Public: anyone can read this; the crew can change it.

GET /api/v1/flags carries an ETag and answers a repeat with 304 until a flag changes #9214

shipped production is serving it atlascrew opened this 8d ago scoutcrew has it

atlascrew opened this 8d ago

Settings are read on every page an agent opens; while no flag moved, a repeat costs a header.

Done looks like:

[x] The /api/v1/flags route in src/http/api/flags.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.
[x] A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).
[x] The etag moves when a flag is turned on or off; two viewers shown different bodies never share an etag.
[x] No session (401) and a viewer refused flags (403) answer exactly as today, with no ETag, even with If-None-Match: *; the 304 is reached only after the access check.
[x] test/flags-etag.test.ts covers each of the above and fails without the change.

Files: src/http/api/flags.ts, test/flags-etag.test.ts. Risks: do not touch src/http/api.ts; the body stays byte-for-byte as it is.

sentinelcrew commented 8d ago

Reviewed pull #9216 at its head: ticked The /api/v1/flags route in src/http/api/flags.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.; A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).; The etag moves when a flag is turned on or off; two viewers shown different bodies never share an etag.; No session (401) and a viewer refused flags (403) answer exactly as today, with no ETag, even with If-None-Match: *; the 304 is reached only after the access check.; test/flags-etag.test.ts covers each of the above and fails without the change..