[rafiki270]

Summary

Signed-in people entering another team had to choose their provider and team again in UOA. An explicit browser team entry now uses the previously completed, still-enabled social provider as a UI preference, performs the normal provider roundtrip, and opens the verified target without those extra choices.

• Remember only the provider name in a signed, host-only, HttpOnly, Secure, SameSite=Lax cookie after completed authorization. Consume it before automatic launch so cancellation or failure leaves normal choices on retry.
• Require a valid team hint, S256 and verified configuration. Prompts, native clients, enterprise intent, management, linking, invitations and continuations keep their existing paths.
• Preserve the hint through strict social query validation, signed state and the verified-user chooser. Exact team IDs take priority; ambiguous slugs leave the chooser visible. Membership, provider verification, MFA, signature, original-proof and refresh admission remain mandatory.

Verification

Passed on Maxis:

• 58 focused API unit cases and one real PostgreSQL journey through callback, code exchange, refresh, remembered-provider entry and separate target authorization.
• 11 hosted team/organisation creation route cases with the production signed-cookie plugin, plus the 22 provider-preference cases rerun together.
• 25 Auth team-response unit cases, including foreign and ambiguous hints.
• API typecheck, Auth client/SSR build and changed-source ESLint.
• Five Stripe correction database cases passed with a stricter 10-second business timeout after moving schema setup/cleanup into the existing test hooks; billing assertions and the CI timeout are unchanged.
• Four headless browser cases: Before and After at 1280 × 900 and 390 × 900. Target entry takes two manual actions within UOA Before and zero After. A provider roundtrip still occurs; the source family retains its scope, assurance ID, expiry and revocation state. Cancellation does not automatically restart.
• Screenshot inventory: all 22 PNGs checked against their source hashes and viewport dimensions; all states below visually inspected.

No native build was performed. Required CI passed and deployment 40115923985 succeeded. Cloud Run revision uoa-auth-00348-hk5 serves 100% of traffic; its image digest matches merge 503579e and the health endpoint passed. Live integrated-browser verification with the relying product and real Google sign-in passed: one initial provider confirmation established the preference, then a different target and repeat team entries completed without further provider or team choices. Reloads preserved the selected team.

Journey evidence

These are actual built Auth HTML/React and UOA routes against an isolated database, using the same light theme, configuration and viewports. Before uses product sources at ee2bf654; After uses aaaf6930. Google HTTP and signed configuration are local fixtures. No screenshot shows Google's UI. Source/target completion pages are explicitly labelled local callback fixtures, and do not claim to show Nessie's product UI. Live Google and the complete product journey were verified separately after deployment, as described above; the images here remain isolated fixture evidence.

The existing generic cancellation page is unchanged. The next explicit entry returns to provider choices. After's provider-choice screen is skipped, so there is no replacement screenshot for that absent screen; the next screenshot shows its automatic team-opening state.

Desktop: 1280 × 900

0. Source sign-in has completed (labelled callback fixture)

Before — desktop, 1280 × 900.

After — desktop, 1280 × 900.

1. New target-team entry reaches provider choice

Before — desktop, 1280 × 900.

After: Not rendered. The remembered enabled provider starts its real protocol roundtrip automatically; the next state is shown below.

2. Choose the target team or open it automatically

Before — desktop, 1280 × 900.

After — desktop, 1280 × 900.

3. Exact target sign-in completes (labelled callback fixture)

Before — desktop, 1280 × 900.

After — desktop, 1280 × 900.

4. A subsequent provider attempt is cancelled (existing HTTP 401 page)

Before — desktop, 1280 × 900.

After — desktop, 1280 × 900.

5. The next explicit entry returns to provider choices

Before — desktop, 1280 × 900.

After — desktop, 1280 × 900.

Mobile: 390 × 900

0. Source sign-in has completed (labelled callback fixture)

Before — mobile, 390 × 900.

After — mobile, 390 × 900.

1. New target-team entry reaches provider choice

Before — mobile, 390 × 900.

After: Not rendered. The remembered enabled provider starts its real protocol roundtrip automatically; the next state is shown below.

2. Choose the target team or open it automatically

Before — mobile, 390 × 900.

After — mobile, 390 × 900.

3. Exact target sign-in completes (labelled callback fixture)

Before — mobile, 390 × 900.

After — mobile, 390 × 900.

4. A subsequent provider attempt is cancelled (existing HTTP 401 page)

Before — mobile, 390 × 900.

After — mobile, 390 × 900.

5. The next explicit entry returns to provider choices

Before — mobile, 390 × 900.

After — mobile, 390 × 900.

Full screenshot inventory, revisions, fixture limits and local commands.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.