docs(users): admin-created SSO-only accounts and POST /api/users limit alignment (#2122) API-Contract: POST /api/users authProvider ('local'|'oidc'), conditional password (12-255), displayName 1-100, OIDC_NOT_CONFIGURED 400, handler check order; login/deactivation/error-code text narrowed to accounts with a password; me/password notes; User Response Shape; unknown properties are stripped, not rejected (correction to the #2120 row). Schema: scrypt, stale oidc-row rationale. ADR-035 Amendments (#2122). ADR-010 amendment: scrypt replaced argon2 in PR #72. Co-Authored-By: Claude product-architect <noreply@anthropic.com>
docs(adr): correct OIDC provisioning race description (#2142) Within one process better-sqlite3 transactions serialize, so a second sign-in for the same subject resolves at the subject-match step. The oidc_subject unique-index catch is the backstop for out-of-process writes, matching provisionOidcUser in userService.ts. Co-Authored-By: Claude product-architect <noreply@anthropic.com>
docs: opt-in OIDC JIT provisioning via OIDC_JIT_PROVISIONING (#2142) - ADR-035: dated #2142 amendment (member-only provisioning after all existing guards, ambiguous-email and empty-users refusals, subject race handling); reconcile §1 and the rejected OIDC_AUTO_PROVISION alternative; record the accepted no-allow-list risk - API-Contract: callback Behavior step 8 (reject or provision), name / preferred_username claims, env row, redirect + error-code rows, Deviation Log - Architecture: OIDC bullet, env row, enablement note, Deviation Log Co-Authored-By: Claude product-architect <noreply@anthropic.com>
docs(adr-035): state that OIDC email case folding is ASCII-only (#1865) Co-Authored-By: Claude product-architect <noreply@anthropic.com>
docs(auth): move OIDC missing-email check after subject lookup, add OIDC_MISSING_EMAIL (#1865) Co-Authored-By: Claude product-architect <noreply@anthropic.com>
docs(auth): OIDC account linking by verified email, no self-registration (#1865, #2026) Add ADR-035 (supersedes ADR-010's auto-provisioning). Rewrite the OIDC callback behaviour, redirect/error codes, oidcLinked on user responses, users-table invariants and migration 0046 (unique oidc_subject). Co-Authored-By: Claude product-architect <noreply@anthropic.com>