refactor: 문서 개선 중

2026-09-21 14:30:55 +09:00
parent c93cdea150
commit 805a18f486
1497 changed files with 525837 additions and 59152 deletions
@@ -0,0 +1,28 @@
+# Bearer JWT가 검증과 역할 변환을 지나 principal이 된다
+
+## Alternative text
+
+Bearer JWT 입력이 JwtDecoder, issuer·시간 검증, audience 검증, role converter를 거쳐 authenticated principal이 되는 검증 사슬.
+
+## Long description
+
+왼쪽의 raw Bearer JWT가 NimbusJwtDecoder에서 JWK 서명을 확인한 뒤 issuer와 timestamp validator, 프로젝트의 AudienceValidator를 통과해 validated Jwt가 된다. 이어서 KeycloakRealmRoleConverter가 realm_access.roles를 ROLE_* authority로 바꾸고 authenticated principal이 만들어진다.
+
+## Elements and evidence
+
+- **Bearer JWT** (data): Resource Server가 Authorization header에서 받은 raw Bearer JWT. Evidence: L354–L359.
+- **NimbusJwtDecoder** (service): JWK를 이용해 JWT 서명을 검증하는 decoder. Evidence: L359–L360.
+- **Issuer · Time validators** (service): Expected issuer와 timestamp 조건을 확인하는 default validators. Evidence: L361–L361.
+- **AudienceValidator** (service): keycloak-pattern-api audience 포함 여부를 확인하는 project validator. Evidence: L362–L370.
+- **Validated Jwt** (data): 서명, issuer·시간, audience 검증을 통과한 Jwt. Evidence: L363–L363.
+- **Realm role converter** (service): realm_access.roles 문자열에 ROLE_ prefix를 붙여 authority로 변환한다. Evidence: L364–L370.
+- **Authenticated principal** (actor): 검증된 JWT와 ROLE_* authorities를 가진 인증 결과. Evidence: L365–L365.
+
+## Relationships
+
+- **Bearer JWT → NimbusJwtDecoder:** decode. Evidence: L354–L360.
+- **NimbusJwtDecoder → Issuer · Time validators:** signature ok. Evidence: L360–L361.
+- **Issuer · Time validators → AudienceValidator:** claims. Evidence: L361–L362.
+- **AudienceValidator → Validated Jwt:** valid audience. Evidence: L362–L363.
+- **Validated Jwt → Realm role converter:** realm roles. Evidence: L363–L364.
+- **Realm role converter → Authenticated principal:** authorities. Evidence: L364–L365.
@@ -0,0 +1,30 @@
+# Bearer JWT가 검증과 역할 변환을 지나 principal이 된다
+# Question: Resource Server가 받은 Bearer JWT는 어떤 검증과 변환 단계를 지나 authenticated principal이 되는가?
+direction: down
+n0: "Bearer JWT" {
+  shape: rectangle
+}
+n1: "NimbusJwtDecoder" {
+  shape: rectangle
+}
+n2: "Issuer · Time validators" {
+  shape: rectangle
+}
+n3: "AudienceValidator" {
+  shape: rectangle
+}
+n4: "Validated Jwt" {
+  shape: rectangle
+}
+n5: "Realm role converter" {
+  shape: rectangle
+}
+n6: "Authenticated principal" {
+  shape: person
+}
+n0 -> n1: "decode"
+n1 -> n2: "signature ok"
+n2 -> n3: "claims"
+n3 -> n4: "valid audience"
+n4 -> n5: "realm roles"
+n5 -> n6: "authorities"
@@ -0,0 +1,18 @@
+digraph techviz {
+  graph [rankdir=TB, splines=ortho, nodesep=0.55, ranksep=0.85];
+  node [fontname=Helvetica, fontsize=11, margin="0.18,0.12", style="rounded,filled", fillcolor=white, color="#2d4357", penwidth=1.5];
+  edge [fontname=Helvetica, fontsize=10, color="#364b5f", penwidth=1.4, arrowsize=0.75];
+  n0 [label="Bearer JWT", shape=box, style="rounded,filled"];
+  n1 [label="NimbusJwtDecoder", shape=box, style="rounded,filled"];
+  n2 [label="Issuer · Time validators", shape=box, style="rounded,filled"];
+  n3 [label="AudienceValidator", shape=box, style="rounded,filled"];
+  n4 [label="Validated Jwt", shape=box, style="rounded,filled"];
+  n5 [label="Realm role converter", shape=box, style="rounded,filled"];
+  n6 [label="Authenticated principal", shape=box, style="rounded,dashed,filled"];
+  n0 -> n1 [label="decode", style=solid];
+  n1 -> n2 [label="signature ok", style=solid];
+  n2 -> n3 [label="claims", style=solid];
+  n3 -> n4 [label="valid audience", style=solid];
+  n4 -> n5 [label="realm roles", style=solid];
+  n5 -> n6 [label="authorities", style=solid];
+}
