Single sign-on architecture

In production, auth cookies are set with a shared COOKIE_DOMAIN (".uamsatech.com"), so a session established on one subdomain is automatically valid on every other *.uamsatech.com subdomain — no redirect-based SSO handshake needed.

For a subdomain to check who's logged in, it calls GET /api/auth/me, which is CORS-enabled for allowed origins and returns the current session's user, active organization, and role.

{
  "authenticated": true,
  "user": { "id": "...", "name": "...", "email": "...", "emailVerified": true },
  "organizationId": "...",
  "role": "OWNER",
  "memberships": [{ "organizationId": "...", "name": "...", "role": "OWNER" }]
}