Merge35: foreign Calendar feed actions return 403 instead of private 404 #1472

Open
opened 2026-10-08 13:50:14 +00:00 by kayg · 0 comments
Owner

Merge35 (#1458) real-release second adversarial phase reported three Calendar feed denial-contract failures:

!! calendar feed cross-User rotate: expected 404, got 403 b'{"code":"forbidden","message":"Access denied"}'
!! calendar feed cross-User revoke: expected 404, got 403 b'{"code":"forbidden","message":"Access denied"}'
!! calendar feed cross-User delete: expected 404, got 403 b'{"code":"forbidden","message":"Access denied"}'

tests/adversarial/attack2.py retains its existing 404 expectation for these private feed actions. The 403 denies the action; these lines alone do not prove a content leak or a successful foreign mutation. Check the owned-ID/missing-ID response pair and feed authority before deciding whether this is a privacy regression or a changed contract. Do not alter the old expectation only to make the gate pass.

Product build 938a141d5; integration head 0ba15bd945. Local log: artifacts/merge35/adversarial.log. The same round's other xuser contract failures are in #1466; Calendar 503 is in #1469.

Merge35 (#1458) real-release second adversarial phase reported three Calendar feed denial-contract failures: ``` !! calendar feed cross-User rotate: expected 404, got 403 b'{"code":"forbidden","message":"Access denied"}' !! calendar feed cross-User revoke: expected 404, got 403 b'{"code":"forbidden","message":"Access denied"}' !! calendar feed cross-User delete: expected 404, got 403 b'{"code":"forbidden","message":"Access denied"}' ``` `tests/adversarial/attack2.py` retains its existing 404 expectation for these private feed actions. The 403 denies the action; these lines alone do not prove a content leak or a successful foreign mutation. Check the owned-ID/missing-ID response pair and feed authority before deciding whether this is a privacy regression or a changed contract. Do not alter the old expectation only to make the gate pass. Product build 938a141d5; integration head 0ba15bd9459c66dd820297474b71d603ca8e637f. Local log: `artifacts/merge35/adversarial.log`. The same round's other xuser contract failures are in #1466; Calendar 503 is in #1469.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1472
No description provided.