Parent

• WebUI epic: #29
• Architecture: #1
• Product epic: #6
• Depends on: SESSION-01 #20

Outcome

Freeze frontend-neutral WebUI, authentication, authorization, session, CSRF, upload-intent and API contracts before persistence or UI implementation.

Estimate

• 3 SP / 2 engineering days
• Risk: medium

Scope

• Define Telegram OIDC Authorization Code + PKCE start/callback/error contracts.
• Define external Telegram subject → internal user → tenant membership resolution.
• Define enrollment precedence: an existing Telegram binding, a one-time tenant invitation, or an explicitly audited development-operator bootstrap.
• Define one-time invitation digest, expiry, optional target-subject binding, membership role and atomic consumption.
• Allow successful OIDC to create/refresh an external identity record only; it must never create a tenant or membership without an explicit grant.
• Define a credential-safe CLI/admin procedure for initial cloud-dev operator membership that does not depend on Telegram webhook reachability or Terraform-managed application rows.
• Define first-party opaque session, rotation, expiry, revocation and membership-security-version behavior.
• Define tenant switching without treating browser tenant_id as authority.
• Define CSRF, Origin, cookie, CSP, log-redaction and audit requirements.
• Define frontend-neutral API schemas and consistent error envelopes.
• Define tenant-bound upload-intent and commit contracts.
• Add a focused threat model covering callback forgery, replay, fixation, tenant/session IDOR, CSRF, malicious uploads and secret leakage.
• Record the selected defaults in public English documentation.

Verification

• Contract tests cover expired/replayed state, invalid issuer/audience/nonce, unknown identity and revoked membership.
• Enrollment tests cover missing grant, expired/replayed invite, wrong bound subject, concurrent consumption and audited dev bootstrap.
• Authorization matrix includes two users, two tenants, multi-membership selection and suspended membership.
• API schema contains no endpoint that trusts a tenant claim without membership resolution.
• Threat-model mitigations map to executable tests in WEB-02/03/06.

Acceptance criteria

• Contracts are implementable without Telegram chat history or a Telegram message update.
• The first cloud-dev operator can receive an explicit audited membership without waiting for external Telegram ingress #17.
• The WebUI remains a projection over canonical sessions/events.
• No provider or Sessionless bearer token is stored in browser-accessible storage.
• The design has explicit compatibility points for future non-Telegram identity providers.

Non-goals

• Implementing the BFF or Svelte UI.
• Creating cloud resources.
• General RBAC administration or password authentication.