From 93874af99b60f3fba840dc1a6644414771a15e57 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Fri, 11 Sep 2026 14:39:30 +0200 Subject: [PATCH] fix(api): record the retirement against the release that carries it v1.38.19 was cut before this change and still answers on the path, so naming it as the version that removed the route would be wrong in the published contract from the day it appears. --- docs/api/openapi.yaml | 6 +++--- src/lib/http/retired-routes.ts | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml index 9b509f22b..669d00803 100644 --- a/docs/api/openapi.yaml +++ b/docs/api/openapi.yaml @@ -20425,9 +20425,9 @@ paths: deprecated: true tags: - Retired - summary: POST /api/auth/check-user — removed in v1.38.19 + summary: POST /api/auth/check-user — removed in v1.38.20 description: >- - Removed in v1.38.19. Every request to this path answers 410 Gone, whatever the method and whatever credential it + Removed in v1.38.20. Every request to this path answers 410 Gone, whatever the method and whatever credential it carries. There is no replacement; the capability is gone rather than moved. @@ -20443,7 +20443,7 @@ paths: do not offer a retry. responses: "410": - description: The path was removed in v1.38.19 and will not answer again. `meta.errorCode` = `route.retired`, + description: The path was removed in v1.38.20 and will not answer again. `meta.errorCode` = `route.retired`, `meta.removedIn` carries the version, and `meta.replacedBy` carries the replacement path or null. content: application/json: diff --git a/src/lib/http/retired-routes.ts b/src/lib/http/retired-routes.ts index 11eb825fd..8ed40ff6d 100644 --- a/src/lib/http/retired-routes.ts +++ b/src/lib/http/retired-routes.ts @@ -146,7 +146,7 @@ export const RETIRED_ROUTES: readonly RetiredRoute[] = [ }, { path: "/api/auth/check-user", - removedIn: "1.38.19", + removedIn: "1.38.20", replacedBy: null, reason: "Took an email address or a username and answered, to any caller and with no credential at all, whether an account existed here and whether it carried a passkey or a password. It was built to decide which field a sign-in screen shows first, which is not worth telling the world who has an account. Send the credential to POST /api/auth/login or run the passkey ceremony and read the answer; both refuse identically whether or not the account exists.",