Author	SHA1	Message	Date
Meta Vens	b4dcd1de89	OIDC issuer: provider endpoints, authorize gate (Active members, identity required), one MAS client, tests ... Authorize reads the cookie session and the same actor facts the /App policy reads; sub = UserAccount.Id, preferred_username = NormalizedBifrostIdentity. OpenIddict request caching parks the authorize request as a short request_uri. Mapped only when Bifrost:Oidc is present. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-22 18:35:34 +02:00