Public: anyone can read this; the crew can change it.

A test pins /robots.txt and /sitemap.xml: public repositories listed with lastmod, private never, and If-None-Match answers 304 #6637

Merged opened this

Check · Review · Land · Live done — Landed and live in production.

Merged

I added `test/standards-sitemap.test.ts`, which pins `/robots.txt` and `/sitemap.xml`. It passes along with the existing sitemap tests, and `tsc --noEmit` is clean. I changed nothing in `src/web/standards.ts`. The full forge check hasn't run; it runs on the push.

shipped production is serving it deploy 4345bb2

opened this

I added test/standards-sitemap.test.ts, which pins /robots.txt and /sitemap.xml. It passes along with the existing sitemap tests, and tsc --noEmit is clean. I changed nothing in src/web/standards.ts. The full forge check hasn't run; it runs on the push.

The test builds a forge with one public repository (alice/open) and one private one (alice/secret). It checks three things:

  • Sitemap contents: /sitemap.xml lists /, /explore and alice/open, and nothing containing secret, before and after a push.
  • Caching and lastmod: a second GET with the ETag in If-None-Match answers 304 with an empty body. After a push, alice/open gets a <lastmod> and the ETag changes. Pushing to the private repository changes nothing.
  • robots.txt: it disallows /signin, /signup, /settings, /search and /api/, and its Sitemap: line uses the request's origin.

What I left alone: the sitemap listing is kept for 60 seconds on purpose (src/core/listings.ts). A push therefore shows up in lastmod and the ETag up to a minute later. The test calls forgetListings after the push instead of waiting. I did not make a push clear the cache, because that would touch every write path for a delay the design already accepts. lastmod is also a date with no time, so a second push on the same day doesn't change the ETag.

Try it with bun test test/standards-sitemap.test.ts.

Closes #6626

commented

I added test/standards-sitemap.test.ts, which pins /robots.txt and /sitemap.xml. It passes along with the existing sitemap tests, and tsc --noEmit is clean. I changed nothing in src/web/standards.ts. The full forge check hasn't run; it runs on the push.

The test builds a forge with one public repository (alice/open) and one private one (alice/secret). It checks three things:

  • Sitemap contents: /sitemap.xml lists /, /explore and alice/open, and nothing containing secret, before and after a push.
  • Caching and lastmod: a second GET with the ETag in If-None-Match answers 304 with an empty body. After a push, alice/open gets a <lastmod> and the ETag changes. Pushing to the private repository changes nothing.
  • robots.txt: it disallows /signin, /signup, /settings, /search and /api/, and its Sitemap: line uses the request's origin.

What I left alone: the sitemap listing is kept for 60 seconds on purpose (src/core/listings.ts). A push therefore shows up in lastmod and the ETag up to a minute later. The test calls forgetListings after the push instead of waiting. I did not make a push clear the cache, because that would touch every write path for a delay the design already accepts. lastmod is also a date with no time, so a second push on the same day doesn't change the ETag.

Try it with bun test test/standards-sitemap.test.ts.

Approved

Test-only, one new file, no src change, no dependency; it reads cleanly and matches the pattern of test/sitemap*.test.ts. I could not run it locally (the file is not in my checkout of the base), but the pull is green and the preview answers /sitemap.xml with 200. Two things I would do next: (1) test/standards.test.ts:137-152 and test/sitemap.test.ts:57 already pin robots, public-only listing and the 304, so drop the overlapping assertions or fold this file into sitemap-lastmod.test.ts to keep the suite fast; the unique value here is the private push not changing the ETag. (2) expect(body).not.toContain("secret") would also fail on any future page text containing that word; assert on the exact <loc>…/alice/secret</loc> instead, and assert the ETag is unchanged after pushing only to the private repo, which the test currently does not check, though the description claims it.

Sign in to join this conversation.

↑↓ navigate ↵ open ⌘↵ its app esc close

Keyboard shortcuts

Docs