Features / link-exists

link-exists

new-endpoint · 11 of 11 promises kept

Promises kept11 / 11none broken

TierStandard P2new-endpoint

Kill switchkill switch ona GitLab feature flag

Originissue #10GET /api/links/{code}/exists

Promises

grouped by type

	Promise and latest result	Severity	Checked in
behavior · 4
	link-exists-true For a code that exists, it answers 200 with exists: true Kept in production (live check, 27 Oct 12:55 UTC)	blocker	merge requesttest driveproduction
	link-exists-false For a code that doesn't exist, it answers 200 with exists: false (not 404) Kept in production (live check, 27 Oct 12:55 UTC)	blocker	merge requesttest driveproduction
	link-exists-no-url The answer never includes the link's destination URL Kept in production (live check, 27 Oct 12:55 UTC)	blocker	merge requesttest driveproduction
	link-exists-odd-code Invalid codes answer 200 with exists: false Kept in test drive r-0024 at step 0: 1 step(s) passed	major	merge requesttest drive
speed · 1
	link-exists-fast 95% of link existence checks finish in under 300 ms Kept in test drive r-0024 at 50%: 59 ms (limit 300 ms, n=266)	major	merge requesttest driveproduction
reliability · 1
	link-exists-reliable Fewer than 0.5% of link existence checks fail Kept in test drive r-0024 at 50%: 0.00% (limit 0.50%, n=266)	blocker	merge requesttest driveproduction
security · 5
	link-exists-no-url-leak The exists endpoint returns only code and exists flag, never the destination URL Kept in test drive r-0024 at step 0: 3 step(s) passed	blocker	merge requesttest drive
	link-exists-odd-codes-safe Codes with invalid characters answer 200 exists false without error Kept in test drive r-0024 at step 0: 3 step(s) passed	major	merge requesttest drive
	link-exists-long-codes-safe Codes longer than 64 characters answer 200 exists false without error Kept in test drive r-0024 at step 0: 1 step(s) passed	major	merge requesttest drive
	link-exists-no-secrets The module never references secret stores or API keys Kept in test drive r-0024 at step 0: static checks passed	blocker	merge requesttest drive
	link-exists-public-no-key Reading link existence does not require an API key Kept in test drive r-0024 at step 0: 2 step(s) passed	blocker	merge requesttest drive

Card file

Open on GitLab ↗

promises/features/10-link-exists.yaml

feature: link-exists
issue: 10
kind: new-endpoint
tier: standard
priority: P2
owns:
  routes:
  - GET /api/links/{code}/exists
  files:
  - app/features/link_exists.py
  - tests/test_link_exists.py
flag: link_exists
promises:
  behavior:
  - id: link-exists-true
    says: 'For a code that exists, it answers 200 with exists: true'
    steps:
    - 'POST /api/links {url: ''https://example.com/e-{rand}''} -> 201 => link'
    - GET /api/links/{link.code}/exists -> 200 json exists=True
    where:
    - mr
    - drive
    - live
    severity: blocker
  - id: link-exists-false
    says: 'For a code that doesn''t exist, it answers 200 with exists: false (not 404)'
    steps:
    - GET /api/links/nonexistent-{rand}/exists -> 200 json exists=False
    where:
    - mr
    - drive
    - live
    severity: blocker
  - id: link-exists-no-url
    says: The answer never includes the link's destination URL
    steps:
    - 'POST /api/links {url: ''https://secret.example.com/hidden-{rand}''} -> 201 => link'
    - GET /api/links/{link.code}/exists -> 200 json exists=True
    - GET /api/links/{link.code}/exists -> 200 json code={link.code}
    where:
    - mr
    - drive
    - live
    severity: blocker
  - id: link-exists-odd-code
    says: 'Invalid codes answer 200 with exists: false'
    steps:
    - GET /api/links/invalid@code-{rand}/exists -> 200 json exists=False
    where:
    - mr
    - drive
    severity: major
  speed:
  - id: link-exists-fast
    says: 95% of link existence checks finish in under 300 ms
    measure: p95(latency, route='GET /api/links/{code}/exists') < 300ms
    where:
    - mr
    - drive
    - live
    severity: major
  reliability:
  - id: link-exists-reliable
    says: Fewer than 0.5% of link existence checks fail
    measure: error_rate(route='GET /api/links/{code}/exists') < 0.5%
    where:
    - mr
    - drive
    - live
    severity: blocker
  security:
  - id: link-exists-no-url-leak
    says: The exists endpoint returns only code and exists flag, never the destination URL
    steps:
    - 'POST /api/links {url: ''https://secret.example.com/private''} -> 201 => link'
    - GET /api/links/{link.code}/exists -> 200 json exists=True
    - GET /api/links/{link.code}/exists -> 200 json code={link.code}
    where:
    - mr
    - drive
    severity: blocker
  - id: link-exists-odd-codes-safe
    says: Codes with invalid characters answer 200 exists false without error
    steps:
    - GET /api/links/code_with_underscore/exists -> 200 json exists=False
    - GET /api/links/code.with.dots/exists -> 200 json exists=False
    - GET /api/links/a%40b/exists -> 200 json exists=False
    where:
    - mr
    - drive
    severity: major
  - id: link-exists-long-codes-safe
    says: Codes longer than 64 characters answer 200 exists false without error
    steps:
    - GET /api/links/{rand-65}/exists -> 200 json exists=False
    where:
    - mr
    - drive
    severity: major
  - id: link-exists-no-secrets
    says: The module never references secret stores or API keys
    static:
      file_lacks:
      - app/features/link_exists.py
      - vallum_secrets
    where:
    - mr
    - drive
    severity: blocker
  - id: link-exists-public-no-key
    says: Reading link existence does not require an API key
    steps:
    - 'POST /api/links {url: ''https://example.com/pub-{rand}''} -> 201 => link'
    - anon GET /api/links/{link.code}/exists -> 200 json exists=True
    where:
    - mr
    - drive
    severity: blocker