Oauth Authorize Resume
oauth
Oauth Authorize Resume
Resume a cold-start authorization request after the member logs in.
SECURITY INVARIANTS:
- The ONLY accepted parameters are the opaque single-use
ridand the non-secret hub slugh. This endpoint never accepts a redirect_uri, return_to, next, client_id, scope, state, nonce, or PKCE value — there is no client-controlled redirect target, so there is no open-redirect surface.his used ONLY as a percent-encoded path segment on the server-configured HUB_FRONTEND_BASE_URL origin (app/hubs/urls.py:66), never as a host or a full URL. - The rid is burned atomically (GET+DEL) on first read: it cannot be replayed.
- Identity comes ONLY from the live session resolved at THIS request; the stored context carries no contact_id, so a resume link cannot fixate a contact.
- The full /authorize validation ladder re-runs; nothing is trusted as pre-validated.
This is an OAuth2/OIDC endpoint — NOT JSON:API.