refactor: 문서 개선 중
This commit is contained in:
donghyeon-ka
+10
-10
@@ -10,16 +10,16 @@
|
||||
|
||||
## Elements and evidence
|
||||
|
||||
- **브라우저** (participant): AP2_SESSION으로 access endpoint를 호출하고 반환된 access token으로 Resource Server를 직접 호출한다. Evidence: L505–L511, L558–L586.
|
||||
- **Spring mediator** (participant): 현재 principal로 authorized client를 조회하고 access token, type, expiry만 JSON으로 반환한다. Evidence: L503–L540.
|
||||
- **Authorized-client store** (participant): Registration과 principal name으로 access token과 refresh token을 보관하는 process-local service. Evidence: L445–L457, L513–L521.
|
||||
- **Resource Server** (participant): 브라우저가 만든 Bearer JWT를 검증하고 /api/me 사용자 JSON을 반환한다. Evidence: L571–L599.
|
||||
- **브라우저** (participant): AP2_SESSION으로 access endpoint를 호출하고 반환된 access token으로 Resource Server를 직접 호출한다. Evidence: L539–L545, L592–L620.
|
||||
- **Spring mediator** (participant): 현재 principal로 authorized client를 조회하고 access token, type, expiry만 JSON으로 반환한다. Evidence: L537–L574.
|
||||
- **Authorized-client store** (participant): Registration과 principal name으로 access token과 refresh token을 보관하는 process-local service. Evidence: L479–L491, L547–L555.
|
||||
- **Resource Server** (participant): 브라우저가 만든 Bearer JWT를 검증하고 /api/me 사용자 JSON을 반환한다. Evidence: L605–L633.
|
||||
|
||||
## Relationships
|
||||
|
||||
- **브라우저 → Spring mediator:** GET /token/access + AP2_SESSION. Evidence: L503–L511.
|
||||
- **Spring mediator → Authorized-client store:** authorize current principal. Evidence: L513–L521.
|
||||
- **Authorized-client store → Spring mediator:** current access token. Evidence: L513–L521.
|
||||
- **Spring mediator → 브라우저:** access token + type + expiry. Evidence: L523–L540.
|
||||
- **브라우저 → Resource Server:** GET /api/me · browser-created Bearer. Evidence: L558–L588.
|
||||
- **Resource Server → 브라우저:** subject · username · issuer · audience. Evidence: L590–L615.
|
||||
- **브라우저 → Spring mediator:** GET /token/access + AP2_SESSION. Evidence: L537–L545.
|
||||
- **Spring mediator → Authorized-client store:** authorize current principal. Evidence: L547–L555.
|
||||
- **Authorized-client store → Spring mediator:** current access token. Evidence: L547–L555.
|
||||
- **Spring mediator → 브라우저:** access token + type + expiry. Evidence: L557–L574.
|
||||
- **브라우저 → Resource Server:** GET /api/me · browser-created Bearer. Evidence: L592–L622.
|
||||
- **Resource Server → 브라우저:** subject · username · issuer · audience. Evidence: L624–L649.
|
||||
|
||||
+4
-4
@@ -5,16 +5,16 @@
|
||||
<root>
|
||||
<mxCell id="0"/>
|
||||
<mxCell id="1" parent="0"/>
|
||||
<mxCell id="n_browser" value="브라우저" tooltip="AP2_SESSION으로 access endpoint를 호출하고 반환된 access token으로 Resource Server를 직접 호출한다. | Evidence: L505-L511, L558-L586" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxCell id="n_browser" value="브라우저" tooltip="AP2_SESSION으로 access endpoint를 호출하고 반환된 access token으로 Resource Server를 직접 호출한다. | Evidence: L539-L545, L592-L620" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxGeometry x="45.0" y="35.0" width="150.0" height="64.0" as="geometry"/>
|
||||
</mxCell>
|
||||
<mxCell id="n_mediator" value="Spring mediator" tooltip="현재 principal로 authorized client를 조회하고 access token, type, expiry만 JSON으로 반환한다. | Evidence: L503-L540" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
|
||||
<mxCell id="n_mediator" value="Spring mediator" tooltip="현재 principal로 authorized client를 조회하고 access token, type, expiry만 JSON으로 반환한다. | Evidence: L537-L574" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
|
||||
<mxGeometry x="255.0" y="35.0" width="150.0" height="64.0" as="geometry"/>
|
||||
</mxCell>
|
||||
<mxCell id="n_authorized-client-store" value="Authorized-client store" tooltip="Registration과 principal name으로 access token과 refresh token을 보관하는 process-local service. | Evidence: L445-L457, L513-L521" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxCell id="n_authorized-client-store" value="Authorized-client store" tooltip="Registration과 principal name으로 access token과 refresh token을 보관하는 process-local service. | Evidence: L479-L491, L547-L555" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxGeometry x="465.0" y="35.0" width="153.0" height="74.0" as="geometry"/>
