2050 lines
69 KiB
JSON
2050 lines
69 KiB
JSON
{
|
|
"schema_version": 2,
|
|
"document": "브라우저 토큰에서 엣지 세션까지: Keycloak 인증 패턴 네 가지의 경계 설계",
|
|
"citation_style": "hidden",
|
|
"reader_document_contains_internal_source_ids": false,
|
|
"sections": [
|
|
{
|
|
"section_id": "01-problem-scene",
|
|
"intent": "problem_scene",
|
|
"title": "코드보다 먼저 드러난 문제",
|
|
"reader_question": "독자가 공감할 수 있는 구체적인 상황에서 어떤 문제가 드러났는가?",
|
|
"decision_requirements": [],
|
|
"evidence": [
|
|
{
|
|
"id": "L4121b8d86b",
|
|
"title": "four pattern tradeoff matrix — Four Keycloak integration patterns",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/four-pattern-tradeoff-matrix.md",
|
|
"heading": "Four Keycloak integration patterns",
|
|
"line_start": 1,
|
|
"line_end": 14,
|
|
"url": "repo:///docs/four-pattern-tradeoff-matrix.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 45.74042
|
|
},
|
|
{
|
|
"id": "AP1_BOUNDARY",
|
|
"title": "AP1 SPA direct의 OAuth·token 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/internal-spa-direct-no-google.md",
|
|
"heading": "AP1 internal SPA direct: local identity profile",
|
|
"line_start": 3,
|
|
"line_end": 10,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/docs/internal-spa-direct-no-google.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP1-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP2_BOUNDARY",
|
|
"title": "AP2 confidential token mediator의 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap2-token-boundary.md",
|
|
"heading": "책임 경계",
|
|
"line_start": 3,
|
|
"line_end": 18,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/docs/ap2-token-boundary.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP2-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_BOUNDARY",
|
|
"title": "AP3 BFF의 tokenless browser 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap3-bff-boundary.md",
|
|
"heading": "요청과 token 경계",
|
|
"line_start": 3,
|
|
"line_end": 18,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/docs/ap3-bff-boundary.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP3-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_BOUNDARY",
|
|
"title": "AP4 oauth2-proxy와 nginx edge 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap4-edge-forward-auth.md",
|
|
"heading": "AP4 oauth2-proxy Edge Forward Auth",
|
|
"line_start": 3,
|
|
"line_end": 70,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docs/ap4-edge-forward-auth.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP4-D1"
|
|
],
|
|
"priority": 100.0
|
|
}
|
|
],
|
|
"evidence_gap": false
|
|
},
|
|
{
|
|
"section_id": "02-constraints",
|
|
"intent": "constraints",
|
|
"title": "문제를 어렵게 만든 제약",
|
|
"reader_question": "단순한 해법을 막은 프로젝트 제약은 무엇이었는가?",
|
|
"decision_requirements": [],
|
|
"evidence": [
|
|
{
|
|
"id": "L4121b8d86b",
|
|
"title": "four pattern tradeoff matrix — Four Keycloak integration patterns",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/four-pattern-tradeoff-matrix.md",
|
|
"heading": "Four Keycloak integration patterns",
|
|
"line_start": 1,
|
|
"line_end": 14,
|
|
"url": "repo:///docs/four-pattern-tradeoff-matrix.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 45.74042
|
|
},
|
|
{
|
|
"id": "AP1_STORAGE",
|
|
"title": "AP1 token 저장 선택과 수용 비용",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap1-token-storage.md",
|
|
"heading": "AP1 token storage trade-off",
|
|
"line_start": 3,
|
|
"line_end": 29,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/docs/ap1-token-storage.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C2"
|
|
],
|
|
"decision_ids": [
|
|
"AP1-D2"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP2_GUARDRAILS",
|
|
"title": "AP2 session, refresh custody, CORS와 audience 가드레일",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "token-mediator/src/main/resources/application.yml",
|
|
"heading": "AP2 session and OAuth client configuration",
|
|
"line_start": 3,
|
|
"line_end": 34,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/resources/application.yml",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C3"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 85.0
|
|
},
|
|
{
|
|
"id": "AP3_TRADEOFF",
|
|
"title": "AP3와 AP1의 위협 모델·운영비 교환",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/bff-vs-spa-direct.md",
|
|
"heading": "BFF vs SPA direct",
|
|
"line_start": 3,
|
|
"line_end": 22,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/docs/bff-vs-spa-direct.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C2"
|
|
],
|
|
"decision_ids": [
|
|
"AP3-D2"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_BOUNDARY",
|
|
"title": "AP4 oauth2-proxy와 nginx edge 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap4-edge-forward-auth.md",
|
|
"heading": "AP4 oauth2-proxy Edge Forward Auth",
|
|
"line_start": 3,
|
|
"line_end": 70,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docs/ap4-edge-forward-auth.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP4-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_RESPONSE_RUNTIME",
|
|
"title": "AP4 trusted header input에서 edge identity JSON까지",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java",
|
|
"heading": "currentUser and hasValidInternalToken",
|
|
"line_start": 27,
|
|
"line_end": 53,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C7"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
}
|
|
],
|
|
"evidence_gap": false
|
|
},
|
|
{
|
|
"section_id": "03-options",
|
|
"intent": "options",
|
|
"title": "검토한 선택지와 막힌 지점",
|
|
"reader_question": "어떤 대안들을 검토했고 각각 어디에서 비용이 생겼는가?",
|
|
"decision_requirements": [
|
|
"상황·제약",
|
|
"선택",
|
|
"선택 이유",
|
|
"검토한 대안",
|
|
"수용한 비용",
|
|
"보완 가드레일"
|
|
],
|
|
"evidence": [
|
|
{
|
|
"id": "L4121b8d86b",
|
|
"title": "four pattern tradeoff matrix — Four Keycloak integration patterns",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/four-pattern-tradeoff-matrix.md",
|
|
"heading": "Four Keycloak integration patterns",
|
|
"line_start": 1,
|
|
"line_end": 14,
|
|
"url": "repo:///docs/four-pattern-tradeoff-matrix.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 45.74042
|
|
},
|
|
{
|
|
"id": "AP1_BOUNDARY",
|
|
"title": "AP1 SPA direct의 OAuth·token 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/internal-spa-direct-no-google.md",
|
|
"heading": "AP1 internal SPA direct: local identity profile",
|
|
"line_start": 3,
|
|
"line_end": 10,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/docs/internal-spa-direct-no-google.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP1-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP1_STORAGE",
|
|
"title": "AP1 token 저장 선택과 수용 비용",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap1-token-storage.md",
|
|
"heading": "AP1 token storage trade-off",
|
|
"line_start": 3,
|
|
"line_end": 29,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/docs/ap1-token-storage.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C2"
|
|
],
|
|
"decision_ids": [
|
|
"AP1-D2"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP2_BOUNDARY",
|
|
"title": "AP2 confidential token mediator의 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap2-token-boundary.md",
|
|
"heading": "책임 경계",
|
|
"line_start": 3,
|
|
"line_end": 18,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/docs/ap2-token-boundary.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP2-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP2_IMPLEMENTATION",
|
|
"title": "AP2 access-only handoff의 실제 구현",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed-discrepancy",
|
|
"path": "token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java",
|
|
"heading": "accessToken",
|
|
"line_start": 28,
|
|
"line_end": 55,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C2"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_BOUNDARY",
|
|
"title": "AP3 BFF의 tokenless browser 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap3-bff-boundary.md",
|
|
"heading": "요청과 token 경계",
|
|
"line_start": 3,
|
|
"line_end": 18,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/docs/ap3-bff-boundary.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP3-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_TRADEOFF",
|
|
"title": "AP3와 AP1의 위협 모델·운영비 교환",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/bff-vs-spa-direct.md",
|
|
"heading": "BFF vs SPA direct",
|
|
"line_start": 3,
|
|
"line_end": 22,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/docs/bff-vs-spa-direct.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C2"
|
|
],
|
|
"decision_ids": [
|
|
"AP3-D2"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_BOUNDARY",
|
|
"title": "AP4 oauth2-proxy와 nginx edge 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap4-edge-forward-auth.md",
|
|
"heading": "AP4 oauth2-proxy Edge Forward Auth",
|
|
"line_start": 3,
|
|
"line_end": 70,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docs/ap4-edge-forward-auth.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP4-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_ALTERNATIVE",
|
|
"title": "AP4 Traefik ForwardAuth 대안과 추가 비용",
|
|
"source_type": "branch-note",
|
|
"status": "config-tested",
|
|
"path": "docs/traefik-forwardauth-alternative.md",
|
|
"heading": "Traefik ForwardAuth alternative",
|
|
"line_start": 3,
|
|
"line_end": 22,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docs/traefik-forwardauth-alternative.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C4"
|
|
],
|
|
"decision_ids": [
|
|
"AP4-D2"
|
|
],
|
|
"priority": 85.0
|
|
}
|
|
],
|
|
"evidence_gap": false
|
|
},
|
|
{
|
|
"section_id": "04-decision-rationale",
|
|
"intent": "decision_rationale",
|
|
"title": "선택의 이유와 지킨 경계",
|
|
"reader_question": "왜 이 선택을 했으며 무엇을 일부러 포기하거나 금지했는가?",
|
|
"decision_requirements": [
|
|
"상황·제약",
|
|
"선택",
|
|
"선택 이유",
|
|
"검토한 대안",
|
|
"수용한 비용",
|
|
"보완 가드레일"
|
|
],
|
|
"evidence": [
|
|
{
|
|
"id": "AP1_BOUNDARY",
|
|
"title": "AP1 SPA direct의 OAuth·token 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/internal-spa-direct-no-google.md",
|
|
"heading": "AP1 internal SPA direct: local identity profile",
|
|
"line_start": 3,
|
|
"line_end": 10,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/docs/internal-spa-direct-no-google.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP1-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP1_STORAGE",
|
|
"title": "AP1 token 저장 선택과 수용 비용",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap1-token-storage.md",
|
|
"heading": "AP1 token storage trade-off",
|
|
"line_start": 3,
|
|
"line_end": 29,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/docs/ap1-token-storage.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C2"
|
|
],
|
|
"decision_ids": [
|
|
"AP1-D2"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP2_BOUNDARY",
|
|
"title": "AP2 confidential token mediator의 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap2-token-boundary.md",
|
|
"heading": "책임 경계",
|
|
"line_start": 3,
|
|
"line_end": 18,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/docs/ap2-token-boundary.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP2-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_BOUNDARY",
|
|
"title": "AP3 BFF의 tokenless browser 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap3-bff-boundary.md",
|
|
"heading": "요청과 token 경계",
|
|
"line_start": 3,
|
|
"line_end": 18,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/docs/ap3-bff-boundary.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP3-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_TRADEOFF",
|
|
"title": "AP3와 AP1의 위협 모델·운영비 교환",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/bff-vs-spa-direct.md",
|
|
"heading": "BFF vs SPA direct",
|
|
"line_start": 3,
|
|
"line_end": 22,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/docs/bff-vs-spa-direct.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C2"
|
|
],
|
|
"decision_ids": [
|
|
"AP3-D2"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_BOUNDARY",
|
|
"title": "AP4 oauth2-proxy와 nginx edge 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap4-edge-forward-auth.md",
|
|
"heading": "AP4 oauth2-proxy Edge Forward Auth",
|
|
"line_start": 3,
|
|
"line_end": 70,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docs/ap4-edge-forward-auth.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP4-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_ALTERNATIVE",
|
|
"title": "AP4 Traefik ForwardAuth 대안과 추가 비용",
|
|
"source_type": "branch-note",
|
|
"status": "config-tested",
|
|
"path": "docs/traefik-forwardauth-alternative.md",
|
|
"heading": "Traefik ForwardAuth alternative",
|
|
"line_start": 3,
|
|
"line_end": 22,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docs/traefik-forwardauth-alternative.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C4"
|
|
],
|
|
"decision_ids": [
|
|
"AP4-D2"
|
|
],
|
|
"priority": 85.0
|
|
}
|
|
],
|
|
"evidence_gap": false
