The acceptance criteria promised sign-in with any configured provider under
third-party cookie blocking, which OAuth as built cannot satisfy: the callback
runs in a popup, a top-level context of its own, so the cookie it sets is keyed
to the auth host and the frame embedded on the other domain is a different
partition that never sees it. The criteria now name email, Telegram and
anonymous, and OAuth carries its own paragraph explaining why it is out and what
would bring it in, which is the server-mediated one-time code the constraints
below already describe.
Two claims went stale alongside it. Master meets the criterion today with
AUTH_SEND_JWT_HEADER on, because fetcher.ts writes the cookie from inside the
frame and the token never travels as a third-party cookie, so the remaining gap
for those flows is documentation and not code. The server-set cookies still lack
Partitioned, but nothing depends on them surviving in a third-party frame any
more, so the upstream work they were waiting on buys no flow that does not
already work.
Dmitry Verkhoturov
33e93a427d