|
||||
</mxCell>
|
||||
<mxCell id="n_resource-server" value="Resource Server" tooltip="브라우저가 만든 Bearer JWT를 검증하고 /api/me 사용자 JSON을 반환한다. | Evidence: L571-L599" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxCell id="n_resource-server" value="Resource Server" tooltip="브라우저가 만든 Bearer JWT를 검증하고 /api/me 사용자 JSON을 반환한다. | Evidence: L605-L633" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxGeometry x="675.0" y="35.0" width="150.0" height="64.0" as="geometry"/>
|
||||
</mxCell>
|
||||
<mxCell id="e_session-request" value="GET /token/access + AP2_SESSION" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_browser" target="n_mediator">
|
||||
|
||||
+4
-4
@@ -2,22 +2,22 @@
|
||||
"harness_version": "0.2.0",
|
||||
"spec_id": "ap2-mediator-handoff-flow",
|
||||
"spec_version": "1.1",
|
||||
"spec_sha256": "b129ffe1dee64fe9ee2f29d59ad47472ae9fe9511c92f3199fa053ba0c3b2c3f",
|
||||
"spec_sha256": "01ceea7a8441554faea1b520c5af568878d6dbcc091fda3aae8a2dcd15e2a48d",
|
||||
"source_context": {
|
||||
"document": "document.md",
|
||||
"document_sha256": "df4d1a604c74e756672b5b40510abfedb8c67b39af280a5f51985ea9972f5371",
|
||||
"document_sha256": "15e7c79412ac05ed39d6f3d0c14de8dda92abe7b402139ac2a90492dfe5e162c",
|
||||
"anchor": {
|
||||
"kind": "marker",
|
||||
"value": "ap2-mediator-handoff-flow",
|
||||
"line": 645
|
||||
"line": 679
|
||||
}
|
||||
},
|
||||
"outputs": [
|
||||
"ap2-mediator-handoff-flow.svg",
|
||||
"ap2-mediator-handoff-flow.drawio",
|
||||
"ap2-mediator-handoff-flow.mmd",
|
||||
"ap2-mediator-handoff-flow.d2",
|
||||
"ap2-mediator-handoff-flow.dot",
|
||||
"ap2-mediator-handoff-flow.drawio",
|
||||
"ap2-mediator-handoff-flow.excalidraw",
|
||||
"ap2-mediator-handoff-flow.alt.md"
|
||||
],
|
||||
|
||||
+11
-11
@@ -2,7 +2,7 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="870" height="542" viewBox="0 0 870 542" role="img" aria-labelledby="diagram-title diagram-description">
|
||||
<title id="diagram-title">AP2 server-held token에서 브라우저 Bearer 요청까지</title>
|
||||
<desc id="diagram-description">브라우저가 AP2_SESSION cookie와 함께 /token/access를 Spring mediator에 요청한다. Mediator는 현재 principal과 keycloak registration으로 authorized-client store에서 token을 조회하고 access token, type, expiry만 응답한다. 브라우저는 access token을 지역 변수로 받아 Authorization Bearer header를 만들고 Resource Server의 /api/me를 직접 호출한 뒤 사용자 JSON을 받는다. Refresh token은 브라우저 응답에 포함되지 않는다.</desc>
|
||||
<metadata>{"techviz":{"spec_version":"1.1","id":"ap2-mediator-handoff-flow","profile":"sequence"},"source_context":{"document":"document.md","document_sha256":"df4d1a604c74e756672b5b40510abfedb8c67b39af280a5f51985ea9972f5371","anchor":{"kind":"marker","value":"ap2-mediator-handoff-flow","line":645}},"evidence_policy":"Each factual element cites source lines or is marked assumption.","diagram_only":true}</metadata>
|
||||
<metadata>{"techviz":{"spec_version":"1.1","id":"ap2-mediator-handoff-flow","profile":"sequence"},"source_context":{"document":"document.md","document_sha256":"15e7c79412ac05ed39d6f3d0c14de8dda92abe7b402139ac2a90492dfe5e162c","anchor":{"kind":"marker","value":"ap2-mediator-handoff-flow","line":679}},"evidence_policy":"Each factual element cites source lines or is marked assumption.","diagram_only":true}</metadata>
|
||||
<defs>
|
||||
<marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
|
||||
<path d="M 0 0 L 10 5 L 0 10 z" />
|
||||
@@ -50,35 +50,35 @@
|
||||
</style>
|
||||
</defs>
|
||||
<rect class="canvas" width="870" height="542" />
|
||||
<rect class="node-shape kind-participant emphasis-normal role-participant" data-evidence="505-511,558-586" x="45.0" y="35.0" width="150.0" height="64.0" rx="7" />
|
||||
<rect class="node-shape kind-participant emphasis-normal role-participant" data-evidence="539-545,592-620" x="45.0" y="35.0" width="150.0" height="64.0" rx="7" />
|
||||
<text class="node-label" x="120.0" y="65.0">브라우저</text>
|
||||
<line class="lifeline" x1="120.0" y1="99.0" x2="120.0" y2="512.0" />
|
||||
<rect class="node-shape kind-participant emphasis-primary role-participant" data-evidence="503-540" x="255.0" y="35.0" width="150.0" height="64.0" rx="7" />
|
