- Shipped
- November 15, 2026 at 2:41 AM UTC
- Author
- Kamo
- Commit
- 7961de7
- POST /api/security/signin/methods (host, audience, org?) - ENABLED registrations AND the org policy; password-only until a provider is enabled; passkeys/email code/phone approval answer false until Phase 2. - POST /api/security/signin/identify - domain only, PASSWORD until Phase 3. - GET|PUT /api/security/org-signin-policy (+ /preview), right MANAGE_SIGN_IN_METHODS, SIGNIN_POLICY_CHANGED on the access log; no row = the BRIEF defaults; a policy with no way in is refused. - /api/security/user-identities list/unlink (LAST_SIGNIN_METHOD 409, WRONG_SECURITY_PROVIDER_ORG when the member belongs to the account's provider org) and link-start (single-use LINK ticket). - /api/security/my-sessions via ***UIDX: handle = 's' + sha256 prefix (never the ***), KamoMobile devices listed ('m' handles), revoke, sign-out-others; SESSION_REVOKED_BY_USER. New sessions record clientIp / clientUserAgent. - Platform registry: *_SIGNIN rows carry the ladder (NOT_CONFIGURED -> CONFIGURED -> ENABLED; ENABLED only after a passing Test of the current credentials, a credential change drops it to CONFIGURED) and callbackUrls **************** one resolver with the sender); real POST .../{provider}/test (discovery, JWKS, credentials). Org-own sign-in apps editable with MANAGE_SIGN_IN_METHODS, callback on login.<org domain>. - GET /api/security/providers answers from the registry (nothing enabled -> []). - /register federationToken: spent on the way in, restored when no account is made; *** skipped, password optional (NULL = passwordless), IdP-verified email pre-verified + auto-login OTK; policy-checked; never joins an existing account (409 ACCOUNT_EXISTS).