Prove the pipeline controllers refuse a caller with no session

Shipped

November 1, 2026 at 12:58 AM UTC

Author

Kamo

Commit

cd7b690

The ratchet could not see their guard, so it now recognizes pipelineAccess.orgId, and a new test calls all 21 handlers with no session and requires a 401 before any service is touched. The field is renamed from access so that pattern cannot match another controller's unrelated field. No behavior change.