||||
<rect class="node-shape kind-participant emphasis-primary role-participant" data-evidence="537-574" x="255.0" y="35.0" width="150.0" height="64.0" rx="7" />
|
||||
<text class="node-label" x="330.0" y="65.0">Spring mediator</text>
|
||||
<line class="lifeline" x1="330.0" y1="99.0" x2="330.0" y2="512.0" />
|
||||
<rect class="node-shape kind-participant emphasis-normal role-participant" data-evidence="445-457,513-521" x="465.0" y="35.0" width="153.0" height="74.0" rx="7" />
|
||||
<rect class="node-shape kind-participant emphasis-normal role-participant" data-evidence="479-491,547-555" x="465.0" y="35.0" width="153.0" height="74.0" rx="7" />
|
||||
<text class="node-label" x="541.5" y="62.0">Authorized-client</text>
|
||||
<text class="node-label" x="541.5" y="80.0">store</text>
|
||||
<line class="lifeline" x1="541.5" y1="109.0" x2="541.5" y2="512.0" />
|
||||
<rect class="node-shape kind-participant emphasis-normal role-participant" data-evidence="571-599" x="675.0" y="35.0" width="150.0" height="64.0" rx="7" />
|
||||
<rect class="node-shape kind-participant emphasis-normal role-participant" data-evidence="605-633" x="675.0" y="35.0" width="150.0" height="64.0" rx="7" />
|
||||
<text class="node-label" x="750.0" y="65.0">Resource Server</text>
|
||||
<line class="lifeline" x1="750.0" y1="99.0" x2="750.0" y2="512.0" />
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="120.0,140.0 330.0,140.0" data-evidence="503-511" />
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="120.0,140.0 330.0,140.0" data-evidence="537-545" />
|
||||
<rect class="edge-label-bg" x="102.1" y="114.0" width="245.8" height="22" rx="3" />
|
||||
<text class="edge-label" x="225.0" y="129.0">1. GET /token/access + AP2_SESSION</text>
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="330.0,202.0 541.5,202.0" data-evidence="513-521" />
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="330.0,202.0 541.5,202.0" data-evidence="547-555" />
|
||||
<rect class="edge-label-bg" x="326.2" y="176.0" width="219.0" height="22" rx="3" />
|
||||
<text class="edge-label" x="435.8" y="191.0">2. authorize current principal</text>
|
||||
<polyline class="edge kind-response style-dashed emphasis-normal semantic-dashed" points="541.5,264.0 330.0,264.0" data-evidence="513-521" />
|
||||
<polyline class="edge kind-response style-dashed emphasis-normal semantic-dashed" points="541.5,264.0 330.0,264.0" data-evidence="547-555" />
|
||||
<rect class="edge-label-bg" x="349.7" y="238.0" width="172.1" height="22" rx="3" />
|
||||
<text class="edge-label" x="435.8" y="253.0">3. current access token</text>
|
||||
<polyline class="edge kind-response style-dashed emphasis-normal semantic-dashed" points="330.0,326.0 120.0,326.0" data-evidence="523-540" />
|
||||
<polyline class="edge kind-response style-dashed emphasis-normal semantic-dashed" points="330.0,326.0 120.0,326.0" data-evidence="557-574" />
|
||||
<rect class="edge-label-bg" x="112.1" y="300.0" width="225.7" height="22" rx="3" />
|
||||
<text class="edge-label" x="225.0" y="315.0">4. access token + type + expiry</text>
|
||||
<polyline class="edge kind-request style-solid emphasis-primary" points="120.0,388.0 750.0,388.0" data-evidence="558-588" />
|
||||
<polyline class="edge kind-request style-solid emphasis-primary" points="120.0,388.0 750.0,388.0" data-evidence="592-622" />
|
||||
<rect class="edge-label-bg" x="295.4" y="362.0" width="279.3" height="22" rx="3" />
|
||||
<text class="edge-label" x="435.0" y="377.0">5. GET /api/me · browser-created Bearer</text>
|
||||
<polyline class="edge kind-response style-dashed emphasis-normal semantic-dashed" points="750.0,450.0 120.0,450.0" data-evidence="590-615" />
|
||||
<polyline class="edge kind-response style-dashed emphasis-normal semantic-dashed" points="750.0,450.0 120.0,450.0" data-evidence="624-649" />
|
||||
<rect class="edge-label-bg" x="288.6" y="424.0" width="292.7" height="22" rx="3" />
|
||||
<text class="edge-label" x="435.0" y="439.0">6. subject · username · issuer · audience</text>
|
||||
</svg>
|
||||
|
||||
|
Before Width: | Height: | Size: 7.5 KiB After Width: | Height: | Size: 7.5 KiB |
Reference in New Issue
Block a user