DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
29 lines
5.2 KiB
Plaintext
29 lines
5.2 KiB
Plaintext
./application-core/src/main/java/dev/caskeleton/application/security/AuthorizationDeniedException.java:6: * Raised by {@link AuthorizationPort} when an authenticated caller lacks a required {@link
|
|
./application-core/src/main/java/dev/caskeleton/application/security/RequiresPermission.java:16: * {@link AuthorizationPort}. See README for the AOP-proxy bypass caveat and where it is required.
|
|
./application-core/src/main/java/dev/caskeleton/application/security/AuthorizationPrincipal.java:8: * Framework-free view of the authenticated caller consumed by {@link AuthorizationPort}: the IdP
|
|
./application-core/src/main/java/dev/caskeleton/application/security/ObjectAccessPolicy.java:11: * <p>Distinct from {@link AuthorizationPort}, which answers "may this caller perform this kind of
|
|
./application-core/src/main/java/dev/caskeleton/application/security/AuthorizationPort.java:13:public interface AuthorizationPort {
|
|
./app-bootstrap/src/test/java/dev/caskeleton/bootstrap/architecture/CleanArchitectureTest.java:688: + "DECISION is a framework-free port (@RequiresPermission / AuthorizationPort / "
|
|
./app-bootstrap/src/test/java/dev/caskeleton/bootstrap/architecture/CleanArchitectureTest.java:911: // authorization contract consumed by AuthorizationPort.
|
|
./app-bootstrap/src/test/java/dev/caskeleton/bootstrap/activation/StartupWarningZeroTest.java:17: * resolved {@code AuthorizationPort} while BeanPostProcessors were still registering, so three
|
|
./shared-contract/src/main/java/dev/caskeleton/shared/security/Permission.java:8: * AuthorizationPort} contract consumes; lives in {@code shared-contract} so the application layer
|
|
./sample-portfolio/src/test/java/dev/caskeleton/sample/portfolio/authz/WorkLogAuthorizationContractTest.java:58: * {@code @RequiresPermission} → {@code AuthorizationPort} → {@code RolePermissionRegistry} path
|
|
./adapter/inbound/web/src/test/java/dev/caskeleton/adapter/inbound/web/authz/RequiresPermissionAuthorizationManagerTest.java:10:import dev.caskeleton.application.security.AuthorizationPort;
|
|
./adapter/inbound/web/src/test/java/dev/caskeleton/adapter/inbound/web/authz/RequiresPermissionAuthorizationManagerTest.java:29: private final AuthorizationPort port =
|
|
./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/authz/MethodSecurityConfig.java:3:import dev.caskeleton.application.security.AuthorizationPort;
|
|
./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/authz/MethodSecurityConfig.java:34: * registered. Taking {@code AuthorizationPort} directly made Spring instantiate it — and with it
|
|
./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/authz/MethodSecurityConfig.java:51: ObjectProvider<AuthorizationPort> authorizationPort) {
|
|
./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/authz/AuthorizationAdapter.java:4:import dev.caskeleton.application.security.AuthorizationPort;
|
|
./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/authz/AuthorizationAdapter.java:11: * Web-adapter implementation of the application {@link AuthorizationPort}.
|
|
./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/authz/AuthorizationAdapter.java:18:public class AuthorizationAdapter implements AuthorizationPort {
|
|
./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/authz/RequiresPermissionAuthorizationManager.java:5:import dev.caskeleton.application.security.AuthorizationPort;
|
|
./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/authz/RequiresPermissionAuthorizationManager.java:25: * AuthorizationPrincipal}, and delegates the decision to the application {@link AuthorizationPort}.
|
|
./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/authz/RequiresPermissionAuthorizationManager.java:32: private final Supplier<AuthorizationPort> authorizationPort;
|
|
./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/authz/RequiresPermissionAuthorizationManager.java:42: public RequiresPermissionAuthorizationManager(Supplier<AuthorizationPort> authorizationPort) {
|
|
./adapter/inbound/graphql/src/test/java/dev/caskeleton/adapter/inbound/graphql/security/GraphQlAuthorizationPolicyTest.java:96: GraphQlObjectAuthorizationPort port =
|
|
./adapter/inbound/graphql/src/main/java/dev/caskeleton/adapter/inbound/graphql/security/ApplicationObjectAuthorization.java:27:public final class ApplicationObjectAuthorization implements GraphQlObjectAuthorizationPort {
|
|
./adapter/inbound/graphql/src/main/java/dev/caskeleton/adapter/inbound/graphql/security/GraphQlObjectAuthorizationPort.java:24:public interface GraphQlObjectAuthorizationPort {
|
|
./adapter/inbound/graphql/src/main/java/dev/caskeleton/adapter/inbound/graphql/security/GraphQlAuthorizationPolicy.java:18: * <p>Object-level access is delegated to {@link GraphQlObjectAuthorizationPort}, because it needs
|
|
./adapter/inbound/graphql/src/testFixtures/java/dev/caskeleton/adapter/inbound/graphql/testkit/GraphQlSecurityContractSuite.java:7:import dev.caskeleton.adapter.inbound.graphql.security.GraphQlObjectAuthorizationPort;
|
|
./adapter/inbound/graphql/src/testFixtures/java/dev/caskeleton/adapter/inbound/graphql/testkit/GraphQlSecurityContractSuite.java:35: GraphQlObjectAuthorizationPort objectAuthorization,
|