fix(auth): classify email control routes for board keys

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/db/src/principal-permission-grant-origin-migration.test.ts

@@ -6,7 +6,7 @@ import {
   startEmbeddedPostgresTestDatabase,
 } from "./test-embedded-postgres.js";
 
-const MIGRATION_FILE = "0273_round_domino.sql";
+const MIGRATION_FILE = "0275_chilly_phalanx.sql";
 const cleanups: Array<() => Promise<void>> = [];
 const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
 const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;

server/src/security/board-key-route-inventory.ts

@@ -252,6 +252,7 @@ export const BOARD_KEY_ROUTE_INVENTORY: readonly string[] = [
   "board_key_denied | deny | /api/companies/{id}/users/{id}/profile",
   "board_key_denied | deny | /api/companies/{id}/{*path}",
   "board_key_denied | deny | /api/connection-intents/{*path}",
+  "board_key_denied | deny | /api/email/{*path}",
   "board_key_denied | deny | /api/feedback-traces/{*path}",
   "board_key_denied | deny | /api/health/{*path}",
   "board_key_denied | deny | /api/invites/{*path}",

server/src/security/board-key-route-registry.ts

@@ -387,6 +387,7 @@ export function lookupBoardKeyRoute(methodInput: string, rawPath: string): Board
     "cases",
     "pipelines",
     "connection-intents",
+    "email",
     "_plugins",
   ].includes(top)) return denied(method, `/api/${top}/{*path}`);