fix(api): carry Allow on the TypeScript handlers' 405 responses by ayobamiseun · Pull Request #9882 · koala73/worldmonitor

ayobamiseun · 2026-10-30T09:48:04Z

Summary

Follow-up to #9876 (eight primary entry points) and #9881 (six legacy JS handlers). RFC 9110 §15.5.6 requires a 405 response to name the supported methods in Allow. Twenty TypeScript handlers still answered without it. With this PR every single-line 405 site under api/ and server/ carries the header.

Handler	Allow
`latest-brief.ts`, `symbol-search.ts`, `referral/me.ts`	`GET, OPTIONS`
`chat-analyst.ts`, `invalidate-user-api-key-cache.ts`, `notify.ts`, `create-checkout.ts`, `brief/share-url.ts`, `skills/fetch-agentskills.ts`, `oauth/token.ts`, `v2/shipping/webhooks/[subscriberId]/[action].ts`	`POST, OPTIONS`
`customer-portal.ts`, `widget-agent.ts`, `notification-channels.ts`	`GET, POST, OPTIONS`
`brief/carousel/…`, `brief/public/[hash].ts`, `brief/[userId]/[issueDate].ts`	`GET, HEAD, OPTIONS`
`v2/shipping/webhooks/[subscriberId].ts`	`GET, DELETE, OPTIONS`
`channel-oauth-bind.ts`, `internal/brief-why-matters.ts` (no CORS preflight)	`POST`

Bodies, status codes and other headers are unchanged. oauth/token.ts and internal/brief-why-matters.ts now build the same response inline so the header can be added (their local helpers take no headers argument).

Tests

New tests/api-405-allow-header-ts.test.mjs drives all twenty handlers with a refused method and asserts Allow. Where the handler answers OPTIONS with the same list, the preflight's Access-Control-Allow-Methods is checked too. widget-agent and notification-channels authenticate before their method guard, so the suite supplies the widget key via env and a stubbed bearer session through __setNotificationChannelsDepsForTests.

Red proof: with the handler edits stashed, the 20 refusal cases fail and the 14 preflight cases stay green.

Verification

tests/api-405-allow-header-ts.test.mjs — 34 pass
45 neighbouring suites for the touched handlers (oauth-token, latest-brief, notification-channels, symbol-search, create-checkout, customer-portal, brief-*, widget-agent, referral, chat-analyst, notify, shipping-webhook, fetch-agentskills, channel-oauth, …) — 768 pass, 0 fail
npm run typecheck:api, git diff --check — clean; the one Biome info on symbol-search.ts:175 predates this change

Summary by CodeRabbit

Bug Fixes
- API responses for unsupported request methods now include an Allow header listing the methods accepted by each endpoint. Existing error statuses and messages remain unchanged.
- CORS-enabled endpoints retain their existing headers, and applicable preflight requests continue to report the supported methods. This makes the accepted methods clearer to API clients when a request is rejected.

Follow-up to the eight primary entry points and the six legacy JS handlers. RFC 9110 §15.5.6 requires a 405 to name the supported methods; twenty TypeScript handlers still answered without `Allow`: latest-brief, chat-analyst, customer-portal, invalidate-user-api-key-cache, channel-oauth-bind, notify, create-checkout, widget-agent, symbol-search, notification-channels, referral/me, oauth/token, internal/brief-why-matters, brief/share-url, skills/fetch-agentskills, the three brief document routes and the two v2 shipping webhook routes. Each guard now carries `Allow` equal to the methods the handler actually accepts (its preflight list where it has one). Bodies, status codes and other headers are unchanged; oauth/token and brief-why-matters build the same response they did with the header added. A new suite drives all twenty handlers with a refused method. widget-agent and notification-channels authenticate before their method guard, so the suite supplies the widget key and a stubbed bearer session through the handler's test seam. Where the handler answers OPTIONS with the same list the preflight is checked too. Red proof: with the handler edits stashed, the 20 refusal cases fail and the 14 preflight cases stay green.

vercel · 2026-10-30T09:48:09Z

@ayobamiseun is attempting to deploy a commit to the World Monitor Team on Vercel.

A member of the Team first needs to authorize it.

strix-security · 2026-10-30T09:48:12Z

Strix Security Review

✅ No open security findings.

PR summary: This PR adds the RFC 9110–required `Allow` header to the 405 method-not-allowed responses of twenty TypeScript API handlers under `api/`, and adds a test suite asserting the header (and preflight method list) for each handler.

Review summary

Reviewed all 21 changed files. The diff is confined to adding a static Allow header to method-not-allowed (405) responses in twenty TypeScript API handlers, with two handlers (channel-oauth-bind.ts, internal/brief-why-matters.ts) inlining the same body/status in order to attach it. I verified each new response construction references identifiers that actually exist in the file (jsonResponse in api/_json-response.ts, HEADERS in channel-oauth-bind.ts, NO_STORE/corsHeaders in oauth/token.ts), that the Allow values are hardcoded literals with no request input reaching them, that the object spread preserves the pre-existing CORS and cache headers, and that each advertised method list matches the handler's real OPTIONS/GET/POST guard branches. No authentication, authorization, input-validation, or data-flow logic is touched, no security control is removed, and static analysis on the modified files is clean. No security issues found.

_{Review 1 on this PR · 7ff6dc9 · requested Oct 30 09:48 UTC when the PR was opened}

Reviewed by Strix
_{Re-run review · Configure security review settings}

coderabbitai · 2026-10-30T09:49:32Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: fe4efe6c-cea6-4859-8782-46c91e0a370c

Commits

Reviewing files that changed from the base of the PR and between c9176af and 7ff6dc9.

