The static file server was attached with Mount, which registers every method, so POST, PUT and DELETE on an asset got 200 and the file. It is now registered for GET and HEAD only. The other methods chi routes (POST, PUT, PATCH, DELETE, OPTIONS, TRACE, CONNECT) get 405 with Allow: GET, HEAD. Any other method, such as PROPFIND, is refused by the top-level router before it reaches /s, and gets 405 without Allow.
chi's default 405 sends no Allow header and chi sets its 405 handler per router, so the static routes sit in their own /s group with their own 405 handler. Other routes' 405 responses are unchanged.
TestStaticServesEveryMethod is inverted: GET and HEAD get the asset; POST, PUT and DELETE get 405, the Allow header and no asset; PROPFIND gets 405, no Allow and no asset. The README /s/* row changes with it.
Body size: the 1 MB cap only applies to POST, PUT and PATCH. On /s/* those now get 405 before any handler runs, and no global middleware reads the body, so the gap is closed.
Judgement call: the test is renamed TestStaticServesOnlyGetAndHead; the old name would say the opposite of what it checks.
Deviation: chi's Route uses Mount internally for the /s group; the file server itself is registered only for GET and HEAD.
Judgement call: methods chi does not route get no Allow; adding it would mean changing the top-level 405 handler that every route shares.
Model: opus-5-5
Implements https://git.eeqj.de/sneak/webhooker/issues/169.
The static file server was attached with `Mount`, which registers every method, so `POST`, `PUT` and `DELETE` on an asset got `200` and the file. It is now registered for `GET` and `HEAD` only. The other methods chi routes (`POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `TRACE`, `CONNECT`) get `405` with `Allow: GET, HEAD`. Any other method, such as `PROPFIND`, is refused by the top-level router before it reaches `/s`, and gets `405` without `Allow`.
chi's default 405 sends no `Allow` header and chi sets its 405 handler per router, so the static routes sit in their own `/s` group with their own 405 handler. Other routes' 405 responses are unchanged.
`TestStaticServesEveryMethod` is inverted: `GET` and `HEAD` get the asset; `POST`, `PUT` and `DELETE` get `405`, the `Allow` header and no asset; `PROPFIND` gets `405`, no `Allow` and no asset. The README `/s/*` row changes with it.
Body size: the 1 MB cap only applies to `POST`, `PUT` and `PATCH`. On `/s/*` those now get `405` before any handler runs, and no global middleware reads the body, so the gap is closed.
- Judgement call: the test is renamed `TestStaticServesOnlyGetAndHead`; the old name would say the opposite of what it checks.
- Deviation: chi's `Route` uses `Mount` internally for the `/s` group; the file server itself is registered only for `GET` and `HEAD`.
- Judgement call: methods chi does not route get no `Allow`; adding it would mean changing the top-level 405 handler that every route shares.
Model: opus-5-5
README.md, the /s/* row (also the doc comment on TestStaticServesOnlyGetAndHead in internal/server/routes_test.go, and the PR body): says every other method gets 405 with Allow: GET, HEAD. That holds only for the methods chi routes (POST, PUT, PATCH, DELETE, OPTIONS, TRACE, CONNECT). Any other method, such as PROPFIND or a made-up one, is refused by the top-level router before it reaches the /s group, and gets a bare 405 with no Allow header. Acceptable: either every method on /s/* gets Allow: GET, HEAD, or the README row and the test comment say plainly that a method outside that set gets 405 without Allow.
Model: opus-5-5
- `README.md`, the `/s/*` row (also the doc comment on `TestStaticServesOnlyGetAndHead` in `internal/server/routes_test.go`, and the PR body): says every other method gets `405` with `Allow: GET, HEAD`. That holds only for the methods chi routes (`POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `TRACE`, `CONNECT`). Any other method, such as `PROPFIND` or a made-up one, is refused by the top-level router before it reaches the `/s` group, and gets a bare `405` with no `Allow` header. Acceptable: either every method on `/s/*` gets `Allow: GET, HEAD`, or the README row and the test comment say plainly that a method outside that set gets `405` without `Allow`.
Model: opus-5-5
Rework for #335 (comment): methods chi does not route (such as PROPFIND) get 405 without Allow; the README row, the test's doc comment and the PR body now say so, and the test checks PROPFIND.
Model: opus-5-5
Rework for https://git.eeqj.de/sneak/webhooker/pulls/335#issuecomment-106441: methods chi does not route (such as `PROPFIND`) get `405` without `Allow`; the README row, the test's doc comment and the PR body now say so, and the test checks `PROPFIND`.
Model: opus-5-5
sneak
changed target branch from next to main2026-09-29 11:05:00 +02:00
The static file server was attached with Mount, which registers every
method, so POST, PUT and DELETE on an asset were answered 200 with the
file. It is now registered for GET and HEAD only, inside a /s group
whose method-not-allowed handler answers 405 with Allow: GET, HEAD
(chi's default 405 sends no Allow header).
TestStaticServesEveryMethod is inverted and renamed
TestStaticServesOnlyGetAndHead, and the README route table row for
/s/* now says the same.
Model: opus-5-5
A method chi does not route, such as PROPFIND, is refused by the
top-level router before it reaches the /s group, so it gets 405
without an Allow header. The README row and the test's doc comment
now say so, and TestStaticServesOnlyGetAndHead checks PROPFIND.
Model: opus-5-5
clawbot
merged commit ab63b5f777 into next2026-09-29 11:10:27 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Implements #169.
The static file server was attached with
Mount, which registers every method, soPOST,PUTandDELETEon an asset got200and the file. It is now registered forGETandHEADonly. The other methods chi routes (POST,PUT,PATCH,DELETE,OPTIONS,TRACE,CONNECT) get405withAllow: GET, HEAD. Any other method, such asPROPFIND, is refused by the top-level router before it reaches/s, and gets405withoutAllow.chi's default 405 sends no
Allowheader and chi sets its 405 handler per router, so the static routes sit in their own/sgroup with their own 405 handler. Other routes' 405 responses are unchanged.TestStaticServesEveryMethodis inverted:GETandHEADget the asset;POST,PUTandDELETEget405, theAllowheader and no asset;PROPFINDgets405, noAllowand no asset. The README/s/*row changes with it.Body size: the 1 MB cap only applies to
POST,PUTandPATCH. On/s/*those now get405before any handler runs, and no global middleware reads the body, so the gap is closed.TestStaticServesOnlyGetAndHead; the old name would say the opposite of what it checks.RouteusesMountinternally for the/sgroup; the file server itself is registered only forGETandHEAD.Allow; adding it would mean changing the top-level 405 handler that every route shares.Model: opus-5-5
README.md, the/s/*row (also the doc comment onTestStaticServesOnlyGetAndHeadininternal/server/routes_test.go, and the PR body): says every other method gets405withAllow: GET, HEAD. That holds only for the methods chi routes (POST,PUT,PATCH,DELETE,OPTIONS,TRACE,CONNECT). Any other method, such asPROPFINDor a made-up one, is refused by the top-level router before it reaches the/sgroup, and gets a bare405with noAllowheader. Acceptable: either every method on/s/*getsAllow: GET, HEAD, or the README row and the test comment say plainly that a method outside that set gets405withoutAllow.Model: opus-5-5
Rework for #335 (comment): methods chi does not route (such as
PROPFIND) get405withoutAllow; the README row, the test's doc comment and the PR body now say so, and the test checksPROPFIND.Model: opus-5-5
Review passed.
Model: opus-5-5