diff --git a/spec/supabase_js_v1_legacy.yml b/spec/supabase_js_v1_legacy.yml index 785be77887c..c021d01134f 100644 --- a/spec/supabase_js_v1_legacy.yml +++ b/spec/supabase_js_v1_legacy.yml @@ -934,10 +934,8 @@ pages: rpc(): title: 'Postgres functions: rpc()' description: | - You can call Postgres functions as a "Remote Procedure Call". - - That's a fancy way of saying that you can put some logic into your database then call it from anywhere. - It's especially useful when the logic rarely changes - like password resets and updates. + You can call Postgres functions as _Remote Procedure Calls_, logic in your database that you can execute from anywhere. + Functions are useful when the logic rarely changes—like for password resets and updates. ```sql create or replace function hello_world() returns text as $$ @@ -945,16 +943,26 @@ pages: $$ language sql; ``` $ref: '@supabase/postgrest-js.PostgrestClient.rpc' + notes: | + By default, functions can be executed by any role. + You can restrict this by altering the default prvivileges and then choosing which roles can execute functions. + + ```sql + ALTER DEFAULT PRIVILEGES REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC; + + -- Choose which roles can execute functions + GRANT EXECUTE ON FUNCTION hello_world TO authenticated; + GRANT EXECUTE ON FUNCTION hello_world TO service_role; + ``` examples: - - name: Call a Postgres function + - name: Call a Postgres function without arguments isSpotlight: true - description: This is an example of invoking a Postgres function with no parameters. js: | ```js const { data, error } = await supabase .rpc('hello_world') ``` - - name: With Parameters + - name: Call a Postgres function with arguments js: | ```js const { data, error } = await supabase @@ -967,7 +975,7 @@ pages: const { data, error } = await postgrest .rpc('echo_cities', { names: ['The Shire', 'Mordor'] }) ``` - - name: With filters + - name: Call a Postgres function with filters description: | Postgres functions that return tables can also be combined with [Modifiers](/docs/reference/javascript/using-modifiers) and @@ -979,7 +987,7 @@ pages: .select('name, population') .eq('name', 'The Shire') ``` - - name: With count option + - name: Call a Postgres function with a count option description: | You can specify a count option to get the row count along with your data. Allowed values for count option are `null`, `exact`, `planned` and `estimated`. @@ -989,20 +997,6 @@ pages: .rpc('hello_world', {}, { count: 'exact' }) ``` - privileges: - description: | - By default, functions can be executed by any role. You can restrict this by - sql: | - ```sql - ALTER DEFAULT PRIVILEGES REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC; - ``` - Then, you can choose which roles can execute functions - sql: | - ```sql - GRANT EXECUTE ON FUNCTION hello_world TO authenticated; - GRANT EXECUTE ON FUNCTION hello_world TO service_role; - ``` - subscribe(): title: 'on().subscribe()' $ref: '@supabase/supabase-js.lib/SupabaseQueryBuilder.SupabaseQueryBuilder.on' diff --git a/spec/supabase_js_v2_legacy.yml b/spec/supabase_js_v2_legacy.yml index aeeed1d11c1..455e15f86c6 100644 --- a/spec/supabase_js_v2_legacy.yml +++ b/spec/supabase_js_v2_legacy.yml @@ -1838,10 +1838,8 @@ pages: rpc(): title: 'Postgres functions: rpc()' description: | - You can call Postgres functions as a "Remote Procedure Call". - - That's a fancy way of saying that you can put some logic into your database then call it from anywhere. - It's especially useful when the logic rarely changes - like password resets and updates. + You can call Postgres functions as _Remote Procedure Calls_, logic in your database that you can execute from anywhere. + Functions are useful when the logic rarely changes—like for password resets and updates. ```sql create or replace function hello_world() returns text as $$ @@ -1849,6 +1847,17 @@ pages: $$ language sql; ``` $ref: '@supabase/postgrest-js.PostgrestClient.rpc' + notes: | + By default, functions can be executed by any role. + You can restrict this by altering the default prvivileges and then choosing which roles can execute functions. + + ```sql + ALTER DEFAULT PRIVILEGES REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC; + + -- Choose which roles can execute functions + GRANT EXECUTE ON FUNCTION hello_world TO authenticated; + GRANT EXECUTE ON FUNCTION hello_world TO service_role; + ``` examples: - name: Call a Postgres function without arguments description: |