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<mxfile host="app.diagrams.net" modified="2026-07-23T00:00:00.000Z" agent="techviz-harness" version="24.7.17" type="device">
+  <diagram id="bearer-jwt-validation-chain" name="Bearer JWT가 검증과 역할 변환을 지나 principal이 된다">
+    <mxGraphModel dx="680" dy="2231" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="827" pageHeight="2231" math="0" shadow="0">
+      <root>
+        <mxCell id="0"/>
+        <mxCell id="1" parent="0"/>
+        <mxCell id="n_bearer-input" value="Bearer JWT" tooltip="Resource Server가 Authorization header에서 받은 raw Bearer JWT. | Evidence: L354-L359" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
+          <mxGeometry x="48.5" y="145.0" width="150.0" height="64.0" as="geometry"/>
+        </mxCell>
+        <mxCell id="n_jwt-decoder" value="NimbusJwtDecoder&lt;br/&gt;JWK signature" tooltip="JWK를 이용해 JWT 서명을 검증하는 decoder. | Evidence: L359-L360" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
+          <mxGeometry x="45.0" y="455.0" width="150.0" height="71.0" as="geometry"/>
+        </mxCell>
+        <mxCell id="n_issuer-time" value="Issuer · Time validators" tooltip="Expected issuer와 timestamp 조건을 확인하는 default validators. | Evidence: L361-L361" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
+          <mxGeometry x="43.5" y="765.0" width="150.0" height="74.0" as="geometry"/>
+        </mxCell>
+        <mxCell id="n_audience-validator" value="AudienceValidator&lt;br/&gt;keycloak-pattern-api" tooltip="keycloak-pattern-api audience 포함 여부를 확인하는 project validator. | Evidence: L362-L370" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
+          <mxGeometry x="45.0" y="1075.0" width="174.0" height="71.0" as="geometry"/>
+        </mxCell>
+        <mxCell id="n_validated-jwt" value="Validated Jwt" tooltip="서명, issuer·시간, audience 검증을 통과한 Jwt. | Evidence: L363-L363" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
+          <mxGeometry x="48.5" y="1409.0" width="150.0" height="64.0" as="geometry"/>
+        </mxCell>
+        <mxCell id="n_role-converter" value="Realm role converter&lt;br/&gt;KeycloakRealmRoleConverter" tooltip="realm_access.roles 문자열에 ROLE_ prefix를 붙여 authority로 변환한다. | Evidence: L364-L370" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
+          <mxGeometry x="45.0" y="1719.0" width="216.0" height="71.0" as="geometry"/>
+        </mxCell>
+        <mxCell id="n_principal" value="Authenticated principal&lt;br/&gt;ROLE_* authorities" tooltip="검증된 JWT와 ROLE_* authorities를 가진 인증 결과. | Evidence: L365-L365" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;dashed=1;fillColor=#f5f7fa;" vertex="1" parent="1">
+          <mxGeometry x="35.0" y="2095.0" width="160.0" height="91.0" as="geometry"/>
+        </mxCell>
+        <mxCell id="e_e1" value="decode" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_bearer-input" target="n_jwt-decoder">
+          <mxGeometry relative="1" as="geometry">
+            <mxPoint x="121.8" y="304.0" as="offset"/>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="e_e2" value="signature ok" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_jwt-decoder" target="n_issuer-time">
+          <mxGeometry relative="1" as="geometry">
+            <mxPoint x="119.2" y="617.5" as="offset"/>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="e_e3" value="claims" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_issuer-time" target="n_audience-validator">
+          <mxGeometry relative="1" as="geometry">
+            <mxPoint x="125.2" y="929.0" as="offset"/>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="e_e4" value="valid audience" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_audience-validator" target="n_validated-jwt">
+          <mxGeometry relative="1" as="geometry">
+            <mxPoint x="127.8" y="1249.5" as="offset"/>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="e_e5" value="realm roles" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_validated-jwt" target="n_role-converter">
+          <mxGeometry relative="1" as="geometry">
+            <mxPoint x="138.2" y="1568.0" as="offset"/>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="e_e6" value="authorities" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_role-converter" target="n_principal">
+          <mxGeometry relative="1" as="geometry">
+            <mxPoint x="134.0" y="1914.5" as="offset"/>
+          </mxGeometry>
+        </mxCell>
+      </root>
+    </mxGraphModel>
+  </diagram>
+</mxfile>
@@ -0,0 +1,32 @@
+{
+  "harness_version": "0.2.0",
+  "spec_id": "bearer-jwt-validation-chain",
+  "spec_version": "1.1",
+  "spec_sha256": "0b60ebe72b75b64466aeed4bbcfa2b08f0b01d0ef3001c51d84e05885d11eaa9",
+  "source_context": {
+    "document": "docs/keycloak/final/document.md",
+    "document_sha256": "ea10df24b892e2c57123a37a4b4f0d821e4f394353e6746f50df6a48342353e9",
+    "anchor": {
+      "kind": "heading",
+      "value": "AP1 완주: callback code가 브라우저 Bearer 요청이 되기까지",
+      "line": 227
+    }
+  },
+  "outputs": [
+    "bearer-jwt-validation-chain.svg",
+    "bearer-jwt-validation-chain.mmd",
+    "bearer-jwt-validation-chain.d2",
+    "bearer-jwt-validation-chain.dot",
+    "bearer-jwt-validation-chain.drawio",
+    "bearer-jwt-validation-chain.excalidraw",
+    "bearer-jwt-validation-chain.alt.md"
+  ],
+  "lint_issue_count": 1,
+  "assumption_count": 0,
+  "assumptions_allowed": false,
+  "composition_profile": "component-flow",
+  "reference_ids": [
+    "payment-event-flow"
+  ],
+  "diagram_only": true
+}
@@ -0,0 +1,18 @@
+%% Bearer JWT가 검증과 역할 변환을 지나 principal이 된다
+%% question: Resource Server가 받은 Bearer JWT는 어떤 검증과 변환 단계를 지나 authenticated principal이 되는가?
+flowchart TB
+    n0["Bearer JWT"]
+    n1["NimbusJwtDecoder"]
+    n2["Issuer · Time validators"]
+    n3["AudienceValidator"]
+    n4["Validated Jwt"]
+    n5["Realm role converter"]
+    n6(["Authenticated principal"])
+    n0 -->|"decode"| n1
+    n1 -->|"signature ok"| n2
+    n2 -->|"claims"| n3
+    n3 -->|"valid audience"| n4
+    n4 -->|"realm roles"| n5
+    n5 -->|"authorities"| n6
+    classDef external stroke-dasharray: 6 4
+    class n6 external
@@ -0,0 +1,107 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="680" height="2231" viewBox="0 0 680 2231" role="img" aria-labelledby="diagram-title diagram-description">
+<title id="diagram-title">Bearer JWT가 검증과 역할 변환을 지나 principal이 된다</title>
+<desc id="diagram-description">왼쪽의 raw Bearer JWT가 NimbusJwtDecoder에서 JWK 서명을 확인한 뒤 issuer와 timestamp validator, 프로젝트의 AudienceValidator를 통과해 validated Jwt가 된다. 이어서 KeycloakRealmRoleConverter가 realm_access.roles를 ROLE_* authority로 바꾸고 authenticated principal이 만들어진다.</desc>
+<metadata>{&quot;techviz&quot;:{&quot;spec_version&quot;:&quot;1.1&quot;,&quot;id&quot;:&quot;bearer-jwt-validation-chain&quot;,&quot;profile&quot;:&quot;component-flow&quot;},&quot;source_context&quot;:{&quot;document&quot;:&quot;docs/keycloak/final/document.md&quot;,&quot;document_sha256&quot;:&quot;ea10df24b892e2c57123a37a4b4f0d821e4f394353e6746f50df6a48342353e9&quot;,&quot;anchor&quot;:{&quot;kind&quot;:&quot;heading&quot;,&quot;value&quot;:&quot;AP1 완주: callback code가 브라우저 Bearer 요청이 되기까지&quot;,&quot;line&quot;:227}},&quot;evidence_policy&quot;:&quot;Each factual element cites source lines or is marked assumption.&quot;,&quot;diagram_only&quot;:true}</metadata>
+<defs>
+  <marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
