refactor: 문서 개선 중
This commit is contained in:
donghyeon-ka
+8
-8
@@ -10,14 +10,14 @@
|
||||
|
||||
## Elements and evidence
|
||||
|
||||
- **Browser** (actor): AP2_SESSION을 사용하고 전달받은 access token으로 API를 직접 호출하는 주체. Evidence: L156–L160.
|
||||
- **Spring mediator** (service): Confidential OAuth client로 code를 교환하고 browser에 access-only 응답을 제공한다. Evidence: L156–L158.
|
||||
- **Authorized-client store** (database): Access와 refresh token을 server-side state로 보관한다. Evidence: L156–L160.
|
||||
- **Resource Server** (service): 브라우저가 만든 Bearer header를 직접 받으며 downstream audience를 검증하는 API. Evidence: L156–L160.
|
||||
- **Browser** (actor): AP2_SESSION을 사용하고 전달받은 access token으로 API를 직접 호출하는 주체. Evidence: L182–L186.
|
||||
- **Spring mediator** (service): Confidential OAuth client로 code를 교환하고 browser에 access-only 응답을 제공한다. Evidence: L182–L184.
|
||||
- **Authorized-client store** (database): Access와 refresh token을 server-side state로 보관한다. Evidence: L182–L186.
|
||||
- **Resource Server** (service): 브라우저가 만든 Bearer header를 직접 받으며 downstream audience를 검증하는 API. Evidence: L182–L186.
|
||||
|
||||
## Relationships
|
||||
|
||||
- **Browser → Resource Server:** Bearer header. Evidence: L158–L160.
|
||||
- **Browser → Spring mediator:** AP2_SESSION. Evidence: L158–L160.
|
||||
- **Spring mediator → Browser:** access_token · type · expiry. Evidence: L158–L158.
|
||||
- **Spring mediator → Authorized-client store:** 보관 · 조회. Evidence: L156–L160.
|
||||
- **Browser → Resource Server:** Bearer header. Evidence: L184–L186.
|
||||
- **Browser → Spring mediator:** AP2_SESSION. Evidence: L184–L186.
|
||||
- **Spring mediator → Browser:** access_token · type · expiry. Evidence: L184–L184.
|
||||
- **Spring mediator → Authorized-client store:** 보관 · 조회. Evidence: L182–L186.
|
||||
|
||||
+4
-4
@@ -5,16 +5,16 @@
|
||||
<root>
|
||||
<mxCell id="0"/>
|
||||
<mxCell id="1" parent="0"/>
|
||||
<mxCell id="n_browser" value="Browser<br/>HttpOnly AP2_SESSION<br/>access token in memory" tooltip="AP2_SESSION을 사용하고 전달받은 access token으로 API를 직접 호출하는 주체. | Evidence: L156-L160" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;dashed=1;fillColor=#f5f7fa;" vertex="1" parent="1">
|
||||
<mxCell id="n_browser" value="Browser<br/>HttpOnly AP2_SESSION<br/>access token in memory" tooltip="AP2_SESSION을 사용하고 전달받은 access token으로 API를 직접 호출하는 주체. | Evidence: L182-L186" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;dashed=1;fillColor=#f5f7fa;" vertex="1" parent="1">
|
||||
<mxGeometry x="70.0" y="128.0" width="170.0" height="88.0" as="geometry"/>
|
||||
</mxCell>
|
||||
<mxCell id="n_api-resource-server" value="Resource Server" tooltip="브라우저가 만든 Bearer header를 직접 받으며 downstream audience를 검증하는 API. | Evidence: L156-L160" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxCell id="n_api-resource-server" value="Resource Server" tooltip="브라우저가 만든 Bearer header를 직접 받으며 downstream audience를 검증하는 API. | Evidence: L182-L186" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxGeometry x="408.5" y="60.0" width="150.0" height="64.0" as="geometry"/>
|
||||
</mxCell>
|
||||
<mxCell id="n_mediator" value="Spring mediator<br/>oauth2Login<br/>confidential client" tooltip="Confidential OAuth client로 code를 교환하고 browser에 access-only 응답을 제공한다. | Evidence: L156-L158" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
|
||||
<mxCell id="n_mediator" value="Spring mediator<br/>oauth2Login<br/>confidential client" tooltip="Confidential OAuth client로 code를 교환하고 browser에 access-only 응답을 제공한다. | Evidence: L182-L184" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
|
||||
<mxGeometry x="400.0" y="196.0" width="167.0" height="88.0" as="geometry"/>
|
||||
</mxCell>
|
||||
