From dae8b6412a35fde167f4d0616229a467e47a3709 Mon Sep 17 00:00:00 2001
From: cryppadotta <34892728+cryppadotta@users.noreply.github.com>
Date: Sat, 12 Sep 2026 01:22:56 +0000
Subject: [PATCH] fix(auth): classify email control routes for board keys

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 .../db/src/principal-permission-grant-origin-migration.test.ts  | 2 +-
 server/src/security/board-key-route-inventory.ts                | 1 +
 server/src/security/board-key-route-registry.ts                 | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/db/src/principal-permission-grant-origin-migration.test.ts b/packages/db/src/principal-permission-grant-origin-migration.test.ts
index 6a37d93c0d..72e2d96fe0 100644
--- a/packages/db/src/principal-permission-grant-origin-migration.test.ts
+++ b/packages/db/src/principal-permission-grant-origin-migration.test.ts
@@ -6,7 +6,7 @@ import {
   startEmbeddedPostgresTestDatabase,
 } from "./test-embedded-postgres.js";
 
-const MIGRATION_FILE = "0273_round_domino.sql";
+const MIGRATION_FILE = "0275_chilly_phalanx.sql";
 const cleanups: Array<() => Promise<void>> = [];
 const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
 const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
diff --git a/server/src/security/board-key-route-inventory.ts b/server/src/security/board-key-route-inventory.ts
index 168ce30712..dd822ac651 100644
--- a/server/src/security/board-key-route-inventory.ts
+++ b/server/src/security/board-key-route-inventory.ts
@@ -252,6 +252,7 @@ export const BOARD_KEY_ROUTE_INVENTORY: readonly string[] = [
   "board_key_denied | deny | /api/companies/{id}/users/{id}/profile",
   "board_key_denied | deny | /api/companies/{id}/{*path}",
   "board_key_denied | deny | /api/connection-intents/{*path}",
+  "board_key_denied | deny | /api/email/{*path}",
   "board_key_denied | deny | /api/feedback-traces/{*path}",
   "board_key_denied | deny | /api/health/{*path}",
   "board_key_denied | deny | /api/invites/{*path}",
diff --git a/server/src/security/board-key-route-registry.ts b/server/src/security/board-key-route-registry.ts
index 129b338ea4..552c7c1ad3 100644
--- a/server/src/security/board-key-route-registry.ts
+++ b/server/src/security/board-key-route-registry.ts
@@ -387,6 +387,7 @@ export function lookupBoardKeyRoute(methodInput: string, rawPath: string): Board
     "cases",
     "pipelines",
     "connection-intents",
+    "email",
     "_plugins",
   ].includes(top)) return denied(method, `/api/${top}/{*path}`);