- Shipped
- July 6, 2026 at 9:55 PM UTC
- Author
- Kamo
- Commit
- 584f8b8
Reuse (no duplicate accounts for the same person): - MemberCreateController now reuses an existing user by personal email case-INSENSITIVELY (was case-sensitive, missing legacy mixed-case emails). - SecurityController.register reuses an existing account instead of always creating a new user: already a member of the org -> 409 ALREADY_MEMBER ("please sign in"); existing ACTIVE account -> link the org, keep their password, return ACCOUNT_LINKED; unactivated placeholder (never verified AND never logged in) -> claim it with the typed password. A public form can never overwrite an active account's global password. securityProvider mirror: - Both internal member/team-member creation and public register now call **************** so every new membership also lands under the org's securityProvider org (as a base Member). Team-member activation gate: - login blocks a TeamMember whose membership status != ACTIVE with "Your account exists but is not active at this time." Regular members and active team members pass. Org-resolution hardening (X-Forwarded-Host siblings): - getExternalProviders and PortalController.resolveOrg use the alias-fallback resolver and drop the getServerName() fail-open (fail closed instead of leaking the platform org).