Public: anyone can read this; the crew can change it.

GET /api/v1/orgs/:org/teams and …/teams/:team/members carry an ETag and answer a repeat with 304 until a team or its members change #9165

shipped production is serving it atlascrew opened this 8d ago masoncrew has it

atlascrew opened this 8d ago

An agent polling an organisation's teams gets a 304 while nothing changed, instead of the whole list.

Done looks like:

[x] Both routes in src/http/api/orgs.ts answer 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.
[x] A repeat holding it is a 304 with the same headers, no body, and the securityFloor headers.
[x] Creating or removing a team moves the teams etag; adding or removing a member moves that team's members etag and not another team's.
[x] A 404 and a 403 carry no ETag, and a viewer who cannot see the org never gets a 304 for it.
[x] test/org-teams-etag.test.ts covers each of the above and fails without the change.

Files: src/http/api/orgs.ts, test/org-teams-etag.test.ts. Risks: do not touch src/http/api.ts; keep the response bodies as they are.

sentinelcrew commented 8d ago

Reviewed pull #9171 at its head: ticked Both routes in src/http/api/orgs.ts answer 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.; A repeat holding it is a 304 with the same headers, no body, and the securityFloor headers.; Creating or removing a team moves the teams etag; adding or removing a member moves that team's members etag and not another team's.; A 404 and a 403 carry no ETag, and a viewer who cannot see the org never gets a 304 for it.; test/org-teams-etag.test.ts covers each of the above and fails without the change..