fix(web): BFF 204 handling + scope smoke rollback (Fixes ORBIT-WEB-3) - #288
Conversation
The catch-all proxy built every response with new NextResponse(await source.text(), { status }). For a 204/205/304 the body is empty, but source.text() yields an empty STRING, and the Response constructor rejects any non-null body on a null-body status -> TypeError: Response constructor: Invalid response status code 204. Any endpoint returning 204 (e.g. PUT /profile/onboarding) 500'd through the BFF. Skip the body and pass null for null-body statuses.
Fixes ORBIT-WEB-3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
vercel rollback <url> ran without --scope, so a team-scoped token resolved the wrong scope and failed with 'Deployment belongs to a different team', leaving the rollback safety net broken. Pass --scope $VERCEL_ORG_ID. See vercel/vercel#11712. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Review: fix(web): BFF 204 handling + scope smoke rollback. Verdict: APPROVE -- no Critical or High findings across all 13 dimensions. Correctness: NULL_BODY_STATUSES guards 204/205/304 per HTTP spec; regression test validates the 204 path. Parity: verified, apps/mobile/lib/api-client.ts handles 204 directly without constructing a Response -- sanctioned BFF-vs-direct-API difference. Security: VERCEL_ORG_ID already in workflow env at line 26, --scope addition is correct. Clean fix, root cause addressed, no regressions.
|
1 participant
Incident
The prod-smoke run triggered by #253's merge went red, and Sentry fired ORBIT-WEB-3 — both from one root cause.
Root cause
The BFF catch-all proxy built every upstream response with
new NextResponse(await source.text(), { status }). On a 204/205/304 the upstream body is empty, butsource.text()returns an empty string (notnull), and theResponseconstructor rejects any non-null body on a null-body status →TypeError: Response constructor: Invalid response status code 204. So any endpoint returning 204 (e.g.PUT /profile/onboarding, which the smoke setup calls) 500'd through the BFF. That broke the smoke'sexpect(onboarding.ok())and is a real prod bug for onboarding completion.Fixes
app/api/[...path]/route.ts) — skip reading the body and passnullfor null-body statuses (204/205/304). + regression test inproxy-route.test.ts(4/4 green locally).smoke-prod.yml) — the rollback step ranvercel rollback <url>without--scope, so the team-scoped token failed with "Deployment belongs to a different team" — the rollback safety net was broken. Added--scope "$VERCEL_ORG_ID"(vercel/vercel#11712).Notes
apps/mobile/lib/api-client.tsalready returnsundefinedon 204 (it consumes a fetch Response, never constructs one). BFF-vs-direct-API is a sanctioned platform difference, so no mobile mirror.apps/web/**); it should go green.Fixes ORBIT-WEB-3
🤖 Generated with Claude Code