Skip to content

anonymous-deny.ts docstring will say "Exactly one consumer writes it" after a second writer lands — one sentence to update when #9823 merges #9849

Description

@huangyiirene

Blocked-by: #9823

Found during #9823 (PR #9848), filed unassigned as an observation — the fix there deliberately did not touch this file (outside that card's declared surface).

Observed

packages/core/src/security/anonymous-deny.ts, the ANONYMOUS_DENY_BODY docstring:

Exactly one consumer writes it: @objectstack/rest's enforceAuth
(rest-server.tsres.status(ANONYMOUS_DENY_STATUS).json(ANONYMOUS_DENY_BODY)),
which owns the /data/* and /meta surfaces.

True on main today. Once #9823's PR lands, packages/runtime/src/dispatcher-plugin.ts mountRouteOnServer (the endpoint-route 401 arm) becomes a second verbatim writer, and the sentence reads false — the same docstring class that invited a tolerant-reader bug before (the docstring previously claimed to be "the single shape every seam returns" and was corrected for it).

Suggested fix

One sentence: name both writers (rest enforceAuth + runtime mountRouteOnServer), or reword to "written verbatim by the flat-family seams" with the two named. The two-envelope table in the same docstring already distinguishes the families correctly and needs no change. Docs-only, no wire effect, no gate involvement.


Generated by Claude Code

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions