Skip to content

@objectstack/runtime@16.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Jul 01:08
@objectstack/runtime@16.1.0
76f18c2

Patch Changes

  • 818e6a3: fix(server-timing): emit the per-request, admin-gated Server-Timing header on the standard server (os serve/dev) (#3361)

    The per-request Server-Timing path (#2408) — where an admin sends
    X-OS-Debug-Timing: 1 (or json) and gets phase timings while an ordinary user
    gets nothing — never emitted on the shipped Hono server. The disclosure gate the
    Hono middleware opens is only ever flipped by the runtime dispatcher's
    timedResolveExecutionContext, but the data (/api/v1/data/*) and metadata
    (/api/v1/meta/*) routes on os serve/dev are served by @objectstack/rest's
    RestServer (which shadows the Hono plugin's own CRUD), and its identity
    resolver never opened the gate. Only global mode (OS_SERVER_TIMING=true) — which
    discloses to every caller, not just admins — worked.

    • observability: the disclosure predicate isPerfDisclosurePrincipal(ec) now
      lives here (the home of the gate), the single definition of "who may pull
      per-request timings" shared by every HTTP entry point. @objectstack/runtime
      re-exports it for back-compat.
    • rest: RestServer.resolveExecCtx opens the gate for an admin/service
      principal (via the carried posture rung), the REST-server analog of the
      dispatcher — this is the fix that makes os serve/dev emit.
    • plugin-hono-server: the standalone CRUD surface's self-contained
      resolveCtx opens the gate too (deriving the rung for the gate decision only,
      never writing it onto the enforcement context). Adds an e2e test that boots the
      Hono app and asserts an admin gets Server-Timing while a member/anon does not.

  • Updated dependencies [9e45b63]

  • Updated dependencies [b20201f]

  • Updated dependencies [818e6a3]

    • @objectstack/spec@16.1.0
    • @objectstack/core@16.1.0
    • @objectstack/observability@16.1.0
    • @objectstack/rest@16.1.0
    • @objectstack/metadata@16.1.0
    • @objectstack/plugin-auth@16.1.0
    • @objectstack/plugin-security@16.1.0
    • @objectstack/formula@16.1.0
    • @objectstack/metadata-core@16.1.0
    • @objectstack/objectql@16.1.0
    • @objectstack/driver-memory@16.1.0
    • @objectstack/driver-sql@16.1.0
    • @objectstack/driver-sqlite-wasm@16.1.0
    • @objectstack/service-cluster@16.1.0
    • @objectstack/service-datasource@16.1.0
    • @objectstack/service-i18n@16.1.0
    • @objectstack/types@16.1.0
Assets 2
Loading