mrhid6andClaude Opus 5
d703bbc4e8
users is unique on (instance_id, email) now, so an unscoped FindOne could return an arbitrary one of several matching users. On the login path that means signing someone into a tenant that is not theirs. GetUserByEmail is deleted rather than left unused. Local sign-in resolves its instance from the host, falling back to the single instance a self-hosted deployment has, and refuses to guess otherwise. The OIDC cross-instance guard goes: a scoped lookup cannot return another instance's user, which is a stronger guarantee than the check it replaces. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>