Begin SSO (browser redirect, documentation)

Kicks off the external JumpCloud OIDC sign-in by issuing a stateless Socialite 302 redirect to JumpCloud's authorize endpoint with scopes openid, profile, email. This is a top-level browser navigation (not an XHR/fetch call). After the user authenticates, JumpCloud bounces back to GET /auth/sso/jumpcloud/callback, which mints a one-time SsoExchangeCode and redirects the SPA to the frontend callback URL with ?code=<raw> (or ?error=<reason>). The SPA then redeems that code at GET /auth/sso/exchange for a Passport access token.

Auth: Both — public/unauthenticated (no authentication). Runs under the web route guard group so Socialite can store and round-trip the OIDC state CSRF parameter in the session (JumpCloud requires a non-empty state ≥ 8 chars). No role scoping happens at this step — it only redirects to the IdP. The endpoint enforces role eligibility later in the callback: super-admins (the account's bundle_id 0/null) are hard-blocked, and only customer-tier users (bundle_id ≥ 1 — agency/Partner, account, store) with jumpcloud in their auth_methods and an associated company are allowed through.

Rate limit: 10 requests/min per IP.

Request

• No path params, query params, or body.

Response — not a { data. } envelope. Returns an HTTP 302 Found redirect to the JumpCloud authorize URL.

• Location (header) — JumpCloud OIDC authorize endpoint URL including client_id, redirect_uri, response_type=code, scope=openid profile email, and a generated state.

Success example

HTTP/1.1 302 Found
Location: https://oauth.id.jumpcloud.com/oauth2/auth?client_id=<client_id>&redirect_uri=<callback>&scope=openid+profile+email&response_type=code&state=<random>

Note: this endpoint is for documentation only. It is meant to be opened directly in a browser, not invoked from the SPA's HTTP layer, since the response is a redirect rather than JSON.