Callable Functions

Define server functions that clients can invoke remotely using addCallable. Clients call them via callableFunction(name, data):

Callable definition

addCallable("getUsersCount", async function (data, admin, sessionId) {
  //get all users
  var res = get(["users"])
  //Count how many users
  count = Object.keys(res.data).length
  //return number
  return count
});

Callback Arguments

Your callable receives (data, admin, sessionId):

data - Payload sent by the client (second argument to callableFunction())
admin - The standard auth context object — see Auth Context for the full shape
sessionId - The caller's WebSocket session ID

Return Value

Callables may return synchronously or as a Promise (use async). The return value is delivered to the client as response.data.

A callable runs as root unless you say otherwise. Data and file operations inside it default to admin = "root" and bypass security rules entirely — which is the point of a callable, but it means you are the only thing standing between the caller and the data. Check admin.uid yourself, and pass admin through to any operation you want rule-checked:

addCallable("updateProfile", (data, admin) => {
  if (!admin.uid) return { status: "Failed", message: "Login required" };

  // Runs as root — rules do NOT apply. The check above is the whole gate.
  set(["users", admin.uid, "profile"], data);

  // Or hand the caller through and let rules decide:
  set(["users", data.targetUid, "profile"], data, admin);
});

Errors. A rejected promise from an async callable answers { status: "Failed", action, requestId, message } with the error's message and logs it server-side. A callable name that was never registered answers { status: "Failed", action: "unknown" }. Returning a value is always status: "Success" — if you need to signal a business-logic failure, return your own object and check it on the client.

sessionId identifies the WebSocket connection, not the user. It is stable for the life of one socket and changes on reconnect — including the automatic reconnect after login(). Use admin.uid for identity and sessionId for per-connection state, the same value connection triggers receive.