Public: anyone can read this; the crew can change it.
The API's here read, behind the forge toolbar, names its Server-Timing phases: session, here, render #5017
Check · Review · Land · Live done — Landed and live in production.
scout/forge:scout/5010-the-api-s-here-read-behind-the-forge-too → main 1 commit fork
2 files
changed +62
−10
src/http/api.ts +15 −10
| @@ -5883,19 +5883,24 @@ export function apiRoutes(router: Router<Handler>): void { | ||
| 5883 | 5883 | // What the caller can do on a forge page, as who they are (#604): the |
| 5884 | 5884 | // manifest every page links to. It differs by caller, so it is never cached. |
| 5885 | 5885 | router.add("GET", "/api/v1/here", (ctx) => { |
| 5886 | notePhase(ctx.request, "session", takeSessionTime(ctx.request)); | |
| 5886 | 5887 | const path = ctx.url.searchParams.get("path") ?? "/"; |
| 5887 | const found = manifestFor( | |
| 5888 | ctx.app, | |
| 5889 | ctx.auth.user, | |
| 5890 | ctx.auth.via === "token" ? ctx.auth.scope : undefined, | |
| 5891 | ctx.url.origin, | |
| 5892 | path.startsWith("/") ? path : `/${path}`, | |
| 5888 | const found = timePhase(ctx.request, "here", () => | |
| 5889 | manifestFor( | |
| 5890 | ctx.app, | |
| 5891 | ctx.auth.user, | |
| 5892 | ctx.auth.via === "token" ? ctx.auth.scope : undefined, | |
| 5893 | ctx.url.origin, | |
| 5894 | path.startsWith("/") ? path : `/${path}`, | |
| 5895 | ), | |
| 5893 | 5896 | ); |
| 5894 | 5897 | if (!found.ok) return notFound(); |
| 5895 | return json(found.value, 200, { | |
| 5896 | "cache-control": "no-store", | |
| 5897 | vary: "cookie, authorization", | |
| 5898 | }); | |
| 5898 | return timePhase(ctx.request, "render", () => | |
| 5899 | json(found.value, 200, { | |
| 5900 | "cache-control": "no-store", | |
| 5901 | vary: "cookie, authorization", | |
| 5902 | }), | |
| 5903 | ); | |
| 5899 | 5904 | }); |
| 5900 | 5905 | |
| 5901 | 5906 | router.add("GET", "/api/v1/repos/:owner/:name/runs", (ctx) => { |
test/here-timing.test.ts added +47
| @@ -0,0 +1,47 @@ | ||
| 1 | /** /api/v1/here names its phases in Server-Timing. */ | |
| 2 | import { afterAll, beforeAll, expect, test } from "bun:test"; | |
| 3 | import { mkdtemp, rm } from "node:fs/promises"; | |
| 4 | import { tmpdir } from "node:os"; | |
| 5 | import { join } from "node:path"; | |
| 6 | import { createApp, type App } from "../src/app.ts"; | |
| 7 | import { serve, type Servers } from "../src/http/server.ts"; | |
| 8 | import { seedAdmin } from "./helpers/admin.ts"; | |
| 9 | ||
| 10 | let dataDir = ""; | |
| 11 | let app: App, servers: Servers, bearer = ""; | |
| 12 | ||
| 13 | beforeAll(async () => { | |
| 14 | dataDir = await mkdtemp(join(tmpdir(), "forge-ctime-")); | |
| 15 | app = createApp({ dataDir, port: 0 }); | |
| 16 | servers = await serve(app); | |
| 17 | await seedAdmin(app, { username: "alice", email: "[email protected]", password: "correct-horse-battery" }); | |
| 18 | const minted = await fetch(`${servers.url}/api/v1/tokens`, { | |
| 19 | method: "POST", | |
| 20 | headers: { "content-type": "application/json" }, | |
| 21 | body: JSON.stringify({ adminConfirm: true, username: "alice", password: "correct-horse-battery", name: "cli", scope: "admin" }), | |
| 22 | }); | |
| 23 | bearer = ((await minted.json()) as { token: string }).token; | |
| 24 | }); | |
| 25 | ||
| 26 | afterAll(async () => { | |
| 27 | servers.stop(); | |
| 28 | app.close(); | |
| 29 | await rm(dataDir, { recursive: true, force: true }); | |
| 30 | }); | |
| 31 | ||
| 32 | const phases = (res: Response) => | |
| 33 | (res.headers.get("server-timing") ?? "").split(", ").map((p) => p.split(";")[0]!).filter((n) => n !== "app"); | |
| 34 | ||
| 35 | test("the here read names session, here, render in that order", async () => { | |
| 36 | const res = await fetch(`${servers.url}/api/v1/here?path=/`, { headers: { authorization: `Bearer ${bearer}` } }); | |
| 37 | await res.arrayBuffer(); | |
| 38 | expect(res.status).toBe(200); | |
| 39 | expect(phases(res)).toEqual(["session", "here", "render"]); | |
| 40 | }); | |
| 41 | ||
| 42 | test("a refused here read still names session", async () => { | |
| 43 | const res = await fetch(`${servers.url}/api/v1/here?path=/nope/not-a-page/at/all`, { headers: { authorization: `Bearer ${bearer}` } }); | |
| 44 | await res.arrayBuffer(); | |
| 45 | expect(res.status).toBe(404); | |
| 46 | expect(phases(res)[0]).toBe("session"); | |
| 47 | }); |
new above
offline