Skip to content

Make REST token bootstrap cache safe#116

Merged
acodebeard merged 4 commits into
test/finish-frontend-qa-coveragefrom
hardening/rest-bootstrap-cache-safe
Jun 6, 2026
Merged

Make REST token bootstrap cache safe#116
acodebeard merged 4 commits into
test/finish-frontend-qa-coveragefrom
hardening/rest-bootstrap-cache-safe

Conversation

@acodebeard

Copy link
Copy Markdown
Owner

Summary

  • Adds a same-site /bootstrap REST endpoint that returns the per-visitor endpoint token on demand.
  • Stops embedding visitor-specific endpoint tokens in rendered planner HTML so cached pages do not reuse another visitor's token.
  • Updates the frontend to fetch a fresh token before browse/route REST requests.
  • Updates browser fixture routing and tests for the new bootstrap contract.

Verification

  • composer test in plugin/plan-your-day passed: 107 tests, 564 assertions.
  • node --check plugin/plan-your-day/assets/js/plan.js
  • git diff --check
  • npm run browser-smoke passed: 7 tests.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 89549fd8da

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines 1252 to +1253
try {
const requestEndpointToken = await ensureEndpointToken();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Re-check request freshness after token bootstrap

When the first REST request has to wait for /bootstrap, aborting it does not stop execution here because ensureEndpointToken() is not tied to the request's AbortController. If a user quickly changes searches/categories before bootstrap resolves, the stale request resumes after the token arrives and sends its browse/route fetch using the newer global activeRequestController.signal, so cancelled requests still hit the REST API and can consume rate limit/API quota before their response is discarded. Capture the controller/signal for this request or check requestId !== activeRequestId immediately after the bootstrap await before issuing the endpoint fetch.

Useful? React with 👍 / 👎.

@acodebeard acodebeard merged commit 653bcef into test/finish-frontend-qa-coverage Jun 6, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant