%% AP4 proxy session에서 trusted identity JSON까지
%% question: AP4에서 AP4_SESSION은 어떤 순서로 검증되고 allowlisted identity header와 internal token을 거쳐 JSON이 되는가?
sequenceDiagram
    participant n0 as 브라우저
    participant n1 as Nginx edge
    participant n2 as oauth2-proxy
    participant n3 as Spring upstream
    n0->>n1: GET /api/edge + AP4_SESSION
    n1->>n2: internal /oauth2/auth subrequest
    n2->>n1: authenticated user + email
    n1->>n3: GET /edge/me · trusted headers + internal token
    n3->>n1: trusted identity JSON
    n1->>n0: pattern + user + email + identityHeader