kayg/calternal
Watch
1
0
Fork
You've already forked calternal
 0
Code Issues 803 Pull requests Projects Releases Packages Wiki Activity Actions 430

[authz] Non-admin config writes return 422 instead of 403 #268

New issue
Closed
opened 2026-09-27 20:44:02 +00:00 by kayg · 18 comments
kayg commented 2026-09-27 20:44:02 +00:00
Owner
Copy link

Observed on the real local adversarial server built from job/index-order after merging dev at 418fcdfce8.

The authz matrix fetched the valid admin config body as Owner, then sent PUT /api/v1/admin/config as the standard User. The matrix expected 403, but the server returned 422. The request was rejected, but it did not use the permission-denied response used by the other admin operations.

Evidence: tests/adversarial/authz_matrix.py reported !! PUT /api/v1/admin/config as standard: expected 403, received 422 in the 234-operation x 4-identity pass.

Please check the authorization and validation order for this route. This follow-up is outside the Files Index repair in #259.

Observed on the real local adversarial server built from job/index-order after merging dev at 418fcdfce8fc1300eddb71fc6e1301d5afdedece. The authz matrix fetched the valid admin config body as Owner, then sent PUT /api/v1/admin/config as the standard User. The matrix expected 403, but the server returned 422. The request was rejected, but it did not use the permission-denied response used by the other admin operations. Evidence: tests/adversarial/authz_matrix.py reported `!! PUT /api/v1/admin/config as standard: expected 403, received 422` in the 234-operation x 4-identity pass. Please check the authorization and validation order for this route. This follow-up is outside the Files Index repair in #259.
kayg commented 2026-09-27 22:00:44 +00:00
Author
Owner
Copy link

Orchestrator: not just this route. Authorization must run BEFORE body extraction/validation on every privileged route (a non-admin must never learn the validation rules or schema of admin endpoints). Audit every admin/owner-only route (and plugin admin routes): put the role check in a guard/extractor ordered before Json/validation extractors (or a router-level layer on /api/v1/admin/*), return 403 uniformly for unauthorised callers regardless of body validity, and extend authz_matrix.py to send both valid and invalid bodies as each identity and assert 403 for non-admins in both cases.

Orchestrator: not just this route. Authorization must run BEFORE body extraction/validation on every privileged route (a non-admin must never learn the validation rules or schema of admin endpoints). Audit every admin/owner-only route (and plugin admin routes): put the role check in a guard/extractor ordered before Json/validation extractors (or a router-level layer on /api/v1/admin/*), return 403 uniformly for unauthorised callers regardless of body validity, and extend authz_matrix.py to send both valid and invalid bodies as each identity and assert 403 for non-admins in both cases.
kayg commented 2026-09-27 22:01:26 +00:00
Author
Owner
Copy link

Starting #268 on job/authz-order at 6a6ffd5ab4 (base dev: 6a6ffd5ab4). I am tracing the privileged route boundaries and authorization matrix before changing them.

Starting #268 on job/authz-order at 6a6ffd5ab47ff59eeabd3a6f1ccfd5f196e1e382 (base dev: 6a6ffd5ab47ff59eeabd3a6f1ccfd5f196e1e382). I am tracing the privileged route boundaries and authorization matrix before changing them.
kayg commented 2026-09-27 22:03:29 +00:00
Author
Owner
Copy link

Follow-up from the chrome-sidebar adversarial round: I traced the matrix's 422 against the current API types. GET /api/v1/admin/config returns AdminConfigView, whose dedup schedule is a structured view; PUT accepts InstanceConfig, whose dedup schedule is a cron string. The matrix copied the GET view into the PUT body, so Axum rejected it during JSON extraction before put_config reached its admin check. This did not establish an authorization-order defect. I removed that substitution and kept the OpenAPI InstanceConfig request body; Python syntax and whitespace checks pass. I did not rerun the full matrix because this job is limited to one adversarial round.

Follow-up from the chrome-sidebar adversarial round: I traced the matrix's 422 against the current API types. `GET /api/v1/admin/config` returns `AdminConfigView`, whose dedup schedule is a structured view; `PUT` accepts `InstanceConfig`, whose dedup schedule is a cron string. The matrix copied the GET view into the PUT body, so Axum rejected it during JSON extraction before `put_config` reached its admin check. This did not establish an authorization-order defect. I removed that substitution and kept the OpenAPI `InstanceConfig` request body; Python syntax and whitespace checks pass. I did not rerun the full matrix because this job is limited to one adversarial round.
kayg commented 2026-09-27 22:06:48 +00:00
Author
Owner
Copy link

Finding: PUT /api/v1/admin/config, other body-bearing admin routes, and PUT /api/v1/admin/plugins/{id} validate Axum body extractors before their handler-level role checks. This explains the reported 422 for a standard User on the config route. The auth crate’s role-protected routes use RequireScope<Admin> before body extractors. I am applying a shared server route guard to every server admin route and plugin instance-admin route; the guard will also enforce the existing recent-assertion requirement before parsing on sensitive writes.

Finding: `PUT /api/v1/admin/config`, other body-bearing admin routes, and `PUT /api/v1/admin/plugins/{id}` validate Axum body extractors before their handler-level role checks. This explains the reported 422 for a standard User on the config route. The auth crate’s role-protected routes use `RequireScope<Admin>` before body extractors. I am applying a shared server route guard to every server admin route and plugin instance-admin route; the guard will also enforce the existing recent-assertion requirement before parsing on sensitive writes.
kayg commented 2026-09-27 22:10:27 +00:00
Author
Owner
Copy link

Additional finding: the auth admin handlers check require_fresh inside the handler after Json extraction for invite creation, passkey re-enrolment, role/disable changes and signup settings. Their RequireScope<Admin> check is already before the body, but stale admin sessions can still observe body validation responses. I am extending that shared extractor with a recent-assertion marker and applying it to those operations before their request extractors.

Additional finding: the auth admin handlers check `require_fresh` inside the handler after `Json` extraction for invite creation, passkey re-enrolment, role/disable changes and signup settings. Their `RequireScope<Admin>` check is already before the body, but stale admin sessions can still observe body validation responses. I am extending that shared extractor with a recent-assertion marker and applying it to those operations before their request extractors.
kayg commented 2026-09-27 22:42:13 +00:00
Author
Owner
Copy link

Matrix finding/correction: the first local round completed 980 requests with no authorization failures, but its PUT /api/v1/admin/config valid case still copied the GET AdminConfigView. The GET schedule is a structured view, while PUT accepts the InstanceConfig cron string. I removed that substitution and built a validator-safe InstanceConfig body from the OpenAPI request schema. Offline checks confirm valid and malformed cases for all 11 privileged routes with bodies. I did not rerun the real-server round because this job is limited to one adversarial round.

Matrix finding/correction: the first local round completed 980 requests with no authorization failures, but its `PUT /api/v1/admin/config` valid case still copied the GET `AdminConfigView`. The GET schedule is a structured view, while PUT accepts the `InstanceConfig` cron string. I removed that substitution and built a validator-safe `InstanceConfig` body from the OpenAPI request schema. Offline checks confirm valid and malformed cases for all 11 privileged routes with bodies. I did not rerun the real-server round because this job is limited to one adversarial round.
kayg commented 2026-09-27 22:45:25 +00:00
Author
Owner
Copy link

Repeated observation during Forgejo #191's real-server adversarial round on 2026-09-28. The authz matrix fetched the current valid admin config as Owner, then sent PUT /api/v1/admin/config as the standard user. It expected 403 and received 422. The broad matrix covered 242 operations x 4 identities (968 requests); this was its only reported mismatch. The write was rejected. This agrees with the response-order issue already tracked here.

