feat(api): send X-Spoo-Client header on backend requests - #3
Conversation
Every request to the spoo.me API now carries X-Spoo-Client: cli/<version> so the backend can attribute traffic by client. The version is injected by goreleaser and falls back to a bare cli value when it does not fit the allowed charset. Only backend hosts receive the header.
|
Warning Review limit reached
Next review available in: 53 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe CLI release build now injects its version into the API package. API requests and inspect requests send a validated ChangesAPI attribution
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant GoReleaser
participant CLI
participant API
GoReleaser->>CLI: Inject release version
CLI->>API: Send X-Spoo-Client header
API-->>CLI: Return HTTP response
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
internal/api/inspect.go (1)
31-31: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd regression coverage for
Inspect.
InspectbypassesClient.send, so the existingTestDoSendsClientHeaderdoes not exercise this new HEAD-request path. Add anhttptestcase assertingX-Spoo-Client == cli/devand confirming redirects are not followed.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/api/inspect.go` at line 31, Add regression coverage for the Inspect HEAD-request path, which bypasses Client.send. Extend or add an httptest case around Inspect that asserts the X-Spoo-Client header equals cli/dev and verifies the HTTP client does not follow redirects.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/api/client.go`:
- Line 114: Update the HTTP client redirect policy around the request setup that
sets X-Spoo-Client so redirects remove this header before forwarding, or reject
cross-origin redirects. Add a regression test verifying the header is not sent
to redirected targets, especially across origins.
---
Nitpick comments:
In `@internal/api/inspect.go`:
- Line 31: Add regression coverage for the Inspect HEAD-request path, which
bypasses Client.send. Extend or add an httptest case around Inspect that asserts
the X-Spoo-Client header equals cli/dev and verifies the HTTP client does not
follow redirects.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 767112d4-86c1-4a22-9404-c6506fc02be7
📒 Files selected for processing (4)
.goreleaser.yamlinternal/api/client.gointernal/api/client_test.gointernal/api/inspect.go
Zingzy
left a comment
Zingzy
left a comment
There was a problem hiding this comment.
Mergeable, nothing blocking.
- The ldflags
-Xtarget matches go.mod's module path exactly (checked), so release builds getcli/<version>and dev builds fall back tocli/dev. - The malformed-version fallback to bare
cliis a nice detail: the backend drops the whole tag when the value does not match its shape, so degrading to slug-only preserves attribution where a rawcli/0.2.0-SNAPSHOT-...would lose it entirely. The test table covers exactly that case. Inspect's hand-built no-follow request is the one call outsidesend(), and it is tagged.- go test passes locally and CI is green.
The default Go client forwards custom headers to redirect targets on other hosts. Attribution belongs to the spoo API only, so CheckRedirect drops X-Spoo-Client when a redirect leaves the original host. Same-host redirects keep it. Regression tests cover both.
|
The CheckRedirect addition at 9584752 verified: comparing against |
Every request the CLI makes to the spoo.me API now carries an
X-Spoo-Client: cli/<version>header so the backend can attribute traffic by client.The version comes from the same goreleaser ldflags that already set
main.version, with a bareclifallback when the value does not match[A-Za-z0-9._-]{1,16}(for example snapshot builds). The header is set centrally in the API client'ssendplus the one out-of-band HEAD inInspect, which never follows redirects, so it is only ever sent to the configured API base.Summary by CodeRabbit
New Features
X-Spoo-Clientheader.cli/dev.Bug Fixes