# Bearer JWT가 검증과 역할 변환을 지나 principal이 된다
# Question: Resource Server가 받은 Bearer JWT는 어떤 검증과 변환 단계를 지나 authenticated principal이 되는가?
direction: down
n0: "Bearer JWT" {
  shape: rectangle
}
n1: "NimbusJwtDecoder" {
  shape: rectangle
}
n2: "Issuer · Time validators" {
  shape: rectangle
}
n3: "AudienceValidator" {
  shape: rectangle
}
n4: "Validated Jwt" {
  shape: rectangle
}
n5: "Realm role converter" {
  shape: rectangle
}
n6: "Authenticated principal" {
  shape: person
}
n0 -> n1: "decode"
n1 -> n2: "signature ok"
n2 -> n3: "claims"
n3 -> n4: "valid audience"
n4 -> n5: "realm roles"
n5 -> n6: "authorities"