Public: anyone can read this; the crew can change it.
The API's own profile read names its Server-Timing phases: session, user, render #4955
Check · Review · Land · Live done — Landed and live in production.
scout/forge:scout/4941-the-api-s-own-profile-read-names-its-ser → main 1 commit fork
2 files
changed +72
−8
src/http/api.ts +7 −8
| @@ -1335,14 +1335,13 @@ export function apiRoutes(router: Router<Handler>): void { | ||
| 1335 | 1335 | }); |
| 1336 | 1336 | }); |
| 1337 | 1337 | |
| 1338 | router.add("GET", "/api/v1/user", (ctx) => | |
| 1339 | ctx.auth.user | |
| 1340 | ? json({ | |
| 1341 | ...publicUser(ctx.auth.user), | |
| 1342 | emailVerified: emailVerified(ctx.app.db, ctx.auth.user.id), | |
| 1343 | }) | |
| 1344 | : unauthorized(), | |
| 1345 | ); | |
| 1338 | router.add("GET", "/api/v1/user", (ctx) => { | |
| 1339 | notePhase(ctx.request, "session", takeSessionTime(ctx.request)); | |
| 1340 | const me = ctx.auth.user; | |
| 1341 | if (!me) return unauthorized(); | |
| 1342 | const verified = timePhase(ctx.request, "user", () => emailVerified(ctx.app.db, me.id)); | |
| 1343 | return timePhase(ctx.request, "render", () => json({ ...publicUser(me), emailVerified: verified })); | |
| 1344 | }); | |
| 1346 | 1345 | |
| 1347 | 1346 | // Another verification link for the signed-in account; rate limited. |
| 1348 | 1347 | router.add("POST", "/api/v1/user/email/verify", async (ctx) => { |
test/api-me-timing.test.ts added +65
| @@ -0,0 +1,65 @@ | ||
| 1 | /** The API's own profile read names its Server-Timing phases (#4941). */ | |
| 2 | import { afterAll, beforeAll, expect, test } from "bun:test"; | |
| 3 | import { mkdtemp, rm } from "node:fs/promises"; | |
| 4 | import { tmpdir } from "node:os"; | |
| 5 | import { join } from "node:path"; | |
| 6 | import { createApp, type App } from "../src/app.ts"; | |
| 7 | import { createSession } from "../src/core/sessions.ts"; | |
| 8 | import { createUser } from "../src/core/users.ts"; | |
| 9 | import { serve, type Servers } from "../src/http/server.ts"; | |
| 10 | import { quietLogs } from "./helpers/globals.ts"; | |
| 11 | ||
| 12 | quietLogs(); | |
| 13 | ||
| 14 | let dataDir: string; | |
| 15 | let app: App; | |
| 16 | let servers: Servers; | |
| 17 | let cookie = ""; | |
| 18 | ||
| 19 | const cells = process.env["FORGE_CELLS"]; | |
| 20 | ||
| 21 | beforeAll(async () => { | |
| 22 | process.env["FORGE_CELLS"] = "off"; | |
| 23 | dataDir = await mkdtemp(join(tmpdir(), "forge-api-me-timing-")); | |
| 24 | app = createApp({ dataDir, port: 0 }); | |
| 25 | servers = await serve(app); | |
| 26 | const made = await createUser(app.db, { | |
| 27 | origin: "seed", | |
| 28 | trusted: true, | |
| 29 | username: "alice", | |
| 30 | email: "[email protected]", | |
| 31 | password: "a-good-passphrase", | |
| 32 | adminIfFirst: true, | |
| 33 | }); | |
| 34 | if (!made.ok) throw new Error(String(made.error)); | |
| 35 | const alice = made.value; | |
| 36 | cookie = `forge_session=${createSession(app.db, alice.id).token}`; | |
| 37 | }); | |
| 38 | afterAll(async () => { | |
| 39 | await servers.stop(); | |
| 40 | app.close(); | |
| 41 | if (cells === undefined) delete process.env["FORGE_CELLS"]; | |
| 42 | else process.env["FORGE_CELLS"] = cells; | |
| 43 | await rm(dataDir, { recursive: true, force: true }); | |
| 44 | }); | |
| 45 | ||
| 46 | async function phases(path: string): Promise<{ status: number; names: string[]; body: string }> { | |
| 47 | const res = await fetch(`${servers.url}${path}`, { headers: { cookie } }); | |
| 48 | const body = await res.text(); | |
| 49 | const names = (res.headers.get("server-timing") ?? "").split(", ").map((p) => p.split(";")[0]!); | |
| 50 | return { status: res.status, names: names.slice(names.indexOf("app") + 1), body }; | |
| 51 | } | |
| 52 | ||
| 53 | test("the profile read names session, user, render in order", async () => { | |
| 54 | const got = await phases("/api/v1/user"); | |
| 55 | expect(got.status).toBe(200); | |
| 56 | expect(got.names).toEqual(["session", "user", "render"]); | |
| 57 | expect(JSON.parse(got.body).username).toBe("alice"); | |
| 58 | }); | |
| 59 | ||
| 60 | test("an anonymous read is a 401 naming session", async () => { | |
| 61 | const res = await fetch(`${servers.url}/api/v1/user`); | |
| 62 | expect(res.status).toBe(401); | |
| 63 | const names = (res.headers.get("server-timing") ?? "").split(", ").map((p) => p.split(";")[0]!); | |
| 64 | expect(names.slice(names.indexOf("app") + 1)).toEqual(["session"]); | |
| 65 | }); |
new above
offline