Repeated observation during Forgejo #191's real-server adversarial round on 2026-09-28. The authz matrix fetched the current valid admin config as Owner, then sent PUT /api/v1/admin/config as the standard user. It expected 403 and received 422. The broad matrix covered 242 operations x 4 identities (968 requests); this was its only reported mismatch. The write was rejected. This agrees with the response-order issue already tracked here.
kayg commented 2026-09-27 23:04:31 +00:00
Author
Owner
Copy link

The first full cargo test reached the isolated live-app test and found stale expectations: anonymous requests to /api/v1/auth/users and /api/v1/auth/invites, plus an expired cookie on /api/v1/admin/system/codecs, still expected 401. These are protected administration routes and now return the requested uniform 403. Updated those expectations; cargo test -p calternal-server wire::tests::live_apps_run_in_separate_processes -- --exact passes (1 passed, 0 failed).

The first full `cargo test` reached the isolated live-app test and found stale expectations: anonymous requests to `/api/v1/auth/users` and `/api/v1/auth/invites`, plus an expired cookie on `/api/v1/admin/system/codecs`, still expected 401. These are protected administration routes and now return the requested uniform 403. Updated those expectations; `cargo test -p calternal-server wire::tests::live_apps_run_in_separate_processes -- --exact` passes (1 passed, 0 failed).
kayg commented 2026-09-27 23:09:19 +00:00
Author
Owner
Copy link

Implemented Forgejo #268 on job/authz-order.

Approach: A shared Axum route guard checks the authenticated principal's admin scope and owner/admin role before handler extractors run. Mutations that already required a recent passkey assertion use the same guard with freshness enabled. Auth API routes use a shared FreshAdmin extractor, so scope, role, and freshness checks run before JSON validation. The outer session layer maps missing or invalid credentials on privileged routes to the same 403 response. The adversarial matrix sends valid and malformed bodies for every privileged body route and each identity.

Commits / head: e380d811 guard, 0a34b159 valid OpenAPI config body in the matrix, merge of dev at dc27d075, and 8dd903231a4409b9aca83fe05a83a3deab461ac0 for updated protected-route expectations. The branch push completed (Everything up-to-date).

Files: crates/calternal-auth/src/api.rs, crates/calternal-server/src/authz.rs, crates/calternal-server/src/main.rs, crates/calternal-server/src/wire.rs, tests/adversarial/authz_matrix.py.

Gates and validation:

  • cargo fmt --all -- --check — exit 0, no output.
  • cargo clippy --all-targets -- -D warnings — output: 
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 6m 19s
  • The single full cargo test run reached the server live-app test and failed on old 401 expectations. Output excerpt: 
    assertion `left == right` failed: /api/v1/auth/users
left: 403
right: 401
test result: FAILED. 59 passed; 1 failed; 2 ignored; 0 measured; 0 filtered out; finished in 9.67s
    Updated anonymous /auth/users and /auth/invites plus expired-cookie /admin/system/codecs expectations. Focused rerun output: 
    test wire::tests::live_apps_run_in_separate_processes ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 61 filtered out
  • bun run check output: svelte-check found 0 errors and 0 warnings.
  • bun run test output: 
    Test Files  89 passed (89)
     Tests  620 passed (620)
  Duration  71.02s (transform 62%, environment 14%, import 13%, tests 8%, setup 2%)
  • One AUTHZ_MATRIX_ONLY=1 tests/adversarial/run.sh round completed with 980 matrix requests across 234 OpenAPI operations and four identities; no policy failures were reported. It reported 11 privileged body routes per identity. The matrix's PUT /admin/config valid body was corrected afterward to use the OpenAPI InstanceConfig request schema and was checked offline; the one-round limit meant the corrected matrix was not sent through a second server run.
  • cargo clean output: Removed 18476 files, 15.6GiB total; apps/web/build was deleted. Worktree is clean.

Known gap: The full workspace test command was not rerun after updating the stale expectations. The focused live-app test passes; all other tests reached before that failure passed. The corrected config matrix body was checked offline but not in another adversarial server round.

Decisions for owner review: Use 403 for unauthenticated and invalid-credential callers on privileged routes to satisfy uniform authorization responses. Preserve recent-assertion requirements only on routes that already required them; role-only admin routes remain role-only. The issue clarification defines the valid config PUT body as InstanceConfig, not the AdminConfigView returned by GET.

Implemented Forgejo #268 on `job/authz-order`. **Approach:** A shared Axum route guard checks the authenticated principal's admin scope and owner/admin role before handler extractors run. Mutations that already required a recent passkey assertion use the same guard with freshness enabled. Auth API routes use a shared `FreshAdmin` extractor, so scope, role, and freshness checks run before JSON validation. The outer session layer maps missing or invalid credentials on privileged routes to the same 403 response. The adversarial matrix sends valid and malformed bodies for every privileged body route and each identity. **Commits / head:** `e380d811` guard, `0a34b159` valid OpenAPI config body in the matrix, merge of `dev` at `dc27d075`, and `8dd903231a4409b9aca83fe05a83a3deab461ac0` for updated protected-route expectations. The branch push completed (`Everything up-to-date`). **Files:** `crates/calternal-auth/src/api.rs`, `crates/calternal-server/src/authz.rs`, `crates/calternal-server/src/main.rs`, `crates/calternal-server/src/wire.rs`, `tests/adversarial/authz_matrix.py`. **Gates and validation:** - `cargo fmt --all -- --check` — exit 0, no output. - `cargo clippy --all-targets -- -D warnings` — output: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 6m 19s ``` - The single full `cargo test` run reached the server live-app test and failed on old 401 expectations. Output excerpt: ``` assertion `left == right` failed: /api/v1/auth/users left: 403 right: 401 test result: FAILED. 59 passed; 1 failed; 2 ignored; 0 measured; 0 filtered out; finished in 9.67s ``` Updated anonymous `/auth/users` and `/auth/invites` plus expired-cookie `/admin/system/codecs` expectations. Focused rerun output: ``` test wire::tests::live_apps_run_in_separate_processes ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 61 filtered out ``` - `bun run check` output: `svelte-check found 0 errors and 0 warnings`. - `bun run test` output: ``` Test Files 89 passed (89) Tests 620 passed (620) Duration 71.02s (transform 62%, environment 14%, import 13%, tests 8%, setup 2%) ``` - One `AUTHZ_MATRIX_ONLY=1 tests/adversarial/run.sh` round completed with 980 matrix requests across 234 OpenAPI operations and four identities; no policy failures were reported. It reported 11 privileged body routes per identity. The matrix's `PUT /admin/config` valid body was corrected afterward to use the OpenAPI `InstanceConfig` request schema and was checked offline; the one-round limit meant the corrected matrix was not sent through a second server run. - `cargo clean` output: `Removed 18476 files, 15.6GiB total`; `apps/web/build` was deleted. Worktree is clean. **Known gap:** The full workspace test command was not rerun after updating the stale expectations. The focused live-app test passes; all other tests reached before that failure passed. The corrected config matrix body was checked offline but not in another adversarial server round. **Decisions for owner review:** Use 403 for unauthenticated and invalid-credential callers on privileged routes to satisfy uniform authorization responses. Preserve recent-assertion requirements only on routes that already required them; role-only admin routes remain role-only. The issue clarification defines the valid config PUT body as `InstanceConfig`, not the `AdminConfigView` returned by GET.
kayg commented 2026-09-27 23:12:18 +00:00
Author
Owner
Copy link

Starting #268 on branch job/authz-order.

  • Base dev: 088e17d4fe49d6a7b41f03fcc13f5f4959346be9
  • Starting head: 8dd903231a4409b9aca83fe05a83a3deab461ac0

The authorization-before-extraction change is present in e380d811. The latest commit only changed anonymous response expectations from 401 to 403. I am tracing the established auth and step-up response contract, then I will cover anonymous, non-admin and stale-admin callers with valid and malformed request bodies.

