Bind link mode to its initiator and redeem to its target #1
2026-11-03
Refuse a connection target on sign_in start
Connection targets ride only on connect and link starts, which carry x-heimdall-app-secret. A sign_in start is open to any browser; with a connection it now returns 400 connection_not_allowed_in_sign_in. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Pin completion expiry at redeem: 410 at and after expiresAt, for any caller and target
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-02
Bind link mode to its initiator and redeem to its target
Link start needs an authenticated app and an initiatingAccountId, carried in the signed state. The callback refuses an identity held by another account (link_initiator_mismatch) and attaches an unlinked one to the initiator. auth_completions stores target_id; redeem compares it and answers completion_target_mismatch without consuming the code. Link completions are redeemed only by the authenticated app. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>