- Ya
- 4 Septemba 2026, 02:47 UTC
- Mwandishi
- Kamo
- Ahadi ya
- f83979f
Every flow here now reads whichever app the org is on — its own registration if it brought one, otherwise Kamo's platform app. The Canva and Meta entry points load the connection or intent BEFORE resolving the client, because which app an authorization runs against depends on the org and the org id lives in the thing being loaded. An authorization started against one app cannot be completed against another. SocialCredsResolver has to follow the org for the same reason in reverse: a Meta webhook is signed by whichever app owns the page, so verifying it with the platform secret would fail every HMAC check for a page connected through the org's own app. Canva's return-navigation callback stays platform-only and is commented as such: it arrives with a correlation JWT and no organization, so an org on its own app falls through to the manual import path that already exists for it. The meetings screen gains orgOAuthClientConfigured and oauthClientAvailable, so it can offer "Kamo's app" and "our own app" independently instead of hiding one-click connect the moment a platform operator switches a provider off.