schema_version: 1
decision:
  id: external-identity-provider
  title: Sign in through an identity provider, never store passwords
  status: accepted
  date: 2026-09-10
  elements: [idp, api, spa]
  diagrams: [0200-containers/web-app.archify]
context: >
  The first version kept password hashes in the database and
  had to handle resets, lockouts and two-factor codes itself.
decision: >
  Users sign in through an OpenID Connect identity provider.
  The single-page app gets a token; the API only verifies it.
consequences: >
  No password tables, no reset flows. The identity provider
  is a hard dependency: when it is down, nobody can sign in.