JumpCloud OIDC callback (issue exchange code)

JumpCloud redirects the browser here after sign-in. Validates the IdP user (email match, jumpcloud enabled in auth_methods, company present, bundle_id ≥ 1, not locked/inactive), mints a single-use SsoExchangeCode, then 302-redirects to FRONTEND_CALLBACK_URL with ?code=<raw> on success or ?error=<reason> on failure. Never returns JSON — the user-agent is the browser. The route carries web session route guard so Socialite can round-trip its OAuth state.

Auth

• Public (no Bearer). Socialite validates the OAuth state; identity comes from JumpCloud.

Rate limit

• 10 requests/min per IP; public.

Query

Behaviour

• Always 302. Failure error reasons: sso_failed, sso_no_email, no_user, sso_not_enabled, no_company, role_not_allowed, account_locked, account_inactive. Emits audit SSO_LOGIN_SUCCESS / SSO_LOGIN_FAILED / SSO_LOGIN_BLOCKED_*.