feat: 문서 구조 변경 및 tech-visual 스킬 추가
This commit is contained in:
DongHyeonka
@@ -0,0 +1,559 @@
|
||||
# Evidence and decision provenance
|
||||
|
||||
> This is an internal sidecar. It is not reader-facing article content.
|
||||
> Source IDs, repository paths, line ranges, status labels, and access dates belong here—not in `document.md`.
|
||||
|
||||
- Document: **브라우저 토큰에서 엣지 세션까지: Keycloak 인증 패턴 네 가지의 경계 설계**
|
||||
- Citation rendering: `hidden`
|
||||
- Evidence sources: **48**
|
||||
|
||||
## Section evidence map
|
||||
|
||||
| Section | Decision contract | Evidence | Status / location |
|
||||
|---|---|---|---|
|
||||
| 코드보다 먼저 드러난 문제 | — | `L4121b8d86b` four pattern tradeoff matrix — Four Keycloak integration patterns | `unspecified` · docs/four-pattern-tradeoff-matrix.md — Four Keycloak integration patterns (lines 1-14) |
|
||||
| ↳ | — | `AP1_BOUNDARY` AP1 SPA direct의 OAuth·token 책임 경계 | `reviewed` · docs/internal-spa-direct-no-google.md — AP1 internal SPA direct: local identity profile (lines 3-10) |
|
||||
| ↳ | — | `AP2_BOUNDARY` AP2 confidential token mediator의 책임 경계 | `reviewed` · docs/ap2-token-boundary.md — 책임 경계 (lines 3-18) |
|
||||
| ↳ | — | `AP3_BOUNDARY` AP3 BFF의 tokenless browser 경계 | `reviewed` · docs/ap3-bff-boundary.md — 요청과 token 경계 (lines 3-18) |
|
||||
| ↳ | — | `AP4_BOUNDARY` AP4 oauth2-proxy와 nginx edge 책임 경계 | `reviewed` · docs/ap4-edge-forward-auth.md — AP4 oauth2-proxy Edge Forward Auth (lines 3-70) |
|
||||
| 문제를 어렵게 만든 제약 | — | `L4121b8d86b` four pattern tradeoff matrix — Four Keycloak integration patterns | `unspecified` · docs/four-pattern-tradeoff-matrix.md — Four Keycloak integration patterns (lines 1-14) |
|
||||
| ↳ | — | `AP1_STORAGE` AP1 token 저장 선택과 수용 비용 | `reviewed` · docs/ap1-token-storage.md — AP1 token storage trade-off (lines 3-29) |
|
||||
| ↳ | — | `AP2_GUARDRAILS` AP2 session, refresh custody, CORS와 audience 가드레일 | `reviewed` · token-mediator/src/main/resources/application.yml — AP2 session and OAuth client configuration (lines 3-34) |
|
||||
| ↳ | — | `AP3_TRADEOFF` AP3와 AP1의 위협 모델·운영비 교환 | `reviewed` · docs/bff-vs-spa-direct.md — BFF vs SPA direct (lines 3-22) |
|
||||
| ↳ | — | `AP4_BOUNDARY` AP4 oauth2-proxy와 nginx edge 책임 경계 | `reviewed` · docs/ap4-edge-forward-auth.md — AP4 oauth2-proxy Edge Forward Auth (lines 3-70) |
|
||||
| ↳ | — | `AP4_RESPONSE_RUNTIME` AP4 trusted header input에서 edge identity JSON까지 | `reviewed` · backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java — currentUser and hasValidInternalToken (lines 27-53) |
|
||||
| 검토한 선택지와 막힌 지점 | 상황·제약, 선택, 선택 이유, 검토한 대안, 수용한 비용, 보완 가드레일 | `L4121b8d86b` four pattern tradeoff matrix — Four Keycloak integration patterns | `unspecified` · docs/four-pattern-tradeoff-matrix.md — Four Keycloak integration patterns (lines 1-14) |
|
||||
| ↳ | — | `AP1_BOUNDARY` AP1 SPA direct의 OAuth·token 책임 경계 | `reviewed` · docs/internal-spa-direct-no-google.md — AP1 internal SPA direct: local identity profile (lines 3-10) |
|
||||
| ↳ | — | `AP1_STORAGE` AP1 token 저장 선택과 수용 비용 | `reviewed` · docs/ap1-token-storage.md — AP1 token storage trade-off (lines 3-29) |
|
||||
| ↳ | — | `AP2_BOUNDARY` AP2 confidential token mediator의 책임 경계 | `reviewed` · docs/ap2-token-boundary.md — 책임 경계 (lines 3-18) |
|
||||
| ↳ | — | `AP2_IMPLEMENTATION` AP2 access-only handoff의 실제 구현 | `reviewed-discrepancy` · token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java — accessToken (lines 28-55) |
|
||||
| ↳ | — | `AP3_BOUNDARY` AP3 BFF의 tokenless browser 경계 | `reviewed` · docs/ap3-bff-boundary.md — 요청과 token 경계 (lines 3-18) |
|
||||
| ↳ | — | `AP3_TRADEOFF` AP3와 AP1의 위협 모델·운영비 교환 | `reviewed` · docs/bff-vs-spa-direct.md — BFF vs SPA direct (lines 3-22) |
|
||||
| ↳ | — | `AP4_BOUNDARY` AP4 oauth2-proxy와 nginx edge 책임 경계 | `reviewed` · docs/ap4-edge-forward-auth.md — AP4 oauth2-proxy Edge Forward Auth (lines 3-70) |
