Upgrade to SDK 0.6 and the new functions rules

Install the new version:

npm install @aurabase/aurabase-js@0.6.0

The release has one security change and several fixes to how errors and responses are reported. The security change is also in the functions service: it applies to your project as soon as the service is updated, whatever SDK version you use.

Management calls now need a service_role key

functions.list(), get(), listJobs(), getJob(), enqueueJob(), listCronJobs(), createCronJob() and deleteCronJob() return 403 to a public key or a signed-in user. Before, list() and get() returned the source code and the variables of every function to anyone holding the public key. See the security model.

const { data } = await aura.functions.list() // worked with the public key

// server/api/functions.ts
const admin = createClient(process.env.AURA_URL!, process.env.AURA_SERVICE_ROLE_KEY!)
export const GET = async () => Response.json((await admin.functions.list()).data?.map((f) => f.name))

Return only what your front end needs (names, for example), never the whole definition.

A body that cannot be JSON is refused

invoke(name, { body: new Blob(…) }), and the same with ArrayBuffer, typed arrays, FormData, URLSearchParams or ReadableStream, now returns the error code invalid_body. Before, the function received {} and no error was reported. Encode binary data (base64) or upload it to Storage and send its path.

A function's own 502, 503 or 504 is a FunctionsHttpError

Before, these statuses were always classed as FunctionsRelayError, even when your code returned them. Now FunctionsRelayError means that the platform failed. If you retried on FunctionsRelayError, check that your retry logic still matches: see errors, timeouts and retries.

FunctionDef is more precise

env_vars is Record<string, string> (it was Record<string, unknown>) and permissions is added. Code that read these fields keeps working; code that assigned values of another type no longer compiles.

New exports: FunctionsHttpError, FunctionsRelayError, isRelayStatus and FunctionsResponseType come from @aurabase/aurabase-js as well as from @aurabase/functions. If you imported them from @aurabase/functions, that keeps working; with pnpm you no longer need that package as a direct dependency.

In @aurabase/auth, the type of email in the result of getClaims() is now string | null, which is what the service returns for a user without an e-mail address.

CLI. aura functions deploy no longer erases the secrets of a function that already exists. aura functions invoke --data refuses invalid JSON instead of sending {}. aura functions download works for Deno functions. aura functions serve listens on the port it announces. aura studio opens the Studio on port 3000.

If your project ran on a service version that predates this change, any holder of your public key could read the code and the variables of your functions. Assume they were read:

1. List your functions with a service_role key and open each one's variables.
2. Rotate every secret they contain: payment keys, webhook secrets, third-party tokens.
3. Remove secrets that were written directly in index.ts and move them to variables.
4. Check the jobs and alert rules of the project for entries you did not create.

• Search your code for functions.list(, functions.get(, listJobs(, getJob(, enqueueJob(, createCronJob(, deleteCronJob( and listCronJobs( in code that runs in a browser or with a public key.
• Search for body: values that are not plain JSON.
• Check retry logic that depends on FunctionsRelayError.
• Rotate the secrets as described above.
• Update the CLI.