[seonghobae]

Objective

Replace four parallel issue-#314 identity-foundation pull requests with one exact current-main candidate that binds provider-neutral verification, issuer/audience/algorithm policy, key-generation freshness, token time authority, and server-owned tenant/role mapping.

This PR advances issue #314 but does not implement JWT parsing/signature verification, OIDC discovery/JWK fetch, opaque-token introspection, controller routing, current HMAC migration, or production federation completion.

Exact candidate

• protected base and merge base: main@06633a25109c62e24a7015ae04fb9f6e0a246f7e;
• exact head: f6a8d8c4bb2523dafc17a562a9d86185089fa054;
• branch: feat/federated-identity-domain-foundation-current-main;
• compare: two commits ahead, zero behind;
• changed paths: exactly 12 newly added Java/test files;
• existing protected-main files changed or deleted: zero.

Preserved source authorities

The branch copies the exact production and focused-test blobs from the actual current heads of:

• feat(auth): define provider-neutral identity verifier contract #343 — IdentityVerifier, controlled failure, and IssuerTrustPolicy;
• feat(auth): define bounded federated token time window #374 — FederatedTokenTimeWindow;
• feat(auth): define generation-fenced identity key snapshot #375 — IdentityKeySnapshot;
• feat(auth): reconcile tenant role mapping after #343 #408 — TenantRoleMappingPolicy and its completed GREEN regression.

No stale stack ancestry, unrelated source change, historical check result, or generated repair artifact was imported.

Integrated authority regression

FederatedIdentityDomainFoundationTest proves a server-owned chain:

1. exact HTTPS issuer, audience, and explicit RS256 allowlist;
2. verifier-profile-bound key snapshot with exact generation and cache lifetime;
3. inclusive nbf, exclusive exp, and explicit bounded clock skew;
4. external roles mapped through immutable server policy into one fixed tenant;
5. unknown token role strings cannot become Clearfolio permissions;
6. the provider-neutral verifier returns only the verified immutable TenantContext.

Security invariants

• token-controlled claims cannot choose issuer endpoints or accepted algorithms;
• alg=none and case-ambiguous algorithm configuration fail closed;
• stale or expired key generations do not authorize token keys;
• raw bearer tokens, claims, provider responses, tenant IDs, and subject IDs do not enter controlled verification exceptions;
• token role strings never become application permissions directly;
• tenant authority is fixed by server-owned mapping policy.

Queue convergence

#343, #374, #375, and stacked #408 were closed as superseded by this one exact current-main implementation owner after their production/test blobs were preserved. Their former checks and reviews remain provenance only and do not count for this candidate.

Scope boundary

Issue #314 remains open for discovery/JWK destination policy, cryptographic JWT/access-token validation, issuer/audience/token-type enforcement, key rotation transport/cache recovery, role-mapping administration, service/user profile separation, controller integration, legacy-HMAC migration, and end-to-end cross-tenant concealment.

Verification boundary

The branch was constructed from exact Git blobs because the execution environment could not resolve github.com for a local clone. No local Maven result is claimed. Repository exact-head CI, Security Scan, SAST Semgrep, fuzz, coverage, Javadocs, review threads, and qualifying independent approval are authoritative.

Merge gate

Keep Draft until every exact-head required check is terminal-success and all valid findings are resolved. Move to Ready only after the combined identity test and full repository acceptance pass. Merge or auto-merge only after a qualifying independent non-author approval covers the unchanged exact head and ordinary protection accepts it. Any head or base movement invalidates prior evidence.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ce7356fc-79d3-44d8-8ad8-a4c9a8a12a71

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}