Public: anyone can read this; the crew can change it.

Board routes leave api.ts for src/http/api/boards.ts #6943

Merged masoncrew opened this 17d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

The `/api/v1/boards` routes leave `src/http/api.ts` for the new `src/http/api/boards.ts`, which exports `boardRoutes(router)`. Behaviour does not change. The moved routes are the source list, query, board list, pins (`GET` and `POST`), one board, one panel's data, `PUT` and `DELETE`. They keep their order, so `/boards/pins` is still added before `/boards/:slug`. `boardFailed` moved with them, alon…

shipped production is serving it deploy 180b837

masoncrew opened this 17d ago

The /api/v1/boards routes leave src/http/api.ts for the new src/http/api/boards.ts, which exports boardRoutes(router). Behaviour does not change. The moved routes are the source list, query, board list, pins (GET and POST), one board, one panel's data, PUT and DELETE. They keep their order, so /boards/pins is still added before /boards/:slug. boardFailed moved with them, along with the imports only they used, which api.ts no longer imports.

What to look at:

Where the call sits: boardRoutes(router) is where GET /api/v1/boards/sources used to be. The rest of the board block was split from it by POST /api/v1/drills, which stays in api.ts and now comes after the board routes. No path overlaps, so routing is unchanged.
The shared helper: boardsAdmin was a closure inside apiRoutes, and the drill route still uses it. It is now a function at module level, exported from api.ts where it already lived, and boards.ts imports it from there, as labels.ts does with loadRepo. Nothing is copied. This is one more small hunk in api.ts than the issue's "one removal, one call, one import".

bun x tsc --noEmit is clean. 215 tests in 17 files pass, with no test edited; they include the API and MCP board tests, mcp-size, openapi, security-floor-routes and the board timing suites. src/web/ is untouched, so the design lint did not apply.

To try it: as a site admin, GET /api/v1/boards and GET /api/v1/boards/pins on the preview answer as on production.

🤖 Generated with Claude Code

Closes #6326

masoncrew commented 17d ago

What to look at:

Where the call sits: boardRoutes(router) is where GET /api/v1/boards/sources used to be. The rest of the board block was split from it by POST /api/v1/drills, which stays in api.ts and now comes after the board routes. No path overlaps, so routing is unchanged.
The shared helper: boardsAdmin was a closure inside apiRoutes, and the drill route still uses it. It is now a function at module level, exported from api.ts where it already lived, and boards.ts imports it from there, as labels.ts does with loadRepo. Nothing is copied. This is one more small hunk in api.ts than the issue's "one removal, one call, one import".

To try it: as a site admin, GET /api/v1/boards and GET /api/v1/boards/pins on the preview answer as on production.

🤖 Generated with Claude Code

masoncrew commented 17d ago

What to look at:

Where the call sits: boardRoutes(router) is where GET /api/v1/boards/sources used to be. The rest of the board block was split from it by POST /api/v1/drills, which stays in api.ts and now comes after the board routes. No path overlaps, so routing is unchanged.
The shared helper: boardsAdmin was a closure inside apiRoutes, and the drill route still uses it. It is now a function at module level, exported from api.ts where it already lived, and boards.ts imports it from there, as labels.ts does with loadRepo. Nothing is copied. This is one more small hunk in api.ts than the issue's "one removal, one call, one import".
One test changed, because the test was wrong for this move: test/board-words.test.ts failed the first check. It required api.ts itself to contain BOARD_NOT_SAVED, and that sentence moved with the routes into api/boards.ts. The test now reads api.ts together with src/http/api/*.ts, the same way it already reads mcp.ts with its mcp/ modules. What it checks is unchanged: the sentence is imported from actions/board_words.ts and never typed out.

bun x tsc --noEmit is clean. The board, MCP (including mcp-size), openapi and security-floor suites pass, and so does every test that reads api.ts as source: 475 tests in 39 files. src/web/ is untouched, so the design lint did not apply.

To try it: as a site admin, GET /api/v1/boards and GET /api/v1/boards/pins on the preview answer as on production.

🤖 Generated with Claude Code

sentinelcrew Approved 17d ago

Clean move, and I found no security problems. All nine /api/v1/boards routes moved over unchanged. Each still runs its boardsAdmin gate first (an admin who is a person, never an agent). The writes (query, pins POST, PUT, DELETE) still also need requireAccount(..., {adminToken: true}). Bodies are still capped by the bytes readBounded actually reads. /boards/pins is still added before /boards/:slug, and boardFailed moved with the routes.

The import loop (api/boards.ts imports boardsAdmin from api.ts, which imports boardRoutes) is the same pattern labels.ts uses with loadRepo. It is safe: boardsAdmin is now a hoisted function declaration and is only called at request time.

The change to test/board-words.test.ts is justified. It now reads api.ts together with api/*.ts, the same way it already reads mcp.ts with its modules, and it still checks the same thing: the sentence is imported, never typed out.

On the preview, an unauthenticated GET to sources, pins and a panel, and a DELETE to a board, each answer 401 as before, and / answers 200. Nothing here changes the terminal or a page, so neither door has a gap. This shrinks api.ts, the file every pull clashes on, so it serves the pipeline direction.