|
|
},
|
|
{
|
|
"section_id": "05-mechanism",
|
|
"intent": "mechanism",
|
|
"title": "선택이 코드와 흐름에 반영되는 방식",
|
|
"reader_question": "결정이 모듈, 인터페이스, 제어 흐름에 어떻게 반영되는가?",
|
|
"decision_requirements": [],
|
|
"evidence": [
|
|
{
|
|
"id": "AP1_LOGIN_RUNTIME",
|
|
"title": "AP1 SPA authorization, callback와 browser token data flow",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "frontend/src/app.js",
|
|
"heading": "UserManager configuration, callback, and renderSession",
|
|
"line_start": 9,
|
|
"line_end": 81,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/frontend/src/app.js",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C4"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP1_PKCE_DEMO_GAP",
|
|
"title": "AP1 manual PKCE helper와 실제 signin path의 구분",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed-gap",
|
|
"path": "frontend/src/pkce.js",
|
|
"heading": "createPkcePair",
|
|
"line_start": 1,
|
|
"line_end": 25,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/frontend/src/pkce.js",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C5"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 85.0
|
|
},
|
|
{
|
|
"id": "AP1_API_RUNTIME",
|
|
"title": "AP1 browser Bearer input에서 /api/me JSON까지",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "frontend/src/app.js",
|
|
"heading": "callProtectedApi",
|
|
"line_start": 83,
|
|
"line_end": 109,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/frontend/src/app.js",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C6"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP1_ROLE_FAILURE_RUNTIME",
|
|
"title": "AP1 JWT failure와 realm role authorization 경계",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed-gap",
|
|
"path": "backend/src/main/java/com/example/keycloakpattern/KeycloakRealmRoleConverter.java",
|
|
"heading": "convert",
|
|
"line_start": 12,
|
|
"line_end": 27,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/backend/src/main/java/com/example/keycloakpattern/KeycloakRealmRoleConverter.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C7"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 90.0
|
|
},
|
|
{
|
|
"id": "AP2_LOGIN_FLOW",
|
|
"title": "AP2 browser entry와 Spring oauth2Login code 교환",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "token-mediator/src/main/resources/static/app.js",
|
|
"heading": "loginButton click and OAuth client registration",
|
|
"line_start": 7,
|
|
"line_end": 9,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/resources/static/app.js",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C4"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 90.0
|
|
},
|
|
{
|
|
"id": "AP2_BOUNDARY_RUNTIME",
|
|
"title": "AP2 token boundary endpoint input과 output",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "token-mediator/src/main/java/com/example/keycloakpattern/mediator/TokenBoundaryController.java",
|
|
"heading": "tokenBoundary",
|
|
"line_start": 25,
|
|
"line_end": 42,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/java/com/example/keycloakpattern/mediator/TokenBoundaryController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C5"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 95.0
|
|
},
|
|
{
|
|
"id": "AP2_ACCESS_RUNTIME",
|
|
"title": "AP2 access handoff와 browser direct API의 data transformation",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java",
|
|
"heading": "accessToken",
|
|
"line_start": 28,
|
|
"line_end": 54,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C6"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP2_RESOURCE_RUNTIME",
|
|
"title": "AP2 Resource Server의 JWT input과 /api/me output",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "backend/src/main/java/com/example/keycloakpattern/ApiController.java",
|
|
"heading": "currentUser",
|
|
"line_start": 21,
|
|
"line_end": 28,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/backend/src/main/java/com/example/keycloakpattern/ApiController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C7"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 95.0
|
|
},
|
|
{
|
|
"id": "AP3_LOGIN_FLOW",
|
|
"title": "AP3 oauth2Login과 server-side PKCE data flow",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/SecurityConfig.java",
|
|
"heading": "authorizationRequestResolver and bffSecurity",
|
|
"line_start": 20,
|
|
"line_end": 58,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/SecurityConfig.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C4"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 95.0
|
|
},
|
|
{
|
|
"id": "AP3_BOUNDARY_RUNTIME",
|
|
"title": "AP3 token boundary endpoint의 input과 관측 output",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"heading": "tokenBoundary",
|
|
"line_start": 44,
|
|
"line_end": 64,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C5"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 95.0
|
|
},
|
|
{
|
|
"id": "AP3_API_RUNTIME",
|
|
"title": "AP3 session input에서 downstream Bearer와 reader JSON까지",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"heading": "currentUser and authorizedClient",
|
|
"line_start": 67,
|
|
"line_end": 111,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C6"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_CSRF_RUNTIME",
|
|
"title": "AP3 CSRF cookie-to-header transformation과 preferences output",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/CsrfController.java",
|
|
"heading": "csrf",
|
|
"line_start": 14,
|
|
"line_end": 23,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/CsrfController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C7"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_PREFERENCE_SCOPE",
|
|
"title": "AP3 preferences 예시의 process-global state 간극",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed-gap",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"heading": "preferenceTheme and updatePreferences",
|
|
"line_start": 28,
|
|
"line_end": 95,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C8"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 90.0
|
|
},
|
|
{
|
|
"id": "AP4_LOGIN_RUNTIME",
|
|
"title": "AP4 unauthenticated navigation에서 oauth2-proxy session까지",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "docker-compose.yml",
|
|
"heading": "oauth2-proxy service",
|
|
"line_start": 92,
|
|
"line_end": 143,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docker-compose.yml",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C5"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_REQUEST_RUNTIME",