<mxCell id="n_authorized-client-store" value="Authorized-client store<br/>access token<br/>refresh token" tooltip="Access와 refresh token을 server-side state로 보관한다. | Evidence: L156-L160" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxCell id="n_authorized-client-store" value="Authorized-client store<br/>access token<br/>refresh token" tooltip="Access와 refresh token을 server-side state로 보관한다. | Evidence: L182-L186" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxGeometry x="727.0" y="118.0" width="153.0" height="108.0" as="geometry"/>
|
||||
</mxCell>
|
||||
<mxCell id="e_browser-to-api" value="Bearer header" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_browser" target="n_api-resource-server">
|
||||
|
||||
+4
-4
@@ -2,22 +2,22 @@
|
||||
"harness_version": "0.2.0",
|
||||
"spec_id": "ap2-mediator-architecture",
|
||||
"spec_version": "1.1",
|
||||
"spec_sha256": "57354aea377e1c3f11e19fd03ccffba9df44f37b78a5fa69f8b2521705f8f6d7",
|
||||
"spec_sha256": "f2bd21d57d7feb8318d8b1c4f06c4cf708b2e8ca7be38b1ae36b851c62a280c1",
|
||||
"source_context": {
|
||||
"document": "document.md",
|
||||
"document_sha256": "df4d1a604c74e756672b5b40510abfedb8c67b39af280a5f51985ea9972f5371",
|
||||
"document_sha256": "15e7c79412ac05ed39d6f3d0c14de8dda92abe7b402139ac2a90492dfe5e162c",
|
||||
"anchor": {
|
||||
"kind": "marker",
|
||||
"value": "ap2-mediator-architecture",
|
||||
"line": 162
|
||||
"line": 188
|
||||
}
|
||||
},
|
||||
"outputs": [
|
||||
"ap2-mediator-architecture.svg",
|
||||
"ap2-mediator-architecture.drawio",
|
||||
"ap2-mediator-architecture.mmd",
|
||||
"ap2-mediator-architecture.d2",
|
||||
"ap2-mediator-architecture.dot",
|
||||
"ap2-mediator-architecture.drawio",
|
||||
"ap2-mediator-architecture.excalidraw",
|
||||
"ap2-mediator-architecture.alt.md"
|
||||
],
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="925" height="393" viewBox="0 0 925 393" role="img" aria-labelledby="diagram-title diagram-description">
|
||||
<title id="diagram-title">AP2는 refresh custody와 API caller를 서로 다른 경계에 둔다</title>
|
||||
<desc id="diagram-description">브라우저는 AP2_SESSION으로 confidential Spring mediator의 login state를 사용한다. Mediator는 code를 교환한 뒤 access와 refresh token을 server-side authorized-client service에 저장한다. 현재 access token의 값, type, expiry만 브라우저로 전달되고 refresh token은 server 경계에 남는다. 브라우저는 memory에 있는 access token으로 Resource Server용 Bearer header를 만든다.</desc>
|
||||
<metadata>{"techviz":{"spec_version":"1.1","id":"ap2-mediator-architecture","profile":"component-flow"},"source_context":{"document":"document.md","document_sha256":"df4d1a604c74e756672b5b40510abfedb8c67b39af280a5f51985ea9972f5371","anchor":{"kind":"marker","value":"ap2-mediator-architecture","line":162}},"evidence_policy":"Each factual element cites source lines or is marked assumption.","diagram_only":true}</metadata>
|
||||
<metadata>{"techviz":{"spec_version":"1.1","id":"ap2-mediator-architecture","profile":"component-flow"},"source_context":{"document":"document.md","document_sha256":"15e7c79412ac05ed39d6f3d0c14de8dda92abe7b402139ac2a90492dfe5e162c","anchor":{"kind":"marker","value":"ap2-mediator-architecture","line":188}},"evidence_policy":"Each factual element cites source lines or is marked assumption.","diagram_only":true}</metadata>
|
||||
<defs>
|
||||
<marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
|
||||
<path d="M 0 0 L 10 5 L 0 10 z" />
|
||||
@@ -50,35 +50,35 @@
|
||||
</style>
|
||||
</defs>
|
||||
<rect class="canvas" width="925" height="393" />
|
||||
<polyline class="edge kind-request style-solid emphasis-primary" points="240.0,154.0 324.2,154.0 324.2,92.0 408.5,92.0" data-evidence="158-160" />
|
||||
<polyline class="edge kind-request style-solid emphasis-primary" points="240.0,154.0 324.2,154.0 324.2,92.0 408.5,92.0" data-evidence="184-186" />
|
||||
<rect class="edge-label-bg" x="295.7" y="109.0" width="105.1" height="22" rx="3" />
|
||||
<text class="edge-label" x="348.2" y="124.0">Bearer header</text>
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="240.0,172.0 320.0,172.0 320.0,231.0 400.0,231.0" data-evidence="158-160" />
