Read session from Redis directly (same as /api/user-info), use forwardToApi for all service calls

Shipped: March 29, 2026 at 8:20 PM UTC
Author: kamo
Commit: 9e920c9

Root cause: the sender profile showed 'Your colleague' because the session fetch called a non-existent SecurityService endpoint. Signature was malformed because direct fetch to EmailService lacked OTK auth. Fixes: - Session: reads *** cookie → Redis directly (same as /api/user-info) - Member/org lookup: uses forwardToApi (generates fresh OTK per call) - Template fetch: uses forwardToApi through email proxy route - Email send: still goes directly to EmailService (proven working)

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free Forever View Pricing