Callable Functions

Define server functions that clients can invoke remotely using addCallable. Clients call them via callableFunction(name, data):

Callable definition

addCallable("getUsersCount", async function (data, admin, sessionId) {
  //get all users
  var res = get(["users"])
  //Count how many users
  count = Object.keys(res.data).length
  //return number
  return count
});

Callback Arguments

Your callable receives (data, admin, sessionId):

data - Payload sent by the client (second argument to callableFunction())
admin - The standard auth context object — see Auth Context for the full shape
sessionId - The caller's WebSocket session ID

Return Value

Callables may return synchronously or as a Promise (use async). The return value is delivered to the client as response.data.

A callable runs as root unless you say otherwise. Data and file operations inside it default to admin = "root" and bypass security rules entirely — which is the point of a callable, but it means you are the only thing standing between the caller and the data. Check admin.uid yourself, and pass admin through to any operation you want rule-checked:

addCallable("updateProfile", (data, admin) => {
  if (!admin.uid) return { status: "Failed", message: "Login required" };

  // Runs as root — rules do NOT apply. The check above is the whole gate.
  set(["users", admin.uid, "profile"], data);

  // Or hand the caller through and let rules decide:
  set(["users", data.targetUid, "profile"], data, admin);
});

Errors. A rejected promise from an async callable answers { status: "Failed", action, requestId, message } with the error's message and logs it server-side. A callable name that was never registered answers { status: "Failed", action: "unknown" }. Returning a value is always status: "Success" — if you need to signal a business-logic failure, return your own object and check it on the client.

A WebSocket connection's identity ends with its session. The user is fixed when the socket connects, and the session token it connected with is re-checked on every message and every 30 seconds. Once that token is revoked (/logout) or expires, the server sends { status: "Failed", action: "sessionExpired" } and closes the socket with code 4001; the SDK's reconnect then comes back as whoever the current cookies say — anonymous after a logout.

sessionId identifies the WebSocket connection, not the user. It is stable for the life of one socket and changes on reconnect — including the automatic reconnect after login(). Use admin.uid for identity and sessionId for per-connection state, the same value connection triggers receive.