From a289aa2799f366c737b5792cbeacaa92f211a070 Mon Sep 17 00:00:00 2001
From: donghyeon-ka <ehdgus6435@kumoh.ac.kr>
Date: Sat, 25 Jul 2026 16:39:53 +0900
Subject: [PATCH] docs: define AP1 Google federation profile

---
 docs/internal-spa-direct-google-federation.md  | 18 ++++++++++++++++++
 scripts/verify-internal-spa-google-contract.sh |  6 ++++++
 2 files changed, 24 insertions(+)
 create mode 100644 docs/internal-spa-direct-google-federation.md
 create mode 100755 scripts/verify-internal-spa-google-contract.sh

diff --git a/docs/internal-spa-direct-google-federation.md b/docs/internal-spa-direct-google-federation.md
new file mode 100644
index 0000000..5985ee9
--- /dev/null
+++ b/docs/internal-spa-direct-google-federation.md
@@ -0,0 +1,18 @@
+# AP1 internal SPA direct: Google-federated profile
+
+```text
+SPA -> Keycloak -> Google
+SPA <- Keycloak code/token <- Keycloak
+SPA -> Spring API with Keycloak access token
+```
+
+Google은 upstream authentication만 담당한다. SPA와 Resource Server의 trust
+anchor는 계속 Keycloak issuer/JWKS/audience다. 따라서 Spring이 Google
+ID token을 직접 받거나 Google JWKS를 검증하지 않는다.
+
+추가 운영 항목은 Google client secret, exact broker redirect URI, safe First
+Broker Login, `sub` account key, claim mapper다. 로컬에서는 두 번째 Keycloak
+realm이 Google 역할을 하므로 외부 credential 없이 같은 hop을 재현한다.
+
+`verify-internal-spa-google-contract.sh`는 broker 설정과 기존 AP1 SPA의
+zero-change federation E2E를 함께 실행한다.
diff --git a/scripts/verify-internal-spa-google-contract.sh b/scripts/verify-internal-spa-google-contract.sh
new file mode 100755
index 0000000..05e77e8
--- /dev/null
+++ b/scripts/verify-internal-spa-google-contract.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+set -eu
+
+./scripts/verify-google-broker-config.sh
+./scripts/verify-federation-spa-zero-change.sh
+echo "AP1 Google-federated profile verified"