# Native accounts and browser return

User direction, 2026-09-13: all Oficina apps use the Eleven account model. Open
the most recent account; Back returns to saved accounts; adding an account keeps
existing sessions. Explicit Sign out revokes only the selected native session.
Store opaque credentials in per-app Keychain entries keyed by account UUID;
UserDefaults stores only display names, server origins and the most recent ID.
Migrate the existing origin-keyed credential only after its new entry is saved.
Account switches recreate workspace models so content cannot cross accounts.

Use ASWebAuthenticationSession for system browser authentication and normal
browser session sharing, allowing existing Home sessions when the server enables
Home. Each app registers works.oficina.<app> as its custom URL scheme. The server
accepts only the exact callback for its app; after explicit browser approval it
returns a random request ID, never a credential. Only the originating app's
verifier can exchange approval for a session. Reject foreign/stale callbacks.
Old servers may ignore callbacks; in-app polling still dismisses the authentication
session after a successful proof exchange. Cancellation invalidates pending work.

Sheets library: shape-only native thumbnail rows; top-right More menu for Import,
appearance and Sign out; native bottom search and New toolbar; Accounts back
button is disabled while edits or writes need completion. Editor-to-library Back
keeps the editor model alive, preserving existing draft protection.

Meet retains its existing meeting/invitation-bound Go sign-in protocol. Its verified
result is adopted through NativeConnection.rememberSession, which validates the
canonical origin and cookie format before saving. Its browser uses the same system
authentication presenter. Saved account sessions are reused only for meeting links
on the same origin; invitation redirects are resolved without forwarding cookies
to another origin. Adding another Meet account starts a new explicit browser proof.