fix(security): refuse consultation signups for accounts the caller doesn't own - #272

Merged

AutomatosAI merged 4 commits into

mainfrom

fix/consultation-account-takeover

Aug 25, 2026

Commits on Aug 25, 2026

fix(security): refuse consultation signups for accounts the caller doesn't own
Gerard161-Site
committed
96c6d14
fix(security): make the ownership gate actually fire (review finding)
Gerard161-Site
committed
60a8104
fix(consultation): extract session-email helper, complete test payload
Gerard161-Site
committed
8530e27
fix(security): gate ownership BEFORE Clerk, close the two-request takeover
Gerard161-Site
committed
05110a8