|
|
"title": "AP4 external request에서 auth subrequest와 upstream input까지",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "frontend/default.conf.template",
|
|
"heading": "auth_request and upstream mapping",
|
|
"line_start": 13,
|
|
"line_end": 74,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/frontend/default.conf.template",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C6"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_RESPONSE_RUNTIME",
|
|
"title": "AP4 trusted header input에서 edge identity JSON까지",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java",
|
|
"heading": "currentUser and hasValidInternalToken",
|
|
"line_start": 27,
|
|
"line_end": 53,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C7"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
}
|
|
],
|
|
"evidence_gap": false
|
|
},
|
|
{
|
|
"section_id": "06-evidence-verification",
|
|
"intent": "evidence_verification",
|
|
"title": "결정이 지켜지는지 확인하는 방법",
|
|
"reader_question": "설명한 경계와 결과가 실제로 유지되는지 어떻게 확인하는가?",
|
|
"decision_requirements": [],
|
|
"evidence": [
|
|
{
|
|
"id": "AP1_VERIFY",
|
|
"title": "AP1 브라우저 흐름과 token 수명주기 검증 계약",
|
|
"source_type": "canonical-project",
|
|
"status": "test-defined",
|
|
"path": "e2e/pattern1.mjs",
|
|
"heading": "AP1 Playwright acceptance contract",
|
|
"line_start": 82,
|
|
"line_end": 202,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/e2e/pattern1.mjs",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-T1"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 80.0
|
|
},
|
|
{
|
|
"id": "AP1_ROLE_FAILURE_RUNTIME",
|
|
"title": "AP1 JWT failure와 realm role authorization 경계",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed-gap",
|
|
"path": "backend/src/main/java/com/example/keycloakpattern/KeycloakRealmRoleConverter.java",
|
|
"heading": "convert",
|
|
"line_start": 12,
|
|
"line_end": 27,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/backend/src/main/java/com/example/keycloakpattern/KeycloakRealmRoleConverter.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C7"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 90.0
|
|
},
|
|
{
|
|
"id": "AP2_VERIFY",
|
|
"title": "AP2 access-only 전달과 브라우저 직접 API 호출 검증 계약",
|
|
"source_type": "canonical-project",
|
|
"status": "test-defined",
|
|
"path": "e2e/pattern2.mjs",
|
|
"heading": "AP2 Playwright acceptance contract",
|
|
"line_start": 39,
|
|
"line_end": 112,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/e2e/pattern2.mjs",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-T1"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 80.0
|
|
},
|
|
{
|
|
"id": "AP2_ACCESS_RUNTIME",
|
|
"title": "AP2 access handoff와 browser direct API의 data transformation",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java",
|
|
"heading": "accessToken",
|
|
"line_start": 28,
|
|
"line_end": 54,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C6"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_VERIFY",
|
|
"title": "AP3 browser token 비노출과 CSRF 방어 검증 계약",
|
|
"source_type": "canonical-project",
|
|
"status": "test-defined",
|
|
"path": "e2e/pattern3.mjs",
|
|
"heading": "AP3 Playwright acceptance contract",
|
|
"line_start": 43,
|
|
"line_end": 191,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/e2e/pattern3.mjs",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-T1"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 80.0
|
|
},
|
|
{
|
|
"id": "AP3_CSRF_RUNTIME",
|
|
"title": "AP3 CSRF cookie-to-header transformation과 preferences output",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/CsrfController.java",
|
|
"heading": "csrf",
|
|
"line_start": 14,
|
|
"line_end": 23,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/CsrfController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C7"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_VERIFY",
|
|
"title": "AP4 edge login과 header spoofing 방어 검증 계약",
|
|
"source_type": "canonical-project",
|
|
"status": "test-defined",
|
|
"path": "e2e/pattern4.mjs",
|
|
"heading": "AP4 Playwright acceptance contract",
|
|
"line_start": 44,
|
|
"line_end": 131,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/e2e/pattern4.mjs",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-T1"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 80.0
|
|
},
|
|
{
|
|
"id": "AP4_RESPONSE_RUNTIME",
|
|
"title": "AP4 trusted header input에서 edge identity JSON까지",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java",
|
|
"heading": "currentUser and hasValidInternalToken",
|
|
"line_start": 27,
|
|
"line_end": 53,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C7"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "BRANCH_REACHABILITY",
|
|
"title": "네 pattern branch와 39개 feature ref의 도달성",
|
|
"source_type": "canonical-project",
|
|
"status": "partially-verified",
|
|
"path": "docs/keycloak-branch-manifest.tsv",
|
|
"heading": "branch target delivery registry",
|
|
"line_start": 1,
|
|
"line_end": 40,
|
|
"url": "repo://keycloak-pattern/develop/docs/keycloak-branch-manifest.tsv",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"COMMON-T1"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 70.0
|
|
}
|
|
],
|
|
"evidence_gap": false
|
|
},
|
|
{
|
|
"section_id": "07-tradeoffs",
|
|
"intent": "tradeoffs",
|
|
"title": "얻은 것, 잃은 것, 적용하지 않을 때",
|
|
"reader_question": "이 선택의 비용과 한계는 무엇이며 언제 다른 선택이 나은가?",
|
|
"decision_requirements": [
|
|
"상황·제약",
|
|
"선택",
|
|
"선택 이유",
|
|
"검토한 대안",
|
|
"수용한 비용",
|
|
"보완 가드레일"
|
|
],
|
|
"evidence": [
|
|
{
|
|
"id": "L4121b8d86b",
|
|
"title": "four pattern tradeoff matrix — Four Keycloak integration patterns",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/four-pattern-tradeoff-matrix.md",
|
|
"heading": "Four Keycloak integration patterns",
|
|
"line_start": 1,
|
|
"line_end": 14,
|
|
"url": "repo:///docs/four-pattern-tradeoff-matrix.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 45.74042
|
|
},
|
|
{
|
|
"id": "AP1_STORAGE",
|
|
"title": "AP1 token 저장 선택과 수용 비용",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap1-token-storage.md",
|
|
"heading": "AP1 token storage trade-off",
|
|
"line_start": 3,
|
|
"line_end": 29,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/docs/ap1-token-storage.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C2"
|
|
],
|
|
"decision_ids": [
|
|
"AP1-D2"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP2_GUARDRAILS",
|
