- Shipped
- September 7, 2026 at 6:56 AM UTC
- Author
- Kamo
- Commit
- 69ea825
**************** caught the new internal endpoint, which is what it is for: with anyRequest().permitAll(), a handler that resolves no caller is reachable through APIService's relay, and this one resolves none. It is genuinely pre-session. MediaService calls it from a Growth Hub approval, where the acting session belongs to the reviewing ADMIN and the member being credited is somebody else entirely — there is no caller here to resolve. The guard is X-Internal-Auth, compared in constant time and failing closed when the secret is unset; the scan cannot follow it because the header arrives as a method parameter rather than a call in the body, the same reason the two entries above it are listed. What limits the damage if that secret ever leaks is the endpoint's shape rather than its guard: the body carries {orgId, memberId} and no count, and the handler recounts that member's approved submissions itself. The worst a caller can do is credit a member for work that member has actually had approved.