Starting #268 on branch `job/authz-order`. - Base `dev`: `088e17d4fe49d6a7b41f03fcc13f5f4959346be9` - Starting head: `8dd903231a4409b9aca83fe05a83a3deab461ac0` The authorization-before-extraction change is present in `e380d811`. The latest commit only changed anonymous response expectations from 401 to 403. I am tracing the established auth and step-up response contract, then I will cover anonymous, non-admin and stale-admin callers with valid and malformed request bodies.
kayg commented 2026-09-27 23:16:58 +00:00
Author
Owner
Copy link

Finding: the five-minute check in AuthStore::require_fresh returns AuthError::Forbidden; the auth error response is HTTP 403 with JSON code forbidden. apps/web/src/routes/settings/api.svelte.ts uses HTTP 403 to start withStepUp and request a passkey. The route middleware added in e380d811 returns a bare status, and RequireScope plus session_context map anonymous/invalid admin sessions to 403. This changes the web sign-in contract and removes the structured response. I will preserve the early guard while returning the existing auth errors: 401 (unauthenticated or invalid_token) without a principal, 403 (forbidden) for authenticated insufficient authority or stale assertion.

Finding: the five-minute check in `AuthStore::require_fresh` returns `AuthError::Forbidden`; the auth error response is HTTP 403 with JSON code `forbidden`. `apps/web/src/routes/settings/api.svelte.ts` uses HTTP 403 to start `withStepUp` and request a passkey. The route middleware added in `e380d811` returns a bare status, and `RequireScope` plus `session_context` map anonymous/invalid admin sessions to 403. This changes the web sign-in contract and removes the structured response. I will preserve the early guard while returning the existing auth errors: 401 (`unauthenticated` or `invalid_token`) without a principal, 403 (`forbidden`) for authenticated insufficient authority or stale assertion.
kayg commented 2026-09-27 23:44:58 +00:00
Author
Owner
Copy link

The first local authz matrix round completed 1,039 requests. Anonymous, invalid-session and non-admin response checks passed. The 24 stale-admin probe failures were fixture setup: the matrix reused its sign-out token, and the matrix signed that token out before running the stale-admin probes. I am giving the stale-assertion probe its own disposable session and will verify it on the local server.

The first local authz matrix round completed 1,039 requests. Anonymous, invalid-session and non-admin response checks passed. The 24 stale-admin probe failures were fixture setup: the matrix reused its sign-out token, and the matrix signed that token out before running the stale-admin probes. I am giving the stale-assertion probe its own disposable session and will verify it on the local server.
kayg commented 2026-09-27 23:46:44 +00:00
Author
Owner
Copy link

The corrected local-server round passed. The fixture now uses a separate admin session for the stale-assertion probe, so the earlier sign-out step cannot revoke it.

Verbatim probe output:

calendar Event tag probe: Unicode/bidi, 65536-byte category, 7 malformed inputs, and 24 parallel reads passed
Authorization matrix: 234 OpenAPI operations; 1039 requests across 4 base identities plus invalid/stale session probes; valid/malformed bodies on 11 privileged body routes per identity; policy classes {'public': 18, 'public_link': 14, 'user': 178, 'admin': 24}

The matrix reported no !! failures.

The corrected local-server round passed. The fixture now uses a separate admin session for the stale-assertion probe, so the earlier sign-out step cannot revoke it. Verbatim probe output: ```text calendar Event tag probe: Unicode/bidi, 65536-byte category, 7 malformed inputs, and 24 parallel reads passed Authorization matrix: 234 OpenAPI operations; 1039 requests across 4 base identities plus invalid/stale session probes; valid/malformed bodies on 11 privileged body routes per identity; policy classes {'public': 18, 'public_link': 14, 'user': 178, 'admin': 24} ``` The matrix reported no `!!` failures.
kayg commented 2026-09-27 23:49:41 +00:00
Author
Owner
Copy link

Final report — #268

  • Branch: job/authz-order
  • Base dev: 088e17d4fe49d6a7b41f03fcc13f5f4959346be9
  • Head: 55b3dbd9af929fa4acd164f7f15ce02092d14933
  • The branch was pushed to origin/job/authz-order.
  • git merge dev ran before final gates and returned Already up to date.

Built

Restored the existing auth response contract while keeping authorization ahead of body extraction. Requests without a principal now return the auth layer's 401 response. Authenticated callers without the required Role or scope return 403. A stale admin assertion still returns 403 with code forbidden, which triggers the web client's passkey step-up retry.

The adversarial matrix now checks anonymous, invalid-session, authenticated non-admin and stale-admin callers. Protected body routes run with valid and malformed bodies. Its stale assertion uses a dedicated disposable session.

Files

  • crates/calternal-auth/src/api.rs
  • crates/calternal-server/src/authz.rs
  • crates/calternal-server/src/wire.rs
  • tests/adversarial/authz_matrix.py
  • tests/adversarial/setup.mjs
  • apps/web/src/routes/settings/api.svelte.test.ts

Gates

cargo fmt --all --check — exit 0; the command emitted no output.

cargo test -p calternal-server -p calternal-auth:

test result: ok. 50 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 19.83s
test result: ok. 60 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 5.24s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy --all-targets -- -D warnings:

Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 08s

bun run --cwd apps/web check:

svelte-check found 0 errors and 0 warnings

bun run --cwd apps/web test:

Test Files  90 passed (90)
Tests  622 passed (622)

The web test run also printed jsdom messages (Not implemented: Window's scrollTo() method and Could not parse CSS stylesheet); Vitest reported all 622 tests passing.

Real-server focused adversarial output:

calendar Event tag probe: Unicode/bidi, 65536-byte category, 7 malformed inputs, and 24 parallel reads passed
Authorization matrix: 234 OpenAPI operations; 1039 requests across 4 base identities plus invalid/stale session probes; valid/malformed bodies on 11 privileged body routes per identity; policy classes {'public': 18, 'public_link': 14, 'user': 178, 'admin': 24}

The matrix reported no failures.

Known gaps

The adversarial harness ran with AUTHZ_MATRIX_ONLY=1: it covered the auth matrix and calendar-event-tag probe. The broader media, editor, attack.py and attack2.py probes did not run.

Decisions outside the design doc

  • DESIGN §21 defines the five-minute assertion rule but does not specify its HTTP response. I kept the established auth-layer 403 / forbidden response because the web client's withStepUp retries on status 403.
  • To test stale assertions without waiting five minutes, the adversarial fixture creates a separate disposable admin session and sets its asserted_at to NULL in the throwaway test Index. Production code does not use this path.
# Final report — #268 - Branch: `job/authz-order` - Base `dev`: `088e17d4fe49d6a7b41f03fcc13f5f4959346be9` - Head: `55b3dbd9af929fa4acd164f7f15ce02092d14933` - The branch was pushed to `origin/job/authz-order`. - `git merge dev` ran before final gates and returned `Already up to date.` ## Built Restored the existing auth response contract while keeping authorization ahead of body extraction. Requests without a principal now return the auth layer's 401 response. Authenticated callers without the required Role or scope return 403. A stale admin assertion still returns 403 with code `forbidden`, which triggers the web client's passkey step-up retry. The adversarial matrix now checks anonymous, invalid-session, authenticated non-admin and stale-admin callers. Protected body routes run with valid and malformed bodies. Its stale assertion uses a dedicated disposable session. ## Files - `crates/calternal-auth/src/api.rs` - `crates/calternal-server/src/authz.rs` - `crates/calternal-server/src/wire.rs` - `tests/adversarial/authz_matrix.py` - `tests/adversarial/setup.mjs` - `apps/web/src/routes/settings/api.svelte.test.ts` ## Gates `cargo fmt --all --check` — exit 0; the command emitted no output. `cargo test -p calternal-server -p calternal-auth`: ```text test result: ok. 50 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 19.83s test result: ok. 60 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 5.24s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo clippy --all-targets -- -D warnings`: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 08s ``` `bun run --cwd apps/web check`: ```text svelte-check found 0 errors and 0 warnings ``` `bun run --cwd apps/web test`: ```text Test Files 90 passed (90) Tests 622 passed (622) ``` The web test run also printed jsdom messages (`Not implemented: Window's scrollTo() method` and `Could not parse CSS stylesheet`); Vitest reported all 622 tests passing. Real-server focused adversarial output: ```text calendar Event tag probe: Unicode/bidi, 65536-byte category, 7 malformed inputs, and 24 parallel reads passed Authorization matrix: 234 OpenAPI operations; 1039 requests across 4 base identities plus invalid/stale session probes; valid/malformed bodies on 11 privileged body routes per identity; policy classes {'public': 18, 'public_link': 14, 'user': 178, 'admin': 24} ``` The matrix reported no failures. ## Known gaps The adversarial harness ran with `AUTHZ_MATRIX_ONLY=1`: it covered the auth matrix and calendar-event-tag probe. The broader media, editor, `attack.py` and `attack2.py` probes did not run. ## Decisions outside the design doc - DESIGN §21 defines the five-minute assertion rule but does not specify its HTTP response. I kept the established auth-layer `403` / `forbidden` response because the web client's `withStepUp` retries on status 403. - To test stale assertions without waiting five minutes, the adversarial fixture creates a separate disposable admin session and sets its `asserted_at` to `NULL` in the throwaway test Index. Production code does not use this path.
kayg commented 2026-09-28 00:26:27 +00:00
Author
Owner
Copy link

Continuing #268 on job/authz-order after the accepted review.

  • Base dev: 088e17d4fe49d6a7b41f03fcc13f5f4959346be9
  • Starting head: 55b3dbd9af929fa4acd164f7f15ce02092d14933
  • Fetched origin/dev: 976b804f (merging once now as requested).
Continuing #268 on `job/authz-order` after the accepted review. - Base `dev`: `088e17d4fe49d6a7b41f03fcc13f5f4959346be9` - Starting head: `55b3dbd9af929fa4acd164f7f15ce02092d14933` - Fetched `origin/dev`: `976b804f` (merging once now as requested).
kayg commented 2026-09-28 01:14:18 +00:00
Author
Owner
Copy link

Final report — #268 merge and verification

  • Branch: job/authz-order
  • Merged origin/dev at 976b804f99188feb300e391c1942836599e2d429 once.
  • Resolved the sole conflict in tests/adversarial/authz_matrix.py. The resolution keeps the OpenAPI InstanceConfig body for config writes, the valid and malformed request cases, and the TOML config fixture.
  • Head: f32d8522dc8ecb63e90f1ceffb7521558b52d5eb

Built

The accepted authorization-before-extraction guards remain in place for instance-admin and plugin-admin routes. The guard checks admin scope, Role and required assertion freshness before body extraction. The matrix checks valid and malformed bodies for each privileged body route and preserves the existing response contract: no principal gets 401; an authenticated caller without authority or with a stale assertion gets 403.

Files

  • crates/calternal-auth/src/api.rs
  • crates/calternal-server/src/authz.rs
  • crates/calternal-server/src/main.rs
  • crates/calternal-server/src/wire.rs
  • tests/adversarial/authz_matrix.py
  • tests/adversarial/setup.mjs
  • apps/web/src/routes/settings/api.svelte.test.ts

Gates and validation

cargo fmt --check — exit 0; no output.

cargo clippy --all-targets -- -D warnings — exit 0:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 9m 33s

cargo test — exit 0; 72 summaries, 1,332 passed, 0 failed, 12 ignored. The exact per-target summaries follow:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 50 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 39.62s
test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.85s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.47s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.82s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 58.64s
test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.97s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.71s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.53s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.02s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.53s
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 39.65s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 19.95s
test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.79s
test result: ok. 9 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.91s
test result: ok. 17 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 0.32s
test result: ok. 35 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 14.34s
test result: ok. 40 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.13s
test result: ok. 486 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.26s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.38s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.08s
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.76s
test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.11s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.28s
test result: ok. 29 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.96s
test result: ok. 47 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.28s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.62s
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.32s
test result: ok. 117 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 34.02s
test result: ok. 95 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 49.50s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.29s
test result: ok. 42 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 3.42s
test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s
test result: ok. 25 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.91s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.83s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.10s
test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.99s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 1 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 3.22s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 60 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 6.57s
test result: ok. 51 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.15s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.30s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

bun run --cwd apps/web check — exit 0:

svelte-check found 0 errors and 0 warnings

bun run --cwd apps/web test — exit 0:

 Test Files  91 passed (91)
      Tests  631 passed (631)
   Duration  103.52s (transform 64%, environment 13%, import 11%, tests 8%, setup 2%)

The web test output also included jsdom notices: Not implemented: Window's scrollTo() method and Could not parse CSS stylesheet. Vitest reported all 631 tests passing.

packages/api-client/check-generated.sh — exit 0; the OpenAPI contract and generated client were regenerated from the merged source and passed the stale-output check.

One real-server adversarial round passed:

calendar Event tag probe: Unicode/bidi, 65536-byte category, 7 malformed inputs, and 24 parallel reads passed
Authorization matrix: 236 OpenAPI operations; 1047 requests across 4 base identities plus invalid/stale session probes; valid/malformed bodies on 11 privileged body routes per identity; policy classes {'public': 18, 'public_link': 14, 'user': 180, 'admin': 24}

Known gaps

This time-boxed round selected the authorization matrix and calendar Event tag probes. The broader media, editor, attack.py and attack2.py probes did not run. The selected round reported no failures.

Decisions outside DESIGN.md

No new design decision was needed for the merge. The existing #268 choices remain: keep the auth-layer 401 for a missing or invalid principal, use the established 403 forbidden response for insufficient authority and stale assertions, and build config PUT probe bodies from InstanceConfig rather than the AdminConfigView returned by GET.

Delivery

cargo clean — output:

     Removed 19059 files, 14.6GiB total

git push origin job/authz-order — exit 0:

Everything up-to-date
# Final report — #268 merge and verification - Branch: `job/authz-order` - Merged `origin/dev` at `976b804f99188feb300e391c1942836599e2d429` once. - Resolved the sole conflict in `tests/adversarial/authz_matrix.py`. The resolution keeps the OpenAPI `InstanceConfig` body for config writes, the valid and malformed request cases, and the TOML config fixture. - Head: `f32d8522dc8ecb63e90f1ceffb7521558b52d5eb` ## Built The accepted authorization-before-extraction guards remain in place for instance-admin and plugin-admin routes. The guard checks admin scope, Role and required assertion freshness before body extraction. The matrix checks valid and malformed bodies for each privileged body route and preserves the existing response contract: no principal gets 401; an authenticated caller without authority or with a stale assertion gets 403. ## Files - `crates/calternal-auth/src/api.rs` - `crates/calternal-server/src/authz.rs` - `crates/calternal-server/src/main.rs` - `crates/calternal-server/src/wire.rs` - `tests/adversarial/authz_matrix.py` - `tests/adversarial/setup.mjs` - `apps/web/src/routes/settings/api.svelte.test.ts` ## Gates and validation `cargo fmt --check` — exit 0; no output. `cargo clippy --all-targets -- -D warnings` — exit 0: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 9m 33s ``` `cargo test` — exit 0; 72 summaries, 1,332 passed, 0 failed, 12 ignored. The exact per-target summaries follow: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 50 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 39.62s test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.85s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.47s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.82s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 58.64s test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.97s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.71s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.53s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.02s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.53s test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 39.65s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 19.95s test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.79s test result: ok. 9 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.91s test result: ok. 17 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 0.32s test result: ok. 35 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 14.34s test result: ok. 40 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.13s test result: ok. 486 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.26s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.38s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.08s test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.76s test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.11s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.28s test result: ok. 29 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.96s test result: ok. 47 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.28s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.62s test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.32s test result: ok. 117 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 34.02s test result: ok. 95 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 49.50s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.29s test result: ok. 42 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 3.42s test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s test result: ok. 25 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.91s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.83s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.10s test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.99s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 1 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 3.22s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 60 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 6.57s test result: ok. 51 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.15s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.30s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `bun run --cwd apps/web check` — exit 0: ```text svelte-check found 0 errors and 0 warnings ``` `bun run --cwd apps/web test` — exit 0: ```text Test Files 91 passed (91) Tests 631 passed (631) Duration 103.52s (transform 64%, environment 13%, import 11%, tests 8%, setup 2%) ``` The web test output also included jsdom notices: `Not implemented: Window's scrollTo() method` and `Could not parse CSS stylesheet`. Vitest reported all 631 tests passing. `packages/api-client/check-generated.sh` — exit 0; the OpenAPI contract and generated client were regenerated from the merged source and passed the stale-output check. One real-server adversarial round passed: ```text calendar Event tag probe: Unicode/bidi, 65536-byte category, 7 malformed inputs, and 24 parallel reads passed Authorization matrix: 236 OpenAPI operations; 1047 requests across 4 base identities plus invalid/stale session probes; valid/malformed bodies on 11 privileged body routes per identity; policy classes {'public': 18, 'public_link': 14, 'user': 180, 'admin': 24} ``` ## Known gaps This time-boxed round selected the authorization matrix and calendar Event tag probes. The broader media, editor, `attack.py` and `attack2.py` probes did not run. The selected round reported no failures. ## Decisions outside DESIGN.md No new design decision was needed for the merge. The existing #268 choices remain: keep the auth-layer 401 for a missing or invalid principal, use the established 403 `forbidden` response for insufficient authority and stale assertions, and build config PUT probe bodies from `InstanceConfig` rather than the `AdminConfigView` returned by GET. ## Delivery `cargo clean` — output: ```text Removed 19059 files, 14.6GiB total ``` `git push origin job/authz-order` — exit 0: ```text Everything up-to-date ```
kayg commented 2026-09-28 01:15:53 +00:00
Author
Owner
Copy link

Post-gate ref update: origin/dev advanced from the merged 976b804f99188feb300e391c1942836599e2d429 to 55a974d32c5ce1a5e138d4ff04db3db2a5b0855f (Merge job/event-stripes (#279)) while I was running the gates. The pushed head f32d8522dc8ecb63e90f1ceffb7521558b52d5eb has merge parents 55b3dbd9af929fa4acd164f7f15ce02092d14933 and 976b804f99188feb300e391c1942836599e2d429. I did not merge again, following the one-merge/no-loop instruction.

Post-gate ref update: `origin/dev` advanced from the merged `976b804f99188feb300e391c1942836599e2d429` to `55a974d32c5ce1a5e138d4ff04db3db2a5b0855f` (`Merge job/event-stripes (#279)`) while I was running the gates. The pushed head `f32d8522dc8ecb63e90f1ceffb7521558b52d5eb` has merge parents `55b3dbd9af929fa4acd164f7f15ce02092d14933` and `976b804f99188feb300e391c1942836599e2d429`. I did not merge again, following the one-merge/no-loop instruction.
kayg referenced this issue from a commit 2026-09-28 01:21:38 +00:00
Merge job/authz-order (#268)
kayg commented 2026-09-28 01:21:38 +00:00
Author
Owner
Copy link

Merged in ab1f0069: authorization before extraction on every privileged route; 401 anonymous / 403 non-admin / 403 step-up for stale admin (unchanged contract). Clippy clean; server+auth tests 110/110.