|
"title": "AP2 session, refresh custody, CORS와 audience 가드레일",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "token-mediator/src/main/resources/application.yml",
|
|
"heading": "AP2 session and OAuth client configuration",
|
|
"line_start": 3,
|
|
"line_end": 34,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/resources/application.yml",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C3"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 85.0
|
|
},
|
|
{
|
|
"id": "AP3_TRADEOFF",
|
|
"title": "AP3와 AP1의 위협 모델·운영비 교환",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/bff-vs-spa-direct.md",
|
|
"heading": "BFF vs SPA direct",
|
|
"line_start": 3,
|
|
"line_end": 22,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/docs/bff-vs-spa-direct.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C2"
|
|
],
|
|
"decision_ids": [
|
|
"AP3-D2"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_PREFERENCE_SCOPE",
|
|
"title": "AP3 preferences 예시의 process-global state 간극",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed-gap",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"heading": "preferenceTheme and updatePreferences",
|
|
"line_start": 28,
|
|
"line_end": 95,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C8"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 90.0
|
|
},
|
|
{
|
|
"id": "AP4_BOUNDARY",
|
|
"title": "AP4 oauth2-proxy와 nginx edge 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap4-edge-forward-auth.md",
|
|
"heading": "AP4 oauth2-proxy Edge Forward Auth",
|
|
"line_start": 3,
|
|
"line_end": 70,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docs/ap4-edge-forward-auth.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP4-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_ALTERNATIVE",
|
|
"title": "AP4 Traefik ForwardAuth 대안과 추가 비용",
|
|
"source_type": "branch-note",
|
|
"status": "config-tested",
|
|
"path": "docs/traefik-forwardauth-alternative.md",
|
|
"heading": "Traefik ForwardAuth alternative",
|
|
"line_start": 3,
|
|
"line_end": 22,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docs/traefik-forwardauth-alternative.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C4"
|
|
],
|
|
"decision_ids": [
|
|
"AP4-D2"
|
|
],
|
|
"priority": 85.0
|
|
}
|
|
],
|
|
"evidence_gap": false
|
|
},
|
|
{
|
|
"section_id": "08-conclusion",
|
|
"intent": "conclusion",
|
|
"title": "결국 지키려던 것은 무엇이었나",
|
|
"reader_question": "세부 기술을 걷어냈을 때 남는 판단은 무엇인가?",
|
|
"decision_requirements": [],
|
|
"evidence": [
|
|
{
|
|
"id": "L4121b8d86b",
|
|
"title": "four pattern tradeoff matrix — Four Keycloak integration patterns",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/four-pattern-tradeoff-matrix.md",
|
|
"heading": "Four Keycloak integration patterns",
|
|
"line_start": 1,
|
|
"line_end": 14,
|
|
"url": "repo:///docs/four-pattern-tradeoff-matrix.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 45.74042
|
|
},
|
|
{
|
|
"id": "AP1_BOUNDARY",
|
|
"title": "AP1 SPA direct의 OAuth·token 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/internal-spa-direct-no-google.md",
|
|
"heading": "AP1 internal SPA direct: local identity profile",
|
|
"line_start": 3,
|
|
"line_end": 10,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/docs/internal-spa-direct-no-google.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP1-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP2_BOUNDARY",
|
|
"title": "AP2 confidential token mediator의 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap2-token-boundary.md",
|
|
"heading": "책임 경계",
|
|
"line_start": 3,
|
|
"line_end": 18,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/docs/ap2-token-boundary.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP2-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_BOUNDARY",
|
|
"title": "AP3 BFF의 tokenless browser 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap3-bff-boundary.md",
|
|
"heading": "요청과 token 경계",
|
|
"line_start": 3,
|
|
"line_end": 18,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/docs/ap3-bff-boundary.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP3-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_BOUNDARY",
|
|
"title": "AP4 oauth2-proxy와 nginx edge 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap4-edge-forward-auth.md",
|
|
"heading": "AP4 oauth2-proxy Edge Forward Auth",
|
|
"line_start": 3,
|
|
"line_end": 70,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docs/ap4-edge-forward-auth.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP4-D1"
|
|
],
|
|
"priority": 100.0
|
|
}
|
|
],
|
|
"evidence_gap": false
|
|
}
|
|
],
|
|
"sources": [
|
|
{
|
|
"id": "AP1_BOUNDARY",
|
|
"title": "AP1 SPA direct의 OAuth·token 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/internal-spa-direct-no-google.md",
|
|
"heading": "AP1 internal SPA direct: local identity profile",
|
|
"line_start": 3,
|
|
"line_end": 10,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/docs/internal-spa-direct-no-google.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP1-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP1_STORAGE",
|
|
"title": "AP1 token 저장 선택과 수용 비용",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap1-token-storage.md",
|
|
"heading": "AP1 token storage trade-off",
|
|
"line_start": 3,
|
|
"line_end": 29,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/docs/ap1-token-storage.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C2"
|
|
],
|
|
"decision_ids": [
|
|
"AP1-D2"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP1_LOGIN_RUNTIME",
|
|
"title": "AP1 SPA authorization, callback와 browser token data flow",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "frontend/src/app.js",
|
|
"heading": "UserManager configuration, callback, and renderSession",
|
|
"line_start": 9,
|
|
"line_end": 81,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/frontend/src/app.js",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C4"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP1_PKCE_DEMO_GAP",
|
|
"title": "AP1 manual PKCE helper와 실제 signin path의 구분",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed-gap",
|
|
"path": "frontend/src/pkce.js",
|
|
"heading": "createPkcePair",
|
|
"line_start": 1,
|
|
"line_end": 25,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/frontend/src/pkce.js",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C5"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 85.0
|
|
},
|
|
{
|
|
