feat: 가상화 문서들 추가
This commit is contained in:
DongHyeonka
+41
-40
@@ -1,8 +1,8 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="1080" height="416" viewBox="0 0 1080 416" role="img" aria-labelledby="diagram-title diagram-description">
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="1039" height="451" viewBox="0 0 1039 451" role="img" aria-labelledby="diagram-title diagram-description">
|
||||
<title id="diagram-title">AP4는 공개 edge에서 session을 정제된 upstream identity로 바꾼다</title>
|
||||
<desc id="diagram-description">왼쪽 외부 브라우저가 AP4_SESSION과 함께 AP4 deployment path의 공개 Nginx entry point를 호출한다. 같은 deployment path에서 Nginx는 host 비공개 oauth2-proxy의 internal /oauth2/auth endpoint에 subrequest를 보내 session을 검증하고 user와 email 결과를 받는다. 이어서 client가 보낸 동명 header를 덮어쓰고 Nginx-owned identity header와 internal token을 host 비공개 Spring upstream의 /edge/me로 전달한다. Upstream은 user header와 internal token을 함께 확인하며 JWT를 직접 입력으로 받지 않는다.</desc>
|
||||
<metadata>{"techviz":{"spec_version":"1.1","id":"ap4-edge-trust-architecture","profile":"two-zone-pipeline"},"source_context":{"document":"document.md","document_sha256":"df4d1a604c74e756672b5b40510abfedb8c67b39af280a5f51985ea9972f5371","anchor":{"kind":"marker","value":"ap4-edge-trust-architecture","line":182}},"evidence_policy":"Each factual element cites source lines or is marked assumption.","diagram_only":true}</metadata>
|
||||
<metadata>{"techviz":{"spec_version":"1.1","id":"ap4-edge-trust-architecture","profile":"component-flow"},"source_context":{"document":"document.md","document_sha256":"e2cc061f683294c937f089ad874cbf7a617f7313c07a92c2148fb11287a0da37","anchor":{"kind":"heading","value":"AP4: OAuth를 모르는 upstream 앞에서 신뢰 경로를 만든다","line":202}},"evidence_policy":"Each factual element cites source lines or is marked assumption.","diagram_only":true}</metadata>
|
||||
<defs>
|
||||
<marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
|
||||
<path d="M 0 0 L 10 5 L 0 10 z" />
|
||||
@@ -49,48 +49,49 @@
|
||||
.timeline-detail { font-size: 11px; fill: #4b5563; text-anchor: middle; }
|
||||
</style>
|
||||
</defs>
|
||||
<rect class="canvas" width="1080" height="416" />
|
||||
<rect class="group-box" x="45.0" y="49.0" width="250.0" height="156.0" rx="8" />
|
||||
<rect class="group-label-bg" x="59.0" y="39.0" width="134.0" height="22" />
|
||||
<text class="group-label" x="69.0" y="54.0">External browser</text>
|
||||
<rect class="group-box" x="565.0" y="49.0" width="470.0" height="322.0" rx="8" />
|
||||
<rect class="group-label-bg" x="579.0" y="39.0" width="155.0" height="22" />
|
||||
<text class="group-label" x="589.0" y="54.0">AP4 deployment path</text>
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="265.0,137.0 430.0,137.0 430.0,139.0 595.0,139.0" data-evidence="994-999" />
|
||||
<rect class="edge-label-bg" x="354.6" y="124.0" width="198.9" height="22" rx="3" />
|
||||
<text class="edge-label" x="454.0" y="139.0">GET /api/edge · AP4_SESSION</text>
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="785.0,148.0 690.0,148.0 690.0,292.5 595.0,292.5" data-evidence="922-928,1009-1009" />
|
||||
<rect class="edge-label-bg" x="597.8" y="206.2" width="232.4" height="22" rx="3" />
|
||||
<text class="edge-label" x="714.0" y="221.2">internal /oauth2/auth subrequest</text>
