Skip to content

Re-sign encoded family photo URLs as the current viewer #599

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
NewWorldVenture merged 1 commit into from
Sep 27, 2026
Merged

Re-sign encoded family photo URLs as the current viewer #599

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 42 additions & 42 deletions audit/status.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,48 +2,48 @@

## Codex integration — 2026-09-27

CURRENT: Worker PR592 published as main e14b12e899fe62cf5a3993cfbe92121aab0a41f9
at16:19:13UTC; tree52e0d1e equals candidate850cc4. Corrected CI36332783206 pending.
PRODUCTION: Vercel dpl_57FH8FY8JZsuTFEo68uwkWJ7A34h SUCCESS16:22:37UTC;
GitHub deployment6694707719 SUCCESS16:22:38UTC. Exact public acceptance PASS
16:23:30–35UTC; full native production wrapper1/1PASS4.3s on final507a6cd.
Real worker/install/icon and synthetic private-cache/offline/library controls,
then scripts-disabled top-level navigation; before/after revision/hash guards.
No auth/provider writes/private production bytes. Receipts:
Temp/bubaly-sw-production-e14b12e8-20260927.json;
Temp/bubaly-native-production-e14b12e8-retained-receipt-20260927.json.
LOCAL WORKER: Combined657 UTC20,701/1,621, build247, types/lint15PASS;
85/85controlled in3.8s (72cache+13registration), focused33 separate.
Final fixture-only delta878a17b verifies5,191files/modes, types/lint15PASS,
discovery1/1 (not runtime). Parents' three-zone gates remain parent-scoped.
HISTORY: Original59 CI36331147265 E2E1369/1370 failed only native iframe;
Web/DB/MobilePASS. Sandbox and anti-framing fixture failures preserved.
Invalid Windows full run and repaired preliminary type failures retained.
INVENTORY: All14,183 prior IDs retained, plus three media-test records:
SUPPORT-302F04E15861, SUPPORT-BC0F2BFDBFD6 and SUPPORT-4CE6A54076E4,
all IN PROGRESS.
RegisterB14,186=13,877NOT STARTED+300IN PROGRESS+4FIXED+PASS+4BLOCKED+1FAIL.
Three worker/support rows remain IN PROGRESS pending corrected hosted CI;
fixture coverage does not count as additional completed product workflows.
MEDIA: SEC-001FAIL. Local owner-scoped cache/inflight repair adopted aftere14,
NOT DEPLOYED. Matching prototype33/33 and actual React/SDK browser2+2PASS;
full integrated gates pending. Actual observer-gap RED preserved; only synthetic
provider/image transport, no live bucket authorization/private bytes.
HEALTH: e14 core checksOK, degraded with six missing settings:CRON_SECRET,
CHILD_LOGIN_SECRET, MARKETING_UNSUB_SECRET, GUARDIAN_INTERNAL_SECRET,
FCM_PRIVATE_KEY, APNS_PRIVATE_KEY. Earlier four-setting history retained.
FOLLOW-UP: Permanent actual React/SDK suite7/7PASS2.6s, types/lintPASS;
collector registration37/37PASS. e14mainCI36332799249 cancelled by docs-onlyf03;
PR850CI36332783206 still pending. Initial media full run20,721PASS/1FAIL
caught display importgraph; repaired display25/25PASS, corrected fullgatespending.
HYDRATION: Actual FamilyMediaImg SSR→hydrate valid-cookie warning reproduced;
hydration-aware hooka7822890 passes valid/absent/external controls and immediate
cached SPA image. Retained fixturee169fe97 has4ownership+3hydration cases;
final complete source fullgates/hosted/deployment pending.
NEXT: Corrected hosted result for scoped worker closure; independently verify
