Implemented OpenSpec and created and updated its artifacts

openspec/changes/archive/2026-10-31-document-project-baseline/specs/session-authentication/spec.md

@@ -0,0 +1,54 @@
+## Purpose
+
+Establish authenticated Oracle access before dependent data operations while preserving credential boundaries and profile restrictions.
+
+## ADDED Requirements
+
+### Requirement: Valid identity precedes dependent data requests
+The extension SHALL obtain a successful current-user response containing a valid user identifier, name, roles array and token before starting dependent opportunity or activity data requests. Concurrent identity consumers SHALL share acquisition, and invalid responses SHALL retry with backoff.
+
+#### Scenario: HTML is returned with HTTP 200
+- **WHEN** current-user acquisition receives a login document instead of the required JSON
+- **THEN** dependent data requests remain blocked and identity acquisition retries
+
+#### Scenario: Identity is already established
+- **WHEN** the user changes Reference or reopens the main modal in the same page session
+- **THEN** the extension reuses the successful identity without another current-user HTTP request
+
+### Requirement: SPA recovery verifies the loaded session page
+SPA session recovery SHALL open the configured bootstrap URL in an inactive auxiliary tab and verify page readiness before probing identity. Login forms, error documents and OAuth callbacks SHALL not count as a ready SPA page.
+
+#### Scenario: Recovery navigation
+- **WHEN** identity recovery requires a SPA session
+- **THEN** navigation starts at `https://spa.oracle.com/oalcrm/web/api/g2m-consumer-application/ui/index.html?ojr=whitespace`
+- **AND** the extension preserves the originating browser context and closes its owned auxiliary tab when recovery finishes
+
+#### Scenario: Rejected callback document
+- **WHEN** recovery encounters an authorization-error callback
+- **THEN** it restarts from the configured bootstrap URL instead of replaying that callback as a successful session
+
+### Requirement: SR session preparation has independent progress
+SR session preparation SHALL be able to run concurrently with SPA identity preparation, using the SeaaS external application URL. It SHALL expose completion or failure and allow a user retry after failure.
+
+#### Scenario: SR preparation fails
+- **WHEN** preparation through `https://comcipapic-oalprod.integration.ocp.oraclecloud.com/ic/builder/rt/SeaaS_initiation/live/webApps/external/` fails or reaches its 70-second timeout
+- **THEN** the extension offers retry rather than declaring the SR session ready
+
+### Requirement: SALES_REP activity access is restricted
+For a user whose roles include `SALES_REP`, the extension SHALL hide CRM SR and Workload Action badges and Manage Time access, and SHALL not issue their dependent activity or Manage Time data requests.
+
+#### Scenario: Restricted user after successful authentication
+- **WHEN** identity resolves with the `SALES_REP` role
+- **THEN** opportunities remain available but CRM activity badges and Manage Time are unavailable
+- **AND** attempting to open Manage Time does not load its data
+
+### Requirement: Credentials are specific to each Oracle service
+The extension SHALL preserve operation-specific credentials and cookie inclusion. It SHALL use the general Token Relay Bearer for Fusion queries and the appropriate SPA consumer authorization for each SPA service rather than substituting token families.
+
+#### Scenario: Customer SR authorization
+- **WHEN** customer service requests are loaded using SPA-ORANGE authorization
+- **THEN** the raw authorization value is sent in `custsr-auth` without a Bearer prefix
+
+#### Scenario: Token Relay does not finish
+- **WHEN** a Token Relay request exceeds its request timeout
+- **THEN** the attempt reports failure instead of remaining indefinitely pending in Debug Requests