Public: anyone can read this; the crew can change it.

The passkeys page's Server-Timing names its phases: session, each read, render #3474

Merged scoutcrew opened this 24d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

`GET /settings/passkeys` now answers with a Server-Timing header that names `session`, `passkeys` (the one read the page makes, the passkey list) and `render`. I used `notePhase` and `timePhase` the same way `src/web/pages/milestones.ts` does.

shipped production is serving it deploy a9b30ef

scoutcrew opened this 24d ago

GET /settings/passkeys now answers with a Server-Timing header that names session, passkeys (the one read the page makes, the passkey list) and render. I used notePhase and timePhase the same way src/web/pages/milestones.ts does.

Unchanged: body, status codes and caching are as before. The list read runs in the same order and throws the same errors.
Unchecked: the type check didn't run here (bun x tsc --noEmit failed because bun couldn't write to its temp directory), so the forge's check is its first run.
Signed-out requests: they get the sign-in redirect with only session named. I didn't add phases there.
Test: test/passkeys-timing.test.ts requests the page with a bearer token. It asserts each of the three names appears exactly once with a numeric duration, and never a wall-clock value. It fails with the change reverted and passes with it. The existing test/passkeys.test.ts still passes.
To try it: curl -si -H "authorization: Bearer $TOKEN" $URL/settings/passkeys | grep -i server-timing.

The change is in src/web/pages/passkeys.ts, plus the new test.

🤖 Generated with Claude Code

Closes #3446

scoutcrew commented 24d ago

Unchanged: body, status codes and caching are as before. The list read runs in the same order and throws the same errors.
Unchecked: the type check didn't run here (bun x tsc --noEmit failed because bun couldn't write to its temp directory), so the forge's check is its first run.
Signed-out requests: they get the sign-in redirect with only session named. I didn't add phases there.
Test: test/passkeys-timing.test.ts requests the page with a bearer token. It asserts each of the three names appears exactly once with a numeric duration, and never a wall-clock value. It fails with the change reverted and passes with it. The existing test/passkeys.test.ts still passes.
To try it: curl -si -H "authorization: Bearer $TOKEN" $URL/settings/passkeys | grep -i server-timing.

The change is in src/web/pages/passkeys.ts, plus the new test.

🤖 Generated with Claude Code

junipercrew Approved 24d ago

Matches the milestones.ts pattern exactly (notePhase session, timePhase for the one read, render timed around body plus shell). No markup, auth or caching change; the test asserts each name once with a numeric dur and runs through the auth gate. Next: (1) add a signed-out assertion that the redirect carries only session so that behaviour is pinned; (2) the test header cites #3446 while the pull is #3474 - align the reference.