- Shipped
- August 24, 2026 at 9:19 PM UTC
- Author
- Kamo
- Commit
- f5b292a
Adds the second half of the split: a sign-in that names no organization authenticates the user, then asks which workspace. POST /api/security/session/select turns one choice into a session, and SignInCompletionService holds every gate between a correct password and a usable session so login and selection cannot drift apart. Reached in two cases. A host that names no organization always defers -- before now that was a sign-in that could not succeed at all, so nothing is taken away. The platform host is the case the change exists for: login.kamocrm.com resolves to KamoCRM Inc., so without this it goes on scoping every sign-in to that one org and a member of a domainless org still cannot get in. That second case ships behind **************** default FALSE. Turning it on makes a member of several orgs receive a workspace list instead of a session, which a client that cannot render one reads as a failed login -- 17 of 53 users have more than one membership. It goes on with the release that teaches kamo-login the picker. Until then this release changes nothing for anyone signing in today, and a custom domain keeps the original path either way. Disclosure rules are preserved deliberately. A correct password that can enter nothing is refused in the same words as a wrong one, or the form becomes an oracle for valid credentials. The workspace list is never an authority: selection re-proves membership, so an edited, stale or invented list gets a refusal. The selectToken is not a session -- single-use, five minutes, a user id and nothing else. **************** correctly flagged the new endpoint as pre-session; it is baselined with the reasoning, since an endpoint whose purpose is to mint a session has none to resolve. Org ids cross every new wire as digit strings. 1200096283020229788 is a real id here and has no exact double representation. 923 tests pass.