Hidden File deep links need reveal, Hidden badge and Unhide #1212

Open
opened 2026-10-06 18:00:51 +00:00 by kayg · 1 comment
Owner

Found during the #1153 production screenshot pass on branch job/hide-1153 (head 1d187f8c0). The hide5 job is restricted to preserved projection work, the Daily Log failure, gates and screenshots; it makes no product UI changes.

Real-server reproduction, macOS platform, 390 × 844:

  1. Upload one text File through the Files API.
  2. Hide it through PUT /api/v1/tags/hidden (documented 204).
  3. Read its stable item ID through GET /api/v1/files/entries?show_hidden_items=true (the returned Item has hidden: true).
  4. Save Show hidden off and open /f/<item-id>. Files loads, but Quick Look does not open.
  5. Save Show hidden on and open the same link. Quick Look opens the real text File, but shows no Hidden badge or Unhide action.

Probe output, unchanged production assets:

{"defaultHiddenFileLinkOpens":false,"hiddenFileBadgeCount":0,"visibleUnhideActionCount":0,"apiHidden":true}

Source evidence: apps/web/src/lib/files/FilesBrowser.svelte applyFocusRequest returns when the default filtered listing lacks focusName; apps/web/src/lib/files/viewer.ts does not map FileItem.hidden to the existing QuickLook ViewerItem.badge or supply Unhide. The #1153 folder deep-link screenshots also show no Hidden badge.

Expected (§31/§33): opening a stable hidden Item link reveals that Item, shows Hidden, and provides Unhide. It must not require changing the User's shared Show hidden setting. Reuse the shared QuickLook/Chrome primitives and CSS; do not add layout measurement or local styling.

Evidence is retained under artifacts/hide5-1153/: file-link-probe.mjs, file-link-probe-final.log, cold-file-link-default.png, cold-file-link-shown.png, and actual-size Files/folder screenshot sets. The #1153 final report will link the attachment archive. No data bytes or Share authorization changed in this probe.

Found during the #1153 production screenshot pass on branch job/hide-1153 (head 1d187f8c0). The hide5 job is restricted to preserved projection work, the Daily Log failure, gates and screenshots; it makes no product UI changes. Real-server reproduction, macOS platform, 390 × 844: 1. Upload one text File through the Files API. 2. Hide it through `PUT /api/v1/tags/hidden` (documented 204). 3. Read its stable item ID through `GET /api/v1/files/entries?show_hidden_items=true` (the returned Item has `hidden: true`). 4. Save Show hidden off and open `/f/<item-id>`. Files loads, but Quick Look does not open. 5. Save Show hidden on and open the same link. Quick Look opens the real text File, but shows no Hidden badge or Unhide action. Probe output, unchanged production assets: ```json {"defaultHiddenFileLinkOpens":false,"hiddenFileBadgeCount":0,"visibleUnhideActionCount":0,"apiHidden":true} ``` Source evidence: `apps/web/src/lib/files/FilesBrowser.svelte` `applyFocusRequest` returns when the default filtered listing lacks `focusName`; `apps/web/src/lib/files/viewer.ts` does not map `FileItem.hidden` to the existing QuickLook `ViewerItem.badge` or supply Unhide. The #1153 folder deep-link screenshots also show no Hidden badge. Expected (§31/§33): opening a stable hidden Item link reveals that Item, shows Hidden, and provides Unhide. It must not require changing the User's shared Show hidden setting. Reuse the shared QuickLook/Chrome primitives and CSS; do not add layout measurement or local styling. Evidence is retained under `artifacts/hide5-1153/`: `file-link-probe.mjs`, `file-link-probe-final.log`, `cold-file-link-default.png`, `cold-file-link-shown.png`, and actual-size Files/folder screenshot sets. The #1153 final report will link the attachment archive. No data bytes or Share authorization changed in this probe.
Author
Owner

Cold hidden File links were checked against the real API and production SPA. The API confirms hidden=true. With Show hidden off, the deep link does not open Quick Look. With it on, the preview opens but has no Hidden badge or Unhide action. Folder deep links also lack this header action.

Evidence: hide5-known-gap-part1.zip. These are original 390 px macOS screenshots. This finding is outside hide5-1153's restricted projection/test scope; no UI behavior was changed.

Cold hidden File links were checked against the real API and production SPA. The API confirms hidden=true. With Show hidden off, the deep link does not open Quick Look. With it on, the preview opens but has no Hidden badge or Unhide action. Folder deep links also lack this header action. Evidence: [hide5-known-gap-part1.zip](https://git.kayg.org/attachments/7f75620f-ac86-420b-9d5a-26e45f4f2bcb). These are original 390 px macOS screenshots. This finding is outside hide5-1153's restricted projection/test scope; no UI behavior was changed.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1212
No description provided.