146691be001f82467f49350eca8349a2f4796799
The middleware matcher intercepts /api/cron/* but the prefix was absent from publicPaths, so unauthenticated scheduler calls were 307'd to /login and the cron handlers never ran. All 9 cron routes already enforce x-cron-secret, so opening the prefix is safe and unblocks the new final-document-reminders cron (and repairs the existing crons). Same class of gap as the /lunch/pick fix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Description
No description provided
Languages
TypeScript
99.5%
JavaScript
0.2%
Shell
0.2%
CSS
0.1%