refactor: 문서 개선 중
This commit is contained in:
donghyeon-ka
@@ -10,16 +10,16 @@
|
||||
|
||||
## Elements and evidence
|
||||
|
||||
- **브라우저** (participant): Authorization header 없이 AP3_SESSION cookie로 BFF endpoint를 호출하고 중계 JSON을 받는다. Evidence: L714–L722, L750–L760, L796–L809.
|
||||
- **Spring BFF** (participant): Session authentication을 authorized client 조회로 바꾸고 Resource Server용 Bearer 요청을 조립한다. Evidence: L750–L783, L796–L809.
|
||||
- **Authorized-client store** (participant): Registration과 principal name으로 BFF의 access token과 refresh token을 보관한다. Evidence: L700–L712, L762–L768.
|
||||
- **Resource Server** (participant): BFF가 붙인 Bearer JWT를 검증하고 사용자 JSON을 반환한다. Evidence: L776–L796.
|
||||
- **브라우저** (participant): Authorization header 없이 AP3_SESSION cookie로 BFF endpoint를 호출하고 중계 JSON을 받는다. Evidence: L750–L758, L786–L796, L832–L845.
|
||||
- **Spring BFF** (participant): Session authentication을 authorized client 조회로 바꾸고 Resource Server용 Bearer 요청을 조립한다. Evidence: L786–L819, L832–L845.
|
||||
- **Authorized-client store** (participant): Registration과 principal name으로 BFF의 access token과 refresh token을 보관한다. Evidence: L736–L748, L798–L804.
|
||||
- **Resource Server** (participant): BFF가 붙인 Bearer JWT를 검증하고 사용자 JSON을 반환한다. Evidence: L812–L832.
|
||||
|
||||
## Relationships
|
||||
|
||||
- **브라우저 → Spring BFF:** GET /bff/api/me + AP3_SESSION. Evidence: L750–L760.
|
||||
- **Spring BFF → Authorized-client store:** authorize current principal. Evidence: L762–L768.
|
||||
- **Authorized-client store → Spring BFF:** server-held access token. Evidence: L762–L768.
|
||||
- **Spring BFF → Resource Server:** GET /api/me · Bearer access token. Evidence: L770–L783.
|
||||
- **Resource Server → Spring BFF:** subject · username · issuer · audience. Evidence: L785–L796.
|
||||
- **Spring BFF → 브라우저:** BFF ResponseEntity → browser JSON. Evidence: L796–L809.
|
||||
- **브라우저 → Spring BFF:** GET /bff/api/me + AP3_SESSION. Evidence: L786–L796.
|
||||
- **Spring BFF → Authorized-client store:** authorize current principal. Evidence: L798–L804.
|
||||
- **Authorized-client store → Spring BFF:** server-held access token. Evidence: L798–L804.
|
||||
- **Spring BFF → Resource Server:** GET /api/me · Bearer access token. Evidence: L806–L819.
|
||||
- **Resource Server → Spring BFF:** subject · username · issuer · audience. Evidence: L821–L832.
|
||||
- **Spring BFF → 브라우저:** BFF ResponseEntity → browser JSON. Evidence: L832–L845.
|
||||
|
||||
@@ -5,16 +5,16 @@
|
||||
<root>
|
||||
<mxCell id="0"/>
|
||||
<mxCell id="1" parent="0"/>
|
||||
<mxCell id="n_browser" value="브라우저" tooltip="Authorization header 없이 AP3_SESSION cookie로 BFF endpoint를 호출하고 중계 JSON을 받는다. | Evidence: L714-L722, L750-L760, L796-L809" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxCell id="n_browser" value="브라우저" tooltip="Authorization header 없이 AP3_SESSION cookie로 BFF endpoint를 호출하고 중계 JSON을 받는다. | Evidence: L750-L758, L786-L796, L832-L845" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxGeometry x="45.0" y="35.0" width="150.0" height="64.0" as="geometry"/>
|
||||
</mxCell>
|
||||
<mxCell id="n_bff" value="Spring BFF" tooltip="Session authentication을 authorized client 조회로 바꾸고 Resource Server용 Bearer 요청을 조립한다. | Evidence: L750-L783, L796-L809" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
|
||||
<mxCell id="n_bff" value="Spring BFF" tooltip="Session authentication을 authorized client 조회로 바꾸고 Resource Server용 Bearer 요청을 조립한다. | Evidence: L786-L819, L832-L845" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
|
||||
<mxGeometry x="255.0" y="35.0" width="150.0" height="64.0" as="geometry"/>
|
||||
</mxCell>
|
||||
<mxCell id="n_authorized-client-store" value="Authorized-client store" tooltip="Registration과 principal name으로 BFF의 access token과 refresh token을 보관한다. | Evidence: L700-L712, L762-L768" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxCell id="n_authorized-client-store" value="Authorized-client store" tooltip="Registration과 principal name으로 BFF의 access token과 refresh token을 보관한다. | Evidence: L736-L748, L798-L804" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxGeometry x="465.0" y="35.0" width="153.0" height="74.0" as="geometry"/>
