mirror of
https://github.com/hanzoai/id.git
synced 2026-10-16 18:38:15 +00:00
zooqueen
6f4d36a748
hanzo.id could sign you in and then had nothing for you to do. /account is a settings surface now — profile, security, organizations, applications — built from what IAM implements and honest where it does not. Signed out it has ONE control, the issuer's own authorize leg: no credential form, no provider strip. Those stay at /login, which is the issuer's screen and the one place a credential is typed. Consent is what a person can actually change here, and it round-trips: the write is read back, so a save that did nothing cannot leave the switch looking moved. The identity fields are read-only because update-user refuses a regular user on their own row by design; the page says so rather than render a form that cannot save. IAM's Guard reads a bearer and has no cookie path, so a portal sign-in gets 401 on exactly two reads — memberships and webauthn-credentials. The client attaches a token when the SDK holds one and says what is true when it does not. A failed read is not an empty list: "No passkeys yet." cannot appear beside the reason they could not be read. The chrome is @hanzogui/shell's OrgHeader, mounted for hanzo only — that bar draws the Hanzo mark and exposes no brand slot, and this image serves lux.id, zoolabs.id and pars.id byte-identically. Applications are in the catalogue's order and the page says so: lastSigninTime has no writer and no login writes an audit row, so sorting by it would be arbitrary order wearing a promise. Also fixes a pre-existing red on main: LoginForm's phone case waits on a dynamic import inside waitFor's 1s default, and the chunk arrives at ~2s. The budget was wrong, not the claim.