# AP1 callback code에서 브라우저 Bearer 요청까지
# Question: AP1에서 authorization code는 어떤 순서로 브라우저의 Bearer API 요청과 사용자 JSON이 되는가?
direction: right
n0: "브라우저 SPA" {
  shape: rectangle
}
n1: "Keycloak" {
  shape: rectangle
}
n2: "Resource Server" {
  shape: rectangle
}
n0 -> n1: "authorization request · S256 challenge"
n1 -> n0: "callback · code + state"
n0 -> n1: "token request · code + verifier"
n1 -> n0: "access + refresh + ID token"
n0 -> n2: "GET /api/me · Bearer access token"
n2 -> n0: "subject · username · issuer · audience"