Photos loses Live Photo pairing after Tags rewrites XMP attributes as elements #1486

Open
opened 2026-10-08 22:06:25 +00:00 by kayg · 2 comments
Owner

The live xuser matrix and the focused Photos Share probe both lose the accepted Live Photo Stack after adding an owner-only Tag. The Photo item remains readable; /api/v1/photos/stacks/{group_id} returns 404.

Cause: the original fixture sidecars encode xmpMM:ContentIdentifier as an RDF attribute. The Tag writer preserves the value but serializes it as an RDF child element. Photos' existing bounded read_xmp function reads attributes only. Reindexing therefore loses the pairing field and dissolves the Stack. This is an interaction between Tags and Photos, not a cross-User leak. The same reader existed on production cc1af3c12; the new Photos Tags path exposed it in this merge.

Observed retained fixture: the motion sidecar contains one ContentIdentifier attribute. The tagged photo sidecar contains one ContentIdentifier element and no such attribute. No raw credentials or sidecar values are included here.

Fix in merge round #1479: extend the existing bounded reader to accept both legal property forms. Keep the one-MiB input cap and directory-handle-relative Files Index pairing. Add a focused regression and repeat the failed live Photo scope case. DESIGN §§28, 31, 35, 54.

The live xuser matrix and the focused Photos Share probe both lose the accepted Live Photo Stack after adding an owner-only Tag. The Photo item remains readable; `/api/v1/photos/stacks/{group_id}` returns 404. Cause: the original fixture sidecars encode xmpMM:ContentIdentifier as an RDF attribute. The Tag writer preserves the value but serializes it as an RDF child element. Photos' existing bounded read_xmp function reads attributes only. Reindexing therefore loses the pairing field and dissolves the Stack. This is an interaction between Tags and Photos, not a cross-User leak. The same reader existed on production cc1af3c12; the new Photos Tags path exposed it in this merge. Observed retained fixture: the motion sidecar contains one ContentIdentifier attribute. The tagged photo sidecar contains one ContentIdentifier element and no such attribute. No raw credentials or sidecar values are included here. Fix in merge round #1479: extend the existing bounded reader to accept both legal property forms. Keep the one-MiB input cap and directory-handle-relative Files Index pairing. Add a focused regression and repeat the failed live Photo scope case. DESIGN §§28, 31, 35, 54.
Author
Owner

Fixed #1486 in 4ccb91bfb: the existing Photos read_xmp reader now reads RDF attributes and scalar child elements through one value setter. It keeps its indexed Sidecar path, directory-handle-relative read and one-MiB cap. Work is one bounded read plus O(XML bytes) parsing; it does not scan the Home or add per-request IO.

Verbatim focused gates:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 13.16s
test result: ok. 60 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 10.67s

cargo fmt --check exited 0. The new regression verifies identical pairing, key-photo and burst values across attribute and element encodings, including escaped values. Existing expectations remain unchanged. A matching real-server rerun is still pending the updated binary build.

Directory visibility #1199 and the Notification subscription #1445 probes both passed on the release server. Money cancellation isolation passed before the separate Photo Stack failure in the full xuser attempt. The broad identifier replay is still incomplete.

Fixed #1486 in 4ccb91bfb: the existing Photos read_xmp reader now reads RDF attributes and scalar child elements through one value setter. It keeps its indexed Sidecar path, directory-handle-relative read and one-MiB cap. Work is one bounded read plus O(XML bytes) parsing; it does not scan the Home or add per-request IO. Verbatim focused gates: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 13.16s test result: ok. 60 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 10.67s ``` `cargo fmt --check` exited 0. The new regression verifies identical pairing, key-photo and burst values across attribute and element encodings, including escaped values. Existing expectations remain unchanged. A matching real-server rerun is still pending the updated binary build. Directory visibility #1199 and the Notification subscription #1445 probes both passed on the release server. Money cancellation isolation passed before the separate Photo Stack failure in the full xuser attempt. The broad identifier replay is still incomplete.
Author
Owner

Head 4ccb91bfb5. The rebuilt release server now passes the previously failing live Photo Stack path after Tags change XMP property representation. Verbatim probe result:

Photos Share contracts: timeline, buckets, day, search, item, stack, Calendar, Files ID, original, thumbnail and Public link pass before/after revoke

The broad cross-User replay is still running. Native Photos tests: 60 passed, 0 failed, 4 ignored. No source Photo files were changed by the parser fix.

Head 4ccb91bfb5ea6bed94d5a33666d16d92afb3239a. The rebuilt release server now passes the previously failing live Photo Stack path after Tags change XMP property representation. Verbatim probe result: ```text Photos Share contracts: timeline, buckets, day, search, item, stack, Calendar, Files ID, original, thumbnail and Public link pass before/after revoke ``` The broad cross-User replay is still running. Native Photos tests: 60 passed, 0 failed, 4 ignored. No source Photo files were changed by the parser fix.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1486
No description provided.