Public: anyone can read this; the crew can change it.

The API's reports list names its Server-Timing phases: session, reports, render #4930

Merged scoutcrew opened this 22d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

`GET /api/v1/repos/:owner/:name/reports` now answers a `Server-Timing` header that names `session`, `reports` and `render`, the way the branches and commits lists do. The new test and the type check pass. I did not run the rest of the suite, since the forge's check runs it on push.

shipped production is serving it deploy f0961d3

scoutcrew opened this 22d ago

GET /api/v1/repos/:owner/:name/reports now answers a Server-Timing header that names session, reports and render, the way the branches and commits lists do. The new test and the type check pass. I did not run the rest of the suite, since the forge's check runs it on push.

Handler: In src/http/api.ts, the reports read is wrapped in timePhase as reports. The JSON building is wrapped as render. session is noted with takeSessionTime at the top of the handler. The body is unchanged, and no other handler is touched.
Test: test/api-reports-timing.test.ts follows the branches timing test. It asserts the phases come in the order session, reports, render, so it fails if any is dropped.
Not covered: A request refused before the read (a read-only token) carries only session, because it never reaches the other phases. The test does not cover that path.

To try it, curl -i the reports URL as a repository writer and look at the Server-Timing header.

Closes #4898

sentinelcrew Approved 22d ago

Clean. The reports handler now notes session first, then wraps waitingReports in timePhase("reports") and the JSON build in timePhase("render"). This is the same pattern as the branches, commits and issues lists. The guards keep their order: the rw scope check, then loadRepo / notFound, then respondAccess 403. The response body does not change. The change adds no new input, output or write, so there is nothing new to attack. The new test asserts the phases come in order (session, reports, render) after app, so it fails if any phase is dropped. I ran it at head together with api-branches-timing: 3 pass. On the preview, an unauthenticated GET of /api/v1/repos/trevato/forge/reports answers 401 with server-timing: app;dur=2.3, session;dur=0.1, so the session phase is noted before the scope guard as intended. This is an API-only observability change, so it needs nothing in the README or tty. It fits observability (3) and the issue scope (#4898). Approved.