"id": "AP1_API_RUNTIME",
|
|
"title": "AP1 browser Bearer input에서 /api/me JSON까지",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "frontend/src/app.js",
|
|
"heading": "callProtectedApi",
|
|
"line_start": 83,
|
|
"line_end": 109,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/frontend/src/app.js",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C6"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP1_ROLE_FAILURE_RUNTIME",
|
|
"title": "AP1 JWT failure와 realm role authorization 경계",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed-gap",
|
|
"path": "backend/src/main/java/com/example/keycloakpattern/KeycloakRealmRoleConverter.java",
|
|
"heading": "convert",
|
|
"line_start": 12,
|
|
"line_end": 27,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/backend/src/main/java/com/example/keycloakpattern/KeycloakRealmRoleConverter.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C7"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 90.0
|
|
},
|
|
{
|
|
"id": "AP1_GUARDRAILS",
|
|
"title": "AP1 public client와 Resource Server 가드레일",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "keycloak/import/keycloak-patterns-realm.json",
|
|
"heading": "spa-public client and realm token settings",
|
|
"line_start": 11,
|
|
"line_end": 73,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/keycloak/import/keycloak-patterns-realm.json",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-C3"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 85.0
|
|
},
|
|
{
|
|
"id": "AP1_VERIFY",
|
|
"title": "AP1 브라우저 흐름과 token 수명주기 검증 계약",
|
|
"source_type": "canonical-project",
|
|
"status": "test-defined",
|
|
"path": "e2e/pattern1.mjs",
|
|
"heading": "AP1 Playwright acceptance contract",
|
|
"line_start": 82,
|
|
"line_end": 202,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern1/e2e/pattern1.mjs",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP1-T1"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 80.0
|
|
},
|
|
{
|
|
"id": "AP2_BOUNDARY",
|
|
"title": "AP2 confidential token mediator의 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap2-token-boundary.md",
|
|
"heading": "책임 경계",
|
|
"line_start": 3,
|
|
"line_end": 18,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/docs/ap2-token-boundary.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP2-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP2_IMPLEMENTATION",
|
|
"title": "AP2 access-only handoff의 실제 구현",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed-discrepancy",
|
|
"path": "token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java",
|
|
"heading": "accessToken",
|
|
"line_start": 28,
|
|
"line_end": 55,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C2"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP2_LOGIN_FLOW",
|
|
"title": "AP2 browser entry와 Spring oauth2Login code 교환",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "token-mediator/src/main/resources/static/app.js",
|
|
"heading": "loginButton click and OAuth client registration",
|
|
"line_start": 7,
|
|
"line_end": 9,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/resources/static/app.js",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C4"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 90.0
|
|
},
|
|
{
|
|
"id": "AP2_BOUNDARY_RUNTIME",
|
|
"title": "AP2 token boundary endpoint input과 output",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "token-mediator/src/main/java/com/example/keycloakpattern/mediator/TokenBoundaryController.java",
|
|
"heading": "tokenBoundary",
|
|
"line_start": 25,
|
|
"line_end": 42,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/java/com/example/keycloakpattern/mediator/TokenBoundaryController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C5"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 95.0
|
|
},
|
|
{
|
|
"id": "AP2_ACCESS_RUNTIME",
|
|
"title": "AP2 access handoff와 browser direct API의 data transformation",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java",
|
|
"heading": "accessToken",
|
|
"line_start": 28,
|
|
"line_end": 54,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/java/com/example/keycloakpattern/mediator/AccessTokenController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C6"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP2_RESOURCE_RUNTIME",
|
|
"title": "AP2 Resource Server의 JWT input과 /api/me output",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "backend/src/main/java/com/example/keycloakpattern/ApiController.java",
|
|
"heading": "currentUser",
|
|
"line_start": 21,
|
|
"line_end": 28,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/backend/src/main/java/com/example/keycloakpattern/ApiController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C7"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 95.0
|
|
},
|
|
{
|
|
"id": "AP2_GUARDRAILS",
|
|
"title": "AP2 session, refresh custody, CORS와 audience 가드레일",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "token-mediator/src/main/resources/application.yml",
|
|
"heading": "AP2 session and OAuth client configuration",
|
|
"line_start": 3,
|
|
"line_end": 34,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/token-mediator/src/main/resources/application.yml",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-C3"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 85.0
|
|
},
|
|
{
|
|
"id": "AP2_VERIFY",
|
|
"title": "AP2 access-only 전달과 브라우저 직접 API 호출 검증 계약",
|
|
"source_type": "canonical-project",
|
|
"status": "test-defined",
|
|
"path": "e2e/pattern2.mjs",
|
|
"heading": "AP2 Playwright acceptance contract",
|
|
"line_start": 39,
|
|
"line_end": 112,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern2/e2e/pattern2.mjs",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP2-T1"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 80.0
|
|
},
|
|
{
|
|
"id": "AP3_BOUNDARY",
|
|
"title": "AP3 BFF의 tokenless browser 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap3-bff-boundary.md",
|
|
"heading": "요청과 token 경계",
|
|
"line_start": 3,
|
|
"line_end": 18,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/docs/ap3-bff-boundary.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP3-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_TRADEOFF",
|
|
"title": "AP3와 AP1의 위협 모델·운영비 교환",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/bff-vs-spa-direct.md",
|
|
"heading": "BFF vs SPA direct",
|
|
"line_start": 3,
|
|