|
||||
| ↳ | — | `AP4_ALTERNATIVE` AP4 Traefik ForwardAuth 대안과 추가 비용 | `config-tested` · docs/traefik-forwardauth-alternative.md — Traefik ForwardAuth alternative (lines 3-22) |
|
||||
| 선택의 이유와 지킨 경계 | 상황·제약, 선택, 선택 이유, 검토한 대안, 수용한 비용, 보완 가드레일 | `AP1_BOUNDARY` AP1 SPA direct의 OAuth·token 책임 경계 | `reviewed` · docs/internal-spa-direct-no-google.md — AP1 internal SPA direct: local identity profile (lines 3-10) |
|
||||
| ↳ | — | `AP1_STORAGE` AP1 token 저장 선택과 수용 비용 | `reviewed` · docs/ap1-token-storage.md — AP1 token storage trade-off (lines 3-29) |
|
||||
| ↳ | — | `AP2_BOUNDARY` AP2 confidential token mediator의 책임 경계 | `reviewed` · docs/ap2-token-boundary.md — 책임 경계 (lines 3-18) |
|
||||
| ↳ | — | `AP3_BOUNDARY` AP3 BFF의 tokenless browser 경계 | `reviewed` · docs/ap3-bff-boundary.md — 요청과 token 경계 (lines 3-18) |
|
||||
| ↳ | — | `AP3_TRADEOFF` AP3와 AP1의 위협 모델·운영비 교환 | `reviewed` · docs/bff-vs-spa-direct.md — BFF vs SPA direct (lines 3-22) |
|
||||
| ↳ | — | `AP4_BOUNDARY` AP4 oauth2-proxy와 nginx edge 책임 경계 | `reviewed` · docs/ap4-edge-forward-auth.md — AP4 oauth2-proxy Edge Forward Auth (lines 3-70) |
|
||||
| ↳ | — | `AP4_ALTERNATIVE` AP4 Traefik ForwardAuth 대안과 추가 비용 | `config-tested` · docs/traefik-forwardauth-alternative.md — Traefik ForwardAuth alternative (lines 3-22) |
|
||||
| 선택이 코드와 흐름에 반영되는 방식 | — | `AP1_LOGIN_RUNTIME` AP1 SPA authorization, callback와 browser token data flow | `reviewed` · frontend/src/app.js — UserManager configuration, callback, and renderSession (lines 9-81) |
|
||||
| ↳ | — | `AP1_PKCE_DEMO_GAP` AP1 manual PKCE helper와 실제 signin path의 구분 | `reviewed-gap` · frontend/src/pkce.js — createPkcePair (lines 1-25) |
|
||||
| ↳ | — | `AP1_API_RUNTIME` AP1 browser Bearer input에서 /api/me JSON까지 | `reviewed` · frontend/src/app.js — callProtectedApi (lines 83-109) |
|
||||
| ↳ | — | `AP1_ROLE_FAILURE_RUNTIME` AP1 JWT failure와 realm role authorization 경계 | `reviewed-gap` · backend/src/main/java/com/example/keycloakpattern/KeycloakRealmRoleConverter.java — convert (lines 12-27) |
|
||||
| ↳ | — | `AP2_LOGIN_FLOW` AP2 browser entry와 Spring oauth2Login code 교환 | `reviewed` · token-mediator/src/main/resources/static/app.js — loginButton click and OAuth client registration (lines 7-9) |
|
||||
| ↳ | — | `AP2_BOUNDARY_RUNTIME` AP2 token boundary endpoint input과 output | `reviewed` · token-mediator/src/main/java/com/example/keycloakpattern/mediator/TokenBoundaryController.java — tokenBoundary (lines 25-42) |
|
||||
| ↳ | — | `AP2_ACCESS_RUNTIME` AP2 access handoff와 browser direct API의 data transformation | `reviewed` · token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java — accessToken (lines 28-54) |
|
||||
| ↳ | — | `AP2_RESOURCE_RUNTIME` AP2 Resource Server의 JWT input과 /api/me output | `reviewed` · backend/src/main/java/com/example/keycloakpattern/ApiController.java — currentUser (lines 21-28) |
|
||||
| ↳ | — | `AP3_LOGIN_FLOW` AP3 oauth2Login과 server-side PKCE data flow | `reviewed` · bff/src/main/java/com/example/keycloakpattern/bff/SecurityConfig.java — authorizationRequestResolver and bffSecurity (lines 20-58) |
|
||||
| ↳ | — | `AP3_BOUNDARY_RUNTIME` AP3 token boundary endpoint의 input과 관측 output | `reviewed` · bff/src/main/java/com/example/keycloakpattern/bff/BffController.java — tokenBoundary (lines 44-64) |
|
||||
| ↳ | — | `AP3_API_RUNTIME` AP3 session input에서 downstream Bearer와 reader JSON까지 | `reviewed` · bff/src/main/java/com/example/keycloakpattern/bff/BffController.java — currentUser and authorizedClient (lines 67-111) |
|
||||
| ↳ | — | `AP3_CSRF_RUNTIME` AP3 CSRF cookie-to-header transformation과 preferences output | `reviewed` · bff/src/main/java/com/example/keycloakpattern/bff/CsrfController.java — csrf (lines 14-23) |
|
||||
| ↳ | — | `AP3_PREFERENCE_SCOPE` AP3 preferences 예시의 process-global state 간극 | `reviewed-gap` · bff/src/main/java/com/example/keycloakpattern/bff/BffController.java — preferenceTheme and updatePreferences (lines 28-95) |
