RFC 9110 section 15.5.6 requires a 405 to name the methods it accepts, and
/api/radio/stations already does this in-tree. Thanks to kvnloo for catching it
on review. The same gap on the pre-existing handlers is tracked in #809 and is
deliberately left alone here.
/api/opensky, /api/adsblol/mil and /api/route answered any verb with the same
body while ignoring the request entirely. Measured against a running server
before the change: POST /api/opensky returned 200 with 833,759 bytes of live
state vectors, POST /api/adsblol/mil returned 47,372 bytes. Their siblings do
not: /api/geocode, /api/weather and /api/transit answer 405, and /api/overpass
is deliberately POST-only.
These three are read-only query proxies, so they now answer 405 to anything but
GET, using the wording and shape /api/geocode already uses. The refusal comes
first, before rate limiting and before any upstream call, which the tests
assert by stubbing fetch to throw.
Scope, stated plainly: this is a consistency and intent fix. No rate limiter
was being bypassed — /api/route already limits every request regardless of
verb, and the two aircraft routes have no limiter at all, only 9s and 12s
server-side caches that bound upstream cost for any method.
One existing fixture in src/search/geospatial.test.mjs built a request without
a method, which a real Node request always has; it now sets GET.
Verified on a running server after the change: GET still 200 on all three,
POST 405 on all three, /api/overpass and the other proxies unchanged.
Suite goes from 5090 to 5092 tests, 0 failures.
Two independent triggers turned the global status chip red while every layer
was still populated (reproduced at JFK in Cockpit; timeline in the issue).
adsb.lol proxy: a non-OK upstream status was relayed verbatim even with a
12 s-old cache in hand, and the browser layer answers a 429 with a 45 s
cooldown in which every refresh reports "adsb.lol rate limited" without a
network call. The proxy now serves its cached body as STALE on a 429/5xx and
backs off from upstream for Retry-After (bounded), mirroring the OpenSky
proxy. A failure with nothing cached is still relayed.
Mapped installations: the "zoom in" guidance was stored in `error`, so the
manager reported a refresh failure and the chip a LOAD FAILED whenever the
view could not be bounded (Cockpit looks at the horizon). The status is now
set without an error string; the row reads the prompt from `statusMessage`,
and the chip ignores `error` for guidance statuses, matching the carve-out
layerFeedState already has.
daikaginza