Go evaluates call arguments left to right, so the two subtests minted the
frontend session before the administrator created the link request. Across a
second boundary (a loaded host) the confirm correctly answered 409
stale_session, because the sign-in predated the request.
- BackendLinkConfirm reads the session's auth_time (bouncer.VerifyAuthTime);
a token without it, or a refreshed old session, answers 409 stale_session
- POST /_user/api/v1/backend-link/show takes the code in the body; GET
/backend-link/{code} stays, deprecated; both answer Cache-Control no-store
- My account answers <frontend_url><page_path>#code=<code>; new key
golem15.user.backend_links.page_path (default /link-admin)
- TestBackendLink now crafts auth_time tokens; TestBackendLinkAuthTimeSmoke
- TestBackendLink: the fresh sign-in rule at the second, 1:1 on the
frontend side, the show route's three keys, SetLink and RemoveLink events
(none after a rollback), deactivated or deleted administrators, and
deactivating the frontend user
- TestFrontendPermissionCatalog: a second plugin's duplicate and an empty
code dropped; a group saved with a declared code grants it
- TestUserMCPGuard: parser refusals, a soft-deleted user, an expired token,
and the dispatch credential against the route's own user.scope:read
