links

new-endpoint · 7 of 7 promises kept

Promises kept7 / 7none broken

TierStandard P2new-endpoint

Kill switchnoneCore features roll back instead

Originbase featurePOST /api/linksGET /api/links/{code}DELETE /api/links/{code}

Promises

grouped by type

	Promise and latest result	Severity	Checked in
behavior · 2
	link-create-read A new link can be read back with its long URL Kept in production (live check, 27 Oct 12:55 UTC)	blocker	merge requesttest driveproduction
	link-delete A deleted link stops redirecting Kept on its merge request (checked before every merge)	major	merge requesttest drive
speed · 1
	link-details-fast 95% of link lookups finish in under 250 ms Kept on its merge request (checked before every merge)	major	merge requesttest driveproduction
reliability · 1
	link-api-reliable Fewer than 0.5% of link lookups fail Kept on its merge request (checked before every merge)	blocker	merge requesttest driveproduction
security · 3
	link-create-needs-key Creating a link without the API key is refused Kept on its merge request (checked before every merge)	blocker	merge requesttest drive
	link-http-only Only http and https addresses are accepted Kept on its merge request (checked before every merge)	blocker	merge requesttest drive
	link-url-well-formed Addresses with spaces or without a host are refused Kept on its merge request (checked before every merge)	blocker	merge requesttest drive

Card file

Open on GitLab ↗

promises/features/base-links.yaml

feature: links
issue: null
kind: new-endpoint
tier: standard
priority: P2
owns:
  routes:
  - POST /api/links
  - GET /api/links/{code}
  - DELETE /api/links/{code}
  files:
  - app/features/links.py
flag: null
promises:
  behavior:
  - id: link-create-read
    says: A new link can be read back with its long URL
    steps:
    - 'POST /api/links {url: ''https://example.com/l-{rand}''} -> 201 => link'
    - GET /api/links/{link.code} -> 200 contains https://example.com/l-{rand}
    where:
    - mr
    - drive
    - live
    severity: blocker
  - id: link-delete
    says: A deleted link stops redirecting
    steps:
    - 'POST /api/links {url: ''https://example.com/d-{rand}''} -> 201 => link'
    - DELETE /api/links/{link.code} -> 204
    - GET /api/links/{link.code} -> 404
    where:
    - mr
    - drive
    severity: major
  speed:
  - id: link-details-fast
    says: 95% of link lookups finish in under 250 ms
    measure: p95(latency, route='GET /api/links/{code}') < 250ms
    where:
    - mr
    - drive
    - live
    severity: major
  reliability:
  - id: link-api-reliable
    says: Fewer than 0.5% of link lookups fail
    measure: error_rate(route='GET /api/links/{code}') < 0.5%
    where:
    - mr
    - drive
    - live
    severity: blocker
  security:
  - id: link-create-needs-key
    says: Creating a link without the API key is refused
    steps:
    - 'anon POST /api/links {url: ''https://example.com/x''} -> 401'
    where:
    - mr
    - drive
    severity: blocker
  - id: link-http-only
    says: Only http and https addresses are accepted
    steps:
    - 'POST /api/links {url: ''javascript:alert(1)''} -> 422'
    where:
    - mr
    - drive
    severity: blocker
  - id: link-url-well-formed
    says: Addresses with spaces or without a host are refused
    steps:
    - 'POST /api/links {url: ''https://example.com/a b''} -> 422'
    - 'POST /api/links {url: ''http://''} -> 422'
    - 'POST /api/links {url: ''https:///path''} -> 422'
    where:
    - mr
    - drive
    severity: blocker