decision: HTTP OIDC admin surface unenforced against its declared Pro/Enterprise tiers

[mikemcdougall]

Problem

The 2026-07-22 local entitlement sweep (#2980) found that the entire OIDC identity surface carries zero LicenseGate/entitlement enforcement:

• OidcProviderEndpoints (/api/v1/admin/oidc/providers CRUD — list/create/get/update/delete/test) never calls LicenseGate.RequireEntitlement or IsEntitlementActive for identity.oidc (Pro), anywhere.
• InMemoryOidcProviderStore has no provider-count limit or edition check, so identity.oidc-multi-provider (Enterprise) is unrestricted — a Community deployment can configure any number of OIDC providers.
• There is no claims-mapping-specific gate anywhere, so identity.claims-mapping (Enterprise) is likewise unrestricted.
• OidcAuthenticationExtensions (the actual JWT bearer / OIDC authentication pipeline) has no entitlement check either — token validation itself runs regardless of edition.

This mirrors the #2978 SAML/SCIM finding (both previously shipped ungated) and the #2981 geocoding finding (declared-but-unenforced), but for the base single-provider OIDC entitlement itself — the one FeatureCatalog calls out explicitly as "no SSO tax for one provider," i.e. the Pro-tier baseline the whole Identity category is built around.

Why it matters now

Pre-release is the cheap moment to gate currently-free endpoints. Today a Community deployment gets full single- and multi-provider OIDC SSO, including claims mapping, for free — the same shape of leak #2978 fixed for SAML/SCIM.

Decision needed (release owner)

1. Gate as declared: add LicenseGate.RequireEntitlement checks to OidcProviderEndpoints (identity.oidc, Pro) and to provider-count / claims-mapping-field handling (identity.oidc-multi-provider / identity.claims-mapping, Enterprise), mirroring the fix: gate SAML (Pro) and SCIM (Enterprise) behind license entitlements #2978/fix: gate SAML and SCIM behind Enterprise entitlements (#2978) #2979 SAML/SCIM gate shape.
2. Re-tier as free: if single-provider OIDC is intended to stay ungated (unlikely given the "no SSO tax for one provider" framing implies a real gate exists above one provider), record that decision in ADR-0024 and move identity.oidc to Community explicitly.

Whichever way: tests in both directions once a decision lands (the local entitlement sweep, #2980, will enforce this key automatically — it currently carries this key as a documented, loud known-gap exception referencing this issue).

Acceptance criteria

• Decision recorded in ADR-0024 (or a successor note) and reflected in FeatureCatalog/CapabilityKeyCatalog/capability-keys.v1.json.
• Enforcement matches the decision on OidcProviderEndpoints and provider configuration (count + claims-mapping fields).
• Gate tests in both directions, mirroring IdentityEntitlementGateTests (SAML/SCIM).
• The identity.oidc / identity.oidc-multi-provider / identity.claims-mapping known-gap exceptions are deleted from the local entitlement sweep (test: local entitlement sweep — catalog-generated 402/200 matrix across all license-gated surfaces #2980) once enforcement lands.

Affected repos

honua-server. Cross-links: #2978 (SAML/SCIM, same shape, already fixed), #2981 (geocoding, same shape, decision pending), #2980 (local entitlement sweep that encodes this as a loud known-gap exception).

Non-goals

• OIDC provider/authentication feature work — enforcement only.
• SDK behavior.

[github-actions]

Capability key needed

This issue doesn't have a Capability Key(s) value yet. Adding one lets us tie the ticket to the cap/<category> label taxonomy and surface it in the capability evidence roadmap.

Comma-separate one or more keys, e.g. editing.feature-edits, geocoding.single-line. If you only know the general area, the category slug alone is fine (e.g. editing, serve-ogc).

Current categories: ai, alerts, analytics, caching, channels, collaboration, control-plane, demo, disaster-recovery, discovery, editing, enrichment, extensibility, field-ops, geocoding, identity, import, ops, printing, process, raster, routing, scene, serve, static-map, streaming, styling, temporal
(see docs/gis/data/capability-categories.seed.json).

This is advisory — no action is required to keep the issue open.