Repository navigation
test(spec): vendor the login lockout's Retry-After header, and pin it - #15
Conversation
sasjs/server now generates a headers entry for the 429 on /SASLogon/login; the vendored copy was taken before that and states the header only in the operation description. check:routes compares the route table, which carries no headers, so the copy can drop one without a failure - a new spec names the facts the table cannot carry and fails when the block is removed. Route table unchanged (60 operations).
![sasjs-dev[bot]](https://avatars.githubusercontent.com/u/67858352?s=60&v=4){kind=small}
There was a problem hiding this comment.
REVIEWED ON 2026-11-06 00:33 UTC
Reviewed the full diff: the 429 Retry-After header on /SASLogon/login and the spec test that pins it. The test is picked up by the existing jest run, so the guard is live.
- spec/swagger.yaml:2726 this adds a response header to the published document, but the subject is test(spec): ..., which semantic-release scores as no release. The header only reaches consumers when the package is published, so the title should be feat(spec): ... (or docs(spec): if the vendored document is not shipped in the artefact).
No blocking issues.
|
Checked, and the vendored document is not shipped: That makes this the second case you named: The PR body already said this, which is why I did not re-type it as |
Why
test(spec), and no releaseThe vendored document is not a published artifact:
package.jsondeclares"files": ["build", "README.md", "LICENCE.md"], andnpm pack @sasjs/api@0.3.0containsbuild/,README.mdandLICENCE.mdand nospec/. A consumer reads the document on the server that generates it, not in this package, so nothing an installer gets changes and no release is due.docs(spec)would claim a published description changed;featwould cut a version for a file nobody downloads.What this changes
sasjs/servermerged #541 while this package's #14 was already merged, so the copy ofapi/public/swagger.yamlvendored here was taken one commit earlier: the429on/SASLogon/loginstates theRetry-Afterheader in the operation description but not as aheadersentry, which is where the server's generated document now puts it. This re-vendors the body and adds the header block.check:routescompares the route table derived from the document, and the table carries no response headers, so a header can be dropped by a re-vendor with nothing failing.spec/vendored-document.spec.tsnames the facts the table cannot carry - theheadersentry and the unit in the prose - so a copy that loses one fails in CI. Measured: removing theheadersblock failsstates the Retry-After header the sign-in lockout carries; it passes with it present.Proof
npm test: 9 suites, 131 tests, all passing (coverage thresholds unchanged).npm run check:routes:route table matches the spec (60 operations)- the vendored body adds a response header and changes no route.npm run build: green.sasjs/servermain'sapi/public/swagger.yamlbelow the six-line vendor header.Order
@sasjs/api@0.3.0was published at 00:13:05, 42 seconds beforesasjs/server#541 merged. The sequence the PR bodies called for cannot mislead a consumer here for the reason above - the package ships no document - so the cost of the order is this one stale copy, which this PR corrects.