- Shipped
- August 25, 2026 at 4:52 PM UTC
- Author
- Kamo
- Commit
- 348ecd3
Its own controller rather than a method on OrganizationController, which already takes 25 constructor dependencies. The path still lands under the same prefix, so nothing about the wizard's routing changes. The session gate is the security boundary, not boilerplate: Spring Security is anyRequest().permitAll() here and authorization is done in the controller, so an endpoint that makes the platform fetch a caller-supplied URL must resolve-or-401 before anything else. The limiter is Redis-backed, following OrgCreationRateLimiter rather than the in-process design this was planned with -- SecurityService runs replicas, so a per-pod counter is a limit in name only, which is the trap the kamocapcha replay guard already fell into. Keyed on the USER, not the member: one person holds memberships in many orgs and keying on the member would multiply their allowance by how many businesses they are in. Fails open, because a branding step that stops suggesting anything because Redis is unreachable is worse than the burst it was slowing.