Optionalemail: stringOptionalfirstName: stringOptionallastName: stringOptionalrequestDomain: stringthe hostname parsed from the request's Origin header. Not used for any
authorization decision — it is spoofable on non-browser requests, and new-user domain
authorization runs against the verified JWT's email domain instead. Retained for audit
logging and for the recursive retry call.
OptionaldataSource: ConnectionPool
Resolves a verified identity to an MJ
UserInfo, optionally auto-provisioning a new user.