P1: stale Photos stack returns metadata after Share revoke when Files members disappear #896

Open
opened 2026-10-02 17:37:39 +00:00 by kayg · 1 comment
Owner

P1: A stale stack with no current members returns 200

crates/plugins/photos/src/routes.rs:1062 joins members to current Files rows. If all member files moved or were removed before the Photos refresh, this query returns no rows. The access check at line 1069 does not run. Lines 1082–1087 return the stale group ID, kind and capture time with an empty member list, even after Share revoke. A missing stack returns 404. This gap exists before the branch. The changed denial handles only stacks with surviving joined members.

Fix: validate the current display identity and authorized root before returning a group; return 404 when no current authorized members exist. Add a stale-projection test that removes the authoritative Files rows, revokes the Share, and requires 404. DESIGN §54 requires revoked and missing IDs to have the same response.

## P1: A stale stack with no current members returns 200 `crates/plugins/photos/src/routes.rs:1062` joins members to current Files rows. If all member files moved or were removed before the Photos refresh, this query returns no rows. The access check at line 1069 does not run. Lines 1082–1087 return the stale group ID, kind and capture time with an empty member list, even after Share revoke. A missing stack returns 404. This gap exists before the branch. The changed denial handles only stacks with surviving joined members. Fix: validate the current display identity and authorized root before returning a group; return 404 when no current authorized members exist. Add a stale-projection test that removes the authoritative Files rows, revokes the Share, and requires 404. DESIGN §54 requires revoked and missing IDs to have the same response.
Author
Owner

Source review target: job/isolation-707 at 0bb018a98f, reviewed for #707. This is a pre-existing gap in the route changed by that branch. Keep the stale Photos group while all authoritative Files members disappear; the current member-only access check is skipped. No runtime checks ran in the LIGHT review job.

Source review target: job/isolation-707 at 0bb018a98fa5be97b3fcf9e2a5d62bc1a51b9abf, reviewed for #707. This is a pre-existing gap in the route changed by that branch. Keep the stale Photos group while all authoritative Files members disappear; the current member-only access check is skipped. No runtime checks ran in the LIGHT review job.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#896
No description provided.