mirror of
https://github.com/clockworklabs/SpacetimeDB.git
synced 2026-07-29 05:16:17 -04:00
21b5af0610
## Summary All `/v1/database` routes go through `anon_auth_middleware`, which allocates a new anonymous identity when no `Authorization` header is provided. The docs previously marked many endpoints as requiring auth (`Required Headers`) when they actually accept anonymous requests. ## Code audit Traced through `anon_auth_middleware` in `crates/client-api/src/auth.rs` and each route handler in `crates/client-api/src/routes/database.rs`: | Route | Old docs | Actual behavior | New docs | |---|---|---|---| | `POST /v1/database` (publish) | Required | Optional (anon creates new DB) | Optional + explanation | | `PUT /v1/database/:id` (publish) | Required | Optional (ownership checked) | Optional + explanation | | `GET /v1/database/:id` (info) | No auth section | No auth used | Unchanged | | `DELETE /v1/database/:id` | Required | Optional (ownership checked) | Optional + explanation | | `GET .../names` | No auth section | No auth used | Unchanged | | `POST .../names` | Required | Optional (TLD ownership checked) | Optional + explanation | | `PUT .../names` | Required | Optional (ownership checked) | Optional + explanation | | `GET .../identity` | No auth section | No auth used | Unchanged | | `GET .../subscribe` (WS) | Optional | Optional | Unchanged (already correct) | | `POST .../call/:reducer` | Required | Optional (identity passed to reducer) | Optional + explanation | | `GET .../schema` | No auth section | No permission check | Added Optional section | | `GET .../logs` | Required | Optional (ownership checked) | Optional + explanation | | `POST .../sql` | Required | Optional (RLS enforces access) | Optional + explanation | Routes that genuinely require auth (`POST /v1/identity/websocket-token`, `GET /v1/identity/:id/verify`) use `SpacetimeAuthRequired` and are unchanged. ## Changes - `authorization.md`: Added paragraph explaining anonymous access for all `/v1/database` endpoints - `database.md`: Changed `Required Headers` to `Optional Headers` for 8 endpoints, with per-endpoint explanations of anonymous behavior - `database.md`: Added new `Optional Headers` section to `/schema` endpoint (previously undocumented) --------- Signed-off-by: Zeke Foppa <[email protected]> Co-authored-by: clockwork-labs-bot <[email protected]> Co-authored-by: Zeke Foppa <[email protected]>