Functions

Changed in 1.36

Rayfin functions are server-side TypeScript user-defined functions (UDFs) authored with @microsoft/fabric-user-data-functions, run in the Fabric runtime, and invoked from your frontend through RayfinClient. Use them for trusted backend logic, secrets, and external resource calls that must not run in the browser.

Use a function for trusted server work

Use a function when code needs a server boundary:

• Secrets and API keys — read values with ctx.Secrets, never from client code.
• Business logic users must not edit — enforce rules that a browser client could bypass.
• Server-side validation — validate before writing data or calling external services.
• Aggregation and transformation — combine data before returning it to the frontend.
• External resources — call Fabric SQL, OneLake, Fabric REST, Azure AI Foundry, or Azure DevOps with server-side tokens.

For normal reads and writes against your Rayfin entities, call client.data.<Entity> from the frontend instead of adding a function hop.

Enable and scaffold functions

Run functions init from an existing Rayfin project:

npx rayfin functions init

The command creates the functions package, enables the service in rayfin/rayfin.yml, installs dependencies, builds, and generates the initial types.ts schema.

services:
  functions:
    enabled: true
    path: rayfin/functions
    auth:
      type: application
    buildCommand: npm run build

auth.type: application is required when Functions are enabled. New 1.36 scaffolds write it automatically; existing apps must add it explicitly and run a full npx rayfin up to apply the remote setting. Standalone commands such as npx rayfin up functions deploy upload code but do not migrate the remote auth mode.

Understand the two identities

Deployed functions use two authentication paths:

Grant external resources to the app identity. Declaring an audience or deploying the function does not grant SQL, Storage, Fabric REST, Azure AI, or Azure DevOps permissions.

Project structure

rayfin/
  data/
  functions/
    src/
      function_app.ts
      types.ts
      secrets.generated.ts
    host.json
    local.settings.json
    package.json
    tsconfig.json

• function_app.ts registers handlers with udf.func(...).
• types.ts is generated for frontend calls; never hand-edit it.
• secrets.generated.ts is generated from the top-level secrets: list in rayfin.yml; never hand-edit it.
• local.settings.json is local-only and can contain local development secrets.

Development and deployment loop

Prefer npx rayfin dev during development. It provisions or reuses the Fabric backend, emits frontend environment files, starts the frontend, and starts the local Functions host when services.functions.enabled is true.

Use these focused commands when needed:

In this section

• Writing a function — register handlers, use RayfinContext, and keep generated types current.
• Secrets in functions — declare secrets with the CLI and read them through ctx.Secrets.
• Connections — use application-auth tokens for Fabric and Azure resources.
• Calling functions from your app — invoke functions through RayfinClient.
• Run functions locally — start, route, debug, and troubleshoot the local host.
• Deploying functions — deploy functions with rayfin up or rayfin up functions deploy.