- Shipped
- 15 Kasım 2026 12:45 UTC
- Author
- Kamo
- Commit
- a86a1b7
- federation/start takes portal + portalHost (BAD_PORTAL unless myloan<->BORROWER / apps<->PATIENT on the SAME organization as the sign-in page); audience forced CUSTOMER; the portal org's socialCustomers decide. - callback / link confirm of a portal start answer PORTAL {returnUrl ?ticket=} / PORTAL_MFA / NOT_LINKED, and every ERROR carries the portal's landing ?error=CODE. New POST federation/portal/mfa and federation/portal/redeem (FEDPT ticket 15 min, spent only on SIGNED_IN, bound to its portal host). - BORROWER redeem: STAFF_ACCOUNT for a Team Member of the lender, memberships via the new PortalMemberships (extracted from PortalAccountController, behaviour unchanged), mailbox proof (VERIFY_EMAIL with the portal's letter, resend-limited), CREATE_ACCOUNT -> passwordless platform user + identity (SIGNUP), OTK via SignInCompletionService, LOGIN_PORTAL_FEDERATED through SignInDetection.signInPortal. - PATIENT: patient_portal_identities -> PatientPortalSession (signInFederated), proof by the PORTAL password (portal lockout) or a practice-branded code to the login address; one NO_PORTAL_ACCOUNT sentence for every miss. Never a User, Member or user_identities row. - Applicants: a PROSPECT team member signs in under CUSTOMER rules; a federated /register carrying a jobId checks socialCustomers.