"line_end": 22,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/docs/bff-vs-spa-direct.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C2"
|
|
],
|
|
"decision_ids": [
|
|
"AP3-D2"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_GUARDRAILS",
|
|
"title": "AP3 CSRF token과 SameSite 가드레일",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/SecurityConfig.java",
|
|
"heading": "bffSecurity",
|
|
"line_start": 25,
|
|
"line_end": 58,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/SecurityConfig.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C3"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 85.0
|
|
},
|
|
{
|
|
"id": "AP3_LOGIN_FLOW",
|
|
"title": "AP3 oauth2Login과 server-side PKCE data flow",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/SecurityConfig.java",
|
|
"heading": "authorizationRequestResolver and bffSecurity",
|
|
"line_start": 20,
|
|
"line_end": 58,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/SecurityConfig.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C4"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 95.0
|
|
},
|
|
{
|
|
"id": "AP3_BOUNDARY_RUNTIME",
|
|
"title": "AP3 token boundary endpoint의 input과 관측 output",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"heading": "tokenBoundary",
|
|
"line_start": 44,
|
|
"line_end": 64,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C5"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 95.0
|
|
},
|
|
{
|
|
"id": "AP3_API_RUNTIME",
|
|
"title": "AP3 session input에서 downstream Bearer와 reader JSON까지",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"heading": "currentUser and authorizedClient",
|
|
"line_start": 67,
|
|
"line_end": 111,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C6"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_CSRF_RUNTIME",
|
|
"title": "AP3 CSRF cookie-to-header transformation과 preferences output",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/CsrfController.java",
|
|
"heading": "csrf",
|
|
"line_start": 14,
|
|
"line_end": 23,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/CsrfController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C7"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP3_PREFERENCE_SCOPE",
|
|
"title": "AP3 preferences 예시의 process-global state 간극",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed-gap",
|
|
"path": "bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"heading": "preferenceTheme and updatePreferences",
|
|
"line_start": 28,
|
|
"line_end": 95,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/bff/src/main/java/com/example/keycloakpattern/bff/BffController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-C8"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 90.0
|
|
},
|
|
{
|
|
"id": "AP3_VERIFY",
|
|
"title": "AP3 browser token 비노출과 CSRF 방어 검증 계약",
|
|
"source_type": "canonical-project",
|
|
"status": "test-defined",
|
|
"path": "e2e/pattern3.mjs",
|
|
"heading": "AP3 Playwright acceptance contract",
|
|
"line_start": 43,
|
|
"line_end": 191,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern3/e2e/pattern3.mjs",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP3-T1"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 80.0
|
|
},
|
|
{
|
|
"id": "AP4_BOUNDARY",
|
|
"title": "AP4 oauth2-proxy와 nginx edge 책임 경계",
|
|
"source_type": "branch-note",
|
|
"status": "reviewed",
|
|
"path": "docs/ap4-edge-forward-auth.md",
|
|
"heading": "AP4 oauth2-proxy Edge Forward Auth",
|
|
"line_start": 3,
|
|
"line_end": 70,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docs/ap4-edge-forward-auth.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C1"
|
|
],
|
|
"decision_ids": [
|
|
"AP4-D1"
|
|
],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_NGINX",
|
|
"title": "AP4 auth_request와 identity header 덮어쓰기",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "frontend/default.conf.template",
|
|
"heading": "nginx AP4 server configuration",
|
|
"line_start": 13,
|
|
"line_end": 74,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/frontend/default.conf.template",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C2"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 90.0
|
|
},
|
|
{
|
|
"id": "AP4_LOGIN_RUNTIME",
|
|
"title": "AP4 unauthenticated navigation에서 oauth2-proxy session까지",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "docker-compose.yml",
|
|
"heading": "oauth2-proxy service",
|
|
"line_start": 92,
|
|
"line_end": 143,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docker-compose.yml",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C5"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_REQUEST_RUNTIME",
|
|
"title": "AP4 external request에서 auth subrequest와 upstream input까지",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "frontend/default.conf.template",
|
|
"heading": "auth_request and upstream mapping",
|
|
"line_start": 13,
|
|
"line_end": 74,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/frontend/default.conf.template",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C6"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_RESPONSE_RUNTIME",
|
|
"title": "AP4 trusted header input에서 edge identity JSON까지",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java",
|
|
"heading": "currentUser and hasValidInternalToken",
|
|
"line_start": 27,
|
|
"line_end": 53,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C7"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 100.0
|
|
},
|
|
{
|
|
"id": "AP4_BACKEND",
|
|
"title": "AP4 upstream의 내부 token 검증",
|
|
"source_type": "canonical-project",
|
|
"status": "reviewed",
|
|
"path": "backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java",
|
|
"heading": "currentUser and hasValidInternalToken",
|
|
"line_start": 18,
|
|
"line_end": 53,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C3"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 85.0
|
|
},
|
|
{
|
|
"id": "AP4_VERIFY",
|
|
"title": "AP4 edge login과 header spoofing 방어 검증 계약",
|
|
"source_type": "canonical-project",
|
|
"status": "test-defined",
|
|
"path": "e2e/pattern4.mjs",
|
|
"heading": "AP4 Playwright acceptance contract",
|
|
"line_start": 44,
|
|
"line_end": 131,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/e2e/pattern4.mjs",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-T1"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 80.0
|
|
},
|
|
{
|
|
"id": "AP4_ALTERNATIVE",
|
|
"title": "AP4 Traefik ForwardAuth 대안과 추가 비용",
|
|
"source_type": "branch-note",
