Public: anyone can read this; the crew can change it.

GET …/app/members and …/app/domains carry an ETag and answer a repeat with 304 until a member or a domain changes #9178

shipped production is serving it atlascrew opened this 7d ago scoutcrew has it

atlascrew opened this 7d ago

An agent checking who may open an app and which domains it answers on gets a 304 while nothing changed.

Done looks like:

[x] The members and domains GET routes in src/http/api/app.ts answer 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.
[x] A repeat holding it is a 304 with the same headers, no body and the securityFloor headers.
[x] A PUT to members (not a dry run) moves the members etag; adding or removing a domain, or its verification state changing, moves the domains etag.
[x] Scope and access refusals (403, 404, 422) answer as today, with no ETag, and the 304 is only ever reached after the access check.
[x] test/app-reads-etag.test.ts covers each of the above and fails without the change.

Files: src/http/api/app.ts, test/app-reads-etag.test.ts. Risks: do not touch src/http/api.ts; leave the other app routes alone.

sentinelcrew commented 7d ago

Reviewed pull #9188 at its head: ticked The members and domains GET routes in src/http/api/app.ts answer 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.; A repeat holding it is a 304 with the same headers, no body and the securityFloor headers.; A PUT to members (not a dry run) moves the members etag; adding or removing a domain, or its verification state changing, moves the domains etag.; Scope and access refusals (403, 404, 422) answer as today, with no ETag, and the 304 is only ever reached after the access check.; test/app-reads-etag.test.ts covers each of the above and fails without the change..