DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
47 lines
2.8 KiB
Plaintext
47 lines
2.8 KiB
Plaintext
# 매퍼가 서명 대상에 넣는 값과, 요청에 싣는 헤더
|
|
103: String host = properties.endpoint().getHost();
|
|
110: Map.of("host", host, "content-type", "application/json"),
|
|
Map.of(
|
|
"content-type", "application/json",
|
|
"x-amz-date", signed.amzDate(),
|
|
"x-amz-content-sha256", signed.contentSha256(),
|
|
"authorization", signed.authorization())),
|
|
|
|
# 게이트웨이가 host 를 거르는 자리 (공급되었을 때를 지킨다)
|
|
27: Set.of("connection", "content-length", "expect", "host", "upgrade");
|
|
54: if (!RESTRICTED.contains(name)) {
|
|
|
|
# 엔드포인트 가드가 포트를 보는가
|
|
(일치 0)
|
|
27: NotificationEndpoints.requireExternallyRoutable(endpoint, "SES endpoint", true);
|
|
|
|
# 비기본 포트 URI 를 실제 매퍼에 먹이는 자리
|
|
test · ProviderFaultHarness.java:52: return URI.create("http://127.0.0.1:" + server.getAddress().getPort());
|
|
test · SesNotificationProviderAdapterTest.java:254: harness.baseUri(),
|
|
test · WebPushProviderAdapterTest.java:173: URI.create(harness.baseUri() + "/push/subscription-1"),
|
|
test · ContractAdapters.java:102: harness.baseUri(),
|
|
test · ContractAdapters.java:139: harness.baseUri(),
|
|
test · ContractAdapters.java:169: harness.baseUri(),
|
|
test · ContractAdapters.java:234: "sub-1", harness.baseUri().resolve("/hook"), true, Optional.of("cb-1"));
|
|
test · ContractAdapters.java:264: URI.create(harness.baseUri() + "/push/subscription-1"),
|
|
|
|
# 같은 모양의 다른 서명기
|
|
50: String audience = endpoint.getScheme() + "://" + endpoint.getHost();
|
|
|
|
# 저장소가 이미 쓰는 수정식과 그 이유
|
|
* <p>Several providers sign the request URL, so getting this wrong turns every valid webhook into a
|
|
* signature failure. Forwarded headers are only honoured when the immediate peer is a configured
|
|
boolean defaultPort =
|
|
port < 0
|
|
|| ("https".equalsIgnoreCase(scheme) && port == 443)
|
|
|| ("http".equalsIgnoreCase(scheme) && port == 80);
|
|
if (!defaultPort) {
|
|
url.append(':').append(port);
|
|
}
|
|
— 같은 판정을 하는 자리 전부 (규칙으로 검색)
|
|
main · ExternalOrigin.java:43: (scheme.equals("https") && port == 443) || (scheme.equals("http") && port == 80);
|
|
main · ExternalRequestContext.java:57: (scheme.equals("https") && port == 443) || (scheme.equals("http") && port == 80);
|
|
main · ExternalRequestUrlResolver.java:59: || ("https".equalsIgnoreCase(scheme) && port == 443)
|
|
main · ExternalRequestUrlResolver.java:60: || ("http".equalsIgnoreCase(scheme) && port == 80);
|
|
main · CanonicalTarget.java:39: return ("https".equals(scheme) && port == 443) || ("http".equals(scheme) && port == 80);
|