Linked accounts page: list, link, unlink with fresh proof (merge design step 2) #84
2026-11-13
Linked accounts: drop the list after an unlink with an uncertain end; Google never mints; docs
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Linked accounts: never guess a proof provider; require stepUpRequested; no-store on completion
With no current list the proof goes only through a provider the member names, never the session's sign-in provider: a sign-in through an unlinked provider makes Heimdall mint an orphan account holding that login. Link buttons need a current list. The unlink completion must say a step-up was requested. POST /auth/heimdall/complete answers no-store. The fake Heimdall now models orphan minting, derives step_up_at from the start's stepUp flag, and enforces the app secret, sign_in-only, unsupported-provider and 600 s rules. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Linked accounts: docs, README line, proof-provider and no-store tests
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Linked accounts page: list, link any admitted provider, unlink with step-up proof
A member sees their Heimdall logins, links Discord, Patreon or Google, and unlinks one with a fresh Google step-up sign-in. Bifrost keeps no Heimdall token: each action is a fresh Heimdall sign-in started by Bifrost whose bearer lives inside the completion request. The list is kept five minutes in this process as non-secret fields only. The Status page's Google-only link button and handler are cut; the Linked accounts page owns link starts. HeimdallStartRequest gains stepUp. Heimdall's member routes use a client without the app secret. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>