Skip to content

api: raise batch request-target guard to 16 KiB - #69

Open
Kzoeps wants to merge 4 commits into
mainfrom
api/batch-guard-16kb
Open

Kzoeps wants to merge 4 commits into
mainfrom
api/batch-guard-16kb

Conversation

@Kzoeps

@Kzoeps Kzoeps commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator

Problem

Batch queries rejected 100 typical AT-URIs (~10.5 KB encoded) because the request-target guard was 7,000 bytes. getReactionCounts and getActorReactions had no guard.

Fix

  • Guard raised to 16,384 encoded bytes (moved to lua/shared/batchRequestTarget.lua); reaction batch endpoints now use it.
  • Overflow still returns 500 script_error with an InvalidRequest: message: pinned HappyView 2.13.0 maps every Lua error() to 500, and scripts can't set a status.
  • Tests: 100 typical URIs pass, oversize rejected. Lexicon descriptions, docs, skill refs and client regenerated. Changeset added.

…ion batches

100 typical hypercert AT-URIs encode to ~10.5 KB and were rejected by the
7000-byte guard. getReactionCounts and getActorReactions now share the guard.
Overflow stays a 500 script_error: the pinned HappyView 2.13.0 maps every
Lua error() to 500 and offers no way for a script to set the status.
Reaction bundles only need the byte guard, not follow_batch_targets, which
luacheck flags as unused there. Old oversize fixtures for getFollows and
getFollowerCounts fit under 16 KiB, so they are enlarged to stay oversize.
Covers getFollows, getEntityFollows, getFollowerCounts and getCommentCounts,
and adds the limit to getReactionCounts and getActorReactions. Regenerates
the explorer snapshots and API client; updates the skill references.
@vercel

vercel Bot commented Nov 13, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
api-endpoints Ready Ready Preview Nov 13, 2026 11:15am UTC

Request Review

@coderabbitai

coderabbitai Bot commented Nov 13, 2026

Copy link
Copy Markdown

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 45 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 3f4f3e4a-025d-4265-9860-fc0944692142
Commits

Reviewing files that changed from the base of the PR and between ab7620b and 7ad8bba.

Files selected for processing: 39

  • .agents/skills/hypercerts-api/references/endpoint-map.md
  • .agents/skills/hypercerts-api/references/openapi.json
  • .agents/skills/hypercerts-api/references/request-patterns.md
  • .changeset/batch-request-target-16kb.md
  • docs/openapi.json
  • docs/sources/lexicons/app.certified.feed.getActorReactions.json
  • docs/sources/lexicons/app.certified.feed.getReactionCounts.json
  • docs/sources/lexicons/app.certified.graph.getEntityFollows.json
  • docs/sources/lexicons/app.certified.graph.getFollowerCounts.json
  • docs/sources/lexicons/app.certified.graph.getFollows.json
  • docs/sources/lexicons/org.hypercerts.context.getCommentCounts.json
  • happyview-modules/README.md
  • happyview-modules/lexicons/app.certified.feed.getActorReactions.json
  • happyview-modules/lexicons/app.certified.feed.getReactionCounts.json
  • happyview-modules/lexicons/app.certified.graph.getEntityFollows.json
  • happyview-modules/lexicons/app.certified.graph.getFollowerCounts.json
  • happyview-modules/lexicons/app.certified.graph.getFollows.json
  • happyview-modules/lexicons/org.hypercerts.context.getCommentCounts.json
  • happyview-modules/lua/endpoints/getActorReactions.lua
  • happyview-modules/lua/endpoints/getCommentCounts.lua
  • happyview-modules/lua/endpoints/getEntityFollows.lua
  • happyview-modules/lua/endpoints/getFollowerCounts.lua
  • happyview-modules/lua/endpoints/getFollows.lua
  • happyview-modules/lua/endpoints/getReactionCounts.lua
  • happyview-modules/lua/shared/batchRequestTarget.lua
  • happyview-modules/lua/shared/feedActorReactions.lua
  • happyview-modules/lua/shared/followBatch.lua
  • happyview-modules/lua/src/getReactionCounts.lua
  • happyview-modules/modules/actor-follow/manifest.json
  • happyview-modules/modules/context-attachments/manifest.json
  • happyview-modules/modules/entity-follow/manifest.json
  • happyview-modules/modules/feed-reactions/manifest.json
  • happyview-modules/modules/follower-counts/manifest.json
  • happyview-modules/tests/unit/tooling/actor-follow.test.js
  • happyview-modules/tests/unit/tooling/comment-counts.test.js
  • happyview-modules/tests/unit/tooling/feed-reactions.test.js
  • happyview-modules/tests/unit/tooling/follower-counts.test.js
  • packages/api/src/lexicons/app/certified/graph/getEntityFollows.defs.ts
  • packages/api/src/lexicons/app/certified/graph/getFollows.defs.ts
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@changeset-bot

changeset-bot Bot commented Nov 13, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 7ad8bba

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
Name Type
@hypercerts-org/happyview-modules Patch
@hypercerts-org/api Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@sonarqubecloud

Copy link
Copy Markdown

❌ The last analysis has failed.

See analysis details on SonarQube Cloud

This branch was successfully deployed

1 active deployment
Preview — 7ad8bbaf Deployed Nov 13, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant