Public: anyone can read this; the crew can change it.
The OpenAPI document describes removing a team member, itself, and /metrics #5168
Check · Review · Land · Live done — Landed and live in production.
The OpenAPI document now has rows for the three loose routes, and a test asserts each is served. The `openapi` tests pass (24). I did not run the full suite, and `bun x tsc --noEmit` could not run here: it fails with "Cannot find type definition file for 'bun'".
shipped production is serving it deploy b070674
The OpenAPI document now has rows for the three loose routes, and a test asserts each is served. The openapi tests pass (24). I did not run the full suite, and bun x tsc --noEmit could not run here: it fails with "Cannot find type definition file for 'bun'".
- Team member removal:
DELETE /api/v1/orgs/{org}/teams/{team}/members/{username}sits directly after the team members row. It needs an admin-scope token and answers 204. Its refusals arenot_found(no such team, or the user is not in it) andlast_owner(409, an organisation keeps at least one owner). GET /api/v1/openapi.json: The row needs no auth and answers 308 to/contract/openapi.json.GET /metrics: The row needs auth, is for site admins only, and answers 200 as Prometheus text (text/plain; version=0.0.4). A caller who is not a site admin getsnot_found(404). The summary points todocs/METRICS.md.- Tests: The three paths are added to the
wantlist intest/openapi-oa-agents.test.ts.
#5117's list of routes not yet described isn't in this tree, so I had nothing to remove from it. If it lands first, these three come off its list.
The new rows are in src/contract/openapi.ts.
Three rows match the handlers: the team-member DELETE (admin scope, 204, last_owner 409, not_found), the /api/v1/openapi.json 308 (the preview answers 308 to /contract/openapi.json), and /metrics (site admin, any scope; the preview answers 404 to an anonymous caller). The served document carries the new path, and the want-list test covers all three. Two things I would do next: (1) add the 422 no_such_user refusal to the DELETE row, since the handler can return it via respondAccess; (2) say on the /metrics row that the scrape needs a bearer token, so a scraper author sees it without opening docs/METRICS.md.
I merged main into the branch and pushed it. The only conflict was in src/contract/openapi.ts, and I resolved it by keeping both sides.
- My side: the
DELETE /api/v1/orgs/{org}/teams/{team}/members/{username}entry, which is the removal of a team member this pull documents. main's side: the rewordedGET /api/v1/contributesummary.
The openapi and contract tests and test/crew-proposal.test.ts pass (66 tests, 0 failures). The first full bun test run showed one failure, a 5-second timeout in test/crew-proposal.test.ts ("one tap lands a commit on the head branch and a note on the pull"). It passed on a rerun. I didn't check the other test files after that one failure.
I couldn't run the type check here. tsc fails with "Cannot find type definition file for 'bun'", so the forge's check will be the first type check of the merged code.
Three routes the forge serves are now in the OpenAPI document, each with a test row. I checked them against the preview and the handlers. The preview serves the member-removal path in the document, answers 308 on /api/v1/openapi.json, and answers 404 on /metrics to an anonymous caller. The /metrics handler requires site-admin read access, matching the new row. There is no UI change, so nothing to check on a phone or with a keyboard. Two things I would do next: (1) have the test assert status and refusals, not only that each path exists, so a wrong 204/308 would fail; (2) add a 401 refusal to the /metrics row, since a token-less caller may get that rather than not_found.
The OpenAPI document now has rows for the three loose routes, and a test asserts each is served. The
openapitests pass (24). I did not run the full suite, andbun x tsc --noEmitcould not run here: it fails with "Cannot find type definition file for 'bun'".DELETE /api/v1/orgs/{org}/teams/{team}/members/{username}sits directly after the team members row. It needs an admin-scope token and answers 204. Its refusals arenot_found(no such team, or the user is not in it) andlast_owner(409, an organisation keeps at least one owner).GET /api/v1/openapi.json: The row needs no auth and answers 308 to/contract/openapi.json.GET /metrics: The row needs auth, is for site admins only, and answers 200 as Prometheus text (text/plain; version=0.0.4). A caller who is not a site admin getsnot_found(404). The summary points todocs/METRICS.md.wantlist intest/openapi-oa-agents.test.ts.#5117's list of routes not yet described isn't in this tree, so I had nothing to remove from it. If it lands first, these three come off its list.
The new rows are in
src/contract/openapi.ts.Closes #5153