- Ya
- 5 Septemba 2026, 00:01 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 0679ed9
The verification screen's Resend button has been reporting success and sending nothing for every organization except the platform's own. `host` already rides in the body of the signup itself, because the proxy targets one shared API host and the ingress rewrites X-Forwarded-Host on the way — the server cannot learn the tenant from the request otherwise. The resend call never carried it, so the server fell back to that rewritten header, looked the address up under the platform organization, and found nobody. It answers a missing account and a real send with the same 200, on purpose, so the screen showed the green "Verification email sent!" either way. Filled in here rather than by the caller: a caller that forgets it gets no error back to tell them, only a cheerful message and silence in the inbox. Needs the matching SecurityService change, which reads the body host and no longer falls back to its own server name.