local media follow-up before its release. No production SQL/provider change.
OWNERSHIP: Root integrates/verifies; auth_current_boundary owns this checkpoint.
RECORD: docs/final-audit/service-worker-private-cache-cycle.md; finalaudit.md.
WORKER CLOSED: Corrected850 CI36332783206 all4SUCCESS; E2E1764/1764,
no failures/flakes/skips reported, finished16:47:07UTC. Web20701x3zones,
build247/types/lintPASS. Exact candidate/tested/e14 tree52e0d1e matches.
Separate e14 public+native deployed acceptancePASS; native wrapper1/1 in4.3s.
Only SUPPORT-98FD1D4C44AD/1A08672F87F3/827E4294FC10 become FIXED+PASS;
the two fixtures are coverage, not two additional product workflows.
MEDIA MAIN: PR595 merged57664cfc69e43bdd35b921edde69aa20cfc609ad16:47:39UTC,
exact b78ff026 tree29a6087. 595 hosted acceptance PENDING.
LIVE: Exact576 public build/worker guards PASS16:50:52–59UTC, hydrated
email/phone controls, protected meals307, v6 install/offline200, corehealthOK.
Zero page errors/failed requests/suppressed writes; six missing features remain.
Complete native production wrapper1/1PASS2.2s, same507 assertions/guards.
No authenticated private-provider image journey executed.
FINAL LOCAL: Source98d5229 UTC20722/1623files, focused146/10files,
build247/full strict types/lint15existingwarningsPASS; all5194paths mapped,
5189 non-audit blobs/modes exactly b78. Media7/7 (4ownership+3hydration),
display25/25 and collector guard37/37PASS. Synthetic transport/build only.
FAILURES RETAINED: Old native iframe1369/1370; media20,721PASS/1FAIL missing
display loader import; actual valid-cookie SSR/hydration warning, now fixed.
SEC-001FAIL: Bucket/privacy/provider scope remains open. New family%2Dmedia
classification bypass reproduced with actual FamilyMediaImg/SDK: raw synthetic
A capability renders underB without B signing; canonical control denied.
No live provider/private data or Storage RLS-bypass claim. Existing finding only.
PARSER LOCAL:147fa9a once-decodes route/bucket; oldparser12FAIL/34PASS,
new46/46focusedPASS. Existing browser fixture now11/11PASS3.2s (fournew
canonical/encoded x Aallow/Bdeny controls). Initial stale-hook7PASS/4FAIL
private attempt preserved;13 actual source hashes verify corrected rerun.
Final whole-source gates and parser publication PENDING;576 not yet fixed.
Calibrated browserRED: currenthook+oldparser canonical2PASS/encoded2FAIL;
final11PASS receipt:bubaly-encoded-browser-retained-receipt-20260927.json.
Native576 derived receipt preserves exact wrapper/log hashes and scope.
INVENTORY:14186=13877NOTSTARTED+297INPROGRESS+7FIXEDPASS+4BLOCKED+1FAIL.
Three media test rows remainIP; no ID removed. Claude593 page statuses and
mainf03 laneA claim preserved; auth/device/migration scope remains separate.
HEALTH: Verified576 degraded/coreOK (same as earlier e14), six missing features:
CRON_SECRET, CHILD_LOGIN_SECRET, MARKETING_UNSUB_SECRET,
GUARDIAN_INTERNAL_SECRET, FCM_PRIVATE_KEY, APNS_PRIVATE_KEY.
RECEIPTS: Temp/bubaly-850-ci36332783206-terminal-20260927.json;
Temp/bubaly-sw-reconcile-20260927/linux-q59-final/final-gates-receipt.json;
Temp/bubaly-media-encoded-bucket-20260927.json.
NEXT: Verify595 hosted CI; retain scoped parser follow-up.
PRODUCTION READY:NO. No source/SQL/provider changes in this documentation update.

