- Shipped
- August 15, 2026 at 3:44 AM UTC
- Author
- kamo
- Commit
- 53d89a5
Contacts: all 26 endpoints of EmailService's ContactRestController now take the verb that names them. They checked ownership carefully and no right at all, with VIEW_CONTACTS enforced only by navRegistry hiding the app — the same client-only shape as notes and documents. Leads: CREATE_LEADS and DELETE_LEADS were the two holes in an otherwise well-gated LeadController, and they are closed alongside the two other authenticated paths that create leads. The three paths with no member to check — the intake webhook, the NATS social consumer and anonymous webinar registration — are deliberately left alone. No seeding except where nothing needed it: the contact verbs and CREATE_LEADS track their parent exactly, and DELETE_LEADS is differentially granted, so by the rule settled in the previous cluster it carries intent and stands. The design document also records that SecurityService's working tree currently fails 396 tests from a concurrent session's in-flight changes, and that this work was verified in a clean origin/main worktree instead — 632 passing — so the next person to run that suite is not left guessing.