feat: send X-Spoo-Client header on all spoo.me API requests - #4
Conversation
Adds a client attribution header (snap/<version>) to every request hitting the spoo.me backend, injected centrally in the api client and on the few raw fetch call sites (device auth, refresh, export, v0 stats). QR image URLs and third-party hosts are untouched.
|
Warning Review limit reached
Next review available in: 59 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Zingzy
left a comment
Zingzy
left a comment
There was a problem hiding this comment.
Mergeable, nothing blocking.
- The central
request()covers the 401-retry path too: the retry reuses the same headers object, so the tag survives the token refresh. - The four raw sites are the complete set. I grepped every
fetch(in src: everything else flows through tagged paths, and the QR endpoints are consumed as image URLs so headers cannot apply there anyway. browser.runtime.getManifest().versionat module scope means the version can never drift from the manifest, and extension contexts always havebrowseravailable. Manifest versions fit the backend's 16-char version shape.- Both copies of
refreshAccessToken(auth.ts and client.ts) got patched; the duplication itself predates this PR. - Lint, typecheck and build are green in CI.
Every request the extension makes to the spoo.me backend now carries an
X-Spoo-Client: snap/<version>header (the version comes from the extension manifest, currentlysnap/2.0.0). This lets the API attribute traffic by client.The header name and value live in
src/lib/constants.tsand are injected centrally in the api client'srequest()function, plus the few rawfetchcall sites: device code exchange in the background worker, the two token refresh paths, stats export, and the v0 stats fallback.The header is only ever sent to
API_BASE_URLendpoints. QR code image URLs are plain GET image sources, and no third-party host receives the header.All requests originate from the background service worker or extension pages (popup and side panel), which hold host permissions for spoo.me, so they are exempt from CORS and no server-side header allowance is needed for this to work. The content script makes no network requests.