|
||||
<polyline class="edge kind-data style-solid emphasis-primary" points="785.0,130.0 815.0,130.0 815.0,59.0 785.0,59.0 785.0,156.0 815.0,156.0" data-evidence="1017-1026,1065-1078" />
|
||||
<rect class="edge-label-bg" x="654.0" y="17.0" width="265.9" height="22" rx="3" />
|
||||
<text class="edge-label" x="787.0" y="32.0">allowlisted identity + internal token</text>
|
||||
<rect class="canvas" width="1039" height="451" />
|
||||
<rect class="group-box" x="40.0" y="142.5" width="230.0" height="156.0" rx="8" />
|
||||
<rect class="group-label-bg" x="54.0" y="132.5" width="134.0" height="22" />
|
||||
<text class="group-label" x="64.0" y="147.5">External browser</text>
|
||||
<rect class="group-box" x="370.0" y="35.0" width="624.0" height="371.0" rx="8" />
|
||||
<rect class="group-label-bg" x="384.0" y="25.0" width="155.0" height="22" />
|
||||
<text class="group-label" x="394.0" y="40.0">AP4 deployment path</text>
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="240.0,230.5 320.0,230.5 320.0,230.5 400.0,230.5" data-evidence="1034-1039" />
|
||||
<rect class="edge-label-bg" x="274.1" y="188.5" width="91.7" height="22" rx="3" />
|
||||
<text class="edge-label" x="320.0" y="203.5">AP4_SESSION</text>
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="595.0,221.5 680.2,221.5 680.2,133.5 765.5,133.5" data-evidence="960-966,1049-1049" />
|
||||
<rect class="edge-label-bg" x="645.0" y="163.5" width="118.5" height="22" rx="3" />
|
||||
<text class="edge-label" x="704.2" y="178.5">auth subrequest</text>
|
||||
<polyline class="edge kind-data style-solid emphasis-primary" points="595.0,239.5 675.0,239.5 675.0,319.0 755.0,319.0" data-evidence="1057-1066,1105-1118" />
|
||||
<rect class="edge-label-bg" x="663.2" y="265.2" width="71.6" height="22" rx="3" />
|
||||
<text class="edge-label" x="699.0" y="280.2">identity</text>
|
||||
<g id="node-browser">
|
||||
<g class="actor-symbol emphasis-normal" data-evidence="980-999"><circle cx="170.0" cy="115.0" r="11.0" /><line x1="170.0" y1="131.0" x2="170.0" y2="150.0" /><line x1="152.0" y1="141.0" x2="188.0" y2="141.0" /><line x1="170.0" y1="150.0" x2="155.0" y2="167.0" /><line x1="170.0" y1="150.0" x2="185.0" y2="167.0" /></g>
|
||||
<text class="node-label" x="170.0" y="172.0">Browser</text>
|
||||
<g class="actor-symbol emphasis-normal" data-evidence="1018-1039"><circle cx="155.0" cy="208.5" r="11.0" /><line x1="155.0" y1="224.5" x2="155.0" y2="233.5" /><line x1="137.0" y1="234.5" x2="173.0" y2="234.5" /><line x1="155.0" y1="233.5" x2="140.0" y2="250.5" /><line x1="155.0" y1="233.5" x2="170.0" y2="250.5" /></g>
|
||||
<text class="node-label" x="155.0" y="265.5">Browser</text>
|
||||
</g>
|
||||
<g id="node-nginx">
|
||||
<rect class="node-shape kind-service emphasis-primary role-service" data-evidence="914-928,1009-1028" x="595.0" y="95.0" width="190.0" height="88.0" rx="7" />
|
||||
<text class="node-label" x="690.0" y="122.0">Nginx edge</text>
|
||||
<line class="node-detail-divider" x1="609.0" y1="143.0" x2="771.0" y2="143.0" />
|
||||
<text class="node-detail" x="611.0" y="160.0">auth_request</text>
|
||||
<text class="node-detail" x="611.0" y="176.0">client header overwrite</text>
|
||||
</g>
|
||||
<g id="node-spring-upstream">
|
