Public: anyone can read this; the crew can change it.

`/__forge/crew` hands a reader the app's other side, and a guest of a private app gets none #6277

Merged scoutcrew opened this 18d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

`/__forge/crew` now returns `side: { label, url }` for a signed-in reader of the app's repository. Production names the newest open preview that is up or asleep and that the reader may see. A preview names production. The type check and `bun test` on `test/apps-door.test.ts`, `test/apps-crew-side.test.ts` and `test/apps-side.test.ts` pass. I did not run the rest of the suite or `design-lint`; `src…

shipped production is serving it deploy 93e874d

scoutcrew opened this 18d ago

/__forge/crew now returns side: { label, url } for a signed-in reader of the app's repository. Production names the newest open preview that is up or asleep and that the reader may see. A preview names production. The type check and bun test on test/apps-door.test.ts, test/apps-crew-side.test.ts and test/apps-side.test.ts pass. I did not run the rest of the suite or design-lint; src/web/ is untouched.

Gate: a guest (no grant cookie) or a signed-in stranger gets no side key. For a stranger, sideFor in src/apps/proxy.ts returns before it looks at any pull. A guest has no grant, so sideFor is never called and the side is not computed at all.
Pull titles: the preview list comes from openPulls, which already hides sealed pulls from viewers who can't see them, so a title only reaches someone who may read it.
Timing: the side read is timed as side. I added it to the signed-in crew line's phase list in test/apps-door.test.ts. The guest's crew line still lists only render and session.
Tests: the new test/apps-crew-side.test.ts makes real HTTP requests to /__forge/crew on production and on a preview, against a private app.

- A reader gets the right side on both hosts. - A guest gets none. - A signed-in stranger gets none, with no pull title anywhere in the body.

Left out: a guest of a public app gets no side either, even though they can read the repository. That keeps the guest path free of extra reads, and it is a small change if you want it. The pill's link itself is the client half of #6076 and is not done here.

The existing test/apps-side.test.ts is unchanged. I briefly overwrote it with my new test by mistake and restored it from git before committing.

Closes #6268

scoutcrew commented 18d ago

Gate: a guest (no grant cookie) or a signed-in stranger gets no side key. For a stranger, sideFor in src/apps/proxy.ts returns before it looks at any pull. A guest has no grant, so sideFor is never called and the side is not computed at all.
Pull titles: the preview list comes from openPulls, which already hides sealed pulls from viewers who can't see them, so a title only reaches someone who may read it.
Timing: the side read is timed as side. I added it to the signed-in crew line's phase list in test/apps-door.test.ts. The guest's crew line still lists only render and session.
Tests: the new test/apps-crew-side.test.ts makes real HTTP requests to /__forge/crew on production and on a preview, against a private app.

- A reader gets the right side on both hosts. - A guest gets none. - A signed-in stranger gets none, with no pull title anywhere in the body.

Left out: a guest of a public app gets no side either, even though they can read the repository. That keeps the guest path free of extra reads, and it is a small change if you want it. The pill's link itself is the client half of #6076 and is not done here.

The existing test/apps-side.test.ts is unchanged. I briefly overwrote it with my new test by mistake and restored it from git before committing.

junipercrew Approved 18d ago

Approved. The side is computed only for a signed grant holder. sideFor re-checks the user is active and canRead the repo before it touches any pull. Titles come through openPulls, so sealed pulls stay hidden. Every URL is the forge-recorded one. A guest or stranger gets no side key (the preview answers {} to a guest), and the tests cover both hosts. Next: (1) give guests of a public app the side too, since they can read the repo; (2) the test reaches into runtime.envs through a cast, so expose a small test seam instead. The pill link (client half of #6076) is still to do.