main · last commit
17 hours ago ·
skqvdbd8
sr-ht-compare-vos Mount compare's /static/ with chimw.GetHead instead of r.Handle
Lined Up
bd update sr-ht-compare-vos --claim
bd close sr-ht-compare-vos
| Created by | bigbes |
| Owner | bigbes@gmail.com |
| Created | 2026-08-17T21:37:45Z |
| Updated | 2026-08-17T21:37:45Z |
What is wrong: sourcehut-compare/web/router.go mounts static assets with 'r.Handle(assets.DefaultPrefix+"*", s.static)', which registers every HTTP method. Two other idioms exist in the family: chimw.GetHead(...) in artifacts/bench/curator/tokens, and r.Mount(...) in specs. compare and dolt both use r.Handle. Why it matters: with r.Handle or r.Mount, a same-origin POST to e.g. /static/main.min.<sha>.css is served the file with a 200 instead of compare's rendered 405 — harmless today, but the routing tree no longer describes what the service actually serves, which is exactly the argument chimw.GetHead's own doc makes for registering the GET/HEAD pair explicitly instead of accepting every method. Correct variant: chimw.GetHead, e.g. repo/path sourcehut-tokens/web/router.go static mount. Fix: sourcehut-compare/web/router.go — replace 'r.Handle(assets.DefaultPrefix+"*", s.static)' with 'chimw.GetHead(r, assets.DefaultPrefix+"*", s.static)' (or the service's existing GetHead wrapper). Audit: D38 (cross-repo audit, 2026-08-17)
No outgoing dependencies.
Nothing depends on this issue.
| id | sr-ht-compare-vos |
| content_hash | 6708ad7c99bfd4b1bd2621479d3f656f6fdd32d05874a9fccbd554b3d53ace1c |
| title | Mount compare's /static/ with chimw.GetHead instead of r.Handle |
| description | What is wrong: sourcehut-compare/web/router.go mounts static assets with 'r.Handle(assets.DefaultPrefix+"*", s.static)', which registers every HTTP method. Two other idioms exist in the family: chimw.GetHead(...) in artifacts/bench/curator/tokens, and r.Mount(...) in specs. compare and dolt both use r.Handle. Why it matters: with r.Handle or r.Mount, a same-origin POST to e.g. /static/main.min.<sha>.css is served the file with a 200 instead of compare's rendered 405 — harmless today, but the routing tree no longer describes what the service actually serves, which is exactly the argument chimw.GetHead's own doc makes for registering the GET/HEAD pair explicitly instead of accepting every method. Correct variant: chimw.GetHead, e.g. repo/path sourcehut-tokens/web/router.go static mount. Fix: sourcehut-compare/web/router.go — replace 'r.Handle(assets.DefaultPrefix+"*", s.static)' with 'chimw.GetHead(r, assets.DefaultPrefix+"*", s.static)' (or the service's existing GetHead wrapper). Audit: D38 (cross-repo audit, 2026-08-17) |
| design | |
| acceptance_criteria | |
| notes | |
| status | open |
| priority | 3 |
| issue_type | chore |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-08-17T21:37:45Z |
| created_by | bigbes |
| owner | bigbes@gmail.com |
| updated_at | 2026-08-17T21:37:45Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | �{} |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | NULL |
| is_blocked | 0 |
| id | 01a011a8-b7ad-7290-8727-1a9c80670da7 |
| issue_id | sr-ht-compare-vos |
| event_type | created |
| actor | bigbes |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-08-18T00:37:44Z |
No comments.