zooqueen 4f420977c1 fix(auth): thread OIDC nonce through the password-login path ...

Confidential OIDC clients that validate strictly (LibreChat openid-client with
OPENID_REUSE_TOKENS) send a nonce on authorize and require the id_token to echo
it. The portal's password-login path read code_challenge from the authorize URL
but DROPPED nonce, so the IAM minted a code (and id_token) with no nonce ->
openid-client 'unexpected JWT claim value encountered' -> hanzo.chat callback
HTTP 500. Thread nonce: Login.tsx reads ?nonce, LoginForm forwards it, and
client.login() puts it on the /v1/iam/login query (next to code_challenge).
Additive + forward-only (never defaulted); social login already rode authorize()
which carried nonce. Verified: id SPA builds green.

2026-06-23 18:17:30 -07:00

..

src

fix(auth): thread OIDC nonce through the password-login path

2026-06-23 18:17:30 -07:00

package.json

fix(social): real Google endpoint + registered redirect_uri (iam.hanzo.ai/callback)

2026-06-22 23:26:35 -07:00

tsconfig.json

feat(social): wire the provider hop + return exchange (gated until creds seeded)

2026-06-20 10:46:26 -07:00