- Shipped
- 15 Kasım 2026 10:27 UTC
- Author
- Kamo
- Commit
- adc476b
ID5.6 — /auth/start accepts portal (BORROWER|PATIENT) + portalHost (+ audience=CUSTOMER, relative next), passes them to federation/start and keeps them in kamo_fed_ctx across the ID1.4b hop; a malformed pair is refused before any provider (BAD_PORTAL card). Callback / link-confirm: PORTAL -> 303 to returnUrl only when it is https on exactly the portal host the flow started with; PORTAL_MFA -> the existing MfaStep posting to the new relay /api/federation/portal-mfa -> federation/portal/mfa (portal host held server-side in HttpOnly kamo_portal); an ERROR carrying returnUrl on a portal flow -> back to the portal. A portal flow never plants ***. @kamo/auth 0.6.1 maps unknown outcomes to ERROR, so routes read the raw answer first (lib/signin/portal.mjs) and otherwise route exactly as before. ID5.7 — kamo_did (HttpOnly, Secure, Lax, 400 days, 32 random bytes) minted when absent and sent as X-Kamo-Device-Id on every sign-in relay (login, mfa, select, federation start/callback/link, passwordless, passkeys, SSO/SAML; never minted on a cross-site form POST). PASSKEY_REQUIRED from /api/login, MFA, select, federation and passwordless answers opens "Your Organization Asks Administrators To Use A Passkey": Use Your Passkey / Create A Passkey Now **************** / Continue For Now (only when canContinue), then the normal hand-off. Breached-password nudge after a PASSWORD sign-in (SHA-1 in the browser, 5-hex prefix to /api/pwned with Add-Padding + 1.5 s, fail-quiet) with Change It Now / Remind Me Later and a fire-and-forget signin/breach-nudge with the planted ***. New /secure-account?t= page. Refusal cards for PASSWORD_RESET_REQUIRED (with Reset My Password), STAFF_ACCOUNT, BAD_PORTAL, NO_PORTAL_ACCOUNT. Every new branch is harmless while securityservice does not answer it (404/unknown -> today's behaviour). Verified: npm test 134/134 (31 new), tsc clean, check-i18n-keys against the pushed dictionary, harness shots.