[Bccorb]

Adapter support for the magic link verification change in seamless-auth-api 0.19.0.

Changes

• GET /magic-link/verify/{token} forwards the requesting device's pre-auth token when one is available: the client's bearer token in bearer transport, or the pre-auth cookie's token in cookie transport, only when the cookie verifies. Without one it sends no Authorization and does not answer 401; the auth API then falls back to the client IP and user agent forwarded with the service token.
• This is special-cased by method and path. No new credential name is added to the known set, because older releases refuse a manifest that uses one.
• manifest.json synced from the seamless-auth-api fix branch with scripts/sync-manifest.sh <path> (a local copy of its adapter-manifest.json, since the fix is not on the API's public main yet). It adds POST /magic-link/verify/{token}/confirm (credential none). The synced file says apiVersion: 0.18.0; the API stamps the version at release, so a re-sync from the API's main after 0.19.0 ships will only change that field.
• 409 confirmation_required bodies already pass through verbatim; a test now pins that requestedFrom survives.
• A GET /magic-link/check answering { "message": "Success" } with no tokens sets no cookies (test added; no code change needed).
• README: new "Magic links" section.

Files

• src/routes.rs
• src/tests/magic_link.rs (new), src/tests/mod.rs
• manifest.json
• README.md

Checks

This private fork runs no Actions, so the local output is below.

$ cargo fmt --check
ok
$ cargo clippy --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.09s
$ cargo clippy --all-targets --no-default-features -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.04s
$ cargo clippy --all-targets --no-default-features --features native-tls -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.05s
$ cargo test
test tests::magic_link::a_check_without_tokens_sets_no_cookies ... ok
test tests::magic_link::confirm_is_proxied_without_a_credential ... ok
test tests::magic_link::confirmation_required_passes_through ... ok
test tests::magic_link::verify_forwards_the_client_bearer ... ok
test tests::magic_link::verify_forwards_a_valid_pre_auth_cookie_as_bearer ... ok
test tests::magic_link::verify_without_a_usable_pre_auth_sends_no_authorization ... ok
test result: ok. 63 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
$ cargo +1.88 test
test result: ok. 63 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Release order

Part of the v0.19 security release (fells-code/seamless-auth-api#385), reviewed in a private fork. Compatible with the current auth API: the forwarded pre-auth credential and the confirm route are only used by API 0.19.0.