Marc-André Bombeck 9eae352bb1 feat(claim): hand over a managed profile through single sign-on ...

POST /api/auth/claim/sso checks the handover link and the username and seals
the link id, the username and a per-start binding into an hl_claim cookie.
GET /api/auth/oidc/login?intent=claim carries the binding into the encrypted
OIDC state, and the callback binds the provider subject to the profile in the
claim transaction, refusing a subject or verified email another account
holds, a link that is no longer usable, and a live session.

The handover status and the claim preview name the redemption methods; a
single-sign-on-only server hands over through the identity provider, and only
the password claim stays refused there.

2026-10-15 23:12:59 +02:00

..

fixtures

fix(labs): resolve biomarker delete through the record-scoped labs authority

2026-10-15 20:24:00 +02:00

integration

feat(claim): hand over a managed profile through single sign-on

2026-10-15 23:12:59 +02:00