|
||||
| ↳ | — | `AP4_LOGIN_RUNTIME` AP4 unauthenticated navigation에서 oauth2-proxy session까지 | `reviewed` · docker-compose.yml — oauth2-proxy service (lines 92-143) |
|
||||
| ↳ | — | `AP4_REQUEST_RUNTIME` AP4 external request에서 auth subrequest와 upstream input까지 | `reviewed` · frontend/default.conf.template — auth_request and upstream mapping (lines 13-74) |
|
||||
| ↳ | — | `AP4_RESPONSE_RUNTIME` AP4 trusted header input에서 edge identity JSON까지 | `reviewed` · backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java — currentUser and hasValidInternalToken (lines 27-53) |
|
||||
| 결정이 지켜지는지 확인하는 방법 | — | `AP1_VERIFY` AP1 브라우저 흐름과 token 수명주기 검증 계약 | `test-defined` · e2e/pattern1.mjs — AP1 Playwright acceptance contract (lines 82-202) |
|
||||
| ↳ | — | `AP1_ROLE_FAILURE_RUNTIME` AP1 JWT failure와 realm role authorization 경계 | `reviewed-gap` · backend/src/main/java/com/example/keycloakpattern/KeycloakRealmRoleConverter.java — convert (lines 12-27) |
|
||||
| ↳ | — | `AP2_VERIFY` AP2 access-only 전달과 브라우저 직접 API 호출 검증 계약 | `test-defined` · e2e/pattern2.mjs — AP2 Playwright acceptance contract (lines 39-112) |
|
||||
| ↳ | — | `AP2_ACCESS_RUNTIME` AP2 access handoff와 browser direct API의 data transformation | `reviewed` · token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java — accessToken (lines 28-54) |
|
||||
| ↳ | — | `AP3_VERIFY` AP3 browser token 비노출과 CSRF 방어 검증 계약 | `test-defined` · e2e/pattern3.mjs — AP3 Playwright acceptance contract (lines 43-191) |
|
||||
| ↳ | — | `AP3_CSRF_RUNTIME` AP3 CSRF cookie-to-header transformation과 preferences output | `reviewed` · bff/src/main/java/com/example/keycloakpattern/bff/CsrfController.java — csrf (lines 14-23) |
|
||||
| ↳ | — | `AP4_VERIFY` AP4 edge login과 header spoofing 방어 검증 계약 | `test-defined` · e2e/pattern4.mjs — AP4 Playwright acceptance contract (lines 44-131) |
|
||||
| ↳ | — | `AP4_RESPONSE_RUNTIME` AP4 trusted header input에서 edge identity JSON까지 | `reviewed` · backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java — currentUser and hasValidInternalToken (lines 27-53) |
|
||||
| ↳ | — | `BRANCH_REACHABILITY` 네 pattern branch와 39개 feature ref의 도달성 | `partially-verified` · docs/keycloak-branch-manifest.tsv — branch target delivery registry (lines 1-40) |
|
||||
| 얻은 것, 잃은 것, 적용하지 않을 때 | 상황·제약, 선택, 선택 이유, 검토한 대안, 수용한 비용, 보완 가드레일 | `L4121b8d86b` four pattern tradeoff matrix — Four Keycloak integration patterns | `unspecified` · docs/four-pattern-tradeoff-matrix.md — Four Keycloak integration patterns (lines 1-14) |
|
||||
| ↳ | — | `AP1_STORAGE` AP1 token 저장 선택과 수용 비용 | `reviewed` · docs/ap1-token-storage.md — AP1 token storage trade-off (lines 3-29) |
|
||||
| ↳ | — | `AP2_GUARDRAILS` AP2 session, refresh custody, CORS와 audience 가드레일 | `reviewed` · token-mediator/src/main/resources/application.yml — AP2 session and OAuth client configuration (lines 3-34) |
|
||||
| ↳ | — | `AP3_TRADEOFF` AP3와 AP1의 위협 모델·운영비 교환 | `reviewed` · docs/bff-vs-spa-direct.md — BFF vs SPA direct (lines 3-22) |
|
||||
| ↳ | — | `AP3_PREFERENCE_SCOPE` AP3 preferences 예시의 process-global state 간극 | `reviewed-gap` · bff/src/main/java/com/example/keycloakpattern/bff/BffController.java — preferenceTheme and updatePreferences (lines 28-95) |
|
||||
| ↳ | — | `AP4_BOUNDARY` AP4 oauth2-proxy와 nginx edge 책임 경계 | `reviewed` · docs/ap4-edge-forward-auth.md — AP4 oauth2-proxy Edge Forward Auth (lines 3-70) |
|
||||
| ↳ | — | `AP4_ALTERNATIVE` AP4 Traefik ForwardAuth 대안과 추가 비용 | `config-tested` · docs/traefik-forwardauth-alternative.md — Traefik ForwardAuth alternative (lines 3-22) |
|
||||
| 결국 지키려던 것은 무엇이었나 | — | `L4121b8d86b` four pattern tradeoff matrix — Four Keycloak integration patterns | `unspecified` · docs/four-pattern-tradeoff-matrix.md — Four Keycloak integration patterns (lines 1-14) |
