Refuse an emailless identity where the session is minted, and rows the upstream should not have sent

2026-09-02 18:24:56 +02:00
parent 390ac5f112
commit 18dc4f3136
14 changed files with 59 additions and 33 deletions
@@ -25,7 +25,6 @@ export type RouteResult =

 export type RouteHandler = (ctx: RequestContext) => Promise<RouteResult | void> | RouteResult | void;

-// `Gate` carries `permission`/`public`/`session`, checked before the handler runs.
 export interface Route extends Gate {
  handler: RouteHandler;
  method: HttpMethod;