← Back to MasterEngine.ai
Private bind · noindex
Sign in to Mission Control
Fail-closed private bind. Unconfigured Control Plane or unknown principals cannot establish a session. This page is noindex.
How this works
Sign-in is a private session bind, not a public account signup. Unknown principals stay unbound.
- Public IdP only. The browser uses public Firebase/OIDC web config only. No client secrets.
- Continue with Google. This Worker host prefers signInWithPopup (Firebase Option 2). A Firebase Auth user is created only after popup, getRedirectResult, or signInWithCredential succeeds on this project — Google UI continuing is not enough. Redirect is used only when authDomain is this host and /__/auth is proxied.
- Same-origin bind. After the IdP returns an ID token, a same-origin BFF calls POST /session/bind.
- Known principal only. The Control Plane verifies the token, binds a known principal, and issues an opaque session.
- HttpOnly cookie. The session proof is stored in an HttpOnly Secure SameSite cookie, not localStorage.
- One-way revoke. Sign out calls POST /session/revoke, one-way revokes the PostgreSQL session, and clears the cookie.
- No membership writes. The browser cannot create or escalate membership.
Bind session
Request an organization already bound in the Control Plane, then continue with Google.
Public Firebase/OIDC web config is not present. This page can render, but it cannot start IdP sign-in or establish a session.