feat(authz): carry authMobile through SSO registration and invite flows

openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/SsoInvitationAcceptRequest.java

@@ -15,4 +15,6 @@ public class SsoInvitationAcceptRequest {
     private String provider;
     private Boolean switchTenant;
     private String redirectTo;
+    /** Mobile-app flow: forwarded to {@code /oauth/continue} — see {@link SsoTenantRegistrationInitRequest#isAuthMobile()}. */
+    private boolean authMobile;
 }

openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/SsoTenantRegistrationInitRequest.java

@@ -38,6 +38,13 @@ public class SsoTenantRegistrationInitRequest {
     // Optional final redirect target (absolute or allowed host)
     private String redirectTo;
 
+    /**
+     * Mobile-app flow: forwarded to the BFF {@code /oauth/continue} after finalization so the
+     * callback attaches the one-time ticket the app exchanges for tokens (same contract as
+     * {@code /oauth/login?authMobile=true}).
+     */
+    private boolean authMobile;
+
     private RegistrationAttribution attribution;
 }
 

openframe-authorization-service-core/src/main/java/com/openframe/authz/security/SsoInviteCookiePayload.java

@@ -6,6 +6,7 @@ public record SsoInviteCookiePayload(
         Boolean switchTenant,
         String provider,
         String redirectTo,
+        boolean authMobile,
         long iat,
         long exp
 ) implements SsoCookiePayload {

openframe-authorization-service-core/src/main/java/com/openframe/authz/security/SsoTenantRegCookiePayload.java

@@ -8,6 +8,7 @@ public record SsoTenantRegCookiePayload(
         String tenantDomain,
         String provider,
         String redirectTo,
+        boolean authMobile,
         String accessCode,
         RegistrationAttribution attribution,
         long iat,

openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/InviteSsoHandler.java

@@ -60,7 +60,7 @@ public void handle(HttpServletRequest request, HttpServletResponse response, Aut
         String targetTenantId = userCreated.getTenantId();
 
         // Clear SSO flow cookie but KEEP session to allow OAuth continue
-        clearFlowCookieAndRedirect(response, cookie, targetTenantId, payload.redirectTo());
+        clearFlowCookieAndRedirect(response, cookie, targetTenantId, payload.redirectTo(), payload.authMobile());
     }
 
 }

openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/SsoFlowHandler.java

@@ -91,13 +91,17 @@ default String[] resolveNames(HttpServletRequest request, Authentication authent
     default void clearFlowCookieAndRedirect(HttpServletResponse response,
                                             Cookie flowCookie,
                                             String tenantId,
-                                            String redirectTo) {
+                                            String redirectTo,
+                                            boolean authMobile) {
         clearCookie(response, flowCookie.getName());
         String path = "/oauth/continue?tenantId=" +
                 encode(tenantId, UTF_8);
         if (hasText(redirectTo)) {
             path += "&redirectTo=" + encode(redirectTo, UTF_8);
         }
+        if (authMobile) {
+            path += "&authMobile=true";
+        }
         foundAtRoot(response, path);
     }
 }

openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/TenantRegSsoHandler.java

@@ -70,7 +70,7 @@ public void handle(HttpServletRequest request, HttpServletResponse response, Aut
 
         var tenant = registrationService.registerTenant(reg);
 
-        clearFlowCookieAndRedirect(response, cookie, tenant.getId(), payload.redirectTo());
+        clearFlowCookieAndRedirect(response, cookie, tenant.getId(), payload.redirectTo(), payload.authMobile());
     }
 
 }

openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SsoInvitationService.java

@@ -36,6 +36,7 @@ public SsoAuthorizeData startAccept(SsoInvitationAcceptRequest request) {
                 request.getSwitchTenant(),
                 provider,
                 request.getRedirectTo(),
+                request.isAuthMobile(),
                 now,
                 now + COOKIE_TTL_SECONDS
         );

openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SsoTenantRegistrationService.java

@@ -77,6 +77,7 @@ private SsoTenantRegCookiePayload buildCookiePayload(SsoTenantRegistrationInitRe
                 request.getTenantDomain(),
                 provider,
                 request.getRedirectTo(),
+                request.isAuthMobile(),
                 request.getAccessCode(),
                 boundedAttribution(request.getAttribution()),
                 issuedAt,