Add the public recommender scorecard read to the curation desk gateway - #96
Conversation
Sixth public curation desk read: GET /private-api/curation-desk/recommender/{username}
pipes to curation/desk/recommenders/<username> through the same path as the other
public reads, so the shared secret, the byte memo, the single flight and the public
payload fence all apply to it unchanged.
The unconfigured 503 is decided before the route value is read, so a dark desk
answers every route alike instead of reporting on this one's name grammar. The name
is validated against the Hive name grammar and escaped before the URL is built; the
route takes no query parameters, so one name is one memo entry and one shared-cache
key. Its own policy holds a scorecard for a minute: the numbers behind it are a
rolling 90-day count recomputed in the background.
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (12)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughChangesCuration desk recommender
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to This adds a validated, cached recommender scorecard endpoint with authenticated upstream access and filtered public responses. Current coverage supports the intended behavior, with no concrete merge-blocking risk identified. Sequence Diagram(s)sequenceDiagram
participant Client
participant CurationDeskRecommender
participant CurationDeskRecommenderPath
participant ServeDeskRead
participant Upstream
Client->>CurationDeskRecommender: GET /private-api/curation-desk/recommender/{username}
CurationDeskRecommender->>CurationDeskRecommenderPath: Validate username and build upstream path
CurationDeskRecommender->>ServeDeskRead: Serve read with 60-second cache policy
ServeDeskRead->>Upstream: Request scorecard with desk token
Upstream-->>ServeDeskRead: Return scorecard JSON
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 27.59% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 29 functions across 11 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Summary by QodoExpose recommender scorecards through the curation desk gateway
AI Description
Diagram
High-Level Assessment
Files changed (9)
|
Code Review by Qodo
1.
|
![qodo-free-for-open-source-projects[bot]](https://avatars.githubusercontent.com/in/1068000?s=60&v=4){kind=small}
A `[a-z0-9.-]{3,16}` class accepts `-ab`, `abc-`, `a..b`, `ab.cdef` and
`...`, none of which is a Hive account name, so those requests went
upstream with the desk token instead of answering 400. `HiveNames`
walks the name the way the chain's `is_valid_account_name` does: labels
of three or more characters, each starting with a letter and ending with
a letter or digit; a trailing dot is rejected as well. Both desk path
helpers use it. Regression cases cover each rejected shape and the
valid edges (`a-b`, multi-label names).
… file The service only receives the variables the stack file names, so a `docker stack deploy` from this file left the desk routes at 503 whatever the host exported. Names only; values stay on the host.
1 participant
Adds
GET /private-api/curation-desk/recommender/{username}, a sixth public curation desk read, piping to the desk backend's recommender scorecard ({username, window_days, recommended, curated, dismissed, withdrawn, precision, trusted, computed_at}).Why: the web client shows each recommender's 90-day scorecard and a trusted chip next to recommender names, which needs a public read of its own.
It goes through the same path as the other public reads: shared secret on the upstream call, byte memo with single flight and last-good fallback, public payload fence. The unconfigured 503 is decided before the route value is read, the username is validated against the Hive name grammar and escaped before the URL is built, and the route takes no query parameters, so one name is one memo entry. Policy
public, max-age=0, s-maxage=60.Test plan:
dotnet buildanddotnet testgreen (414 tests). New cases cover the path grammar, the 503 while unconfigured, the 400 before any upstream call, the piped call with its token header, Cache-Control on a 200 JSON body only, a memo hit offering the remaining window with no Age header, name-only cache keying and the payload fence on served and memoized bytes. ParityKNOWN_DIVERGENCESgained the new route.Summary by CodeRabbit
New Features
Performance