docs(rfc): rfc 0029 — oidc bearer layer (issuer-agnostic, dex-validated), drafted

[jensholdgaard]

Drafts RFC 0029: OIDC JWT verification as a second credential kind on every RFC 0026 gate — standard iss/aud/exp/JWKS validation, a configured claim → tenant mapping resolving onto the unchanged (name, tenants) enforcement, additive to static tokens. Issuer-agnostic by construction; Dex (CNCF) is the blessed lightweight deployment and the real-container CI target (the RFC 0019 testcontainers pattern). Discharges RFC 0026 §7.1 (rotation) and §7.2 (IdP layering); machine senders ride the OTel Collector oauth2client extension → Dex client-credentials/token-exchange. OpenFGA is recorded as the adopt-if for future fine-grained authz (§4) — a different question, behind an already-clean seam, not needed while the model is a flat tenant allow-list. §5 lands at the specified gate per the lifecycle.

Also updates epic #331's remainder to point here.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@jensholdgaard, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 5 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4005518a-230d-43db-ac38-1ac2a54489be

📥 Commits

Reviewing files that changed from the base of the PR and between 6fc8859 and 241bd56.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• docs/SUMMARY.md
• docs/rfcs/0029-oidc-bearer-layer.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch rfc0029-drafted

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Drafts RFC 0029 to define an issuer-agnostic OIDC/JWT bearer-token verification layer (Dex as the reference issuer for CI), additive to RFC 0026’s existing static-token authentication model, and updates mdBook navigation to include the new RFC.

Changes:

• Add RFC 0029 document describing OIDC JWT verification, claim→tenant mapping, and Dex-based acceptance strategy.
• Add RFC 0029 to the docs SUMMARY navigation.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
docs/SUMMARY.md	Adds RFC 0029 to the mdBook table of contents.
docs/rfcs/0029-oidc-bearer-layer.md	Introduces drafted RFC 0029 describing OIDC bearer auth layering over RFC 0026 gates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.