Files selected for processing: 21

api/brief/[userId]/[issueDate].ts
api/brief/carousel/[userId]/[issueDate]/[page].ts
api/brief/public/[hash].ts
api/brief/share-url.ts
api/channel-oauth-bind.ts
api/chat-analyst.ts
api/create-checkout.ts
api/customer-portal.ts
api/internal/brief-why-matters.ts
api/invalidate-user-api-key-cache.ts
api/latest-brief.ts
api/notification-channels.ts
api/notify.ts
api/oauth/token.ts
api/referral/me.ts
api/skills/fetch-agentskills.ts
api/symbol-search.ts
api/v2/shipping/webhooks/[subscriberId].ts
api/v2/shipping/webhooks/[subscriberId]/[action].ts
api/widget-agent.ts
tests/api-405-allow-header-ts.test.mjs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

Walkthrough

Twenty API handlers now include endpoint-specific Allow headers in method-not-allowed responses. A new test suite checks the 405 responses and, for selected handlers, OPTIONS preflight responses.

Changes: API method contracts

Layer / File(s)	Summary
405 responses and coverage `api/brief/[userId]/[issueDate].ts`, `api/brief/carousel/[userId]/[issueDate]/[page].ts`, `api/brief/public/[hash].ts`, `api/brief/share-url.ts`, `api/channel-oauth-bind.ts`, `api/chat-analyst.ts`, `api/create-checkout.ts`, `api/customer-portal.ts`, `api/internal/brief-why-matters.ts`, `api/invalidate-user-api-key-cache.ts`, `api/latest-brief.ts`, `api/notification-channels.ts`, `api/notify.ts`, `api/oauth/token.ts`, `api/referral/me.ts`, `api/skills/fetch-agentskills.ts`, `api/symbol-search.ts`, `api/v2/shipping/webhooks/[subscriberId].ts`, `api/v2/shipping/webhooks/[subscriberId]/[action].ts`, `api/widget-agent.ts`, `tests/api-405-allow-header-ts.test.mjs`	The handlers add endpoint-specific `Allow` headers to their 405 responses. The new tests check the expected header values and selected OPTIONS preflight responses.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

koala73/worldmonitor#9881: Adds Allow headers to 405 responses in six legacy JavaScript handlers.
koala73/worldmonitor#9876: Adds Allow headers to other handlers as part of the same API method-contract update.
koala73/worldmonitor#8378: Changes the CORS method configuration for the shipping webhook action handler, which this PR also updates.

Suggested reviewers: koala73

Merge Risk: Minimal · up to 7ff6d

The handlers advertise their supported methods in 405 responses. No merge-blocking issue was identified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: adding Allow headers to 405 responses in TypeScript API handlers.
Description check		The description provides a detailed summary, affected handlers, method mappings, test coverage, verification results, and implementation notes. It omits some template headings and checklist selections…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description provides a detailed summary, affected handlers, method mappings, test coverage, verification results, and implementation notes. It omits some template headings and checklist selections, but the required change context and validation details are substantially complete.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 20 functions across 21 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

greptile-apps · 2026-10-30T09:50:28Z

Confidence Score: 5/5

[Medium impact] This PR appears safe to merge.

Summary

Adds Allow headers to 405 responses in twenty TypeScript handlers.

API callers see supported methods when a route rejects a request.

_{Reviews (1) · Last reviewed commit: "fix(api): carry Allow on the TypeScript ..." · Reviewed by Greptile}

koala73 · 2026-11-03T09:36:42Z

Reviewed exact head 7ff6dc91c36126c7a140af36cec3a4b6e71222b4 against current main and the mandatory-response-header follow-up in #4840.

No verified code defect found. All twenty advertised method lists match their guards; the rewritten HTML/JSON responses preserve their bodies, status and cache headers. Node 24 focused handler proof passes 34/34, npm run typecheck:api passes with this head's locked dependencies, and git diff --check passes. This is a useful, scoped completion of the TypeScript 405 part; it does not complete the separate gateway authentication work.

Feedback review found no unresolved inline thread. The automated request for docstrings on twenty unchanged handler bodies would add unrelated churn to a header-only correction, so I am leaving that advisory unchanged.

GitHub reports MERGEABLE. Required checks pass, while the Vercel status is failed because the contributor deployment needs team authorization. I have not authorized that gate. Sequential correctness, testing, maintainability, standards, agent-accessibility, security/API, adversarial and prior-feedback lenses were performed in this chat. No independent cross-model review ran under this lane's no-subagent constraint; this is not an independent approval or a claim of full merge readiness.

This was referenced Nov 3, 2026

fix(api): carry Allow on the legacy handlers' 405 responses #9881

Open

fix(api): carry Allow on eight more 405 responses #9876

Open

Navigation Menu

Repository navigation

fix(api): carry Allow on the TypeScript handlers' 405 responses - #9882

fix(api): carry Allow on the TypeScript handlers' 405 responses#9882
ayobamiseun wants to merge 1 commit into
koala73:mainfrom
ayobamiseun:fix/allow-on-405-ts-handlers

ayobamiseun commented Oct 30, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Oct 30, 2026

Uh oh!

strix-security Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

koala73 commented Nov 3, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ayobamiseun commented Oct 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Tests

Verification

Summary by CodeRabbit

Uh oh!

vercel Bot commented Oct 30, 2026

Uh oh!

strix-security Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Strix Security Review

Uh oh!

coderabbitai Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

koala73 commented Nov 3, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ayobamiseun commented Oct 30, 2026 •

edited by coderabbitai Bot

Loading

strix-security Bot commented Oct 30, 2026 •

edited

Loading

coderabbitai Bot commented Oct 30, 2026 •

edited

Loading

greptile-apps Bot commented Oct 30, 2026 •

edited

Loading