||||
<rect class="node-shape kind-service emphasis-normal role-sink" data-evidence="1017-1037,1065-1078" x="815.0" y="95.0" width="190.0" height="122.0" rx="7" />
|
||||
<text class="node-label" x="910.0" y="122.0">Spring upstream</text>
|
||||
<line class="node-detail-divider" x1="829.0" y1="143.0" x2="991.0" y2="143.0" />
|
||||
<text class="node-detail" x="831.0" y="160.0">X-Auth-Request-User</text>
|
||||
<text class="node-detail" x="831.0" y="176.0">X-Auth-Request-Email</text>
|
||||
<text class="node-detail" x="831.0" y="192.0">X-Internal-Auth-Token</text>
|
||||
<text class="node-detail" x="831.0" y="208.0">/edge/me controller check</text>
|
||||
<rect class="node-shape kind-service emphasis-primary role-service" data-evidence="952-966,1049-1068" x="400.0" y="178.0" width="195.0" height="105.0" rx="7" />
|
||||
<text class="node-label" x="497.5" y="205.0">Nginx edge</text>
|
||||
<line class="node-detail-divider" x1="414.0" y1="226.0" x2="581.0" y2="226.0" />
|
||||
<text class="node-detail" x="416.0" y="243.0">/api/edge</text>
|
||||
<text class="node-detail" x="416.0" y="259.0">auth_request</text>
|
||||
<text class="node-detail" x="416.0" y="275.0">client header overwrite</text>
|
||||
</g>
|
||||
<g id="node-oauth2-proxy">
|
||||
<rect class="node-shape kind-service emphasis-normal role-service" data-evidence="940-990,1009-1014" x="595.0" y="240.0" width="190.0" height="105.0" rx="7" />
|
||||
<text class="node-label" x="690.0" y="267.0">oauth2-proxy</text>
|
||||
<line class="node-detail-divider" x1="609.0" y1="288.0" x2="771.0" y2="288.0" />
|
||||
<text class="node-detail" x="611.0" y="305.0">edge-proxy client</text>
|
||||
<text class="node-detail" x="611.0" y="321.0">minimal cookie session</text>
|
||||
<text class="node-detail" x="611.0" y="337.0">returns user · email</text>
|
||||
<rect class="node-shape kind-service emphasis-normal role-service" data-evidence="978-1028,1049-1054" x="765.5" y="81.0" width="188.0" height="105.0" rx="7" />
|
||||
<text class="node-label" x="859.5" y="108.0">oauth2-proxy</text>
|
||||
<line class="node-detail-divider" x1="779.5" y1="129.0" x2="939.5" y2="129.0" />
|
||||
<text class="node-detail" x="781.5" y="146.0">edge-proxy client</text>
|
||||
<text class="node-detail" x="781.5" y="162.0">minimal cookie session</text>
|
||||
<text class="node-detail" x="781.5" y="178.0">returns user · email</text>
|
||||
</g>
|
||||
<g id="node-spring-upstream">
|
||||
<rect class="node-shape kind-service emphasis-normal role-sink" data-evidence="1057-1077,1105-1118" x="755.0" y="258.0" width="209.0" height="122.0" rx="7" />
|
||||
<text class="node-label" x="859.5" y="285.0">Spring upstream</text>
|
||||
<line class="node-detail-divider" x1="769.0" y1="306.0" x2="950.0" y2="306.0" />
|
||||
<text class="node-detail" x="771.0" y="323.0">X-Auth-Request-User</text>
|
||||
<text class="node-detail" x="771.0" y="339.0">X-Auth-Request-Email</text>
|
||||
<text class="node-detail" x="771.0" y="355.0">X-Internal-Auth-Token</text>
|
||||
<text class="node-detail" x="771.0" y="371.0">/edge/me controller check</text>
|
||||
</g>
|
||||
</svg>
|
||||
|
||||
|
Before Width: | Height: | Size: 8.1 KiB After Width: | Height: | Size: 8.1 KiB |
Reference in New Issue
Block a user