handleRegister called createAuthSession on every path, including an admin
creating someone else's account. That minted a live 7-day session for the
NEW user and returned its token to the admin. For a cookie caller it also
set that token as the admin's cookie, and since BUG-3011 that destroyed the
admin's own row. Nobody held the new session, because the new user signs in
on their own: it was an orphaned impersonation credential.
The admin-created path (no invitation, admin caller) now answers 201 with
the user only: no session, no cookie, and no token. The audit event and
autoCreateWorkspace run as before. Invitation and cloud self-serve signups
are the new user signing up and keep their session; tests pin both.
The UI symptom BUG-3232 was first filed for is unreachable: /register and
/join/[code] never post a register with a live session. Also removes the
dead cli.Client.Register, which had no callers.
Claude-Session: https://claude.ai/code/session_016PXRzXhokr61CLbbu3Txj9
xarmian
a537ba84e2