2cd22b3 · 602fa66
@@ -189,7 +189,7 @@
export const ROUTES: readonly Route[] = [
    method: "get",
    path: "/api/v1/admin/limits",
    summary:
      "Read the forge's limits (a person admin's token, any scope); answers { limits: [{ key, value, isSet, defaultValue, ... }], changes }",
      "Read the forge's limits (a person admin's token, any scope); answers { items: [{ key, value, isSet, defaultValue, ... }], changes, next_cursor }",
      
        sentinelcrew
        23d ago
        outdated
      
      Once changes is restored, add it here too: { items: [...], changes, next_cursor }.
    
    auth: true,
    refusals: { not_found: "the token is not a person who administers the forge" },
  },
@@ -1701,7 +1701,7 @@
export function apiRoutes(router: Router<Handler>): void {
    const denied = accountAdmin(ctx, "ro");
    if (denied) return denied;
    const listed = timePhase(ctx.request, "limits", () => listLimits(ctx.app, ctx.auth.user));
    return timePhase(ctx.request, "render", () => (listed.ok ? json(listed.value) : notFound()));
    return timePhase(ctx.request, "render", () => (listed.ok ? json({ items: listed.value.limits, changes: listed.value.changes, next_cursor: null }) : notFound()));
      
        sentinelcrew
        23d ago
        outdated
      
      High (audit regression): changes is dropped, so the API loses the limit-change history. Keep it as a sibling field, the same way the egress grants route does: json({ items: listed.value.limits, changes: listed.value.changes, next_cursor: null }).
    
  });
  router.add("PUT", "/api/v1/admin/limits/:key", async (ctx) => {
@@ -178,7 +178,9 @@
describe("limits", () => {
      });
    const listed = await api(adminToken, "GET", "/admin/limits");
    expect(listed.status).toBe(200);
    expect(((await listed.json()) as { limits: unknown[] }).limits).toHaveLength(LIMIT_KEYS.length);
    const body = (await listed.json()) as { items: unknown[]; next_cursor: unknown };
    expect(body.items).toHaveLength(LIMIT_KEYS.length);
    expect(body.next_cursor).toBeNull();
      
        sentinelcrew
        23d ago
        
      
      Assert changes as well: after the PUT earlier in this test, body.changes should be an array that names the key that was set. Without that assertion, the field can disappear again unnoticed.
    
    expect((await api(bobToken, "GET", "/admin/limits")).status).toBe(403);
    expect((await api(bobToken, "PUT", "/admin/limits/share.daily_max", { value: "9" })).status).toBe(403);
    expect((await api(adminToken, "PUT", "/admin/limits/share.daily_max", { value: "0" })).status).toBe(422);
@@ -187,6 +189,11 @@
describe("limits", () => {
    const put = await api(adminToken, "PUT", "/admin/limits/share.daily_max", { value: "9" });
    expect(put.status).toBe(200);
    expect(limitValue(app.db, "share.daily_max")).toBe(9);
    const afterPut = (await (await api(adminToken, "GET", "/admin/limits")).json()) as {
      changes: { key: string }[];
    };
    expect(Array.isArray(afterPut.changes)).toBe(true);
    expect(afterPut.changes[0]?.key).toBe("share.daily_max");
    expect((await api(adminToken, "PUT", "/admin/limits/share.daily_max", { value: 11 })).status).toBe(200);
    expect(limitValue(app.db, "share.daily_max")).toBe(11);
    expect((await api(adminToken, "PUT", "/admin/limits/share.daily_max", { value: null })).status).toBe(200);
		@@ -189,7 +189,7 @@ export const ROUTES: readonly Route[] = [
189	189	method: "get",
190	190	path: "/api/v1/admin/limits",
191	191	summary:
192		"Read the forge's limits (a person admin's token, any scope); answers { limits: [{ key, value, isSet, defaultValue, ... }], changes }",
	192	"Read the forge's limits (a person admin's token, any scope); answers { items: [{ key, value, isSet, defaultValue, ... }], changes, next_cursor }",
		sentinelcrew 23d ago outdated Once `changes` is restored, add it here too: `{ items: [...], changes, next_cursor }`.
193	193	auth: true,
194	194	refusals: { not_found: "the token is not a person who administers the forge" },
195	195	},
		@@ -1701,7 +1701,7 @@ export function apiRoutes(router: Router<Handler>): void {
1701	1701	const denied = accountAdmin(ctx, "ro");
1702	1702	if (denied) return denied;
1703	1703	const listed = timePhase(ctx.request, "limits", () => listLimits(ctx.app, ctx.auth.user));
1704		return timePhase(ctx.request, "render", () => (listed.ok ? json(listed.value) : notFound()));
	1704	return timePhase(ctx.request, "render", () => (listed.ok ? json({ items: listed.value.limits, changes: listed.value.changes, next_cursor: null }) : notFound()));
		sentinelcrew 23d ago outdated High (audit regression): `changes` is dropped, so the API loses the limit-change history. Keep it as a sibling field, the same way the egress grants route does: `json({ items: listed.value.limits, changes: listed.value.changes, next_cursor: null })`.
1705	1705	});
1706	1706
1707	1707	router.add("PUT", "/api/v1/admin/limits/:key", async (ctx) => {
		@@ -178,7 +178,9 @@ describe("limits", () => {
178	178	});
179	179	const listed = await api(adminToken, "GET", "/admin/limits");
180	180	expect(listed.status).toBe(200);
181		expect(((await listed.json()) as { limits: unknown[] }).limits).toHaveLength(LIMIT_KEYS.length);
	181	const body = (await listed.json()) as { items: unknown[]; next_cursor: unknown };
	182	expect(body.items).toHaveLength(LIMIT_KEYS.length);
	183	expect(body.next_cursor).toBeNull();
		sentinelcrew 23d ago Assert `changes` as well: after the `PUT` earlier in this test, `body.changes` should be an array that names the key that was set. Without that assertion, the field can disappear again unnoticed.
182	184	expect((await api(bobToken, "GET", "/admin/limits")).status).toBe(403);
183	185	expect((await api(bobToken, "PUT", "/admin/limits/share.daily_max", { value: "9" })).status).toBe(403);
184	186	expect((await api(adminToken, "PUT", "/admin/limits/share.daily_max", { value: "0" })).status).toBe(422);
		@@ -187,6 +189,11 @@ describe("limits", () => {
187	189	const put = await api(adminToken, "PUT", "/admin/limits/share.daily_max", { value: "9" });
188	190	expect(put.status).toBe(200);
189	191	expect(limitValue(app.db, "share.daily_max")).toBe(9);
	192	const afterPut = (await (await api(adminToken, "GET", "/admin/limits")).json()) as {
	193	changes: { key: string }[];
	194	};
	195	expect(Array.isArray(afterPut.changes)).toBe(true);
	196	expect(afterPut.changes[0]?.key).toBe("share.daily_max");
190	197	expect((await api(adminToken, "PUT", "/admin/limits/share.daily_max", { value: 11 })).status).toBe(200);
191	198	expect(limitValue(app.db, "share.daily_max")).toBe(11);
192	199	expect((await api(adminToken, "PUT", "/admin/limits/share.daily_max", { value: null })).status).toBe(200);