|
||||
| ↳ | — | `AP1_BOUNDARY` AP1 SPA direct의 OAuth·token 책임 경계 | `reviewed` · docs/internal-spa-direct-no-google.md — AP1 internal SPA direct: local identity profile (lines 3-10) |
|
||||
| ↳ | — | `AP2_BOUNDARY` AP2 confidential token mediator의 책임 경계 | `reviewed` · docs/ap2-token-boundary.md — 책임 경계 (lines 3-18) |
|
||||
| ↳ | — | `AP3_BOUNDARY` AP3 BFF의 tokenless browser 경계 | `reviewed` · docs/ap3-bff-boundary.md — 요청과 token 경계 (lines 3-18) |
|
||||
| ↳ | — | `AP4_BOUNDARY` AP4 oauth2-proxy와 nginx edge 책임 경계 | `reviewed` · docs/ap4-edge-forward-auth.md — AP4 oauth2-proxy Edge Forward Auth (lines 3-70) |
|
||||
|
||||
## Source details
|
||||
|
||||
### `AP1_BOUNDARY` AP1 SPA direct의 OAuth·token 책임 경계
|
||||
|
||||
- Type: `branch-note`
|
||||
- Status: `reviewed`
|
||||
- Location: `docs/internal-spa-direct-no-google.md — AP1 internal SPA direct: local identity profile (lines 3-10)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern1/docs/internal-spa-direct-no-google.md`
|
||||
- Claim IDs: `AP1-C1`
|
||||
- Decision IDs: `AP1-D1`
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP1_STORAGE` AP1 token 저장 선택과 수용 비용
|
||||
|
||||
- Type: `branch-note`
|
||||
- Status: `reviewed`
|
||||
- Location: `docs/ap1-token-storage.md — AP1 token storage trade-off (lines 3-29)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern1/docs/ap1-token-storage.md`
|
||||
- Claim IDs: `AP1-C2`
|
||||
- Decision IDs: `AP1-D2`
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP1_LOGIN_RUNTIME` AP1 SPA authorization, callback와 browser token data flow
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `frontend/src/app.js — UserManager configuration, callback, and renderSession (lines 9-81)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern1/frontend/src/app.js`
|
||||
- Claim IDs: `AP1-C4`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP1_PKCE_DEMO_GAP` AP1 manual PKCE helper와 실제 signin path의 구분
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed-gap`
|
||||
- Location: `frontend/src/pkce.js — createPkcePair (lines 1-25)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern1/frontend/src/pkce.js`
|
||||
- Claim IDs: `AP1-C5`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `85.0000`
|
||||
|
||||
### `AP1_API_RUNTIME` AP1 browser Bearer input에서 /api/me JSON까지
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `frontend/src/app.js — callProtectedApi (lines 83-109)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern1/frontend/src/app.js`
|
||||
- Claim IDs: `AP1-C6`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP1_ROLE_FAILURE_RUNTIME` AP1 JWT failure와 realm role authorization 경계
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed-gap`
|
||||
- Location: `backend/src/main/java/com/example/keycloakpattern/KeycloakRealmRoleConverter.java — convert (lines 12-27)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern1/backend/src/main/java/com/example/keycloakpattern/KeycloakRealmRoleConverter.java`
|
||||
- Claim IDs: `AP1-C7`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `90.0000`
|
||||
|
||||
### `AP1_GUARDRAILS` AP1 public client와 Resource Server 가드레일
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `keycloak/import/keycloak-patterns-realm.json — spa-public client and realm token settings (lines 11-73)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern1/keycloak/import/keycloak-patterns-realm.json`
|
||||
- Claim IDs: `AP1-C3`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `85.0000`
|
||||
|
||||
### `AP1_VERIFY` AP1 브라우저 흐름과 token 수명주기 검증 계약
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `test-defined`
|
||||
- Location: `e2e/pattern1.mjs — AP1 Playwright acceptance contract (lines 82-202)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern1/e2e/pattern1.mjs`
|
||||
- Claim IDs: `AP1-T1`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `80.0000`
