Mail API: reconcile anonymous event-stream denial body #1064

Open
opened 2026-10-04 15:44:57 +00:00 by kayg · 0 comments
Owner

Found during the single real-server adversarial round for #867 at head 6bad188b0.

An anonymous GET /api/v1/mail/events returned HTTP 401 with the normal structured body {"error":{"code":"unauthorized","message":"authentication is required"}}. The existing assertion in tests/adversarial/mail_api.mjs:98 expects an empty body. Authorization remained enforced; this is a response-contract mismatch, not an access-control failure.

Keep the existing assertion until the owner decides whether the event endpoint should return an empty 401 or the shared JSON denial. Then update the route or the probe and retain a regression check.

Found during the single real-server adversarial round for #867 at head 6bad188b0. An anonymous `GET /api/v1/mail/events` returned HTTP 401 with the normal structured body `{"error":{"code":"unauthorized","message":"authentication is required"}}`. The existing assertion in `tests/adversarial/mail_api.mjs:98` expects an empty body. Authorization remained enforced; this is a response-contract mismatch, not an access-control failure. Keep the existing assertion until the owner decides whether the event endpoint should return an empty 401 or the shared JSON denial. Then update the route or the probe and retain a regression check.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#1064
No description provided.