- Shipped
- 15 Novemba 2026, 02:18 UTC
- Author
- Kamo
- Commit
- d7ec192
- @kamo/auth 0.5.0 (pinned in the lockfile by hand; .npmrc names the private registry; the Dockerfile copies it and the workflow maps k1m1 for the build, like kamo-internal). - The legacy SSO buttons (/oauth2/authorization/<id>, served by nothing) and /api/providers are gone. Buttons come from providerCatalog, shown only for what securityservice signin/methods reports ENABLED for this host + audience (?audience=, default MEMBER); gaming providers only on kamouniverse.com. No answer / 404 => password only, so today the page is unchanged. Brand-guideline buttons, staggered motion, Last Used chip (localStorage, guarded), help tip. - /auth/start/[provider] -> federation/start, kamo_fed binding cookie (HttpOnly, /auth, 10 min; SameSite=None;Secure for Apple), 302. - /auth/callback/[provider] GET + POST (Apple form_post) -> federation/callback. SIGNED_IN plants *** like /api/login and the page finishes through redirectSignedIn (next, job advert, shared doc, checkout); MFA -> MfaStep; SELECT -> picker; NOT_LINKED -> /auth/link; SIGNUP -> **************** (org/jobId/doc kept, prefill in the URL fragment); ERROR -> plain-language card. The outcome travels under a Redis handle in an HttpOnly cookie, never the URL. - /auth/link: prove the existing account with password (+ authenticator code) or an emailed code; the link token stays server-side. - MotionConfig reducedMotion=user at the app root. Host travels in the body (and X-Forwarded-Host) on every securityservice call. - English in app/lib/federation/copy.ts keyed by the kamo-login dictionary keys until next-intl is wired (ID2.1).