%% AP3 session cookie에서 BFF downstream Bearer까지
%% question: AP3에서 브라우저의 AP3_SESSION은 어떻게 BFF가 만든 downstream Bearer 요청과 중계 JSON이 되는가?
sequenceDiagram
    participant n0 as 브라우저
    participant n1 as Spring BFF
    participant n2 as Authorized-client store
    participant n3 as Resource Server
    n0->>n1: GET /bff/api/me + AP3_SESSION
    n1->>n2: authorize current principal
    n2->>n1: server-held access token
    n1->>n3: GET /api/me · Bearer access token
    n3->>n1: subject · username · issuer · audience
    n1->>n0: BFF ResponseEntity → browser JSON