Repository navigation
fix(parameters): refuse @Connection on handlers that never receive a connection - #101
Merged
Merged
Conversation
Upd4ting
force-pushed
the
fix/connection-handler-mode
branch
from
November 9, 2026 14:58
d8da1a8 to
19dc6bd
Compare
Upd4ting
added a commit
that referenced
this pull request
Nov 10, 2026
## Why The verify-interface skill still listed #75 and #76 as open known findings. Both are closed. #99 registers `@Get("")` at the controller root, and #101 refuses `@Connection` on handlers that never receive a connection. An agent reading the skill learned behaviour that is no longer true. The `route-locations` journey also stripped one trailing slash, so it pinned neither form of the root location. ## What changed - `features/README.md`: the Known findings section is removed. Its table held only #75 and #76, and its "No journey pins either behaviour" line went with it. - `features/routes.md`: the #75 gotcha is removed. The `route-locations` sub-feature now names the root location it pins. - `scenarios-second.ts`: `route-locations` compares `r.handler.location` as registered and drops `.replace(/\/$/, "")`. The expected line already held `/users` for `@Get("")`, so it now pins the root form exactly. - `@Connection`: #101 already covers the refusal in the `injected-values` journey (`connectionOnGet`, listed in `features/parameter-sources.md`). This PR does not change it. ## Proof Verify journeys the retired findings pointed at, run on this branch's packed build: ```text $ antelopejs-verify journey "$RUN" routes PASS routes/route-locations (0.0 s) PASS routes/route-errors (0.0 s) $ antelopejs-verify journey "$RUN" parameter-sources injected-values PASS parameter-sources/injected-values (0.0 s) $ antelopejs-verify journey "$RUN" --plan PASS smoke/core-calls (0.4 s) PASS smoke/export-surface (0.0 s) ``` The same `route-locations` journey with `src/routes.ts` set back to the pre-#99 join (`${controller.location}/${segment}`), a local change that was not committed: ```text FAIL routes/route-locations (0.0 s) 02-run-the-route-locations-scenario: route-locations answers as docs/ states (expected "{\"routes\":[[\"handler\",\"get\",\"/users/listUsers\",\"listUsers\",null],[\"handler\",\"get\",\"/users\",\"root\",null],... ``` With the strip in place, that regression would pass. `pnpm run checks`: ```text Checks: 9 passed, 0 failed. ``` ```mermaid flowchart LR A["@get("") on Controller("/users")"] --> B[ProcessCallback] B --> C["location /users"] C --> D{"route-locations journey"} D -- "before: strip one trailing slash" --> E["/users and /users/ both pass"] D -- "after: compare as registered" --> F["only /users passes"] ```
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
@Connection()is documented as WebSocket-only, but on an HTTP handler it passedundefinedwithout any error. Route decorators now refuse it when the class is defined, in the modes that never receive a connection.Fixes #76
What changed
ProcessCallbackthrows aTypeErrorand registers no route for the handler when a handler parameter receives@Connectioninhandler,prefixorpostfixmode.websocketandmonitormode stay allowed.@ConnectionTSDoc,docs/4.parameters.mdand theapi-interfaceskill state the rule by mode.@Connectionon a WebSocket handler and checks that a@Gethandler is refused.Scope
@Connectionstay allowed, because every handler of the controller shares them. They stayundefinedoutside a WebSocket request.TypeErrorfromProcessCallback.@Getoverride of a parent@WebsocketHandlermethod that uses@Connectionis refused too. The shared records also cause a separate bug, filed as A child controller's parameter decorator overwrites the parent handler's parameter of the same method name #100.Tradeoffs
undefined, so no test can fail on it.@antelopejs/apiruns them after the upgrade with the connection set, and a probe showed a@Monitorreceives the socket on a WebSocket route.callback.lengthparameters was tried and rejected. Handlers with default, rest or wrapped parameters still received the connection.Blast Radius
Code that used
@Connectionon an HTTP, prefix or postfix handler now fails when the class is defined, where it used to getundefined. WebSocket and monitor handlers are not affected.Verification
src/tests/connection.test.ts: 4 of 5 tests fail onmainand all 5 pass on this branch. The outputs are below.antelopejs-verify: all 12 planned journeys pass on the packed build.pnpm run checks:Checks: 9 passed, 0 failed.flowchart TD A[Route decorator] --> B[ProcessCallback] B --> C{A handler parameter receives @Connection?} C -- no --> R[RegisterRoute] C -- yes --> D{mode is websocket or monitor?} D -- yes --> R D -- no --> E[TypeError when the class is defined, no route]Test output on main (82bbb2a) with this branch's test file
Test output on this branch