|
||||
|
||||
### `AP2_BOUNDARY` AP2 confidential token mediator의 책임 경계
|
||||
|
||||
- Type: `branch-note`
|
||||
- Status: `reviewed`
|
||||
- Location: `docs/ap2-token-boundary.md — 책임 경계 (lines 3-18)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern2/docs/ap2-token-boundary.md`
|
||||
- Claim IDs: `AP2-C1`
|
||||
- Decision IDs: `AP2-D1`
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP2_IMPLEMENTATION` AP2 access-only handoff의 실제 구현
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed-discrepancy`
|
||||
- Location: `token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java — accessToken (lines 28-55)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java`
|
||||
- Claim IDs: `AP2-C2`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP2_LOGIN_FLOW` AP2 browser entry와 Spring oauth2Login code 교환
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `token-mediator/src/main/resources/static/app.js — loginButton click and OAuth client registration (lines 7-9)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/resources/static/app.js`
|
||||
- Claim IDs: `AP2-C4`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `90.0000`
|
||||
|
||||
### `AP2_BOUNDARY_RUNTIME` AP2 token boundary endpoint input과 output
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `token-mediator/src/main/java/com/example/keycloakpattern/mediator/TokenBoundaryController.java — tokenBoundary (lines 25-42)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/java/com/example/keycloakpattern/mediator/TokenBoundaryController.java`
|
||||
- Claim IDs: `AP2-C5`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `95.0000`
|
||||
|
||||
### `AP2_ACCESS_RUNTIME` AP2 access handoff와 browser direct API의 data transformation
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java — accessToken (lines 28-54)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java`
|
||||
- Claim IDs: `AP2-C6`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP2_RESOURCE_RUNTIME` AP2 Resource Server의 JWT input과 /api/me output
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `backend/src/main/java/com/example/keycloakpattern/ApiController.java — currentUser (lines 21-28)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern2/backend/src/main/java/com/example/keycloakpattern/ApiController.java`
|
||||
- Claim IDs: `AP2-C7`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `95.0000`
|
||||
|
||||
### `AP2_GUARDRAILS` AP2 session, refresh custody, CORS와 audience 가드레일
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `token-mediator/src/main/resources/application.yml — AP2 session and OAuth client configuration (lines 3-34)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/resources/application.yml`
|
||||
- Claim IDs: `AP2-C3`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `85.0000`
|
||||
|
||||
### `AP2_VERIFY` AP2 access-only 전달과 브라우저 직접 API 호출 검증 계약
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `test-defined`
|
||||
- Location: `e2e/pattern2.mjs — AP2 Playwright acceptance contract (lines 39-112)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern2/e2e/pattern2.mjs`
|
||||
- Claim IDs: `AP2-T1`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `80.0000`
|
||||
|
||||
### `AP3_BOUNDARY` AP3 BFF의 tokenless browser 경계
|
||||
|
||||
- Type: `branch-note`
|
||||
- Status: `reviewed`
|
||||
- Location: `docs/ap3-bff-boundary.md — 요청과 token 경계 (lines 3-18)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern3/docs/ap3-bff-boundary.md`
|
||||
- Claim IDs: `AP3-C1`
|
||||
- Decision IDs: `AP3-D1`
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP3_TRADEOFF` AP3와 AP1의 위협 모델·운영비 교환
|
||||
|
||||
- Type: `branch-note`
|
||||
- Status: `reviewed`
|
||||
- Location: `docs/bff-vs-spa-direct.md — BFF vs SPA direct (lines 3-22)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern3/docs/bff-vs-spa-direct.md`