Merged in ab1f0069: authorization before extraction on every privileged route; 401 anonymous / 403 non-admin / 403 step-up for stale admin (unchanged contract). Clippy clean; server+auth tests 110/110.
kayg closed this issue 2026-09-28 01:21:39 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
dev
wip/editreg-1132
wip/editorrail3-1113
wip/editorrail2-1113
wip/editorrail-1113
wip/e2e-b2-1071
wip/e2e-b-1071
wip/draw4-1101
wip/draw3-1101
wip/draw2-1101
wip/draw-1101
wip/directory-1199-r
wip/directory-1199
wip/delete-1119
wip/collabrev-1197
wip/collabloss-1197
wip/cards2-1083
wip/cards-1083
wip/canvas-visual
wip/canvasvis2-976
wip/calhdr-1112
wip/calcards-1115
wip/browserfix
wip/blocks-1125
wip/allday-1107
wip/agenda-decks
wip/agenda-1086
wip/adv7c-1105
wip/txentry-1198
wip/trayicons2-1095
wip/trayicons-1095
wip/tagperf-1186
wip/sidebar3-1094
wip/rev2-webperf
wip/rev2-money-ident
job/adv-1202
wip/restyle-notes
wip/previewcard-1098
wip/palette2-1123
wip/palette-1093
wip/onboard2-1141
wip/onboard-1141.aborted-early
wip/onboard-1141
wip/nlpchip-1127
wip/morph-1104
wip/merge-round-7c5
wip/merge-round-7c4
job/notifloop-1194
wip/merge-round-7c3
wip/merge-round-7c2
wip/merge-round-7c
wip/mchrome-1084
wip/mailghost2-1094
wip/mailghost-1094
wip/kbpreview2-1118
wip/kbpreview-1118
wip/kanban-1092
wip/importhang-1121
wip/hiderev-1153
wip/hide4-1153
wip/hide3-1153
wip/hide2-1153
wip/hide-1153
job/collabloss-1197
job/onboard-1141
job/hide-1153
job/perf-1124
job/perf2-1124
job/tocrail-1191
job/restyle-settings
wip/restyle-settings
job/segmented-1200
wip/notifloop-1194
job/tagperf-1186
wip/segmented-1200
job/restyle-files
job/tagdnd-1187
job/merge30
job/cards-1179
wip/cards2-1179
wip/cards-1179
wip/tocrail-1191
wip/tagdnd-1187
wip/restyle-files
wip/perf-1124
wip/merge30j
job/restyle-notes
job/wizchoices-1140
wip/wizchoices-1140
wip/restyle-1190
job/moneyfmt-1180
job/txentry-1198
wip/moneyfmt2-1180
wip/moneyfmt-1180-r
wip/moneyfmt-1180
job/pillglass-1189
job/flags-1181
wip/flags-1181
job/restyle-1190
job/restyle-mailmoney
job/restyle-search
job/settingsreg-1195
job/wizard-1140
site/website
wip/wizardrev2-1140
wip/wizardrev-1140
wip/wizard5-1140
wip/wizard4-1140
wip/wizard3-1140
wip/wizard2-1140
wip/wizard-1140
wip/pillglass-1189
wip/settingsreg-1195
job/merge29
job/fu-1171
wip/merge29j
wip/fu-1171
job/fu-1166
job/directory-1199
job/proflog-1204
job/txresearch-1188
wip/fu-1166
job/merge28
job/search-1066
wip/search-1066
wip/merge28j
job/gateslot-1182
job/bulkimport-1157
job/mailnet-1160
wip/mailnetrev-1160
wip/mailnet-1160
wip/bulkrev-1157
wip/bulkimport-1157
job/startup-1161
wip/startup-1161
job/merge27
job/linkcards-1151
wip/linkcards3-1151
wip/linkcards2-1151
wip/linkcards-1151
job/traydate-1144
wip/traydate3-1144
wip/traydate2-1144
wip/traydate-1144
job/draw-1101
wip/merge27j
job/blockpill-1152
wip/blockpill3-1152
wip/blockpill2-1152
wip/blockpill-1152
job/minihover-1149
wip/minihover2-1149
wip/minihover-1149
job/merge25
wip/merge25-r
wip/merge25b
wip/merge25
job/inspector-1129
job/tags-1110
wip/inspector3-1129
wip/inspector2-1129
wip/inspector-1129
wip/tagsrev-1110
wip/tags2-1110
wip/tags-1110
job/dates-1148
wip/datesrev-1148
wip/dates2-1148
wip/dates-1148
job/licence-1145
wip/licence2-1145
wip/licence-1145
job/selfhost-1156
job/merge23
wip/merge23
job/tagfilter-1109
wip/tagfilter2-1109
wip/tagfilter-1109
job/kbd-1134
wip/kbd2-1134
wip/kbd-1134
job/palfoot-1137
wip/selfhost-1156
wip/palfoot2-1137
wip/palfoot-1137
job/toggle-1158
wip/toggle-1158
job/kbpreview-1118
job/docratchet-1155
job/perflint-1133
job/devtests-1159
wip/docratchet-1155
wip/devtests-1159
job/segv-1136
wip/toast-1142
wip/segv-1136
job/toast-1142
job/blockreload-1147
wip/blockreload-1147
job/font-1150
wip/font-1150
job/importui-1120
job/minimonth-1149
wip/importui-1120
wip/minimonth-1149
job/depcheck-1146
wip/perflint-1133
wip/depcheck-1146
job/calcards-1115
job/blocks-1125
job/plus-1128
job/shift-1138
wip/plus2-1128
wip/plus-1128
wip/shift-1138
job/moneyfid-1130
job/editorrail-1113
wip/moneyrev-1130
wip/moneyfid-1130
job/noext-851
wip/noext-851
wip/noext3-851
wip/noext2-851
job/week-1135
wip/week-1135
job/editreg-1132
job/smoke-1122
wip/smoke-1122
job/docs-1143
job/palette2-1123
job/calhdr-1112
job/nlpchip-1127
job/mailghost-1094
job/reconnect-1131
wip/reconnect-1131
job/trayicons-1095
job/delete-1119
job/importhang-1121
job/cards-1083
job/palette-1093
job/mchrome-1084
job/e2e-a-1071
job/canvas-visual
job/previewcard-1098
job/allday-1107
wip/e2e-a2-1071
wip/e2e-a-1071
job/e2e-b-1071
job/adv7c-1105
job/kanban-1092
job/agenda-1086
job/merge-round-7c
job/morph-1104
wip/surfaces-p2
job/merge-round-9
wip/merge-round-9
job/7cfix-small
wip/7cfix-small
job/mailui-1078
job/merge-round-8
wip/merge-round-8
wip/mailui-1078
job/mailround-1038
job/applemail-accept
wip/settitle-1068
wip/mailround2-1038
wip/mailround-1038
wip/e2e-7b
job/crash-1069
wip/crash-1069
job/searchlost-1066
wip/searchlost-1066
job/7b-reconcile
job/flake-1065
wip/flake-1065
wip/merge-round-7b7
wip/merge-round-7b6
wip/merge-round-7b5
wip/merge-round-7b4
wip/7b-reconcile
job/appupdate-1059
job/nfd-1044
wip/appupdate-1059
job/e2e-7b
job/loop-1062
wip/loop-1062
job/pdfprev-1045
job/invtoggle-1053
wip/pdfprev-1045
wip/nfd-1044
wip/invtoggle-1053
job/7bfix-e2e
job/mailstress-b
wip/7bfix-e2e
wip/mailstress-b
job/7bfix-adv
wip/7bfix-adv
job/mailstress-a
job/stack-1054
wip/stack-1054
wip/mailstress-a
job/mailstress-1038
wip/mailstress-1038
job/upload500-1051
wip/upload500-1051
job/share-1034
wip/share-1034
job/syncerr-1037
job/7bfix-photos
wip/7bfix-photos
job/paste-1036
job/setside-1039
wip/setside-1039
wip/paste-1036
job/lease-1042
wip/syncerr-1037
wip/lease-1042
job/7bfix-data
job/passkeybind-1043
wip/apprevoke-1041
job/invite-1035
wip/invite-1035
job/merge-round-7b2
wip/merge-round-7b2
job/mailproxy-486
job/apprevoke-1041
job/rebuild-1033
job/pillborder-1029
wip/pillborder-1029
wip/mailproxy-486
wip/applemail-486
job/headless-998
wip/headless-998
job/groups-1028
wip/groups-1028
job/rebuildwarn-1016
wip/rebuildwarn-1016
job/startup-1011
wip/startup-1011
job/monthpill-1009
job/bgthumb-1025
job/sharetitle-1012
wip/monthpill-1009
wip/bgthumb-1025
wip/sharetitle-1012
job/canvas-cards-977
wip/canvas-cards-977
job/canvas-pencil-978
job/canvas-sketch-990
wip/canvas-sketch-990
wip/canvas-pencil-978
job/canvas-files-989
wip/canvas-files-989
job/canvas-collab-991
wip/canvas-collab-991
job/weekscroll-1018
wip/weekscroll-1018
wip/canvas-core-976
job/canvas-core-976
job/round-drag
wip/round-drag
job/round-settings
job/browserfix
wip/oapi-974
job/oapi-974
