Photos timeline omits items from an active shared root #187

Closed
opened 2026-09-26 15:13:54 +00:00 by kayg · 2 comments
Owner

Reproduction

  1. Install and index Photos/2024/2024-06-02/adversarial-photo.jpg for user A.
  2. Create a Files Share from A's Photos folder to user B.
  3. As B, set /api/v1/photos/library-roots to Shared/<A>/Photos.
  4. Poll /api/v1/photos/timeline?before=2024-06-03&days=7&tiles_per_day=10 as B.

The real-server adversarial probe received HTTP 200 on each poll for 12 seconds, with {"days":[],"next_before":null}. The active shared photo did not appear. The server stayed alive; this was not a latency-only finding.

Probe: tests/adversarial/attack2.py, isolation section (Photos shared timeline).

## Reproduction 1. Install and index `Photos/2024/2024-06-02/adversarial-photo.jpg` for user A. 2. Create a Files Share from A's `Photos` folder to user B. 3. As B, set `/api/v1/photos/library-roots` to `Shared/<A>/Photos`. 4. Poll `/api/v1/photos/timeline?before=2024-06-03&days=7&tiles_per_day=10` as B. The real-server adversarial probe received HTTP 200 on each poll for 12 seconds, with `{"days":[],"next_before":null}`. The active shared photo did not appear. The server stayed alive; this was not a latency-only finding. Probe: `tests/adversarial/attack2.py`, `isolation` section (`Photos shared timeline`).
Author
Owner

Additional evidence from the #176 post-merge adversarial round on 2026-09-27:

  • The Photos shared timeline probe reported: active shared photo never appeared: 200 b'{"days":[],"next_before":null}'.
  • The HTTP response was 200, but the active shared photo was absent. The server remained alive.
  • Other worktrees were running API probes on the shared host. This was an empty-result correctness finding, not a latency-only result.

This matches the existing reproduction in #187. No Photos API behavior was changed in the menu-icons job.

Additional evidence from the #176 post-merge adversarial round on 2026-09-27: - The `Photos shared timeline` probe reported: `active shared photo never appeared: 200 b'{"days":[],"next_before":null}'`. - The HTTP response was 200, but the active shared photo was absent. The server remained alive. - Other worktrees were running API probes on the shared host. This was an empty-result correctness finding, not a latency-only result. This matches the existing reproduction in #187. No Photos API behavior was changed in the menu-icons job.
Author
Owner

Merged into dev by Claude after review (413ccaa7), deploying to calternal.cloud. Closing.

Merged into dev by Claude after review (413ccaa7), deploying to calternal.cloud. Closing.
kayg closed this issue 2026-09-28 23:46:34 +00:00
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#187
No description provided.