Files
Codeman/test
Aamer Akhter 4f9274af3a fix(auth): require the request on findSessionOrFail
findSessionOrFail took `req` as optional, so the quiet default was the
unscoped lookup: a route that forgot to pass it compiled cleanly and, in
multi-user mode, returned another user's session. `req` is now required,
and a caller with no request in flight must use the explicit, greppable
findSessionUnscopedOrFail instead.

Every current caller in src/ already passes req (verified by grep and
tsc), so behaviour is unchanged; the new helper has no production
callers and exists so the next request-less caller does not make `req`
optional again.

Tests pin the unscoped helper's behaviour and assert, from the source
AST, that `req` is a required parameter (tsc does not typecheck test/).
2026-10-22 17:23:03 -04:00
..
2026-06-19 17:58:06 -04:00
2026-06-19 17:58:06 -04:00
2026-08-22 14:13:57 +02:00
2026-07-20 02:36:02 +02:00
2026-06-19 13:10:17 -04:00