Public: anyone can read this; the crew can change it.
The organization reads name their Server-Timing phases: an org, its teams, a team's members, the caller's orgs #5179
Check · Review · Land · Live done — Landed and live in production.
The four organization reads already name their Server-Timing phases on this branch, and the rest of this note describes that earlier work. I made no new change and pushed nothing, because the branch matches `origin`.
shipped production is serving it deploy d5155e2
The four organization reads already name their Server-Timing phases on this branch, and the rest of this note describes that earlier work. I made no new change and pushed nothing, because the branch matches origin.
- Code:
GET /api/v1/orgs/:org,/orgs/:org/teams,/orgs/:org/teams/:team/membersand/user/orgsanswersession, thenorg,teams,membersororgs, thenrender. This is insrc/http/api.ts. The read sits inside the phase and the access check outside it. A refused read (404 or 403) still namessession. Bodies, status codes and access rules are unchanged. - Tests:
test/org-timing.test.tshas one test per route asserting the phase names in order. All 5 tests pass here andtsc --noEmitis clean. I did not run the whole suite. - Why the pull was parked: the failing check was "a sleeping preview woken at the limit > stays asleep…". That is the app-sleep test, which this change doesn't touch, so I take it to be unrelated. I couldn't run it here, because the suites about unix sockets and cells are skipped in this sandbox. The forge's check will run it on the next push.
I left out the 404/403 case for the three org-scoped routes, since the issue only asks that those refusals still name session.
To try it: curl -si -H "authorization: Bearer $TOKEN" $URL/api/v1/orgs/<org>/teams | grep -i server-timing
I read every changed line and found nothing to fix. The four org reads now follow the GET …/tags pattern: session first, the read inside timePhase, and json(…) inside render. Access checks (getOrg, loadTeam, teamVisible, unauthorized) and the keyedWindow validation are still outside the timed phases, so bodies, status codes and access rules are unchanged. The headers carry only phase names and durations, no user data.
The new test asserts the exact phase order for each route plus the 404 path, and it would fail without the change. On the preview at this head, /api/v1/orgs/forge answers session, org, render, /orgs/forge/teams answers session, teams, render, and the refused reads (a 404 org, a 401 on /user/orgs) still name session. The change is API-only, so there is no page or tty surface it would need to match. Approved.
The four organization reads already name their Server-Timing phases on this branch, and the rest of this note describes that earlier work. I made no new change and pushed nothing, because the branch matches
origin.GET /api/v1/orgs/:org,/orgs/:org/teams,/orgs/:org/teams/:team/membersand/user/orgsanswersession, thenorg,teams,membersororgs, thenrender. This is insrc/http/api.ts. The read sits inside the phase and the access check outside it. A refused read (404 or 403) still namessession. Bodies, status codes and access rules are unchanged.test/org-timing.test.tshas one test per route asserting the phase names in order. All 5 tests pass here andtsc --noEmitis clean. I did not run the whole suite.I left out the 404/403 case for the three org-scoped routes, since the issue only asks that those refusals still name
session.To try it:
curl -si -H "authorization: Bearer $TOKEN" $URL/api/v1/orgs/<org>/teams | grep -i server-timingCloses #4983