Repository navigation
docs: lead the request-boundary docs with the FromHTTP constructors - #518
Merged
Merged
Conversation
osanderson
force-pushed
the
docs/architecture-fromhttp
branch
from
October 2, 2026 07:05
135e336 to
5347985
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
…tors The raw request boundary section described FormRequestFromHTTP and the DPoP and peer-certificate helpers, but not the per-request constructors that read them all at once. Those are what a net/http adapter should use, because a struct filled field by field compiles with a field left out. Rule 8 showed VerifyRequest without PeerCertificate and didn't mention VerifyRequestFromHTTP. Both now do, along with the 400 invalid_request a malformed request gets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The section explained binding the handle and keeping the interaction by hand, and only then mentioned that server/interactioncookie does both. It now leads with the package and a short sketch of New/Set/Read/Clear. The by-hand rules follow, for a server-side session, including tying the form to the handle it was rendered for. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
osanderson
force-pushed
the
docs/architecture-fromhttp
branch
from
October 2, 2026 07:10
5347985 to
bf3d27a
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is DevX follow-up item 4: the docs now lead with the convenience APIs rather than explaining the by-hand approach first.
ARCHITECTURE.md:
"Raw request boundary" explained
FormRequestFromHTTPand the DPoP and peer-certificate helpers. It didn't mention the per-request constructors that read all of them at once:PushAuthorizationRequestFromHTTPTokenEndpointRequestFromHTTPBeginBackchannelAuthenticationRequestFromHTTPBeginAuthorizationRequestFromHTTPresource.VerifyRequestFromHTTPA new paragraph names them as the recommended path, says why (a struct filled field by field compiles with a field left out), and gives the 400
invalid_requestbehaviour from fix(server): answer an unreadable form body as invalid_request #512 and fix(resource): refuse a request with more than one Authorization header #513.Rule 8 showed
VerifyRequest{Method, URL, Authorization, DPoPProofs}withoutPeerCertificate. It now includes it and showsresource.VerifyRequestFromHTTP(r, target)with the fixed-URL rule.GETTING_STARTED.md:
server/interactioncookiedoes both. It now leads with the package ("Carry the interaction to the form's submission"), with a shortNew/Set/Read/Clearsketch matching feat(server): say when an interaction expires, and expire its cookie then #516's signatures.🤖 Generated with Claude Code