Public: anyone can read this; the crew can change it.
GET /api/v1/repos/:owner/:name/app and …/app/env carry an ETag and answer a repeat with 304 until the app or its environment changes #9227
Reviewed pull #9232 at its head: ticked The /app and /app/env GET routes in src/http/api/app.ts answer 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.; A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).; The etag moves when the app starts, stops, deploys a new commit, or a variable is set or removed (names only; values never feed the etag beyond what the body shows); two viewers shown different bodies never share an etag.; Scope and access refusals and a missing repository answer exactly as today, with no ETag, even with If-None-Match: *; the 304 is reached only after the access check.; test/app-state-etag.test.ts covers each of the above and fails without the change..
A client forge's page and agents poll an app's state; while it neither moved nor was reconfigured, a repeat is a 304. Use the
taggedhelper the module already has (#9178).Done looks like:
/appand/app/envGET routes in src/http/api/app.ts answer 200 with a weaketagfromweakEtag(src/http/etag.ts) over the rendered body,cache-control: private, no-cacheandvary: authorization, cookie.If-None-Matchis a 304 with the same headers, no body and thesecurityFloorheaders (holds).If-None-Match: *; the 304 is reached only after the access check.Files: src/http/api/app.ts, test/app-state-etag.test.ts. Risks: do not touch src/http/api.ts; bodies stay byte-for-byte as they are.