|
||||
- Claim IDs: `AP3-C2`
|
||||
- Decision IDs: `AP3-D2`
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP3_GUARDRAILS` AP3 CSRF token과 SameSite 가드레일
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `bff/src/main/java/com/example/keycloakpattern/bff/SecurityConfig.java — bffSecurity (lines 25-58)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/SecurityConfig.java`
|
||||
- Claim IDs: `AP3-C3`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `85.0000`
|
||||
|
||||
### `AP3_LOGIN_FLOW` AP3 oauth2Login과 server-side PKCE data flow
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `bff/src/main/java/com/example/keycloakpattern/bff/SecurityConfig.java — authorizationRequestResolver and bffSecurity (lines 20-58)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/SecurityConfig.java`
|
||||
- Claim IDs: `AP3-C4`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `95.0000`
|
||||
|
||||
### `AP3_BOUNDARY_RUNTIME` AP3 token boundary endpoint의 input과 관측 output
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `bff/src/main/java/com/example/keycloakpattern/bff/BffController.java — tokenBoundary (lines 44-64)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/BffController.java`
|
||||
- Claim IDs: `AP3-C5`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `95.0000`
|
||||
|
||||
### `AP3_API_RUNTIME` AP3 session input에서 downstream Bearer와 reader JSON까지
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `bff/src/main/java/com/example/keycloakpattern/bff/BffController.java — currentUser and authorizedClient (lines 67-111)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/BffController.java`
|
||||
- Claim IDs: `AP3-C6`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP3_CSRF_RUNTIME` AP3 CSRF cookie-to-header transformation과 preferences output
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `bff/src/main/java/com/example/keycloakpattern/bff/CsrfController.java — csrf (lines 14-23)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/CsrfController.java`
|
||||
- Claim IDs: `AP3-C7`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP3_PREFERENCE_SCOPE` AP3 preferences 예시의 process-global state 간극
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed-gap`
|
||||
- Location: `bff/src/main/java/com/example/keycloakpattern/bff/BffController.java — preferenceTheme and updatePreferences (lines 28-95)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/BffController.java`
|
||||
- Claim IDs: `AP3-C8`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `90.0000`
|
||||
|
||||
### `AP3_VERIFY` AP3 browser token 비노출과 CSRF 방어 검증 계약
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `test-defined`
|
||||
- Location: `e2e/pattern3.mjs — AP3 Playwright acceptance contract (lines 43-191)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern3/e2e/pattern3.mjs`
|
||||
- Claim IDs: `AP3-T1`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `80.0000`
|
||||
|
||||
### `AP4_BOUNDARY` AP4 oauth2-proxy와 nginx edge 책임 경계
|
||||
|
||||
- Type: `branch-note`
|
||||
- Status: `reviewed`
|
||||
- Location: `docs/ap4-edge-forward-auth.md — AP4 oauth2-proxy Edge Forward Auth (lines 3-70)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern4/docs/ap4-edge-forward-auth.md`
|
||||
- Claim IDs: `AP4-C1`
|
||||
- Decision IDs: `AP4-D1`
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP4_NGINX` AP4 auth_request와 identity header 덮어쓰기
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `frontend/default.conf.template — nginx AP4 server configuration (lines 13-74)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern4/frontend/default.conf.template`
|
||||
- Claim IDs: `AP4-C2`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `90.0000`
|
||||
|
||||