job/hist2-integrate
job/mailhtml-726
wip/mailhtml-726
wip/hist2-integrate
job/moneyfu-984
job/drag-1015
wip/drag-1015
job/rename-1017
wip/rename-1017
job/hist2-api
wip/hist2-api
job/oneacct-1014
wip/oneacct-1014
wip/moneyfu-984
job/hist2-bench
job/hist2-restore
wip/hist2-bench
job/hist2-write
job/hotfix-724
wip/hotfix-724
wip/hist2-write
wip/hist2-restore
job/hist2-store
job/hist2-ui
wip/hist2-ui
wip/hist2-store
job/searchstarve-965
job/shutdown-963
wip/shutdown-963
wip/pubedit-981
job/pubedit-981
job/analytics-973
wip/searchstarve-965
job/authflash-850
job/weeklane-969
job/pvtitle-1004
job/hist-975
wip/authflash-850
job/voicepill-617
wip/pvtitle-1004
job/headring-1003
wip/weeklane-969
wip/voicepill-617
wip/headring-1003
wip/analytics-973
job/agentscope-980
wip/thumbsandbox-988
job/thumbsandbox-988
wip/hist-975
job/links-856
wip/links-856
job/davetag-966
wip/davetag-966
job/filesstorm-1000
job/hoverpad-725
wip/filesstorm-1000
job/ffmpegblas-993
job/merge-round-7a
wip/hoverpad-725
wip/ffmpegblas-993
job/nowdot-1002
wip/verify-7a
job/noteid-857
wip/nowdot-1002
wip/noteid-857
wip/merge-round-7a
wip/agentscope-980
job/imapedge
job/a11yfix2
wip/imapedge-941
wip/imapedge
wip/a11yfix2
job/notetask-986
job/logheading
wip/logheading-998
job/textthumb-652
job/photolive-987
wip/photolive-987
job/davactive-983
job/savefix-985
job/tabicons-607
wip/davactive-983
wip/tabicons-607
wip/notetask-986
wip/savefix-985
job/dirid-627
job/buildspeed-1007
wip/dirid-627
job/agenda-decks
job/perfguards-impl
job/undo-a11y
wip/undo-a11y
job/mailperf
job/wal-824
wip/settings-50
job/settings-50
job/notesfilter-606
wip/notesfilter-606
job/surfaces-p2
wip/wal-824
job/maillayouts
wip/mailperf
wip/maillayouts
job/taskmeta-659
job/money-ident
wip/money-ident
wip/taskmeta-659
job/errstates
wip/perfguards-impl
job/headings-881
wip/headings-881
wip/errstates
job/voice-619
job/gaps-827
job/notesperf
wip/notesperf
wip/voice-619
job/hddsql-549
job/perf-stream-668
wip/perf-stream-668
wip/deeplinks-fix
job/deeplinks-fix
job/authfix
job/docsfix-rust
wip/docsfix-rust
job/webperf
job/docsfix-web
job/datafix2
job/webdav-lock-476
job/copyfix
wip/copyfix
wip/webperf
job/focus-658
wip/protofix
job/mediafix
job/protofix
wip/mediafix
job/agentfix
job/hhmm-724
wip/agentfix
job/undo-722
job/reuse
wip/webdav-lock-476
wip/reuse
job/scopefix
job/datafix
wip/hhmm-724
wip/undo-722
job/surfaces-p1
wip/hddsql-549
job/voicememos-618
wip/datafix2
wip/surfaces-p1
job/fix-940
wip/fix-940
job/blaze-surfaces
wip/datafix
wip/blaze-surfaces
job/taskday-655
job/linknav-639
wip/linknav-639
wip/gaps-827
job/isolation-707
job/audiophotos-720
wip/audiophotos-720
job/advfind-664
wip/voicememos-618
wip/taskday-655
wip/isolation-707
wip/advfind-664
wip/scopefix
wip/focus-658
job/testgaps
wip/testgaps
job/overscroll-718
wip/authfix
job/deps
wip/overscroll-718
job/rev2-agentfix
job/rev2-money-ident
job/rev2-mailperf
wip/deps
job/hardening-728
wip/hardening-728
job/searchgen-832
wip/searchgen-832
job/photopw-849
job/mailsql-825
wip/photopw-849
job/sharefix
wip/sharefix
job/rev2-mailhtml-726
job/rev2-perfguards
job/copyval-723
job/lightglass-r2
wip/lightglass-r2
wip/docsfix-web
job/copy-audit
job/macinterop-staging-r2
job/design-sync
job/rev2-taskmeta-659
job/rev2-webperf
job/docs-audit
job/rev2-advfind-664
job/rev2-mailproxy-486
job/states-audit
job/rev2-datafix
job/design-drift
job/test-gaps
job/rev2-voicememos-618
job/rev2-mediafix
job/rev2-deps
job/rev2-datafix2
job/licence-audit
job/issue-hygiene
job/rev2-protofix
job/rev2-voice-619
job/rev2-isolation-707
job/rev2-surfaces-p1
job/deeplink-audit2
job/rev2-audiophotos-720
wip/test-gaps
job/rev2-overscroll-718
job/rev2-undo-722
wip/states-audit
job/rev2-dropmd-719
job/rev2-linknav-639
job/merge-7b-plan
wip/merge-7b-plan
job/rev2-taskday-655
wip/mailsql-825
job/rev2-webdav-lock-476
job/rev2-browserfix
wip/design-drift
job/rev2-hddsql-549
wip/deeplink-audit2
job/rev2-scopefix
job/rev2-authfix
job/rev2-hardening-728
job/rev2-wal-824
job/rev2-sharefix
job/calsidebar-638
job/chrome-audit
job/ioperf
wip/ioperf
wip/chrome-audit
wip/calsidebar-638
job/dropmd-719
wip/dropmd-719
job/ocr-build
wip/ocr-build
job/blaze-settings
wip/copyval-723
job/toastring-721
wip/toastring-721
job/deployfix-732
wip/deployfix-732
wip/blaze-settings
job/money-import-recheck
job/rev-a11y
job/perf-arch-db
job/rev-7b-data
wip/textthumb-652
wip/perf-arch-db
job/sec-protocols
job/sidehdr-660
job/rev-7b-security
job/research-surfaces
job/rev-design-gaps
job/rev-mcp-api
wip/sidehdr-660
job/perf-arch-memory
wip/sec-protocols
job/perf-arch-bundle
job/snapedge-714
wip/rev-mcp-api
job/sec-supplychain
wip/research-surfaces
job/perf-arch-sync
job/rev-consistency
job/perf-arch-server
wip/perf-arch-server
wip/perf-arch-memory
job/perf-arch-io
job/perf-arch-client
job/sec-fs
job/sec-mcp-scopes
job/sec-sharing
job/perf-guards
job/sec-browser
job/sec-admin-deploy
job/sec-auth
wip/snapedge-714
job/bgpicker-717
wip/perf-arch-bundle
wip/money-import-recheck
job/advsetup-654
wip/bgpicker-717
wip/advsetup-654
job/burst-709
job/kbdcaps-710
job/app-pw-chooser
wip/burst-709
wip/app-pw-chooser
job/imaptest-625
wip/kbdcaps-710
job/fix-499
wip/fix-499
job/perf-mut-667
job/calimg-589
job/perf-snap-666
wip/calimg-589
wip/perf-snap-666
wip/perf-mut-667
job/perf-cache-665
wip/perf-cache-665
job/voicefiles-620
wip/voicefiles-620
job/admin-burst-705
wip/admin-burst-705
job/voicememos-review
wip/voicememos-review
wip/ryw-653
job/ryw-653
job/writeonopen-661
job/instant-663
wip/writeonopen-661
job/money-import-review
wip/money-import-review
wip/importjs-610
review/integrations-407-round6
wip/integrations-review
job/dragghost-612
wip/dragghost-612
job/integrations
wip/integrations
job/decider-656
job/merge-round-6
job/perf-rerun
wip/merge-round-6
job/integrations-review-round5
job/selalign-576
wip/selalign-576
job/mcp-events-491
job/files-631
job/cal-e2e-569
wip/cal-e2e-569
job/reload-423
wip/reload-423
wip/mcp-events-491
wip/files-631
job/notesbridge-644
wip/notesbridge-644
job/editor-series
job/calcard-series
wip/calcard-series
job/mcp-events-review-491
wip/mcp-events-review
wip/editor-series
job/quirks-546
job/integrations-recheck
job/tocrail-636
wip/tocrail-636
wip/quirks-546
wip/reminders-643
job/reminders-643
wip/davscale-573
job/davscale-573
job/integrations-review
wip/ocr-eval-584
job/ocr-eval-584
job/esc-537
wip/esc-537
job/toastname-586
wip/toastname-586
job/submenu-579
wip/submenu-579
job/tasks-mode
wip/tasks-mode
job/agentdocs-630
job/dupwrite-634
wip/agentdocs-630
wip/dupwrite-634
job/lightglass-588
wip/lightglass-588
job/tabswitch-549
job/ghosttask-623
