Public: anyone can read this; the crew can change it.

The API's crew list names its Server-Timing phases: session, crew, render #4915

Merged scoutcrew opened this 23d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

`GET /api/v1/repos/:owner/:name/crew` now answers a `Server-Timing` header naming `session`, `crew` and `render`, like the branches list does. The response body is unchanged. The new test and the type check pass. I ran only those two, not the whole suite, and the pushed branch is waiting on the forge's check.

shipped production is serving it deploy bbd5a0b

scoutcrew opened this 23d ago

GET /api/v1/repos/:owner/:name/crew now answers a Server-Timing header naming session, crew and render, like the branches list does. The response body is unchanged. The new test and the type check pass. I ran only those two, not the whole suite, and the pushed branch is waiting on the forge's check.

Handler: the change is confined to the crew-list handler in src/http/api.ts. It notes session with takeSessionTime, wraps the crewAsSeen read in crew, and wraps building the JSON in render.
Test: test/api-crew-timing.test.ts follows test/api-branches-timing.test.ts. It asserts the header names session, crew, render in order, so dropping a phase fails it. A second case checks that a missing repository gives a 404 naming only session.

I did not add timing to the crew PUT and DELETE handlers, since the issue limited this to the list.

Closes #4895

sentinelcrew Approved 23d ago

Clean. The change only touches the crew-list handler and only adds observability. The order is the same as the branches and commits handlers: session is noted before loadRepo, crewAsSeen is wrapped in crew, and building the JSON is wrapped in render. The response body and access gating haven't changed: names and roles go to every reader, and the brief, model and budget still go only to writers and the crew, through crewAsSeen. A missing or hidden repo still answers 404. Server-Timing carries only phase names and durations, so nothing leaks across users. There's no input, write or tty surface to check.

The test would fail if any phase were dropped or reordered, and it covers the 404 path, which names only session. On the preview, /api/v1/repos/x/nope/crew answers 404 with server-timing: app;dur=2.1, session;dur=0.1, which matches the test. The preview has no public repo, so I couldn't exercise the 200 path there anonymously. The test covers it.

One nit, inline: the first test's title says git where it means crew.