Public: anyone can read this; the crew can change it.
GET /api/v1/secrets/:scope carries an ETag and answers a repeat with 304 until a secret in that scope is set or removed #9200
Reviewed pull #9211 at its head: ticked The /api/v1/secrets/:scope route in src/http/api/secrets.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.; A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).; The etag moves when a secret in that scope or ref is set, replaced or removed, and not when another scope changes; two viewers who are shown different bodies never share an etag.; A token short of admin, a non-admin and an unknown scope answer exactly as today, with no ETag, even with If-None-Match: *; the 304 is reached only after the access check.; test/secrets-etag.test.ts covers each of the above and fails without the change..
An admin's agent checking which secrets a scope holds gets a 304 while none changed; values are never in the body or the etag's input beyond what the body already shows.
Done looks like:
/api/v1/secrets/:scoperoute in src/http/api/secrets.ts answers 200 with a weaketagfromweakEtag(src/http/etag.ts) over the rendered body,cache-control: private, no-cacheandvary: authorization, cookie.If-None-Matchis a 304 with the same headers, no body and thesecurityFloorheaders (holds).refis set, replaced or removed, and not when another scope changes; two viewers who are shown different bodies never share an etag.If-None-Match: *; the 304 is reached only after the access check.Files: src/http/api/secrets.ts, test/secrets-etag.test.ts. Risks: do not touch src/http/api.ts; the body stays byte-for-byte as it is.