Make GET /workspaces/mine smaller and cheaper by jeffmaki · Pull Request #158 · TaskarCenterAtUW/workspaces-backend

jeffmaki · 2026-10-28T20:25:29Z

Three backend-only changes to GET /workspaces/mine. None of them changes the response shape for existing callers.

Apply gig_only on the server. The ScoutRoute iOS and Android apps already call /mine?lat=…&lon=…&radius=20000&gig_only=true, but the backend ignored every parameter. The apps downloaded all workspaces in the user's project groups and threw away the ones they can't use.

gig_only=true now returns only OSW workspaces with external app access (PUBLIC or PROJECT_GROUP). The apps' own type == "osw" && externalAppAccess == 1 filter still applies, so app behavior is unchanged; their responses just get smaller.
lat, lon and radius stay ignored on purpose, and the route comment now says so.
The web frontend doesn't send gig_only, so its list is unchanged.

Don't load unused data. The list query loaded the geometry multipolygon and eager-joined the long-form quest and imagery definitions for every workspace, and /mine sends none of them. They're now deferred and not loaded.

Gzip the native API. Responses under /api/v1/ over 1,000 bytes are gzipped for clients that accept it. Prod currently sends everything uncompressed: openapi.json came back as 89 KB of plain JSON despite Accept-Encoding: gzip. Proxied OSM traffic (catch_all) passes through untouched, since it already negotiates encoding with the upstream. The browser and all three mobile apps already accept gzip: Ktor ContentEncoding { gzip() } on Android, URLSession on iOS.

Follow-up: #159 removes tdeiMetadata and kartaViewToken from /mine, once the frontend fetches metadata per workspace.

Tests: new tests cover the gig_only SQL filter, the dropped geometry and joins (this test fails against the old query), the exact query string the apps send, a non-boolean gig_only returning 422, a gzipped /mine response, and a large proxied OSM response that is not recompressed. ./scripts/ci.sh passes.

🤖 Generated with Claude Code

- Apply gig_only, which the ScoutRoute apps already send: only OSW workspaces open to external apps. lat, lon and radius stay ignored on purpose. - Don't load the geometry column or join in the long-form quest and imagery definitions; the list response sends none of them. - Gzip responses from this service's own API (/api/v1/) for clients that accept it. Proxied OSM traffic is left as received. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-10-28T20:25:39Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: c8ea527f-859e-41c9-ae2b-e1eea1040b58

