> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.ruoomsoftware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> Cross-business SSO token and OAuth pipeline architecture

## Core integration

The wheel installs `plugins.single_sign_on`. Plugin metadata mounts it at `/sso/`, registers its one-time-token path as public, and appends `plugins.single_sign_on.middleware.sso.SSOMiddleware` to Core middleware.

## Model and flow

`DisposableAuthenticationToken` stores a token that links an authenticated user/profile to a target business and expires according to `SSO_TOKEN_TTL_SECONDS`.

1. `/sso/redirect/<business_id>/` creates or selects a cross-business destination.
2. A one-time token is issued for the transition.
3. `/sso/one-time/<token>/` checks the token, expiry, user/profile, and target business.
4. The token is consumed and the user is signed into the target context.
5. The role-specific redirect setting determines the final destination.

The optional Google OAuth pipeline creates or resolves a temporary user, then `SSOMiddleware` moves eligible temporary profiles into the appropriate Ruoom business flow.

## Routes

* `/sso/redirect/<business_id>/`: initiate a business-to-business redirect (`single_sign_on:sso_redirect`).
* `/sso/one-time/<token>/`: consume a UUID authentication token (`single_sign_on:one_time_token_auth`).