The SPA hits this to redeem the one-time SSO code issued by the JumpCloud callback. Validates and single-use-redeems the code under a DB lock, re-checks eligibility, issues a Passport access token, fires UserLoggedIn, and 302-redirects to {FRONTEND_URL}/rs-sso-login/?token=<accessToken>. An invalid / expired / already-redeemed code returns a 400 JSON error. Emits audit SSO_EXCHANGE_CODE_REDEEMED + AUTH_LOGIN on success, SSO_EXCHANGE_CODE_INVALID on failure.

Auth

• Public. The one-time code is the credential.

Rate limit

• 10 requests/min per IP; public.

Query

Behaviour

• On success: 302 to the frontend with ?token=<accessToken> (the token is delivered via the redirect URL, not a JSON body). On failure: 400 JSON Invalid or expired SSO code.

Errors: 422 on validation failure.