Federated Login

The upstream legs of a browser login started at /oauth2/authorize, brokered to an upstream identity provider (Cognito hosted UI in the open-source deployment). Clients only ever receive ESP User tokens.

📄️Redirect to an upstream identity provider

Sends the browser to the upstream provider's login. Reads the flow from the `__Host-esp_flow_id` cookie, refuses a provider the client does not allow, and records this leg's own `state`, `nonce` and PKCE verifier on the flow. The client's values never reach the provider.

📄️Upstream provider callback

The provider returns here after login. Verifies `state` against the flow, exchanges the upstream code, validates the upstream `id_token`, finds or creates the ESP User account, and redirects to the client's `redirect_uri` with a single-use `code`. Upstream tokens are discarded.