docs: the history phrases the id sweep missed, restated as present-tense facts or traps (#6277)
release / govulncheck (push) Successful in 19s
release / web (push) Successful in 1m14s
release / go (push) Successful in 1m43s
release / integration (push) Successful in 5m18s
release / android (push) Successful in 5m33s
release / Build signed APK (releases and dev) (push) Successful in 5m40s
release / Attach APK to the Release (tag releases only) (push) Skipped
release / Build + push container image (push) Successful in 25s
release / Verify release artifacts (tag releases only) (push) Skipped

A wider pass for "previous", "before the fix", "we shipped" and the
like. The chi double-subtree, uppercase Vorbis key and stopPropagation
comments now describe the trap they guard; commit hashes, CI run
numbers and a deleted file name are gone; uuidString's comment says
what it returns.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
2026-10-23 12:43:11 -04:00
co-authored by Claude Opus 5.5
parent 10d50dccbd
commit 9f588b6d61
12 changed files with 32 additions and 39 deletions
+7 -9
View File
@@ -150,13 +150,12 @@ func TestRouter_RestPathNotSwallowedBySPA(t *testing.T) {
}
}
// TestRouter_AdminSubtreeNotShadowed is a regression test for a real bug we
// shipped in 06a1fe1 and didn't catch until M6a: r.Route("/api/admin", ...)
// in server.go was creating a second chi subtree at the same prefix as the
// nested admin Route inside api.Mount. chi.Walk shows both subtrees as
// registered, but runtime routing dispatch only matches one — every admin
// endpoint registered by api.Mount (summary, quarantine, etc.)
// silently 404'd for authenticated callers in production.
// TestRouter_AdminSubtreeNotShadowed guards the trap of a second
// r.Route("/api/admin", ...) in server.go: it creates a chi subtree at the
// same prefix as the nested admin Route inside api.Mount. chi.Walk shows both
// subtrees as registered, but runtime routing dispatch only matches one, so
// every admin endpoint registered by api.Mount (summary, quarantine, etc.)
// would silently 404 for authenticated callers.
//
// chi.Walk enumeration would NOT have caught this (both branches are in
// the tree). The only reliable check is to make a real authenticated
@@ -214,8 +213,7 @@ func TestRouter_AdminSubtreeNotShadowed(t *testing.T) {
// Each path is registered by a different package: admin/summary from
// api.Mount and admin/scan from server.Router. If chi runtime dispatch
// only routes one /api/admin subtree, one of these returns 404 — that
// IS the bug we shipped in 06a1fe1.
// only routes one /api/admin subtree, one of these returns 404.
cases := []struct {
method string
path string