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

* Update push-docker-image.yml Pushes the workspaces-backend to the app service on push * Update push-docker-image.yml added other step for building the environment * Update push-docker-image.yml v3 deployment * Update push-docker-image.yml * Update push-docker-image.yml name check * Add GET /workspaces/{id}/fixmes for the review queue (#154) Lists the workspace's current elements with a non-empty fixme tag (the key in any case, e.g. FIXME), newest first, each with its note, version, changeset, timestamp, tags and a location: a node's own, or the middle of a way's nodes (none for a relation). The OSM API can't search by tag, so, like the bbox and adiff endpoints, this reads the workspace's tables directly. Anyone who can open the workspace can call it. Checked against a real Postgres with the OSM current_* tables: nodes, ways and relations are found, empty notes and deleted elements aren't. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Implement workspace creation permissions based on TDEI roles (#147) * Implement workspace creation permissions based on TDEI roles and update tests * Implement TDEI dataset fetching and workspace creation validation based on dataset status and project group * Implement workspace creation permission checks and related API endpoint * Rename TDEI client variable for consistency in security and test files * Add TDEI API backend URL and enhance dataset handling in workspace creation - Introduced TDEI_API_BACKEND_URL in .env.example and docker-compose.local.yml for environment configuration. - Added same_uuid function to compare UUIDs in a case-insensitive manner. - Enhanced TdeiDataset class to include data_type and added matches_type method for workspace type validation. - Updated fetch_tdei_dataset to handle dataset type and improved error handling for TDEI API responses. - Modified WorkspaceRepository to enforce dataset type restrictions during workspace creation. - Expanded integration and unit tests to cover new dataset type validations and TDEI API error scenarios. * Document the workspace creation rule in CLAUDE.md Who may create a workspace (POC, or the data generator of the matching type), the extra checks when creating from a TDEI dataset, and that tdei-admin gets no extra rights. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Normalize TDEI project group role names Trim and lowercase the roles TDEI returns so "POC" or " poc " grant the same rights as "poc", as the frontend's hasCreationRole already does. Roles the backend doesn't model (e.g. tdei-admin) are dropped; they granted nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Require TDEI_API_BACKEND_URL with no default A dev default would quietly send prod tokens to api-dev.tdei.us when a deployment doesn't set it. Fail at startup instead, including for the empty string docker-compose passes when the variable is unset. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Jeff Maki <hello@jeffmaki.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Make GET /workspaces/mine smaller and cheaper (#158) - Apply gig_only, which the ScoutRoute apps already send: only OSW workspaces open to external apps. lat, lon and radius stay ignored on purpose. - Don't load the geometry column or join in the long-form quest and imagery definitions; the list response sends none of them. - Gzip responses from this service's own API (/api/v1/) for clients that accept it. Proxied OSM traffic is left as received. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Make Sentry setup visible: startup log, release from the commit, /health version (#160) * Say at startup whether errors reach Sentry Without SENTRY_DSN the Sentry SDK silently sends nothing; the App Services ran that way and nobody could tell. Log a warning when it's missing, and the environment and release when it's set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Bake the commit into the image as CODE_VERSION Sentry's release (and the startup log line) read CODE_VERSION, which nothing set, so every event reported release "unknown". The image workflows now pass the commit SHA as a build arg; the Dockerfile sets it last so a new commit doesn't invalidate the dependency layers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Report the running commit from /health /health now returns {"status": "ok", "version": <CODE_VERSION>}, so a deploy can be confirmed from outside. "unknown" for an image built without the build arg. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Naresh Kumar D <susrisha@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Rajesh Kantipudi <44539669+iamrajeshk@users.noreply.github.com>

