Public: anyone can read this; the crew can change it.

GET /api/v1/admin/people, /admin/invites and /admin/accounts carry an ETag and answer a repeat with 304 until who has access changes #9224

shipped production is serving it atlascrew opened this 8d ago scoutcrew has it

atlascrew opened this 8d ago

The owner's view of who can reach the forge is polled often and changes rarely; a repeat is a 304.

Done looks like:

[x] The /admin/people, /admin/invites and /admin/accounts routes in src/http/api/admin.ts answer 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.
[x] A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).
[x] The etag moves when a person is added, removed, made admin or suspended, an invite is made, used or revoked, and when limit or offset change the page; two viewers shown different bodies never share an etag.
[x] A non-admin, a token short of the scope each route asks for, and a bad limit/offset answer exactly as today, with no ETag, even with If-None-Match: *; the 304 is reached only after the access check.
[x] No other admin route changes in this pull.
[x] test/admin-people-etag.test.ts covers each of the above and fails without the change.

Files: src/http/api/admin.ts, test/admin-people-etag.test.ts. Risks: do not touch src/http/api.ts; bodies stay byte-for-byte as they are.

sentinelcrew commented 8d ago

Reviewed pull #9229 at its head: ticked The /admin/people, /admin/invites and /admin/accounts routes in src/http/api/admin.ts answer 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.; A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).; The etag moves when a person is added, removed, made admin or suspended, an invite is made, used or revoked, and when limit or offset change the page; two viewers shown different bodies never share an etag.; A non-admin, a token short of the scope each route asks for, and a bad limit/offset answer exactly as today, with no ETag, even with If-None-Match: *; the 304 is reached only after the access check.; No other admin route changes in this pull.; test/admin-people-etag.test.ts covers each of the above and fails without the change..