
-            url: targetUrl,
-            errorCode: error.code,
-            message: error.message,
-          });
-
-          // Enhanced exponential backoff: 200ms, 500ms, 1000ms
-          const backoffDelay = Math.min(200 * Math.pow(2.5, attempt - 1), 1000);
-          await new Promise((resolve) => setTimeout(resolve, backoffDelay));
-        } else {
-          throw error; // Don't retry on HTTP errors or last attempt
-        }
-      }
-    }
-
-    if (!response) {
-      throw lastError || new Error('Failed to get response from PostgREST');
-    }
+      path,
+      query: req.query as Record<string, unknown>,
+      headers: req.headers as Record<string, string | string[] | undefined>,
+      body: ['POST', 'PUT', 'PATCH'].includes(req.method) ? body : undefined,
+      apiKey: extractApiKey(req) ?? undefined,
+    });
 
     // Forward response headers
-    Object.entries(response.headers).forEach(([key, value]) => {
-      const keyLower = key.toLowerCase();
-      if (
-        keyLower !== 'content-length' &&
-        keyLower !== 'transfer-encoding' &&
-        keyLower !== 'connection' &&
-        keyLower !== 'content-encoding'
-      ) {
-        res.setHeader(key, value);
-      }
-    });
+    const headers = PostgrestProxyService.filterHeaders(result.headers);
+    Object.entries(headers).forEach(([key, value]) => res.setHeader(key, value));
 
     // Handle empty responses
-    let responseData = response.data;
+    let responseData = result.data;
     if (
-      response.data === undefined ||
-      (typeof response.data === 'string' && response.data.trim() === '')
+      result.data === undefined ||
+      (typeof result.data === 'string' && result.data.trim() === '')
     ) {
       responseData = [];
     }
 
-    // Only send socket events for mutations (POST, DELETE)
-    const mutationMethods = ['POST', 'DELETE'];
-    if (mutationMethods.includes(req.method.toUpperCase())) {
+    // Broadcast socket events for mutations
+    if (['POST', 'DELETE'].includes(method)) {
       const socket = SocketManager.getInstance();
       socket.broadcastToRoom(
         'role:project_admin',
@@ -217,39 +111,9 @@ const forwardToPostgrest = async (req: AuthRequest, res: Response, next: NextFun
       );
     }
 
-    successResponse(res, responseData, response.status);
+    successResponse(res, responseData, result.status);
   } catch (error) {
-    if (axios.isAxiosError(error)) {
-      // Log more detailed error information
-      logger.error('PostgREST request failed', {
-        url: targetUrl,
-        method: req.method,
-        error: {
-          code: error.code,
-          message: error.message,
-          response: error.response?.data,
-          responseStatus: error.response?.status,
-        },
-      });
-
-      // Forward PostgREST errors
-      if (error.response) {
-        res.status(error.response.status).json(error.response.data);
-      } else {
-        // Network error - connection refused, DNS failure, etc.
-        const errorMessage =
-          error.code === 'ECONNREFUSED'
-            ? 'PostgREST connection refused'
-            : error.code === 'ENOTFOUND'
-              ? 'PostgREST service not found'
-              : 'Database service unavailable';
-
-        next(new AppError(errorMessage, 503, ERROR_CODES.INTERNAL_ERROR));
-      }
-    } else {
-      logger.error('Unexpected error in database route', { error });
-      next(error);
-    }
+    handleProxyError(error, res, next);
   }
 };
 

package/backend/src/api/routes/database/rpc.routes.ts

@@ -0,0 +1,69 @@
+import { Router, Response, NextFunction } from 'express';
+import axios from 'axios';
+import { AuthRequest, extractApiKey } from '@/api/middlewares/auth.js';
+import { AppError } from '@/api/middlewares/error.js';
+import { ERROR_CODES } from '@/types/error-constants.js';
+import { validateFunctionName } from '@/utils/validations.js';
+import { successResponse } from '@/utils/response.js';
+import { PostgrestProxyService } from '@/services/database/postgrest-proxy.service.js';
+
+const router = Router();
+const proxyService = PostgrestProxyService.getInstance();
+
+/**
+ * Helper to handle PostgREST proxy errors
+ */
+function handleProxyError(error: unknown, res: Response, next: NextFunction) {
+  if (axios.isAxiosError(error) && error.response) {
+    res.status(error.response.status).json(error.response.data);
+  } else {
+    next(error);
+  }
+}
+
+/**
+ * Forward RPC calls to PostgREST
+ */
+const forwardRpcToPostgrest = async (req: AuthRequest, res: Response, next: NextFunction) => {
+  const { functionName } = req.params;
+
+  try {
+    // Validate function name
+    try {
+      validateFunctionName(functionName);
+    } catch (error) {
+      if (error instanceof AppError) {
+        throw error;
+      }
+      throw new AppError(`Invalid function name: ${functionName}`, 400, ERROR_CODES.INVALID_INPUT);
+    }
+
+    const result = await proxyService.forward({
+      method: req.method,
+      path: `/rpc/${functionName}`,
+      query: req.query as Record<string, unknown>,
+      headers: req.headers as Record<string, string | string[] | undefined>,
+      body: req.body,
+      apiKey: extractApiKey(req) ?? undefined,
+    });
+
+    const headers = PostgrestProxyService.filterHeaders(result.headers);
+    Object.entries(headers).forEach(([key, value]) => res.setHeader(key, value));
+
+    let responseData = result.data;
+    if (
+      result.data === undefined ||
+      (typeof result.data === 'string' && result.data.trim() === '')
+    ) {
+      responseData = null;
+    }
+
+    successResponse(res, responseData, result.status);
+  } catch (error) {
+    handleProxyError(error, res, next);
+  }
+};
+
+router.all('/:functionName', forwardRpcToPostgrest);
+
+export { router as databaseRpcRouter };