Oracle IDCS Org Provisioning

Use when login succeeds but tenant, role, or org membership still has to become real in Oracle.

Do NOT load when

• problem is Fastify header bridging or cookie/session forwarding
• problem is base OIDC setup, callback URLs, or trusted origins
• task is renaming IDCS concepts across an existing codebase

Three-stage flow

1. Capture IDCS claims during OAuth profile mapping (mapProfileToUser)
2. Gate session in session.create.before when explicit allow-rules exist
3. Resolve org and upsert org_members in session.create.after

NEVER