limits

new-endpoint · 11 of 11 promises kept

Promises kept11 / 11none broken

TierStandard P2new-endpoint

Kill switchkill switch ona GitLab feature flag

Originissue #16GET /api/limits

Promises

grouped by type

	Promise and latest result	Severity	Checked in
behavior · 2
	limits-returns-constants The limits endpoint returns the correct max URL and code length constants Kept in production (live check, 27 Oct 12:55 UTC)	blocker	merge requesttest driveproduction
	limits-public-no-key The limits endpoint works without an API key Kept in production (live check, 27 Oct 12:55 UTC)	blocker	merge requesttest driveproduction
speed · 1
	limits-fast 95% of limit queries finish in under 300 ms Kept in test drive r-0036 at 50%: 68 ms (limit 300 ms, n=251)	major	merge requesttest driveproduction
reliability · 1
	limits-reliable Fewer than 0.5% of limit queries fail Kept in test drive r-0036 at 50%: 0.00% (limit 0.50%, n=251)	blocker	merge requesttest driveproduction
security · 7
	limits-no-api-key-required The limits endpoint is public and does not require an API key Kept in test drive r-0036 at step 0: 1 step(s) passed	blocker	merge requesttest drive
	limits-no-secrets The limits module never reads or exposes secrets Kept in test drive r-0036 at step 0: static checks passed	blocker	merge requesttest drive
	limits-no-ip-logging The limits endpoint does not log visitor IP addresses Kept in test drive r-0036 at step 0: static checks passed	major	merge requesttest drive
	limits-constant-response The limits endpoint returns constant values without reading user data Kept in test drive r-0036 at step 0: 1 step(s) passed	blocker	merge requesttest drive
	limits-no-request-body The limits endpoint ignores request bodies Kept in test drive r-0036 at step 0: 1 step(s) passed	major	merge requesttest drive
	limits-no-path-parameters The limits endpoint has no path parameters to validate Kept in test drive r-0036 at step 0: 1 step(s) passed	major	merge requesttest drive
	limits-no-query-parameters The limits endpoint ignores query parameters Kept in test drive r-0036 at step 0: 1 step(s) passed	major	merge requesttest drive

Card file

Open on GitLab ↗

promises/features/16-limits.yaml

feature: limits
issue: 16
kind: new-endpoint
tier: standard
priority: P2
owns:
  routes:
  - GET /api/limits
  files:
  - app/features/limits.py
  - tests/test_limits.py
flag: limits
promises:
  behavior:
  - id: limits-returns-constants
    says: The limits endpoint returns the correct max URL and code length constants
    steps:
    - GET /api/limits -> 200 json max_url_length=2048 json max_code_length=64
    where:
    - mr
    - drive
    - live
    severity: blocker
  - id: limits-public-no-key
    says: The limits endpoint works without an API key
    steps:
    - anon GET /api/limits -> 200 json max_url_length=2048 json max_code_length=64
    where:
    - mr
    - drive
    - live
    severity: blocker
  speed:
  - id: limits-fast
    says: 95% of limit queries finish in under 300 ms
    measure: p95(latency, route='GET /api/limits') < 300ms
    where:
    - mr
    - drive
    - live
    severity: major
  reliability:
  - id: limits-reliable
    says: Fewer than 0.5% of limit queries fail
    measure: error_rate(route='GET /api/limits') < 0.5%
    where:
    - mr
    - drive
    - live
    severity: blocker
  security:
  - id: limits-no-api-key-required
    says: The limits endpoint is public and does not require an API key
    steps:
    - GET /api/limits -> 200
    where:
    - mr
    - drive
    severity: blocker
  - id: limits-no-secrets
    says: The limits module never reads or exposes secrets
    static:
      file_lacks:
      - app/features/limits.py
      - vallum_secrets
    where:
    - mr
    - drive
    severity: blocker
  - id: limits-no-ip-logging
    says: The limits endpoint does not log visitor IP addresses
    static:
      file_lacks:
      - app/features/limits.py
      - request.client
    where:
    - mr
    - drive
    severity: major
  - id: limits-constant-response
    says: The limits endpoint returns constant values without reading user data
    steps:
    - GET /api/limits -> 200 contains max_url_length
    where:
    - mr
    - drive
    severity: blocker
  - id: limits-no-request-body
    says: The limits endpoint ignores request bodies
    steps:
    - 'POST /api/limits {data: ''test''} -> 405'
    where:
    - mr
    - drive
    severity: major
  - id: limits-no-path-parameters
    says: The limits endpoint has no path parameters to validate
    steps:
    - GET /api/limits/extra -> 404
    guard: true
    where:
    - mr
    - drive
    severity: major
  - id: limits-no-query-parameters
    says: The limits endpoint ignores query parameters
    steps:
    - GET /api/limits?param=value -> 200
    where:
    - mr
    - drive
    severity: major