wip/ghosttask-623
job/toaststack-616
job/weekstate-609
job/mailsync-613
wip/mailsync-613
wip/weekstate-609
job/maildup-626
wip/tabswitch-549
wip/maildup-626
wip/toaststack-616
job/motion-611
wip/motion-611
job/tlstest-601
wip/tlstest-601
job/perf-495
job/floating-sheet
wip/floating-sheet
job/remdup-585
wip/remdup-585
job/fix-502
wip/fix-502
job/attachplay-622
job/perf-batch
wip/perf-batch-563
wip/perf-495
hotfix/mail-sync-diag
job/mail-m3
wip/mail-m3
job/attach-poof-603
job/calhover-608
job/editorbar-604
job/mentions-605
job/merge-round-4
job/allday-514
wip/merge-round-4
wip/allday-514
job/merge-round-4a
wip/merge-round-4a
job/sharestack-580
job/fix-501
wip/sharestack-580
wip/fix-501
job/perf-batch-563
job/apw-cache-review
wip/apw-cache-review
job/probe-520
wip/probe-520
job/mac-393
wip/mac-393
job/header-571
job/flake-513
wip/flake-513
job/docs-thumb-547
wip/header-571
job/webcal-572
wip/webcal-572
wip/shortcuts-542
job/shortcuts-542
wip/docs-thumb-547
job/caldav-stress
wip/caldav-stress
wip/sweep-478
job/apw-cache-512
wip/apw-cache-512
job/money-empty-540
wip/restart-505
wip/money-empty-540
wip/fix-510
job/restart-505
job/fix-503
job/perf-496
wip/perf-496
job/fix-498
wip/fix-498
job/info-inspector-465
wip/info-inspector-465
job/fix-510
job/fix-507
wip/fix-507
wip/fix-503
job/fix-493
job/money-kinds
wip/money-kinds
job/hygiene-548
job/merge-round-3
wip/fix-493
job/drag-snap-536
wip/merge-round-3
wip/merge-round-0930
wip/drag-snap-536
job/align-538
wip/align-538
job/bg-flash
wip/bg-flash
job/money-import
job/search-count-544
wip/search-count-544
wip/money-import
job/settings-key-541
wip/settings-key-541
job/toast-539
job/preview-421
wip/preview-421
wip/toast-539
job/tasks-500-531
job/title-plain-526
wip/title-plain-526
wip/tasks-500-531
job/notes-bridge
wip/parity-484
job/parity-484
job/files-slow
job/crash-525
wip/notes-bridge
wip/files-slow
wip/crash-525
job/kbd-motion-527
wip/bg-422
job/analytics-504
wip/analytics-504
wip/kbd-motion-527
job/upload-pill-523
wip/upload-pill-523
wip/tray-order
job/tray-order
wip/overflow-mid
wip/merge-round-2
job/perf-494
wip/perf-494
wip/mcp-fast-492
wip/motion-477
wip/asr-ab-489
wip/theme-variants-506
wip/overflow-511
wip/week-header-508
wip/attach-427
job/dav-delete-471
job/iso-435
wip/iso-435
wip/files-sel-keys
wip/dav-delete-471
job/align-253
job/siwc-490
wip/siwc-490
job/money-kinds-review
wip/align-253
wip/money-kinds-review
job/small-bugs-3
wip/overlay-title-487
wip/multiget-500
wip/hidden-420
wip/webcal-ui
wip/webcal-431
job/perf-367
job/location
wip/small-bugs-3
wip/location
wip/perf-367
wip/admin-deny-483
job/tag-unicode-473
wip/tag-unicode-473
job/blur-436
wip/photos-470
wip/blur-436
wip/small-bugs-4
wip/hunt-20260930
wip/settings-hdr-482
wip/chips-416
job/dedup-375
wip/dedup-375
job/doc-stack
wip/doc-stack
job/tokens-literals
wip/tokens-literals
job/jobs-leftovers
wip/send-fast
wip/paste-467
wip/money-numbers
job/money-plugin
wip/money-plugin
job/break-dav
wip/merge-batch
wip/crossday-469
wip/mac-verify
wip/mail-m2
wip/break-dav
wip/money-review2
job/money-md
job/modes-424
wip/money-md
wip/jobs-leftovers
job/agenda-413
wip/agenda-413
wip/modes-424
job/recog-417
wip/recog-417
wip/bounce-425
wip/ab-384-luna
job/webdav-perf
wip/webdav-perf
job/toast-ring
wip/toast-ring
job/money-review
wip/money-review
wip/micro-motion
wip/settings-card
wip/minical
job/notes-imap-428
job/least-priv
wip/ui-small-2
wip/flaky-426
wip/drag-end-418
job/jank
wip/jank
wip/least-priv
wip/docs-site
job/agenda
job/sec-batch
wip/sec-batch
wip/per-user-index
job/area-calendars
wip/area-calendars
job/parity
wip/parity
job/documents-research
wip/documents-research
job/test-infra
job/reminders-sync
wip/small-bugs-2
wip/reminders-sync
wip/gestures
job/google-oauth
wip/tags-merge
wip/tags
job/e2e-theme
wip/e2e-theme
job/icon-align
wip/test-infra
wip/select-align
wip/editor-385
job/voice
wip/webdav
job/webdav
job/app-pw-ui
job/editor-integrity
wip/editor-integrity
wip/voice
wip/quota
wip/cal-followups
wip/icon-align
job/composer-scale
wip/composer-scale
job/jobs-page
wip/jobs-page
job/hig-type
wip/hig-type
wip/app-pw-ui
job/motion-spring
job/mcp
wip/motion-spring
wip/mcp
job/small-bugs
wip/push-hosts
job/profile-sign
wip/touch-369
wip/profile-sign
job/mobile-focus
wip/mobile-focus
wip/ui-polish-354
wip/small-bugs
wip/dup-task
job/toast-polish
job/app-pw-scopes
wip/toast-polish
wip/app-pw-scopes
wip/cli-agent
wip/selection-pills
job/preview-attach
wip/preview-attach
job/dav-proppatch
wip/dav-proppatch
wip/cal-switcher
job/atomic-race
wip/atomic-race
job/photos-shared
wip/photos-shared
wip/cal-grid
wip/note-rewrite
wip/search-rebuild
job/mail-m1
job/paperless-import
wip/paperless-import
wip/mail-m1
wip/hidden-activity
wip/search-d
wip/pricing-research
wip/cursors
wip/auto-scheme
job/single-pills
wip/single-pills
wip/xuser-matrix
wip/money-format
wip/app-pw-setup
wip/purge-dos
wip/vault-health
wip/caldav-apple
wip/xuser-audit
wip/e2e-green
wip/tabbar
wip/adv-harness
wip/maple-mono
job/search-fix
wip/search-fix
wip/search-perf-c
job/adv-harness
wip/sidebar-headers
job/glass
wip/temp-index
job/polish
wip/polish
wip/file-protocols
wip/money-research
wip/glass
wip/voice-models
wip/collab-redo
job/voice-research
wip/hunt-20260928
wip/notes-actions-research
wip/search-pad
wip/search-perf
wip/search-sticky
wip/editor-undo
wip/chrome-rules
wip/motion
wip/appearance-research
wip/appearance
wip/audit-bugs
wip/cal-glass
wip/block-actions
wip/authz-order
wip/event-stripes
wip/chrome-sidebar
wip/auth-flaky
wip/robust-2
wip/gate-fix
wip/menu-blur
wip/import-calternaljs
wip/tray-fix
job/import-calternaljs
wip/index-order
wip/audit-fixes
wip/search-chevrons
research/mail
wip/phone-chrome
wip/dedup-break
wip/csp
wip/ui-audit
wip/select-toast
wip/perf
wip/flat-layout
wip/fonts
wip/event-tint
wip/sync-converge
wip/data-split
wip/glass-audit
wip/robustness
wip/sync-chaos
wip/search-thumbs
wip/fuzz
wip/menu-icons
wip/search-pill
wip/sync-changing
wip/heading-links
wip/date-formats
wip/a11y
wip/break-editor
wip/e2e-fix
wip/settings-sections
wip/sync-root-guard
wip/search-palette
wip/share-edit
job/toasts
wip/toasts
wip/cont-analytics
wip/authz-review
wip/popovers
wip/overlay-glass
wip/change-feed
wip/editor-modes
wip/composer-align
wip/cont-agenda
wip/agenda-merge
job/agent-conventions
wip/agent-conventions
wip/backend-misc
job/route-audit
wip/route-audit
wip/ui-batch
wip/heif-hardening
wip/grid-resize
wip/ask-page
wip/webmcp
job/deeplink-audit
wip/deeplinks
wip/shortcuts
wip/cont-tz-days
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#268
No description provided.