+    <path d="M 0 0 L 10 5 L 0 10 z" />
+  </marker>
+  <style>
+    :root { color-scheme: light; }
+    text { font-family: Inter, Pretendard, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; fill: #111827; }
+    .canvas { fill: #ffffff; }
+    .group-box { fill: #ffffff; stroke: #9ca3af; stroke-width: 1.4; stroke-dasharray: 7 5; }
+    .group-label-bg { fill: #ffffff; }
+    .group-label { font-size: 13px; font-weight: 650; fill: #374151; }
+    .edge { fill: none; stroke: #374151; stroke-width: 1.8; stroke-linejoin: round; stroke-linecap: round; marker-end: url(#arrow); }
+    .edge.style-dashed, .edge.semantic-dashed, .edge.assumption { stroke-dasharray: 7 5; }
+    .edge.style-dotted { stroke-dasharray: 2 5; }
+    .edge.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
+    .edge.emphasis-muted { stroke: #9ca3af; }
+    .edge.emphasis-warning, .edge.kind-failure, .edge.kind-error { stroke: #dc2626; stroke-width: 2.2; }
+    .edge-label-bg { fill: #ffffff; }
+    .edge-label { font-size: 12px; font-weight: 560; text-anchor: middle; }
+    .node-shape { fill: #ffffff; stroke: #4b5563; stroke-width: 1.7; }
+    .node-shape.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
+    .node-shape.emphasis-muted { stroke: #9ca3af; fill: #f9fafb; }
+    .node-shape.emphasis-warning { stroke: #d97706; stroke-width: 2; fill: #fffdf5; }
+    .node-shape.kind-database, .node-shape.kind-datastore, .node-shape.kind-storage { fill: #f8fafc; }
+    .node-shape.kind-queue, .node-shape.kind-event, .node-shape.kind-topic { fill: #fafafa; }
+    .node-shape.assumption { stroke-dasharray: 4 4; }
+    .storage-bottom, .controller-divider { fill: none; stroke: #4b5563; stroke-width: 1.4; }
+    .controller-led { fill: #4b5563; }
+    .actor-symbol { fill: none; stroke: #4b5563; stroke-width: 1.8; stroke-linecap: round; }
+    .actor-symbol.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
+    .node-label { font-size: 14px; font-weight: 650; text-anchor: middle; }
+    .node-role { font-size: 10px; letter-spacing: 0.04em; text-anchor: middle; fill: #6b7280; }
+    .node-detail-divider { stroke: #d1d5db; stroke-width: 1; }
+    .node-detail { font-size: 11px; fill: #374151; }
+    .assumption-badge { font-size: 9px; font-weight: 700; fill: #92400e; }
+    .failure-mark { stroke: #dc2626; stroke-width: 4; stroke-linecap: round; }
+    .lifeline { stroke: #9ca3af; stroke-width: 1.2; stroke-dasharray: 5 5; }
+    .timeline-axis { stroke: #374151; stroke-width: 1.8; marker-end: url(#arrow); }
+    .timeline-stem { stroke: #6b7280; stroke-width: 1.3; }
+    .timeline-marker { fill: #ffffff; stroke: #374151; stroke-width: 1.7; }
+    .timeline-marker.primary { fill: #2563eb; stroke: #2563eb; }
+    .timeline-marker.warning { fill: #dc2626; stroke: #dc2626; }
+    .timeline-label { font-size: 13px; font-weight: 650; text-anchor: middle; }
+    .timeline-detail { font-size: 11px; fill: #4b5563; text-anchor: middle; }
+  </style>
+</defs>
+<rect class="canvas" width="680" height="2231" />
+<polyline class="edge kind-data style-solid emphasis-normal" points="123.5,209.0 123.5,332.0 120.0,332.0 120.0,455.0" data-evidence="354-360" />
+<rect class="edge-label-bg" x="92.7" y="290.0" width="58.2" height="22" rx="3" />
+<text class="edge-label" x="121.8" y="305.0">decode</text>
+<polyline class="edge kind-data style-solid emphasis-normal" points="120.0,526.0 120.0,645.5 118.5,645.5 118.5,765.0" data-evidence="360-361" />
+<rect class="edge-label-bg" x="70.0" y="603.5" width="98.4" height="22" rx="3" />
+<text class="edge-label" x="119.2" y="618.5">signature ok</text>
