~bigbes/sr-ht-dolt · parade

main · last commit 5 hours ago · ti41arbu

← Back to the parade

sr-ht-dolt-w9p Mount middleware.PrivateCache on the /query GraphQL route Lined Up

status: open P2 bug
bd update sr-ht-dolt-w9p --claim bd close sr-ht-dolt-w9p
Created byEugene Blikh
Ownerbigbes@gmail.com
Created2026-08-17T20:39:10Z
Updated2026-08-17T20:39:10Z
Description
What is wrong: the chi Group mounting `/query` in `sourcehut-dolt/cmd/doltsrht/main.go` carries RealIP/log/config/database middleware but never `middleware.PrivateCache`. dolt's GraphQL schema answers per-credential and also answers anonymous callers, so the same URL can yield different response bodies to different viewers with nothing marking that in the response headers.

Why it matters: ranked as a lower-severity correctness risk than the REST equivalent (D03) because POST bodies are not normally cached by intermediaries — but it becomes live risk the moment GET-query support or a GraphQL-aware cache sits in front of the service.

Sibling that already does it correctly: `sourcehut-curator/graph/graph.go::Mount` and `sourcehut-artifacts/graph/graph.go::privateCache`, both of which set `no-store` + `Vary: Authorization, Cookie` on the `/query` route.

Fix: add `r.Use(middleware.PrivateCache)` to the chi Group mounting `/query` in `cmd/doltsrht/main.go`.

Status: verified by the underlying report.

Audit: D14 (cross-repo audit, 2026-08-17)

Depends on

No outgoing dependencies.

Depended on by

Nothing depends on this issue.

No comments.

  • Eugene Blikh created the issue · 2026-08-17T23:39:10Z
Stored rows — what this pane was built from, as read
issues 1 row
id sr-ht-dolt-w9p
content_hash 9dda36b62370ee29df3aecaf80b94cc108302d1c9c2493aeedd3a8a64016ac54
title Mount middleware.PrivateCache on the /query GraphQL route
description What is wrong: the chi Group mounting `/query` in `sourcehut-dolt/cmd/doltsrht/main.go` carries RealIP/log/config/database middleware but never `middleware.PrivateCache`. dolt's GraphQL schema answers per-credential and also answers anonymous callers, so the same URL can yield different response bodies to different viewers with nothing marking that in the response headers. Why it matters: ranked as a lower-severity correctness risk than the REST equivalent (D03) because POST bodies are not normally cached by intermediaries — but it becomes live risk the moment GET-query support or a GraphQL-aware cache sits in front of the service. Sibling that already does it correctly: `sourcehut-curator/graph/graph.go::Mount` and `sourcehut-artifacts/graph/graph.go::privateCache`, both of which set `no-store` + `Vary: Authorization, Cookie` on the `/query` route. Fix: add `r.Use(middleware.PrivateCache)` to the chi Group mounting `/query` in `cmd/doltsrht/main.go`. Status: verified by the underlying report. Audit: D14 (cross-repo audit, 2026-08-17)
design
acceptance_criteria
notes
status open
priority 2
issue_type bug
assignee NULL
estimated_minutes NULL
created_at 2026-08-17T20:39:10Z
created_by Eugene Blikh
owner bigbes@gmail.com
updated_at 2026-08-17T20:39:10Z
closed_at NULL
closed_by_session
external_ref NULL
spec_id
compaction_level 0
compacted_at NULL
compacted_at_commit NULL
original_size NULL
sender
ephemeral 0
wisp_type
pinned 0
is_template 0
mol_type
work_type
source_system
metadata �{}
source_repo
close_reason
event_kind
actor
target
payload
await_type
await_id
timeout_ns 0
waiters
hook_bead
role_bead
agent_state
last_activity NULL
role_type
rig
due_at NULL
defer_until NULL
no_history 0
started_at NULL
is_blocked 0
events 1 row
id 01a01173-1646-7aba-8368-7b6c4923c7fa
issue_id sr-ht-dolt-w9p
event_type created
actor Eugene Blikh
old_value
new_value
comment NULL
created_at 2026-08-17T23:39:10Z