> Two sessions ran this board. Both sections are kept.

Expand Down
20 changes: 20 additions & 0 deletions docs/final-audit/auth-phone-ownership-cycle.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,25 @@
# Phone OTP ownership

## Current worker closure and media release checkpoint — 2026-09-27

**Worker scope is FIXED + PASS.** Corrected candidate `850cc4c7347e790f0972da124cbc98bcf686cf61` CI [36332783206](https://github.com/NewWorldVenture/Bubaly/actions/runs/36332783206) completed all four jobs successfully; E2E finished at16:47:07UTC with **1,764/1,764 PASS in18.3m**, no failures/flakes/skips reported. The tested checkout28575c1940a82a0069a0631a4b06ecd4779619c7, candidate and e14 production share tree52e0d1e72ee23f67369d68e255c42958926252b7. Web passes20,701 tests across1,621files in each default/LosAngeles/Tokyo zone, build247, strict types and lint. Native worker and three phone HTTP cases are included by enabled discovery and the all-pass matrix; the dot reporter does not name individual passes. Terminal receipt: `Temp/bubaly-850-ci36332783206-terminal-20260927.json`. This joins the separately verified e14 deployed public/native acceptance at16:23UTC, Vercel dpl_57FH8FY8JZsuTFEo68uwkWJ7A34h, and the1/1 native production wrapper. The failed original iframe case and all prior REDs remain preserved below. This closes only SUPPORT-98FD1D4C44AD, SUPPORT-1A08672F87F3 and SUPPORT-827E4294FC10; fixture rows certify regression coverage, not extra product workflows.

**Media follow-up live; hosted CI pending.** PR595 merged at16:47:39UTC as main `57664cfc69e43bdd35b921edde69aa20cfc609ad`, preserving the exact b78ff026 application/release tree29a6087. PR593 was integrated with its page statuses and the f03 laneA claim intact. Final canonical media source98d522926dee7b06cd9e6ffd1a52a4adf32cfad9 passes **20,722/20,722 UTC tests across1,623files**, focused146/146 across10files, build247, full generated-route strict types and lint with15existingwarnings. All5,194paths/modes were checked;5,189 non-audit blobs/modes map exactly to b78ff026, with only the five evolving audit documents different. Receipts: `Temp/bubaly-sw-reconcile-20260927/linux-q59-final/{final-gates-receipt,commit-map-b78ff026}.json`. The final hooka7822890 includes both owner-scoped cache/inflight isolation and the actual SSR/hydration repair. Retained browser fixturee169fe97 passes7/7 in2.6s (four ownership, three actual renderToString/hydrateRoot controls); display25/25 and fixture-graph37/37 pass separately. These are overlapping gate scopes, not additive product counts. The initial20,721PASS/1FAIL missing display import and valid-cookie hydration warning remain retained as failed checkpoints. Production/provider behavior is not inferred from synthetic build or controlled transport; PR595 hosted acceptance remains pending; exact new production proof follows.

**Main576 is now verified live.** The exact public acceptance at16:50:52–59UTC passes build revision57664cfc before/after, unchanged workerSHAe9b19ada5f708e880d56b7902f223d704e8b04662af8db3ae9265c33c9feeb5b, hydrated email/phone controls without submission, protected meals307, nativev6 installation and offline200. Health core checks pass; the same six missing feature settings remain. Page errors, failed requests and suppressed background writes are all zero. The complete production native wrapper retains the final507a6cd assertion suite plus exact revision/hash guards and passes1/1 in2.2s. Receipts: `Temp/bubaly-sw-production-57664cfc-20260927.json` and `Temp/bubaly-native-production-57664cfc-20260927.log`. These anonymous public/worker checks identify the deployed media revision but do not execute an authenticated private-provider image journey. PR595 hosted CI remains pending.

**SEC-001 remains FAIL, with a new bounded parser follow-up.** Actual current FamilyMediaImg/React/SDK under B rejects a canonical stored A signed URL through B signing, but classifies the same bucket spelling `family%2Dmedia` as external: no B signing occurs, and the browser renders/decodes the synthetic A-capability PNG. Evidence: `Temp/bubaly-media-encoded-bucket-20260927.{cjs,log,json}`, executed16:48:54UTC on unchanged production modules. This proves a client-side mandatory-signing bypass with controlled synthetic transport; it does **not** prove a Storage RLS bypass, acquisition of a token, live provider response or private production-byte access. A source-reachable input is FamilyModule’s manager-editable Cover Photo URL: line636 accepts text, line622 stores trimmed families.cover_url, and line270 renders it with FamilyMediaImg. No entry-flow mutation or live exploit was performed. This remains an open follow-up under existing SEC-001; the independent worker closure is unchanged. The bucket/privacy/provider rollout and broader auth/migration/device requirements remain open.

