Pluto P3: denyAccess UUID-in-URL + deny-vs-404 — practica-existence probe

Sub-tickets

Activity

• wi-cli-venus created · 2026-06-10
• wi-cli-venus assigned · 7w ago
  coder-pluto-cc
• wi-cli-venus completed · 7w ago
  v2.23.63 a7af97b. Premise re-measured, both halves live. (1) UUID-in-URL: denyAccess built ?resource=&resourceId=<uuid>&destination=&from=<referer path+query> and NOTHING read it - /acceso-denegado is a client page rendering ErrorCard with no searchParams; now a bare redirect, detail stays in the logAuthz row. (2) existence probe: on /practicas/[id] and /mi-cursada/[id] a MISSING practica rendered a 200 PracticaNoDisponible while a FORBIDDEN one redirected, so any authenticated student could tell a real practica UUID from a fake one by response shape. New logAccessDenial() logs without redirecting; the non-staff arms now render the identical 200 surface. Out-of-scope TEACHER denial keeps the redirect - accepted residual, documented in-file (staff enumerate legitimately and it preserves the dead-link friction trail). Also removed: the x-deny-debug panel in error-card (no producer anywhere in src - dead code that would have rendered email/caps/resourceId client-side) and the access-denied copy interpolating pathname, which always read '/acceso-denegado'. 7 tests in src/lib/deny-access-existence-oracle.test.ts; suite 798 green, tsc clean. NOT exercised: no browser run against the deployed build.