Gustavo Valverde 539a1adac8 fix(auth): request the TikTok identity scope and keep provider bindings on refresh ...

TikTok returns `open_id`, `union_id`, `display_name`, and `avatar_large_url`
only under `user.info.basic`, while `username` belongs to `user.info.profile`.
Sign-in requested the profile scope alone and read fields from both, which held
together only because the identity subject was not load-bearing. It is now.

Updating a session or a user profile reissued the session cookie through the
new-sign-in path, which clears the provider account binding. Same-user refreshes
keep their binding, as the password-change path already does.

2026-07-17 12:58:34 +01:00

..

blogs

fix(auth): isolate provider identities and tokens from provider aliases

2026-07-17 11:53:02 +01:00

changelogs

chore(docs): format markdown including mdx files (#9085)

2026-04-10 05:09:33 +00:00

docs

fix(auth): request the TikTok identity scope and keep provider bindings on refresh

2026-07-17 12:58:34 +01:00

docs-beta

docs: add stable/beta versioning with build-time content sync (#9258)

2026-04-21 03:49:33 +00:00