45 lines
4.7 KiB
XML
45 lines
4.7 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<mxfile host="app.diagrams.net" modified="2026-07-23T00:00:00.000Z" agent="techviz-harness" version="24.7.17" type="device">
|
|
<diagram id="ap4-edge-trust-architecture" name="AP4는 공개 edge에서 session을 정제된 upstream identity로 바꾼다">
|
|
<mxGraphModel dx="1080" dy="416" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1080" pageHeight="1169" math="0" shadow="0">
|
|
<root>
|
|
<mxCell id="0"/>
|
|
<mxCell id="1" parent="0"/>
|
|
<mxCell id="g_external-client-zone" value="External browser" style="swimlane;html=1;rounded=1;startSize=30;horizontal=1;dashed=1;strokeWidth=1.5;fillColor=#f7f9fb;strokeColor=#66788a;fontStyle=1;fontSize=13;" vertex="1" parent="1">
|
|
<mxGeometry x="45.0" y="49.0" width="250.0" height="156.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="g_ap4-deployment-zone" value="AP4 deployment path" style="swimlane;html=1;rounded=1;startSize=30;horizontal=1;dashed=1;strokeWidth=1.5;fillColor=#f7f9fb;strokeColor=#66788a;fontStyle=1;fontSize=13;" vertex="1" parent="1">
|
|
<mxGeometry x="565.0" y="49.0" width="470.0" height="322.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="n_browser" value="Browser<br/>HttpOnly AP4_SESSION" tooltip="Opaque AP4_SESSION을 자동 첨부해 공개 edge endpoint를 호출한다. | Evidence: L980-L999" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;dashed=1;fillColor=#f5f7fa;" vertex="1" parent="1">
|
|
<mxGeometry x="75.0" y="95.0" width="190.0" height="84.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="n_nginx" value="Nginx edge<br/>auth_request<br/>client header overwrite" tooltip="Internal auth subrequest를 만들고 검증 결과를 allowlisted upstream header로 다시 조립하는 공개 gateway. | Evidence: L914-L928, L1009-L1028" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
|
|
<mxGeometry x="595.0" y="95.0" width="190.0" height="88.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="n_spring-upstream" value="Spring upstream<br/>X-Auth-Request-User<br/>X-Auth-Request-Email<br/>X-Internal-Auth-Token<br/>/edge/me controller check" tooltip="정제된 user header와 Nginx-owned internal token을 함께 검증하는 /edge/me upstream. | Evidence: L1017-L1037, L1065-L1078" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
|
<mxGeometry x="815.0" y="95.0" width="190.0" height="122.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="n_oauth2-proxy" value="oauth2-proxy<br/>edge-proxy client<br/>minimal cookie session<br/>returns user · email" tooltip="Confidential edge-proxy client이자 AP4_SESSION의 유효성을 판단하는 host 비공개 auth service. | Evidence: L940-L990, L1009-L1014" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
|
|
<mxGeometry x="595.0" y="240.0" width="190.0" height="105.0" as="geometry"/>
|
|
</mxCell>
|
|
<mxCell id="e_browser-to-nginx" value="GET /api/edge · AP4_SESSION" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_browser" target="n_nginx">
|
|
<mxGeometry relative="1" as="geometry">
|
|
<mxPoint x="454.0" y="138.0" as="offset"/>
|
|
</mxGeometry>
|
|
</mxCell>
|
|
<mxCell id="e_nginx-to-oauth2-proxy" value="internal /oauth2/auth subrequest" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_oauth2-proxy">
|
|
<mxGeometry relative="1" as="geometry">
|
|
<mxPoint x="714.0" y="220.2" as="offset"/>
|
|
</mxGeometry>
|
|
</mxCell>
|
|
<mxCell id="e_nginx-to-upstream" value="allowlisted identity + internal token" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_spring-upstream">
|
|
<mxGeometry relative="1" as="geometry">
|
|
<mxPoint x="787.0" y="31.0" as="offset"/>
|
|
</mxGeometry>
|
|
</mxCell>
|
|
</root>
|
|
</mxGraphModel>
|
|
</diagram>
|
|
</mxfile>
|