Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- When a user chooses 'Sign in with RODMENA ID', the Highway API shall run an authorization_code+PKCE(S256) flow against https://identity.rodmena.co.uk (discovery-driven), with exact redirect URI https://highway.rodmena.app/api/v1/auth/oidc/callback.
- When the ID token is received, the API shall verify it against the published JWKS (RS256, iss/aud/nonce/exp) with an independent JOSE lib, extract the verified email claim, and map it to Highway tenants via the existing RBAC path (get_user_accessible_tenants) exactly as the Google flow does.
- While Identity integration is being validated, the existing Google OAuth flow shall remain available and unchanged (additive opt-in, not a replacement).
- If offline_access refresh tokens are used, then the API shall persist the ROTATED refresh token on every refresh in exactly one place (identity revokes the whole family on reuse of a superseded token).
- When silent re-auth is needed, the flow shall use a top-level redirect bounce, never a hidden iframe (cross-registrable-domain cookies are blocked in iframes).
- When the integration is verified end-to-end against production identity (login, tenant mapping, logout, refresh rotation), Highway shall send a verify-result to identity thread thr-b8bd08bdce3e4121916d.
Origin: identity offer 01KYVWTW218FFSK187BFA1T4SM; their discovery endpoint verified live by us (authorization_code+refresh_token, PKCE S256 only).

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #840