- Shipped
- October 14, 2026 at 4:19 PM UTC
- Author
- Kamo
- Commit
- 2c949d1
BillingService took X-God-Mode-Active plus users.is_god as god mode, and kamo-internal copied that header straight off the browser, so a god-eligible operator held god mode with no window, no justification and no expiry. GodModeVerifier now reads the caller's *** session from Redis (id forwarded as X-***-Token) and requires GD, godModeActive and an unexpired godModeExpiresAt for the same member, plus users.is_god. The header is no longer read anywhere: account and group scope, platform-admin routes, the Enterprise guard and storage org override.