* Update push-docker-image.yml Pushes the workspaces-backend to the app service on push * Update push-docker-image.yml added other step for building the environment * Update push-docker-image.yml v3 deployment * Update push-docker-image.yml * Update push-docker-image.yml name check * Add GET /workspaces/{id}/fixmes for the review queue (#154) Lists the workspace's current elements with a non-empty fixme tag (the key in any case, e.g. FIXME), newest first, each with its note, version, changeset, timestamp, tags and a location: a node's own, or the middle of a way's nodes (none for a relation). The OSM API can't search by tag, so, like the bbox and adiff endpoints, this reads the workspace's tables directly. Anyone who can open the workspace can call it. Checked against a real Postgres with the OSM current_* tables: nodes, ways and relations are found, empty notes and deleted elements aren't. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Implement workspace creation permissions based on TDEI roles (#147) * Implement workspace creation permissions based on TDEI roles and update tests * Implement TDEI dataset fetching and workspace creation validation based on dataset status and project group * Implement workspace creation permission checks and related API endpoint * Rename TDEI client variable for consistency in security and test files * Add TDEI API backend URL and enhance dataset handling in workspace creation - Introduced TDEI_API_BACKEND_URL in .env.example and docker-compose.local.yml for environment configuration. - Added same_uuid function to compare UUIDs in a case-insensitive manner. - Enhanced TdeiDataset class to include data_type and added matches_type method for workspace type validation. - Updated fetch_tdei_dataset to handle dataset type and improved error handling for TDEI API responses. - Modified WorkspaceRepository to enforce dataset type restrictions during workspace creation. - Expanded integration and unit tests to cover new dataset type validations and TDEI API error scenarios. * Document the workspace creation rule in CLAUDE.md Who may create a workspace (POC, or the data generator of the matching type), the extra checks when creating from a TDEI dataset, and that tdei-admin gets no extra rights. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Normalize TDEI project group role names Trim and lowercase the roles TDEI returns so "POC" or " poc " grant the same rights as "poc", as the frontend's hasCreationRole already does. Roles the backend doesn't model (e.g. tdei-admin) are dropped; they granted nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Require TDEI_API_BACKEND_URL with no default A dev default would quietly send prod tokens to api-dev.tdei.us when a deployment doesn't set it. Fail at startup instead, including for the empty string docker-compose passes when the variable is unset. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Jeff Maki <hello@jeffmaki.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Make GET /workspaces/mine smaller and cheaper (#158) - Apply gig_only, which the ScoutRoute apps already send: only OSW workspaces open to external apps. lat, lon and radius stay ignored on purpose. - Don't load the geometry column or join in the long-form quest and imagery definitions; the list response sends none of them. - Gzip responses from this service's own API (/api/v1/) for clients that accept it. Proxied OSM traffic is left as received. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Make Sentry setup visible: startup log, release from the commit, /health version (#160) * Say at startup whether errors reach Sentry Without SENTRY_DSN the Sentry SDK silently sends nothing; the App Services ran that way and nobody could tell. Log a warning when it's missing, and the environment and release when it's set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Bake the commit into the image as CODE_VERSION Sentry's release (and the startup log line) read CODE_VERSION, which nothing set, so every event reported release "unknown". The image workflows now pass the commit SHA as a build arg; the Dockerfile sets it last so a new commit doesn't invalidate the dependency layers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Report the running commit from /health /health now returns {"status": "ok", "version": <CODE_VERSION>}, so a deploy can be confirmed from outside. "unknown" for an image built without the build arg. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Leave tdeiMetadata and kartaViewToken out of GET /workspaces/mine (#163) For a workspace created from a TDEI dataset, tdeiMetadata is the whole dataset record, so it made the list large; the dashboard now fetches it for the selected workspace from GET /workspaces/{id}. kartaViewToken was sent to every member of the project group; no client reads it from the list. The always-null longFormQuestDef and imageryListDef go too. /mine now uses WorkspaceSummaryResponse; WorkspaceResponse extends it for the single-workspace GET, which still sends all four. The list query no longer loads tdeiMetadata. Deploy after the frontend change that reads tdeiMetadata per workspace. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Naresh Kumar D <susrisha@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Rajesh Kantipudi <44539669+iamrajeshk@users.noreply.github.com>

