admin
023406c9b6
CI (SIAX Cloud) / integration (push) Skipped
CI (SIAX Cloud) / sonar (push) Skipped
masterplan-lock / check (push) Successful in 3s
CI (SIAX Cloud) / sonar (pull_request) Skipped
masterplan-lock / check (pull_request) Successful in 5s
Security Scan (SIAX Cloud) / security (push) Successful in 14s
CI (SIAX Cloud) / security (push) Successful in 21s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 19s
CI (SIAX Cloud) / security (pull_request) Successful in 23s
CI (SIAX Cloud) / integration (pull_request) Successful in 28s
CI (SIAX Cloud) / quality (push) Successful in 48s
CI (SIAX Cloud) / quality (pull_request) Successful in 45s
The portal had no way to obtain a verified principal: /api/0pt/* requires a Bearer token, but the browser only had the dev-only HMAC cookie. - GET /api/auth/login: Authorization Code + PKCE against Zitadel. - GET /api/auth/callback: code exchange, id_token verification (issuer, audience, nonce) and a signed session cookie with sub + tenant. - middleware accepts the signed session as a verified principal; Bearer wins. - dev login POST is refused in production. - Sign-in link in the portal shell.