Engineering / ENG-1498
Notices token for the portal's bell
Description
The bell reads a person's notices from notifier. The portal mustn't hold notifier's credentials.
Acceptance criteria
- identity-service gives the signed-in person a short-lived token (15 minutes) for notices only, scoped to that person and their client's region.
- notifier accepts nothing else on the notices endpoints, and refuses a token from another region.
- The portal renews it quietly while the person is signed in; signing out ends it.
Merged and deployed. Elif checked notifier refuses a UK token in the EU.