* Update push-docker-image.yml Pushes the workspaces-backend to the app service on push * Update push-docker-image.yml added other step for building the environment * Update push-docker-image.yml v3 deployment * Update push-docker-image.yml * Update push-docker-image.yml name check * Add GET /workspaces/{id}/fixmes for the review queue (#154) Lists the workspace's current elements with a non-empty fixme tag (the key in any case, e.g. FIXME), newest first, each with its note, version, changeset, timestamp, tags and a location: a node's own, or the middle of a way's nodes (none for a relation). The OSM API can't search by tag, so, like the bbox and adiff endpoints, this reads the workspace's tables directly. Anyone who can open the workspace can call it. Checked against a real Postgres with the OSM current_* tables: nodes, ways and relations are found, empty notes and deleted elements aren't. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Implement workspace creation permissions based on TDEI roles (#147) * Implement workspace creation permissions based on TDEI roles and update tests * Implement TDEI dataset fetching and workspace creation validation based on dataset status and project group * Implement workspace creation permission checks and related API endpoint * Rename TDEI client variable for consistency in security and test files * Add TDEI API backend URL and enhance dataset handling in workspace creation - Introduced TDEI_API_BACKEND_URL in .env.example and docker-compose.local.yml for environment configuration. - Added same_uuid function to compare UUIDs in a case-insensitive manner. - Enhanced TdeiDataset class to include data_type and added matches_type method for workspace type validation. - Updated fetch_tdei_dataset to handle dataset type and improved error handling for TDEI API responses. - Modified WorkspaceRepository to enforce dataset type restrictions during workspace creation. - Expanded integration and unit tests to cover new dataset type validations and TDEI API error scenarios. * Document the workspace creation rule in CLAUDE.md Who may create a workspace (POC, or the data generator of the matching type), the extra checks when creating from a TDEI dataset, and that tdei-admin gets no extra rights. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Normalize TDEI project group role names Trim and lowercase the roles TDEI returns so "POC" or " poc " grant the same rights as "poc", as the frontend's hasCreationRole already does. Roles the backend doesn't model (e.g. tdei-admin) are dropped; they granted nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Require TDEI_API_BACKEND_URL with no default A dev default would quietly send prod tokens to api-dev.tdei.us when a deployment doesn't set it. Fail at startup instead, including for the empty string docker-compose passes when the variable is unset. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Jeff Maki <hello@jeffmaki.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Make GET /workspaces/mine smaller and cheaper (#158) - Apply gig_only, which the ScoutRoute apps already send: only OSW workspaces open to external apps. lat, lon and radius stay ignored on purpose. - Don't load the geometry column or join in the long-form quest and imagery definitions; the list response sends none of them. - Gzip responses from this service's own API (/api/v1/) for clients that accept it. Proxied OSM traffic is left as received. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Make Sentry setup visible: startup log, release from the commit, /health version (#160) * Say at startup whether errors reach Sentry Without SENTRY_DSN the Sentry SDK silently sends nothing; the App Services ran that way and nobody could tell. Log a warning when it's missing, and the environment and release when it's set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Bake the commit into the image as CODE_VERSION Sentry's release (and the startup log line) read CODE_VERSION, which nothing set, so every event reported release "unknown". The image workflows now pass the commit SHA as a build arg; the Dockerfile sets it last so a new commit doesn't invalidate the dependency layers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Report the running commit from /health /health now returns {"status": "ok", "version": <CODE_VERSION>}, so a deploy can be confirmed from outside. "unknown" for an image built without the build arg. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Leave tdeiMetadata and kartaViewToken out of GET /workspaces/mine (#163) For a workspace created from a TDEI dataset, tdeiMetadata is the whole dataset record, so it made the list large; the dashboard now fetches it for the selected workspace from GET /workspaces/{id}. kartaViewToken was sent to every member of the project group; no client reads it from the list. The always-null longFormQuestDef and imageryListDef go too. /mine now uses WorkspaceSummaryResponse; WorkspaceResponse extends it for the single-workspace GET, which still sends all four. The list query no longer loads tdeiMetadata. Deploy after the frontend change that reads tdeiMetadata per workspace. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Rename the /mine filter to external_only, keeping gig_only as a synonym (#165) external_only is now the documented parameter. The mobile apps send gig_only, so it keeps working but is left out of the OpenAPI schema. If either is true, the filter applies. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Naresh Kumar D <susrisha@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Rajesh Kantipudi <44539669+iamrajeshk@users.noreply.github.com>

jeffmaki mentioned this pull request Oct 28, 2026

Leave tdeiMetadata and kartaViewToken out of GET /workspaces/mine #159

Merged

jeffmaki merged commit 243e3cc into develop Oct 28, 2026
2 checks passed

This was referenced Oct 28, 2026

Develop to Stage #161

Closed

Develop to Stage #162

Merged

Navigation Menu

Repository navigation

Make GET /workspaces/mine smaller and cheaper - #158

Make GET /workspaces/mine smaller and cheaper#158
jeffmaki merged 1 commit into
developfrom
mine-gig-only-filter

jeffmaki commented Oct 28, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 28, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jeffmaki commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 28, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jeffmaki commented Oct 28, 2026 •

edited

Loading