|
|
"status": "config-tested",
|
|
"path": "docs/traefik-forwardauth-alternative.md",
|
|
"heading": "Traefik ForwardAuth alternative",
|
|
"line_start": 3,
|
|
"line_end": 22,
|
|
"url": "repo://keycloak-pattern/develop-keycloak-pattern4/docs/traefik-forwardauth-alternative.md",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"AP4-C4"
|
|
],
|
|
"decision_ids": [
|
|
"AP4-D2"
|
|
],
|
|
"priority": 85.0
|
|
},
|
|
{
|
|
"id": "BRANCH_REACHABILITY",
|
|
"title": "네 pattern branch와 39개 feature ref의 도달성",
|
|
"source_type": "canonical-project",
|
|
"status": "partially-verified",
|
|
"path": "docs/keycloak-branch-manifest.tsv",
|
|
"heading": "branch target delivery registry",
|
|
"line_start": 1,
|
|
"line_end": 40,
|
|
"url": "repo://keycloak-pattern/develop/docs/keycloak-branch-manifest.tsv",
|
|
"accessed": "",
|
|
"claim_ids": [
|
|
"COMMON-T1"
|
|
],
|
|
"decision_ids": [],
|
|
"priority": 70.0
|
|
},
|
|
{
|
|
"id": "L4121b8d86b",
|
|
"title": "four pattern tradeoff matrix — Four Keycloak integration patterns",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/four-pattern-tradeoff-matrix.md",
|
|
"heading": "Four Keycloak integration patterns",
|
|
"line_start": 1,
|
|
"line_end": 14,
|
|
"url": "repo:///docs/four-pattern-tradeoff-matrix.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 45.74042
|
|
},
|
|
{
|
|
"id": "La5d0a70f24",
|
|
"title": "four pattern tradeoff matrix — 이 repository의 실행 증거",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/four-pattern-tradeoff-matrix.md",
|
|
"heading": "이 repository의 실행 증거",
|
|
"line_start": 28,
|
|
"line_end": 37,
|
|
"url": "repo:///docs/four-pattern-tradeoff-matrix.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 21.712857
|
|
},
|
|
{
|
|
"id": "L2c120c8093",
|
|
"title": "four pattern tradeoff matrix — 선택 기준",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/four-pattern-tradeoff-matrix.md",
|
|
"heading": "선택 기준",
|
|
"line_start": 15,
|
|
"line_end": 27,
|
|
"url": "repo:///docs/four-pattern-tradeoff-matrix.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 17.280962
|
|
},
|
|
{
|
|
"id": "L4ec23ba045",
|
|
"title": "keycloak branch index — Keycloak branch implementation index",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/keycloak-branch-index.md",
|
|
"heading": "Keycloak branch implementation index",
|
|
"line_start": 1,
|
|
"line_end": 29,
|
|
"url": "repo:///docs/keycloak-branch-index.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 14.830096
|
|
},
|
|
{
|
|
"id": "Lb39734ea9b",
|
|
"title": "google idp brokering — Google IdP brokering",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/google-idp-brokering.md",
|
|
"heading": "Google IdP brokering",
|
|
"line_start": 1,
|
|
"line_end": 5,
|
|
"url": "repo:///docs/google-idp-brokering.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 5.851474
|
|
},
|
|
{
|
|
"id": "La28755902d",
|
|
"title": "google claim to role — Google claim-to-role mapping",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/google-claim-to-role.md",
|
|
"heading": "Google claim-to-role mapping",
|
|
"line_start": 1,
|
|
"line_end": 18,
|
|
"url": "repo:///docs/google-claim-to-role.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 4.750257
|
|
},
|
|
{
|
|
"id": "Le8474e5ddd",
|
|
"title": "https termination — HTTPS termination: nginx or Caddy",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/https-termination.md",
|
|
"heading": "HTTPS termination: nginx or Caddy",
|
|
"line_start": 1,
|
|
"line_end": 20,
|
|
"url": "repo:///docs/https-termination.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 2.684955
|
|
},
|
|
{
|
|
"id": "L0eb117abf5",
|
|
"title": "google redirect uri policy — Google redirect URI policy",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/google-redirect-uri-policy.md",
|
|
"heading": "Google redirect URI policy",
|
|
"line_start": 1,
|
|
"line_end": 24,
|
|
"url": "repo:///docs/google-redirect-uri-policy.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 2.514945
|
|
},
|
|
{
|
|
"id": "L5d2c3b8016",
|
|
"title": "reverse proxy headers — Reverse proxy headers",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/reverse-proxy-headers.md",
|
|
"heading": "Reverse proxy headers",
|
|
"line_start": 1,
|
|
"line_end": 15,
|
|
"url": "repo:///docs/reverse-proxy-headers.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 1.816984
|
|
},
|
|
{
|
|
"id": "L03b6abccb3",
|
|
"title": "google claim mapping — Google claim and identity mapping",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/google-claim-mapping.md",
|
|
"heading": "Google claim and identity mapping",
|
|
"line_start": 1,
|
|
"line_end": 23,
|
|
"url": "repo:///docs/google-claim-mapping.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 1.503831
|
|
},
|
|
{
|
|
"id": "L0217277f31",
|
|
"title": "account linking sub vs email — Federated account key: `sub`, not email",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/account-linking-sub-vs-email.md",
|
|
"heading": "Federated account key: `sub`, not email",
|
|
"line_start": 1,
|
|
"line_end": 18,
|
|
"url": "repo:///docs/account-linking-sub-vs-email.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 1.49767
|
|
},
|
|
{
|
|
"id": "L4a3b756b3d",
|
|
"title": "google idp brokering — Two verification profiles",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/google-idp-brokering.md",
|
|
"heading": "Two verification profiles",
|
|
"line_start": 6,
|
|
"line_end": 28,
|
|
"url": "repo:///docs/google-idp-brokering.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 1.020519
|
|
},
|
|
{
|
|
"id": "Le9a41ffd86",
|
|
"title": "public domain tunneling — Public HTTPS domain for broker callbacks",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/public-domain-tunneling.md",
|
|
"heading": "Public HTTPS domain for broker callbacks",
|
|
"line_start": 1,
|
|
"line_end": 21,
|
|
"url": "repo:///docs/public-domain-tunneling.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 0.729912
|
|
},
|
|
{
|
|
"id": "L55212df816",
|
|
"title": "first broker login security — First Broker Login security",
|
|
"source_type": "local-document",
|
|
"status": "",
|
|
"path": "docs/first-broker-login-security.md",
|
|
"heading": "First Broker Login security",
|
|
"line_start": 1,
|
|
"line_end": 27,
|
|
"url": "repo:///docs/first-broker-login-security.md",
|
|
"accessed": "",
|
|
"claim_ids": [],
|
|
"decision_ids": [],
|
|
"priority": 0.088108
|
|
}
|
|
]
|
|
}
|