**Parser follow-up repaired locally; publication pending.** Candidate parser `147fa9a52a018e064ea5b1c7928c51cd58050a24` structurally decodes the route/bucket segments once and validates the object path without double decoding. The13 added regression cases expose12FAIL/34PASS on the old parser; the repaired focused suite passes46/46. The existing media browser fixture adds four canonical/encoded stored signed-reference cases, each with viewerA allowed and viewerB denied; actual React/SDK/FamilyMediaImg on the exact current modules passes11/11 in3.2s. Receipt: `Temp/bubaly-encoded-photo-browser-verified-green-20260927.log`;13 exact raw source hashes: `Temp/bubaly-encoded-browser-source-20260927.json`. An initial private integration attempt used a stale old hook and produced7PASS/4FAIL; that failed harness/source checkpoint is preserved, and the verified-current-source rerun passes. This extends the existing fixture rather than adding inventory records or four product workflows. Complete final-source gates and parser deployment remain pending. Current production576 still has the encoded-reference behavior reproduced above, so SEC-001 remainsFAIL and the three media test records stay IN PROGRESS.

The calibrated browser baseline uses the CURRENT final hook with only the old parser: both canonical controls pass and both encoded cases fail (2PASS/2FAIL in6.4s). This is separate from the excluded stale-hook integration attempt. Final source/strict fixture types/lint and11/11 passing evidence are retained in `Temp/bubaly-encoded-browser-retained-receipt-20260927.json`; final browser fixturecb4c67ef79e056ed730e683de0359d0017244b6b. The main576 native execution has a derived retained receipt at `Temp/bubaly-native-production-57664cfc-retained-receipt-20260927.json`, preserving actual log/wrapper hashes and scope limitations rather than inventing a persisted inline attachment.

Register B remains14,186 items:13,877 NOT STARTED,297 IN PROGRESS,7 FIXED + PASS,4 BLOCKED and1 FAIL. No permanent ID is removed or added. The three media test records remain IN PROGRESS pending their separate hosted/release evidence; AUTH-001/002/003 and broad SEC-001 are not closed. Current verified main576 health is degraded with six missing feature settings (CRON_SECRET, CHILD_LOGIN_SECRET, MARKETING_UNSUB_SECRET, GUARDIAN_INTERNAL_SECRET, FCM_PRIVATE_KEY, APNS_PRIVATE_KEY); earlier four-setting reports remain dated history. **PRODUCTION READY: NO.**

## Retained earlier September 27 checkpoint

The following pending statements and counts describe the earlier checkpoint. The current closure and release state above supersede them; its failed attempts and exact source evidence remain preserved.

## Status reconciliation — 2026-09-27

Current follow-up checkpoint: main e14 CI `36332799249` was automatically cancelled after another session merged documentation-only f03a5457; it is not full acceptance. Corrected PR candidate CI `36332783206` remains pending. The first local four-file media integration ran20,721 passing tests and one failure: the existing fixture-graph guard detected the new browser-storage import missing from the manual display fixture. That failed run is preserved. The repaired display fixture passes25/25 browser cases; corrected full integrated gates remain pending. A permanent serverless suite, `tests/e2e/family-media-session-ownership.spec.ts` (`SUPPORT-4CE6A54076E4`), now retains four actual React/SDK two-tab cases plus three actual component SSR/hydration controls and passes7/7 in2.6s, with strict fixture types and lint passing. Its required collector registration also passes the37/37 fixture-graph guard. Logs: `Temp/bubaly-media-browser-retained-20260927/{browser,types,lint,guard}.log`. This is targeted local repair evidence, not a deployed media fix or a new product finding.
Expand Down
Loading
Loading