The landing page's Sign in opened a modal whose entire content was a
single "Sign in with PedsHub SSO" link. That is a step that exists to be
clicked through.
Every sign-in control on the page — the header, the hero, the closing
call to action — now goes straight to /api/auth/sso/login when the site
is SSO-only. The modal is still built and still opens on a site that has
a password door, which is the only thing it was ever for.
/login is deliberately left as it is. It renders the one button rather
than redirecting, because it is also where the provider sends somebody
back when sign-in fails — ?error=sso_failed — and a page that redirected
on sight would bounce them into the provider again, forever.
Verified live: one click from the landing page lands on
sso.pedshub.com's flow with the client id, callback, scope, state and
nonce, and no modal is rendered on the way.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TqXevQJhxFrM7jJg82cgZN
a8cc0c40df