docs(keycloak-session-store): import the session-storage lab as a new project

The keycloak project ended with four open questions that design could not settle. A two-VM lab was built to answer them by measurement, and this is that material: 26 experiments, 125 raw command outputs, 22 browser captures. Follows the import procedure in README.md. source/ the originating repository verbatim — 78 documents, 28 SVGs, 8 manifests, plus .source-revision recording the commit final/ the SSOT document.md 729 lines written from the 29 experiment documents, not concatenated: what was predicted, what was measured, and where the measurement itself was wrong evidence/raw 125 outputs, flattened to <experiment>__<file> because the originals collided (01-baseline.txt appeared three times) and the audit only globs the top level evidence/meta one per raw file; command and exitCode are null and the README says why rather than inventing them evidence/browser 22 captures assets/ three diagrams through techviz .techviz/ their VizSpecs A separate project rather than an addition to keycloak: the B-layer answers that project's four questions, but the A, C and D layers are about cluster failure, SSO and operations, and one document.md should hold one subject. The four question records there can point here through 관계. Recorded rather than papered over: only three of the 28 diagrams were remade. The repository forbids hand-drawn SVG and forbids titles inside the canvas; all 28 originals carry both, so converting them is redrawing, not reformatting. They stay in source/ and the gap is written into the document. verify-pipeline.py passes. audit-records.py reports no issues. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-04 22:51:59 +09:00
parent 43bccd08a8
commit b2963105a8
5017 changed files with 372751 additions and 4943 deletions
@@ -0,0 +1,78 @@
+# 다섯 검사
+  public static String requireIdentifier(String value) {
+    if (value == null || !IDENTIFIER.matcher(value).matches()) {
+      throw new IllegalArgumentException(
+          "identifier must be 1..128 characters of [A-Za-z0-9._~-] and must not contain a"
+              + " key separator");
+    }
+    String lowerCase = value.toLowerCase(Locale.ROOT);
+    if (value.indexOf('@') >= 0) {
+      throw new IllegalArgumentException("identifier must not contain a mail address");
+    }
+    if (JSON_WEB_TOKEN.matcher(value).matches()) {
+      throw new IllegalArgumentException("identifier must not contain a JSON web token");
+    }
+    if (INTERNATIONAL_PHONE.matcher(value).matches()) {
+      throw new IllegalArgumentException("identifier must not contain a phone number");
+    }
+    if (lowerCase.startsWith("bearer") || lowerCase.startsWith("eyj")) {
+      throw new IllegalArgumentException("identifier must not contain authentication material");
+    }
+    return value;
+  }
+
+# 검사가 쓰는 패턴 넷
+  private static final Pattern IDENTIFIER = Pattern.compile("^[A-Za-z0-9][A-Za-z0-9._~-]{0,127}$");
+
+  private static final Pattern JSON_WEB_TOKEN =
+      Pattern.compile("^[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}$");
+
+  private static final Pattern INTERNATIONAL_PHONE = Pattern.compile("^\\+\\d[\\d.~-]{7,}$");
+
+# 이 메서드에 값을 넣는 test 가 무엇을 단언하는가
+  @Test
+  void rejectsEmailInIdentifier() {
+    assertThatThrownBy(() -> new RedisKeyName("user", "person@example.com"))
+        .isInstanceOf(IllegalArgumentException.class);
+  }
+
+  @Test
+  void rejectsAuthenticationMaterialInIdentifier() {
+    for (String forbidden :
+        List.of(
+            "eyJhbGciOiJIUzI1NiJ9",
+            "bearer-abcdefabcdef",
+            "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.c2lnbmF0dXJlLXZhbHVl")) {
+      assertThatThrownBy(() -> new RedisKeyName("session", forbidden))
+          .as("identifier '%s'", forbidden)
+          .isInstanceOf(IllegalArgumentException.class);
+    }
+  }
+
+  @Test
+  void rejectsInternationalPhoneNumbersInIdentifier() {
+    assertThatThrownBy(() -> new RedisKeyName("contact", "+821012345678"))
+        .isInstanceOf(IllegalArgumentException.class);
+  }
+
+  @Test
+  void rejectsSeparatorInjectionInEveryKeyPart() {
+    assertThatThrownBy(() -> new RedisKeyName("user", "1:2"))
+        .isInstanceOf(IllegalArgumentException.class);
+    assertThatThrownBy(() -> new RedisSlotTag("{nested}"))
+        .isInstanceOf(IllegalArgumentException.class);
+    assertThatThrownBy(() -> new RedisNamespace("prod", "order:service", "shared"))
+        .isInstanceOf(IllegalArgumentException.class);
+  }
+  @Test
+  void rejectsAnIdentifierAboveTheTokenLimit() {
+    String oversized = "a".repeat(129);
+    assertThatThrownBy(() -> new RedisKeyName("user", oversized))
+        .isInstanceOf(IllegalArgumentException.class);
+  }
+
+# 저장소 전체에서 네 메시지가 나오는 곳 (파일 형식 제한 없음)
+    sdk/api/key/RedisKeyRules.java:67:      throw new IllegalArgumentException("identifier must not contain a mail address");
+    sdk/api/key/RedisKeyRules.java:70:      throw new IllegalArgumentException("identifier must not contain a JSON web token");
+    sdk/api/key/RedisKeyRules.java:73:      throw new IllegalArgumentException("identifier must not contain a phone number");
+    sdk/api/key/RedisKeyRules.java:76:      throw new IllegalArgumentException("identifier must not contain authentication material");