After magic link login, account bounces through each client app's
/auth/login to establish local sessions via OAuth. Each app does its
OAuth flow (instant since account is logged in) then redirects back
to /auth/propagate for the next app in the chain.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Account creates OAuthGrant per authorization, revokes on logout.
Client apps verify grants via /auth/internal/verify-grant endpoint.
Removes iframe-based logout page.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Account is now the OAuth authorization server with magic link login,
OAuth2 authorize endpoint, SSO logout, and session management.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>