Access boundary: Authenticated browser session.
Unified personal account and optional workspace implementation; migrations, aligned document policy, Auth0 configuration and connected production qualification require separate evidence.
Surfaces: Personal browser API/session without workspace Bearer authority; workspace browser and native sessions; canonical MCP resource OAuth discovery. Optional custom domain affects browser sign-in only.
Read the engineering guide · All features
Capabilities
- Auth0 sign-in, verified accounts and explicit MFA policy
- Canonical browser sign-in/callback; retired hosts and preview URLs refuse authentication
- Personal profile, interface language and saved Classic/V2 appearance
- Session listing, revocation and explicit logout
- Successful logout returns to the public home before Login remounts; failures stay visible and never claim a logout
- Workshop switching with current membership rights
- OAuth connection binding, revocation and consented scopes
- Exact resource-metadata discovery issuer, including its trailing slash; official MCP SDK contract tests without external network
- Account deletion request; complete erasure processing remains unqualified
- Visible signed-in name, login email and current role on desktop/mobile
- Explicit Auth0 account switching without disabling ordinary SSO
- Tab-focus reconciliation of identity, workshop and saved language
- One authenticated language control in the account; visitor choice stays separate
- Account Classic/V2 preference, migration 0053 and reconciliation after identity changes
- Late contact-directory errors provide accessible recovery without interrupting profile editing
- Path-scoped browser reads: hide previous resources, preserve same-path refresh and ignore cancelled late responses/401s
- Direct Auth0 entry from public links and unauthenticated private routes, preserving locale and exact destination
- Deep-link recovery from the valid transaction, excluding callback URLs and private parameters
- Prepared Auth0 brand assets and FR/EN/DE UI; Luxembourgish keeps its Guteneo locale with Auth0 fallback; language activation and publication need separate proof
- Restore explicit visitor language after the initial session check without overwriting current selection or account preference
- Recovery screen only after an error, with explicit retry and no automatic loop; native Auth0 signup, local demo and public fixture remain distinct
- Reread workshop capabilities for a browser session; anonymous reads support recovery and refresh the shared public offer/FAQ after returning home
- Optional auth.guteneo.com browser domain for the existing Auth0 tenant; MCP issuer/discovery/tokens remain canonical
- Additive migration 0054 binds authorisation issuer and identity namespace to PKCE; legacy NULL flows stay canonical and rollback never silently switches provider
- Verified dual-token subject binds to the canonical namespace without email linking or duplicate person/workshop/credits/authority; browser evidence and prepare_only restriction remain
- One Guteneo account without an automatic workspace; idempotent initial administrator/workspace creation only on explicit service use
- Personal browser principal and session without membership, separate from workspace API authority; shared profile name/language and no email-based identity merging
- My documents, Use Guteneo and Account and security share one sign-in; voluntary workspace choice/creation reloads the chosen destination and bootstraps that workspace’s current session, rights and CSRF
- Document policy defaults to strong or explicitly selects verified_account: verified account/address and signed recent auth_time; fifteen minutes for reading/association/approval and five for export/deposit/deletion; documentAccessAllowed/documentAccessMode do not imply MFA or strongAuthentication; D1 defaults strong and environment disagreement fails closed
- Document invitation handoff lasts at most ten minutes in the same tab, then is deleted; capture before Auth0 with secret-free returnTo and no arbitrary private query
- Document-service 401 offers explicit recovery without session-bootstrap loops; Auth0 recovery reconciles language and returned identity