zooqueen da05c24f51 fix(auth): thread OIDC nonce through the password-login path ...

Confidential OIDC clients that validate strictly (LibreChat openid-client with
OPENID_REUSE_TOKENS) send a nonce on authorize and require the id_token to echo
it. The portal's password-login path read code_challenge from the authorize URL
but DROPPED nonce, so the IAM minted a code (and id_token) with no nonce ->
openid-client 'unexpected JWT claim value encountered' -> hanzo.chat callback
HTTP 500. Thread nonce: Login.tsx reads ?nonce, LoginForm forwards it, and
client.login() puts it on the /v1/iam/login query (next to code_challenge).
Additive + forward-only (never defaulted); social login already rode authorize()
which carried nonce. Verified: id SPA builds green.

2026-06-23 18:17:30 -07:00

..

auth

fix(auth): thread OIDC nonce through the password-login path

2026-06-23 18:17:30 -07:00

idv

rewrite: Vite + @hanzo/gui monorepo (drops CF Worker + Next.js)

2026-05-24 01:50:39 -07:00

onboarding

fix(onboarding): never list other tenants' orgs; create-or-skip only (#15)

2026-06-23 12:56:31 -07:00

shared

fix(auth): org-agnostic password login — resolve real owner-org, not pinned brand

2026-06-23 15:24:32 -07:00