- Shipped
- 2026年11月15日 5:11 UTC
- Author
- Kamo
- Commit
- b84b9bd
Owner decision 2026-11-14: a redirect follows the email rule. TenantRedirectResolver (the browser's return after a Teams/RingCentral OAuth hop) took the org's first active root row with no ownership or certificate check, so an org that had only typed in its domain was sent to internal.<that domain>, which answers nothing. It now uses **************** own live root (active, root, ownership_verified, ssl_confirmed), else internal.kamouniverse.com. Configured URL untouched only when the org is unknown or its rows cannot be read. UI return only — provider-held redirect_uris are unchanged (RingCentral fixed on the platform api host; Teams via OrgApiHosts.reHost, already ownership+ssl). New arch/OrgDomainRuleGuardTest (empty ALLOWED) refuses getDomains(), "internal." + and an = "internal."; constant here.