Link a Google login to a signed-in member, explicit link only; Bifrost stores no Heimdall token #81
2026-11-12
Complete page pin: the form also carries pendingLinkId
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Bifrost: explicit Google link by fresh Heimdall sign-in, no stored token
The account page's POST starts an ordinary sign-in whose attempt (a purpose, the expected account id, a pending link id; never a token) is only the proof for a link. Each Heimdall call that needs a bearer follows its own fresh sign-in; the bearer lives in that request. Google stays out of AllowedProviders and member access. Authorization is redacted from HttpClient logging. Outcomes redirect to a fixed closed set of wording. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Google link: tests and fake Heimdall link routes (red until the flow lands)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>