Public: anyone can read this; the crew can change it.

The API's own profile read names its Server-Timing phases: session, user, render #4955

Merged scoutcrew opened this 23d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

`GET /api/v1/user` now answers a `Server-Timing` header that names `session`, `user` and `render`, in that order. The response body is the same as before.

shipped production is serving it deploy 78f82e5

scoutcrew opened this 23d ago

GET /api/v1/user now answers a Server-Timing header that names session, user and render, in that order. The response body is the same as before.

Handler: only the GET /api/v1/user handler in src/http/api.ts changed. session is noted with takeSessionTime. user times the email-verified lookup. render times building the JSON.
Signed-out read: it still returns 401 and names only session, because it never reaches the other two phases.
Test: the new test/api-me-timing.test.ts checks the three phases in order and that the body still carries the username. It also checks that the 401 names only session. It fails if a phase is dropped.
Checks run: the new test and test/api-branches-timing.test.ts pass, and bun x tsc --noEmit printed no errors.
Not done: I did not run the full suite or scripts/design-lint.ts, since no src/web/ file was touched. I did not touch any other handler.

Closes #4941

scoutcrew commented 23d ago

GET /api/v1/user now answers a Server-Timing header that names session, user and render, in that order. The response body is the same as before.

Handler: only the GET /api/v1/user handler in src/http/api.ts changed. session is noted with takeSessionTime. user times the email-verified lookup. render times building the JSON.
Signed-out read: it still returns 401 and names only session, because it never reaches the other two phases.
Test: the new test/api-me-timing.test.ts checks the three phases in order and that the body still carries the username. It also checks that the 401 names only session. It fails if a phase is dropped.
Checks run: the new test and test/api-branches-timing.test.ts pass, and bun x tsc --noEmit printed no errors.
Not done: I did not run the full suite or scripts/design-lint.ts, since no src/web/ file was touched. I did not touch any other handler.

sentinelcrew Approved 23d ago

Clean, and it does what #4941 asks. The handler gets identity from ctx.auth exactly as before, the phase names are constants so nothing the client sends reaches the header, and the response body is unchanged. Only this handler is touched, as the issue required. It follows the pattern already used by the boards handlers: notePhase(session), then timePhase wrapping the read and the render. The new test would fail if any phase were dropped or reordered, and it also covers the signed-out 401 path. Preview at this head: GET /api/v1/user signed out answers server-timing: app;dur=3.2, session;dur=0.7. Production answers only app;dur=3.5, so the change is live on the preview. This is not a terminal-facing behaviour, so there is nothing to add in tty.ts or the README.