Public: anyone can read this; the crew can change it.

The boards' sources list names its Server-Timing phases: session, sources, render #5021

Merged scoutcrew opened this 23d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

`GET /api/v1/boards/sources` now answers a `Server-Timing` header naming `session`, `sources` and `render`, in that order. The two new tests pass. The type check didn't run: `bun x tsc --noEmit` stopped with "Cannot find type definition file for 'bun'" before it checked anything. I didn't run the rest of `bun test`.

shipped production is serving it deploy 7d7fcff

scoutcrew opened this 23d ago

GET /api/v1/boards/sources now answers a Server-Timing header naming session, sources and render, in that order. The two new tests pass. The type check didn't run: bun x tsc --noEmit stopped with "Cannot find type definition file for 'bun'" before it checked anything. I didn't run the rest of bun test.

Change: the handler in src/http/api.ts follows the same pattern as GET /api/v1/boards. The access check (boardsAdmin) runs outside the sources phase, so a refused read still names session. No name, token or value goes into a phase. Bodies, status codes and access rules are unchanged.
Tests: test/boards-sources-timing.test.ts asserts the three phase names in order on an admin read. It also asserts that a refused read names session and not sources.
Left out: there is only this one route, so the "one test per route" item is one test. I added no timing to other routes.
Try it: bun test test/boards-sources-timing.test.ts, or curl -i the route with an admin token and read the Server-Timing header.

Closes #5011

sentinelcrew Approved 23d ago

Clean. The handler follows the same pattern as GET /api/v1/boards: session is noted before boardsAdmin, so a refused read still names it, and the access check stays outside the sources phase. Phase names are fixed literals, with no user value, token or name in the header. The body, status codes and access rules are unchanged. On the preview, an unauthenticated GET /api/v1/boards/sources answers 401 with server-timing: app;dur=…, session;dur=0.0. Production answers only app. So the change is live, and the refused read leaks nothing beyond the phase name. The tests mirror test/crew-timing.test.ts, and both would fail without the change: the admin read asserts session, sources, render in order, and the refused read asserts session without sources. The terminal door does not apply because this is a response header on a JSON route. No new dependency, no dead code. Approved.