### `AP4_LOGIN_RUNTIME` AP4 unauthenticated navigation에서 oauth2-proxy session까지
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `docker-compose.yml — oauth2-proxy service (lines 92-143)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern4/docker-compose.yml`
|
||||
- Claim IDs: `AP4-C5`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP4_REQUEST_RUNTIME` AP4 external request에서 auth subrequest와 upstream input까지
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `frontend/default.conf.template — auth_request and upstream mapping (lines 13-74)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern4/frontend/default.conf.template`
|
||||
- Claim IDs: `AP4-C6`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP4_RESPONSE_RUNTIME` AP4 trusted header input에서 edge identity JSON까지
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java — currentUser and hasValidInternalToken (lines 27-53)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern4/backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java`
|
||||
- Claim IDs: `AP4-C7`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `100.0000`
|
||||
|
||||
### `AP4_BACKEND` AP4 upstream의 내부 token 검증
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `reviewed`
|
||||
- Location: `backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java — currentUser and hasValidInternalToken (lines 18-53)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern4/backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java`
|
||||
- Claim IDs: `AP4-C3`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `85.0000`
|
||||
|
||||
### `AP4_VERIFY` AP4 edge login과 header spoofing 방어 검증 계약
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `test-defined`
|
||||
- Location: `e2e/pattern4.mjs — AP4 Playwright acceptance contract (lines 44-131)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern4/e2e/pattern4.mjs`
|
||||
- Claim IDs: `AP4-T1`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `80.0000`
|
||||
|
||||
### `AP4_ALTERNATIVE` AP4 Traefik ForwardAuth 대안과 추가 비용
|
||||
|
||||
- Type: `branch-note`
|
||||
- Status: `config-tested`
|
||||
- Location: `docs/traefik-forwardauth-alternative.md — Traefik ForwardAuth alternative (lines 3-22)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop-keycloak-pattern4/docs/traefik-forwardauth-alternative.md`
|
||||
- Claim IDs: `AP4-C4`
|
||||
- Decision IDs: `AP4-D2`
|
||||
- Retrieval priority: `85.0000`
|
||||
|
||||
### `BRANCH_REACHABILITY` 네 pattern branch와 39개 feature ref의 도달성
|
||||
|
||||
- Type: `canonical-project`
|
||||
- Status: `partially-verified`
|
||||
- Location: `docs/keycloak-branch-manifest.tsv — branch target delivery registry (lines 1-40)`
|
||||
- Public/reference URL: `repo://keycloak-pattern/develop/docs/keycloak-branch-manifest.tsv`
|
||||
- Claim IDs: `COMMON-T1`
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `70.0000`
|
||||
|
||||
### `L4121b8d86b` four pattern tradeoff matrix — Four Keycloak integration patterns
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/four-pattern-tradeoff-matrix.md — Four Keycloak integration patterns (lines 1-14)`
|
||||
- Public/reference URL: `repo:///docs/four-pattern-tradeoff-matrix.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `45.7404`
|
||||
|
||||
### `La5d0a70f24` four pattern tradeoff matrix — 이 repository의 실행 증거
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/four-pattern-tradeoff-matrix.md — 이 repository의 실행 증거 (lines 28-37)`
|
||||
- Public/reference URL: `repo:///docs/four-pattern-tradeoff-matrix.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `21.7129`
|
||||
|
||||
### `L2c120c8093` four pattern tradeoff matrix — 선택 기준
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/four-pattern-tradeoff-matrix.md — 선택 기준 (lines 15-27)`
|
||||
- Public/reference URL: `repo:///docs/four-pattern-tradeoff-matrix.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `17.2810`
|
||||
|
||||
