The change-history endpoints pass the unauthenticated-endpoint ratchet

Shipped

November 14, 2026 at 7:00 PM UTC

Author

Kamo

Commit

12f148f

Every handler already answered 401 without a session (LeadPipelineAccess.orgId reads the session OTKPreAuthFilter validated), but the field was named access, so the ratchet's recognised pipelineAccess.orgId( never matched and the build's guard test failed on main. Renamed the field, and a test now calls each handler with no session and expects 401 with nothing read.