|
||||
</mxCell>
|
||||
<mxCell id="n_resource-server" value="Resource Server" tooltip="BFF가 붙인 Bearer JWT를 검증하고 사용자 JSON을 반환한다. | Evidence: L776-L796" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxCell id="n_resource-server" value="Resource Server" tooltip="BFF가 붙인 Bearer JWT를 검증하고 사용자 JSON을 반환한다. | Evidence: L812-L832" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
||||
<mxGeometry x="675.0" y="35.0" width="150.0" height="64.0" as="geometry"/>
|
||||
</mxCell>
|
||||
<mxCell id="e_session-request" value="GET /bff/api/me + AP3_SESSION" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_browser" target="n_bff">
|
||||
|
||||
@@ -2,22 +2,22 @@
|
||||
"harness_version": "0.2.0",
|
||||
"spec_id": "ap3-bff-session-flow",
|
||||
"spec_version": "1.1",
|
||||
"spec_sha256": "2030434c650208507b9ad33f894d4de71990b1b550fa4652cddf4a6c50141d2b",
|
||||
"spec_sha256": "f7b05b118b25590243f09fb312fd40794dba7bc0a7f76d09d74c8d3ff1484a81",
|
||||
"source_context": {
|
||||
"document": "document.md",
|
||||
"document_sha256": "df4d1a604c74e756672b5b40510abfedb8c67b39af280a5f51985ea9972f5371",
|
||||
"document_sha256": "15e7c79412ac05ed39d6f3d0c14de8dda92abe7b402139ac2a90492dfe5e162c",
|
||||
"anchor": {
|
||||
"kind": "marker",
|
||||
"value": "ap3-bff-session-flow",
|
||||
"line": 908
|
||||
"line": 944
|
||||
}
|
||||
},
|
||||
"outputs": [
|
||||
"ap3-bff-session-flow.svg",
|
||||
"ap3-bff-session-flow.drawio",
|
||||
"ap3-bff-session-flow.mmd",
|
||||
"ap3-bff-session-flow.d2",
|
||||
"ap3-bff-session-flow.dot",
|
||||
"ap3-bff-session-flow.drawio",
|
||||
"ap3-bff-session-flow.excalidraw",
|
||||
"ap3-bff-session-flow.alt.md"
|
||||
],
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="870" height="542" viewBox="0 0 870 542" role="img" aria-labelledby="diagram-title diagram-description">
|
||||
<title id="diagram-title">AP3 session cookie에서 BFF downstream Bearer까지</title>
|
||||
<desc id="diagram-description">브라우저가 Authorization header 없이 AP3_SESSION cookie로 /bff/api/me를 호출한다. BFF는 현재 Authentication으로 authorized-client manager를 호출해 server-held access token을 얻고 Resource Server의 /api/me에 Bearer header를 붙인다. Resource Server가 JWT를 검증해 사용자 JSON을 반환하면 BFF가 ResponseEntity로 받아 브라우저에 중계한다. 브라우저 session cookie는 downstream으로 전달되지 않는다.</desc>
|
||||
<metadata>{"techviz":{"spec_version":"1.1","id":"ap3-bff-session-flow","profile":"sequence"},"source_context":{"document":"document.md","document_sha256":"df4d1a604c74e756672b5b40510abfedb8c67b39af280a5f51985ea9972f5371","anchor":{"kind":"marker","value":"ap3-bff-session-flow","line":908}},"evidence_policy":"Each factual element cites source lines or is marked assumption.","diagram_only":true}</metadata>
|
||||
<metadata>{"techviz":{"spec_version":"1.1","id":"ap3-bff-session-flow","profile":"sequence"},"source_context":{"document":"document.md","document_sha256":"15e7c79412ac05ed39d6f3d0c14de8dda92abe7b402139ac2a90492dfe5e162c","anchor":{"kind":"marker","value":"ap3-bff-session-flow","line":944}},"evidence_policy":"Each factual element cites source lines or is marked assumption.","diagram_only":true}</metadata>
|
||||
<defs>
|
||||
<marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
|
||||
<path d="M 0 0 L 10 5 L 0 10 z" />
|
||||
@@ -50,35 +50,35 @@
|
||||
</style>
|
||||
</defs>
|
||||
<rect class="canvas" width="870" height="542" />
|
||||
<rect class="node-shape kind-participant emphasis-normal role-participant" data-evidence="714-722,750-760,796-809" x="45.0" y="35.0" width="150.0" height="64.0" rx="7" />
|
||||
<rect class="node-shape kind-participant emphasis-normal role-participant" data-evidence="750-758,786-796,832-845" x="45.0" y="35.0" width="150.0" height="64.0" rx="7" />
|
||||
<text class="node-label" x="120.0" y="65.0">브라우저</text>
|
||||
<line class="lifeline" x1="120.0" y1="99.0" x2="120.0" y2="512.0" />
|
||||
<rect class="node-shape kind-participant emphasis-primary role-participant" data-evidence="750-783,796-809" x="255.0" y="35.0" width="150.0" height="64.0" rx="7" />
|
||||
