From 1e675f824bd24dd74d3c378f94e3fdee261c13bf Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Tue, 20 Oct 2026 16:15:22 -0400
Subject: [PATCH] Add email whitelist remote header to response

---
 server/private/routers/hybrid.ts | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/server/private/routers/hybrid.ts b/server/private/routers/hybrid.ts
index 7000f5aa3..47c3c0021 100644
--- a/server/private/routers/hybrid.ts
+++ b/server/private/routers/hybrid.ts
@@ -98,6 +98,7 @@ import { checkOrgAccessPolicy } from "@server/lib/checkOrgAccessPolicy";
 import { sanitizeString } from "@server/lib/sanitize";
 import {
     getRedirectsByHost,
+    getWhitelistEmail,
     type RedirectByHost
 } from "@server/db/queries/verifySessionQueries";
 
@@ -1881,8 +1882,19 @@ hybridRouter.post(
                 resourceId
             );
 
+            // Lets the node forward the whitelisted email downstream as
+            // Remote-Email, same as verifySession does locally
+            const whitelistEmail = result.resourceSession
+                ? await getWhitelistEmail(
+                      result.resourceSession.whitelistId,
+                      result.resourceSession.policyWhitelistId
+                  )
+                : null;
+
             // this is for backward compatibility with nodes that did not have the policy id checking
-            const modifiedResult: ResourceSessionValidationResult = {
+            const modifiedResult: ResourceSessionValidationResult & {
+                whitelistEmail: string | null;
+            } = {
                 ...result,
                 resourceSession: result.resourceSession
                     ? {
@@ -1901,7 +1913,8 @@ hybridRouter.post(
                               result.resourceSession.whitelistId ??
                               null
                       }
-                    : null
+                    : null,
+                whitelistEmail
             };
 
             return response(res, {