4 Commits

Author	SHA1	Message	Date
giles	bfd8d55f27	Silent SSO via sso_hint cookie ... - Federation sets sso_hint=1 on .rose-ash.com after magic link login - Client apps: before_request checks sso_hint, triggers silent OAuth once per session (sso_checked flag prevents loops) - Logout clears sso_hint cookie on all apps Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-23 11:23:26 +00:00
giles	d0a5170cd9	Fix logout: redirect to blog home to avoid re-auth loop ... Account's / requires login, so redirecting there after logout triggers silent OAuth re-authentication. Blog home is safe. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-23 11:15:14 +00:00
giles	ea35e040e7	Fix OAuth authorize URL: include /auth prefix ... The federation auth blueprint is mounted at /auth, so the authorize endpoint is /auth/oauth/authorize, not /oauth/authorize. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-23 10:25:46 +00:00
giles	46f44f6171	OAuth SSO infrastructure + account app support ... - OAuthCode model + migration for authorization code flow - OAuth client blueprint (auto-registered for non-federation apps) - Per-app first-party session cookies (fixes Safari ITP) - /oauth/authorize endpoint support in URL helpers - account_url() helper + Jinja global - Templates: federation_url('/auth/...') → account_url('/...') - Widget registry: account page links use account_url Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-23 09:55:27 +00:00