Refresh stale Appearance and DAV adversarial API expectations #557

Open
opened 2026-09-30 23:25:03 +00:00 by kayg · 2 comments
Owner

A real local-server ADVERSARIAL_API_ONLY=1 round on 2026-09-30 UTC found two adversarial probe/API contract mismatches:

  • tests/adversarial/attack.py sent auto_scheme.location; 11 of 31 Appearance PUTs returned HTTP 422 with unknown field location, expected mode, while the probe expected 200. The payload no longer matches the accepted Appearance shape.
  • The DAV Journal probe updated an existing VTODO and expected HTTP 201, but the server returned 204. The probe only refreshed its ETag on 201, so later move and delete checks used the stale ETag and got 412.

No API behavior or existing test expectation was changed in this job. Please update the probes to match the current contract before treating these responses as product failures.

A real local-server `ADVERSARIAL_API_ONLY=1` round on 2026-09-30 UTC found two adversarial probe/API contract mismatches: - `tests/adversarial/attack.py` sent `auto_scheme.location`; 11 of 31 Appearance PUTs returned HTTP 422 with `unknown field location, expected mode`, while the probe expected 200. The payload no longer matches the accepted Appearance shape. - The DAV Journal probe updated an existing VTODO and expected HTTP 201, but the server returned 204. The probe only refreshed its ETag on 201, so later move and delete checks used the stale ETag and got 412. No API behavior or existing test expectation was changed in this job. Please update the probes to match the current contract before treating these responses as product failures.
Author
Owner

One local API-only adversarial round against the merged branch reported:

  • appearance Auto default: a new User had saved scheme {'mode': 'system'} when the probe expected no saved scheme.
  • DAV Journal accepts a well-formed alarm: expected 201, got 204 with an empty body.

The round timed out during a later Photos upload campaign at its 20-minute bound. This job did not change Appearance or DAV behavior.

One local API-only adversarial round against the merged branch reported: - appearance Auto default: a new User had saved scheme {'mode': 'system'} when the probe expected no saved scheme. - DAV Journal accepts a well-formed alarm: expected 201, got 204 with an empty body. The round timed out during a later Photos upload campaign at its 20-minute bound. This job did not change Appearance or DAV behavior.
Author
Owner

Partial overlap with #708: both report an existing DAV Journal resource PUT returning 204 while the probe expects 201, then using a stale ETag and receiving 412. This issue also reports a distinct Appearance payload field mismatch; #708 reports a different Appearance default-value mismatch. Recommend link the shared DAV probe defect and keep the separate Appearance evidence in its own tracking issue. No test expectation should change without the owner decision.

Partial overlap with #708: both report an existing DAV Journal resource PUT returning 204 while the probe expects 201, then using a stale ETag and receiving 412. This issue also reports a distinct Appearance payload field mismatch; #708 reports a different Appearance default-value mismatch. Recommend link the shared DAV probe defect and keep the separate Appearance evidence in its own tracking issue. No test expectation should change without the owner decision.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#557
No description provided.