Vantage/vantage-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(monitors): public heartbeat ping endpoints, header token, log masking and sweeper

Browse Source
This commit is contained in:
mrhid6
2026-09-17 08:27:34 +00:00
parent 839d716a47
commit 17ed0192c1
10 changed files with 329 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/superpowers/specs/2026-09-17-metric-alerts-heartbeats-design.md
+5 -3
View File
@@ -114,9 +114,11 @@ Evaluators are pure functions `func(kind string, t models.MonitorTarget, srv mod
Registered outside `/api`, unauthenticated, no scope declarations needed:
- `GET|POST /hb/:token`: success ping
- `GET|POST /hb/:token/start`: run started
- `GET|POST /hb/:token/fail`: run failed
- `GET|POST /public/hb/:token`: success ping
- `GET|POST /public/hb/:token/start`: run started
- `GET|POST /public/hb/:token/fail`: run failed
Mounted under /public because every deployment already routes that prefix to the server. The token may instead be sent in the `X-Vantage-Token` header to `/public/hb`, `/public/hb/start` or `/public/hb/fail`; a URL token wins when both are present. The server's request log and the bundled nginx access log mask the URL token.
Lookup is by SHA-256 of the token. Unknown token or disabled monitor gives 404. Rate limit is one accepted request per second per token (in-process, Redis-backed if a limiter helper already exists); excess gives 429. The response body is `OK`. Request bodies over 1 KB are truncated; only `/fail` uses the body.