How Harmonia uses it
Cognito authorization-code login uses PKCE and nonce validation. Server sessions bind the verified subject to workspace membership and role. The application has no development identity bypass. Google Drive and Calendar permissions are connected separately and never inferred from login.Implementation
src/lib/cognito.ts