### `L4ec23ba045` keycloak branch index — Keycloak branch implementation index
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/keycloak-branch-index.md — Keycloak branch implementation index (lines 1-29)`
|
||||
- Public/reference URL: `repo:///docs/keycloak-branch-index.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `14.8301`
|
||||
|
||||
### `Lb39734ea9b` google idp brokering — Google IdP brokering
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/google-idp-brokering.md — Google IdP brokering (lines 1-5)`
|
||||
- Public/reference URL: `repo:///docs/google-idp-brokering.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `5.8515`
|
||||
|
||||
### `La28755902d` google claim to role — Google claim-to-role mapping
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/google-claim-to-role.md — Google claim-to-role mapping (lines 1-18)`
|
||||
- Public/reference URL: `repo:///docs/google-claim-to-role.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `4.7503`
|
||||
|
||||
### `Le8474e5ddd` https termination — HTTPS termination: nginx or Caddy
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/https-termination.md — HTTPS termination: nginx or Caddy (lines 1-20)`
|
||||
- Public/reference URL: `repo:///docs/https-termination.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `2.6850`
|
||||
|
||||
### `L0eb117abf5` google redirect uri policy — Google redirect URI policy
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/google-redirect-uri-policy.md — Google redirect URI policy (lines 1-24)`
|
||||
- Public/reference URL: `repo:///docs/google-redirect-uri-policy.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `2.5149`
|
||||
|
||||
### `L5d2c3b8016` reverse proxy headers — Reverse proxy headers
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/reverse-proxy-headers.md — Reverse proxy headers (lines 1-15)`
|
||||
- Public/reference URL: `repo:///docs/reverse-proxy-headers.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `1.8170`
|
||||
|
||||
### `L03b6abccb3` google claim mapping — Google claim and identity mapping
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/google-claim-mapping.md — Google claim and identity mapping (lines 1-23)`
|
||||
- Public/reference URL: `repo:///docs/google-claim-mapping.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `1.5038`
|
||||
|
||||
### `L0217277f31` account linking sub vs email — Federated account key: `sub`, not email
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/account-linking-sub-vs-email.md — Federated account key: `sub`, not email (lines 1-18)`
|
||||
- Public/reference URL: `repo:///docs/account-linking-sub-vs-email.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `1.4977`
|
||||
|
||||
### `L4a3b756b3d` google idp brokering — Two verification profiles
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/google-idp-brokering.md — Two verification profiles (lines 6-28)`
|
||||
- Public/reference URL: `repo:///docs/google-idp-brokering.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `1.0205`
|
||||
|
||||
### `Le9a41ffd86` public domain tunneling — Public HTTPS domain for broker callbacks
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/public-domain-tunneling.md — Public HTTPS domain for broker callbacks (lines 1-21)`
|
||||
- Public/reference URL: `repo:///docs/public-domain-tunneling.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `0.7299`
|
||||
|
||||
### `L55212df816` first broker login security — First Broker Login security
|
||||
|
||||
- Type: `local-document`
|
||||
- Status: `unspecified`
|
||||
- Location: `docs/first-broker-login-security.md — First Broker Login security (lines 1-27)`
|
||||
- Public/reference URL: `repo:///docs/first-broker-login-security.md`
|
||||
- Claim IDs: —
|
||||
- Decision IDs: —
|
||||
- Retrieval priority: `0.0881`
|
||||
Reference in New Issue
Block a user