<rect class="node-shape kind-participant emphasis-primary role-participant" data-evidence="786-819,832-845" x="255.0" y="35.0" width="150.0" height="64.0" rx="7" />
|
||||
<text class="node-label" x="330.0" y="65.0">Spring BFF</text>
|
||||
<line class="lifeline" x1="330.0" y1="99.0" x2="330.0" y2="512.0" />
|
||||
<rect class="node-shape kind-participant emphasis-normal role-participant" data-evidence="700-712,762-768" x="465.0" y="35.0" width="153.0" height="74.0" rx="7" />
|
||||
<rect class="node-shape kind-participant emphasis-normal role-participant" data-evidence="736-748,798-804" x="465.0" y="35.0" width="153.0" height="74.0" rx="7" />
|
||||
<text class="node-label" x="541.5" y="62.0">Authorized-client</text>
|
||||
<text class="node-label" x="541.5" y="80.0">store</text>
|
||||
<line class="lifeline" x1="541.5" y1="109.0" x2="541.5" y2="512.0" />
|
||||
<rect class="node-shape kind-participant emphasis-normal role-participant" data-evidence="776-796" x="675.0" y="35.0" width="150.0" height="64.0" rx="7" />
|
||||
<rect class="node-shape kind-participant emphasis-normal role-participant" data-evidence="812-832" x="675.0" y="35.0" width="150.0" height="64.0" rx="7" />
|
||||
<text class="node-label" x="750.0" y="65.0">Resource Server</text>
|
||||
<line class="lifeline" x1="750.0" y1="99.0" x2="750.0" y2="512.0" />
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="120.0,140.0 330.0,140.0" data-evidence="750-760" />
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="120.0,140.0 330.0,140.0" data-evidence="786-796" />
|
||||
<rect class="edge-label-bg" x="108.8" y="114.0" width="232.4" height="22" rx="3" />
|
||||
<text class="edge-label" x="225.0" y="129.0">1. GET /bff/api/me + AP3_SESSION</text>
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="330.0,202.0 541.5,202.0" data-evidence="762-768" />
|
||||
<polyline class="edge kind-request style-solid emphasis-normal" points="330.0,202.0 541.5,202.0" data-evidence="798-804" />
|
||||
<rect class="edge-label-bg" x="326.2" y="176.0" width="219.0" height="22" rx="3" />
|
||||
<text class="edge-label" x="435.8" y="191.0">2. authorize current principal</text>
|
||||
<polyline class="edge kind-response style-dashed emphasis-normal semantic-dashed" points="541.5,264.0 330.0,264.0" data-evidence="762-768" />
|
||||
<polyline class="edge kind-response style-dashed emphasis-normal semantic-dashed" points="541.5,264.0 330.0,264.0" data-evidence="798-804" />
|
||||
<rect class="edge-label-bg" x="336.3" y="238.0" width="198.9" height="22" rx="3" />
|
||||
<text class="edge-label" x="435.8" y="253.0">3. server-held access token</text>
|
||||
<polyline class="edge kind-request style-solid emphasis-primary" points="330.0,326.0 750.0,326.0" data-evidence="770-783" />
|
||||
<polyline class="edge kind-request style-solid emphasis-primary" points="330.0,326.0 750.0,326.0" data-evidence="806-819" />
|
||||
<rect class="edge-label-bg" x="410.4" y="300.0" width="259.2" height="22" rx="3" />
|
||||
<text class="edge-label" x="540.0" y="315.0">4. GET /api/me · Bearer access token</text>
|
||||
<polyline class="edge kind-response style-dashed emphasis-normal semantic-dashed" points="750.0,388.0 330.0,388.0" data-evidence="785-796" />
|
||||
<polyline class="edge kind-response style-dashed emphasis-normal semantic-dashed" points="750.0,388.0 330.0,388.0" data-evidence="821-832" />
|
||||
<rect class="edge-label-bg" x="393.6" y="362.0" width="292.7" height="22" rx="3" />
|
||||
<text class="edge-label" x="540.0" y="377.0">5. subject · username · issuer · audience</text>
|
||||
<polyline class="edge kind-response style-dashed emphasis-normal semantic-dashed" points="330.0,450.0 120.0,450.0" data-evidence="796-809" />
|
||||
<polyline class="edge kind-response style-dashed emphasis-normal semantic-dashed" points="330.0,450.0 120.0,450.0" data-evidence="832-845" />
|
||||
<rect class="edge-label-bg" x="95.4" y="424.0" width="259.2" height="22" rx="3" />
|
||||
<text class="edge-label" x="225.0" y="439.0">6. BFF ResponseEntity → browser JSON</text>
|
||||
</svg>
|
||||
|
||||
|
Before Width: | Height: | Size: 7.5 KiB After Width: | Height: | Size: 7.5 KiB |
Reference in New Issue
Block a user