The guided-tours read answers the member's CURRENT Show Tour rights

Shipped

October 14, 2026 at 2:20 AM UTC

Author

Kamo

Commit

2bd7b0d

A session carries the rights it was issued with and the routine refresh does not re-read them, so everyone signed in before the Show Tour rights existed saw no tour — the database had all 31 for them, the session had none. GET /api/security/guided-tours now also returns tourRights, the membership's Show Tour rights from member_rights_applied, and the web app gates tours on those. A tour switched on or off by an administrator takes effect without signing out.