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="240.0,172.0 320.0,172.0 320.0,231.0 400.0,231.0" data-evidence="184-186" />
|
||||
<rect class="edge-label-bg" x="298.1" y="187.5" width="91.7" height="22" rx="3" />
|
||||
<text class="edge-label" x="344.0" y="202.5">AP2_SESSION</text>
|
||||
<polyline class="edge kind-response style-dashed emphasis-primary semantic-dashed" points="495.5,284.0 495.5,348.0 167.0,348.0 167.0,216.0" data-evidence="158-158" />
|
||||
<polyline class="edge kind-response style-dashed emphasis-primary semantic-dashed" points="495.5,284.0 495.5,348.0 167.0,348.0 167.0,216.0" data-evidence="184-184" />
|
||||
<rect class="edge-label-bg" x="194.4" y="362.0" width="205.6" height="22" rx="3" />
|
||||
<text class="edge-label" x="297.2" y="377.0">access_token · type · expiry</text>
|
||||
<polyline class="edge kind-data style-solid emphasis-normal" points="567.0,240.0 647.0,240.0 647.0,172.0 727.0,172.0" data-evidence="156-160" />
|
||||
<polyline class="edge kind-data style-solid emphasis-normal" points="567.0,240.0 647.0,240.0 647.0,172.0 727.0,172.0" data-evidence="182-186" />
|
||||
<rect class="edge-label-bg" x="638.5" y="192.0" width="64.9" height="22" rx="3" />
|
||||
<text class="edge-label" x="671.0" y="207.0">보관 · 조회</text>
|
||||
<g id="node-browser">
|
||||
<g class="actor-symbol emphasis-normal" data-evidence="156-160"><circle cx="155.0" cy="148.0" r="11.0" /><line x1="155.0" y1="164.0" x2="155.0" y2="177.0" /><line x1="137.0" y1="174.0" x2="173.0" y2="174.0" /><line x1="155.0" y1="177.0" x2="140.0" y2="194.0" /><line x1="155.0" y1="177.0" x2="170.0" y2="194.0" /></g>
|
||||
<g class="actor-symbol emphasis-normal" data-evidence="182-186"><circle cx="155.0" cy="148.0" r="11.0" /><line x1="155.0" y1="164.0" x2="155.0" y2="187.0" /><line x1="137.0" y1="174.0" x2="173.0" y2="174.0" /><line x1="155.0" y1="187.0" x2="140.0" y2="204.0" /><line x1="155.0" y1="187.0" x2="170.0" y2="204.0" /></g>
|
||||
<text class="node-label" x="155.0" y="209.0">Browser</text>
|
||||
</g>
|
||||
<g id="node-api-resource-server">
|
||||
<rect class="node-shape kind-service emphasis-normal role-sink" data-evidence="156-160" x="408.5" y="60.0" width="150.0" height="64.0" rx="7" />
|
||||
<rect class="node-shape kind-service emphasis-normal role-sink" data-evidence="182-186" x="408.5" y="60.0" width="150.0" height="64.0" rx="7" />
|
||||
<text class="node-label" x="483.5" y="90.0">Resource Server</text>
|
||||
</g>
|
||||
<g id="node-mediator">
|
||||
<rect class="node-shape kind-service emphasis-primary role-service" data-evidence="156-158" x="400.0" y="196.0" width="167.0" height="88.0" rx="7" />
|
||||
<rect class="node-shape kind-service emphasis-primary role-service" data-evidence="182-184" x="400.0" y="196.0" width="167.0" height="88.0" rx="7" />
|
||||
<text class="node-label" x="483.5" y="223.0">Spring mediator</text>
|
||||
<line class="node-detail-divider" x1="414.0" y1="244.0" x2="553.0" y2="244.0" />
|
||||
<text class="node-detail" x="416.0" y="261.0">oauth2Login</text>
|
||||
<text class="node-detail" x="416.0" y="277.0">confidential client</text>
|
||||
</g>
|
||||
<g id="node-authorized-client-store">
|
||||
<rect class="node-shape kind-database emphasis-normal role-store" data-evidence="156-160" x="727.0" y="118.0" width="153.0" height="108.0" rx="7" />
|
||||
<rect class="node-shape kind-database emphasis-normal role-store" data-evidence="182-186" x="727.0" y="118.0" width="153.0" height="108.0" rx="7" />
|
||||
<text class="node-label" x="803.5" y="145.0">Authorized-client</text>
|
||||
<text class="node-label" x="803.5" y="163.0">store</text>
|
||||
<line class="node-detail-divider" x1="741.0" y1="184.0" x2="866.0" y2="184.0" />
|
||||
|
||||
|
Before Width: | Height: | Size: 7.3 KiB After Width: | Height: | Size: 7.3 KiB |
Reference in New Issue
Block a user