+<polyline class="edge kind-data style-solid emphasis-normal" points="118.5,839.0 118.5,957.0 132.0,957.0 132.0,1075.0" data-evidence="361-362" />
+<rect class="edge-label-bg" x="96.2" y="915.0" width="58.2" height="22" rx="3" />
+<text class="edge-label" x="125.2" y="930.0">claims</text>
+<polyline class="edge kind-data style-solid emphasis-primary" points="132.0,1146.0 132.0,1277.5 123.5,1277.5 123.5,1409.0" data-evidence="362-363" />
+<rect class="edge-label-bg" x="71.8" y="1235.5" width="111.8" height="22" rx="3" />
+<text class="edge-label" x="127.8" y="1250.5">valid audience</text>
+<polyline class="edge kind-data style-solid emphasis-normal" points="123.5,1473.0 123.5,1596.0 153.0,1596.0 153.0,1719.0" data-evidence="363-364" />
+<rect class="edge-label-bg" x="92.4" y="1554.0" width="91.7" height="22" rx="3" />
+<text class="edge-label" x="138.2" y="1569.0">realm roles</text>
+<polyline class="edge kind-data style-solid emphasis-normal" points="153.0,1790.0 153.0,1942.5 115.0,1942.5 115.0,2095.0" data-evidence="364-365" />
+<rect class="edge-label-bg" x="88.2" y="1900.5" width="91.7" height="22" rx="3" />
+<text class="edge-label" x="134.0" y="1915.5">authorities</text>
+<g id="node-bearer-input">
+<rect class="node-shape kind-data emphasis-normal role-source" data-evidence="354-359" x="48.5" y="145.0" width="150.0" height="64.0" rx="7" />
+<text class="node-label" x="123.5" y="175.0">Bearer JWT</text>
+</g>
+<g id="node-jwt-decoder">
+<rect class="node-shape kind-service emphasis-normal role-service" data-evidence="359-360" x="45.0" y="455.0" width="150.0" height="71.0" rx="7" />
+<text class="node-label" x="120.0" y="482.0">NimbusJwtDecoder</text>
+<line class="node-detail-divider" x1="59.0" y1="503.0" x2="181.0" y2="503.0" />
+<text class="node-detail" x="61.0" y="520.0">JWK signature</text>
+</g>
+<g id="node-issuer-time">
+<rect class="node-shape kind-service emphasis-normal role-service" data-evidence="361-361" x="43.5" y="765.0" width="150.0" height="74.0" rx="7" />
+<text class="node-label" x="118.5" y="792.0">Issuer · Time</text>
+<text class="node-label" x="118.5" y="810.0">validators</text>
+</g>
+<g id="node-audience-validator">
+<rect class="node-shape kind-service emphasis-primary role-service" data-evidence="362-370" x="45.0" y="1075.0" width="174.0" height="71.0" rx="7" />
+<text class="node-label" x="132.0" y="1102.0">AudienceValidator</text>
+<line class="node-detail-divider" x1="59.0" y1="1123.0" x2="205.0" y2="1123.0" />
+<text class="node-detail" x="61.0" y="1140.0">keycloak-pattern-api</text>
+</g>
+<g id="node-validated-jwt">
+<rect class="node-shape kind-data emphasis-normal role-service" data-evidence="363-363" x="48.5" y="1409.0" width="150.0" height="64.0" rx="7" />
+<text class="node-label" x="123.5" y="1439.0">Validated Jwt</text>
+</g>
+<g id="node-role-converter">
+<rect class="node-shape kind-service emphasis-normal role-service" data-evidence="364-370" x="45.0" y="1719.0" width="216.0" height="71.0" rx="7" />
+<text class="node-label" x="153.0" y="1746.0">Realm role converter</text>
+<line class="node-detail-divider" x1="59.0" y1="1767.0" x2="247.0" y2="1767.0" />
+<text class="node-detail" x="61.0" y="1784.0">KeycloakRealmRoleConverter</text>
+</g>
+<g id="node-principal">
+<g class="actor-symbol emphasis-normal" data-evidence="365-365"><circle cx="115.0" cy="2115.0" r="11.0" /><line x1="115.0" y1="2131.0" x2="115.0" y2="2157.0" /><line x1="97.0" y1="2141.0" x2="133.0" y2="2141.0" /><line x1="115.0" y1="2157.0" x2="100.0" y2="2174.0" /><line x1="115.0" y1="2157.0" x2="130.0" y2="2174.0" /></g>
+<text class="node-label" x="115.0" y="2161.0">Authenticated</text>
+<text class="node-label" x="115.0" y="2179.0">principal</text>
+</g>
+</svg>