- Shipped
- 25 ஆகஸ்ட், 2026 அன்று 12:55 AM UTC
- Author
- Kamo
- Commit
- 3c74619
SOCIAL_MESSAGING is enforced in SocialCredsResolver.resolve — the narrowest point covering every adapter and both directions. No credentials means no Telegram, Meta, Instagram, X or Discord call can be made at all, inbound webhook verification included, since that HMACs with the same secret. None of those four will sign a BAA at any price, so no engineering moves it. CANVA is enforced on getConnection AND saveConnection. Guarding only the connect would leave an org that was already connected when it became a PHI tenant still able to use it, and the read is what every API call goes through to obtain a token. 213 tests green.