session-authentication Specification

Purpose

Establish authenticated Oracle access before dependent data operations while preserving credential boundaries and profile restrictions.

Requirements

Requirement: Valid identity precedes dependent data requests

The extension SHALL obtain a successful current-user response containing a valid user identifier, name, roles array and token before starting dependent opportunity or activity data requests. Concurrent identity consumers SHALL share acquisition, and invalid responses SHALL retry with backoff.

Scenario: HTML is returned with HTTP 200

WHEN current-user acquisition receives a login document instead of the required JSON
THEN dependent data requests remain blocked and identity acquisition retries

Scenario: Identity is already established

WHEN the user changes Reference or reopens the main modal in the same page session
THEN the extension reuses the successful identity without another current-user HTTP request

Requirement: SPA recovery verifies the loaded session page

SPA session recovery SHALL open the configured bootstrap URL in an inactive auxiliary tab and verify page readiness before probing identity. Login forms, error documents and OAuth callbacks SHALL not count as a ready SPA page.

WHEN identity recovery requires a SPA session
THEN navigation starts at https://spa.oracle.com/oalcrm/web/api/g2m-consumer-application/ui/index.html?ojr=whitespace
AND the extension preserves the originating browser context and closes its owned auxiliary tab when recovery finishes

Scenario: Rejected callback document

WHEN recovery encounters an authorization-error callback
THEN it restarts from the configured bootstrap URL instead of replaying that callback as a successful session

Requirement: SR session preparation has independent progress

SR session preparation SHALL be able to run concurrently with SPA identity preparation, using the SeaaS external application URL. It SHALL expose completion or failure and allow a user retry after failure.

Scenario: SR preparation fails

WHEN preparation through https://comcipapic-oalprod.integration.ocp.oraclecloud.com/ic/builder/rt/SeaaS_initiation/live/webApps/external/ fails or reaches its 70-second timeout
THEN the extension offers retry rather than declaring the SR session ready

Requirement: SALES_REP activity access is restricted

For a user whose roles include SALES_REP, the extension SHALL hide CRM SR and Workload Action badges and Manage Time access, and SHALL not issue their dependent activity or Manage Time data requests.

Scenario: Restricted user after successful authentication

WHEN identity resolves with the SALES_REP role
THEN opportunities remain available but CRM activity badges and Manage Time are unavailable
AND attempting to open Manage Time does not load its data

Requirement: Credentials are specific to each Oracle service

The extension SHALL preserve operation-specific credentials and cookie inclusion. It SHALL use the general Token Relay Bearer for Fusion queries and the appropriate SPA consumer authorization for each SPA service rather than substituting token families.

Scenario: Customer SR authorization

WHEN customer service requests are loaded using SPA-ORANGE authorization
THEN the raw authorization value is sent in custsr-auth without a Bearer prefix

Scenario: Token Relay does not finish

WHEN a Token Relay request exceeds its request timeout
THEN the attempt reports failure instead of remaining indefinitely pending in Debug Requests

3.6 KiB Raw Permalink Blame History