docs: B-0 — deploy the BFF and read what autoconfiguration actually chose

The authorized client repository is AuthenticatedPrincipalOAuth2AuthorizedClientRepository, keyed by principal with no session id in it, which is the mechanism behind the sharing problem Q1 and Q3 describe. Sharing a store does not fix a lookup key. Five problems on the way in: only build output was committed under bff/, a duplicate YAML key broke the image build and was invisible until the full log was captured, env placeholders without defaults broke the tests, actuator was behind the login redirect so a 200 was the login page, and the 117KB beans response failed through the proxy. Deploying two replicas made the login itself fail before any experiment started, because the authorization request lives in per-instance memory and the callback lands elsewhere. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs: A-7 — three results invert when persistent sessions are turned off
2026-09-04 13:48:33 +09:00 · 2026-09-04 13:33:33 +09:00
41 changed files with 1735 additions and 0 deletions
@@ -9,3 +9,135 @@
 [   20184ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [   32473ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [   50697ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [   65961ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [   85590ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [   99644ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  115524ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  130773ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  134354ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  142549ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  151361ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  155246ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  165901ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  169379ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  180952ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  190372ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  193657ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  205737ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  220582ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  225496ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  240339ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  244029ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  264211ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  273424ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  284893ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  292571ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  305778ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  306804ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  324378ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  335169ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  337968ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  352967ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  364258ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  379409ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  399590ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  403681ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  406340ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  421033ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  428667ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  429483ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  437573ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  442286ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  445865ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  456312ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  464043ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  480382ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  491438ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  494608ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  508231ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  528305ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  529632ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  538033ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  550079ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  566347ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  586157ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  603877ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  615779ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  624657ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  629879ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  637255ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  643298ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  650047ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  668080ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  669816ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  675422ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  677001ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  686611ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  692655ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  713114ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  723787ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  730443ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  751427ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  757583ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  776007ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  792298ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  803509ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  822917ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  827374ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  847278ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  867460ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  875338ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  886296ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  900938ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  912511ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  917067ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  924405ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  930435ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  942211ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  953146ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  957153ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  969140ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [  984088ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1003544ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1014908ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1020851ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1034668ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1040406ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1056887ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1062828ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1073375ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1085052ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1102031ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1110039ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1129341ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1132300ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1133670ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1142705ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1160906ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1172400ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1190482ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1196673ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1213666ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1225136ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1228310ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1242751ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1243874ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1256126ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1274444ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1288526ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1307058ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1320986ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1325134ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1335974ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1344832ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1354780ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1364165ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1383346ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1399019ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1400207ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1413875ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1423809ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1427502ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1430773ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1436408ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
 [ 1447464ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
@@ -0,0 +1 @@
 [     207ms] [ERROR] Failed to load resource: the server responded with a status of 404 () @ https://app1.hyeonworks.com/favicon.ico:0
@@ -0,0 +1,7 @@
 - main [ref=f21e2]:
  - heading "AP3 · Backend-for-Frontend" [level=1] [ref=f21e3]
  - paragraph [ref=f21e4]: 브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource Server 요청에 붙입니다.
  - button "Keycloak 로그인" [ref=f21e5] [cursor=pointer]
  - button "token 경계 확인" [ref=f21e6] [cursor=pointer]
  - button "BFF 경유 API 호출" [ref=f21e7] [cursor=pointer]
  - button "CSRF token으로 상태 변경" [ref=f21e8] [cursor=pointer]
@@ -0,0 +1,16 @@
 - generic [ref=f22e3]:
  - banner [ref=f22e4]:
    - generic [ref=f22e5]: keycloak-patterns
  - main [ref=f22e6]:
    - heading "Sign in to your account" [level=1] [ref=f22e8]
    - generic [ref=f22e12]:
      - generic [ref=f22e13]:
        - generic [ref=f22e14]: Username or email
        - textbox "Username or email" [active] [ref=f22e17]
      - generic [ref=f22e18]:
        - generic [ref=f22e19]: Password
        - generic [ref=f22e21]:
          - textbox "Password" [ref=f22e24]
          - button "Show password" [ref=f22e26] [cursor=pointer]:
            - generic [aria-hidden] [ref=f22e27]: 
      - button "Sign In" [ref=f22e30] [cursor=pointer]
@@ -0,0 +1,20 @@
 - generic [ref=f23e3]:
  - banner [ref=f23e4]:
    - generic [ref=f23e5]: keycloak-patterns
  - main [ref=f23e6]:
    - heading "Update Account Information" [level=1] [ref=f23e8]
    - generic [ref=f23e9]:
      - generic [ref=f23e10]: "* Required fields"
      - generic [ref=f23e13]:
        - generic [ref=f23e14]:
          - generic [ref=f23e15]: Email *
          - textbox "Email" [ref=f23e19]: labuser@example.com
        - generic [ref=f23e20]:
          - generic [ref=f23e21]: First name *
          - textbox "First name" [invalid] [ref=f23e25]
          - generic [ref=f23e26]: Please specify this field.
        - generic [ref=f23e31]:
          - generic [ref=f23e32]: Last name *
          - textbox "Last name" [invalid] [ref=f23e36]
          - generic [ref=f23e37]: Please specify this field.
        - button "Submit" [ref=f23e44]
@@ -0,0 +1,20 @@
 - generic [ref=f23e3]:
  - banner [ref=f23e4]:
    - generic [ref=f23e5]: keycloak-patterns
  - main [ref=f23e6]:
    - heading "Update Account Information" [level=1] [ref=f23e8]
    - generic [ref=f23e9]:
      - generic [ref=f23e10]: "* Required fields"
      - generic [ref=f23e13]:
        - generic [ref=f23e14]:
          - generic [ref=f23e15]: Email *
          - textbox "Email" [ref=f23e19]: labuser@example.com
        - generic [ref=f23e20]:
          - generic [ref=f23e21]: First name *
          - textbox "First name" [invalid] [ref=f23e25]: Lab
          - generic [ref=f23e26]: Please specify this field.
        - generic [ref=f23e31]:
          - generic [ref=f23e32]: Last name *
          - textbox "Last name" [active] [invalid] [ref=f23e36]: User
          - generic [ref=f23e37]: Please specify this field.
        - button "Submit" [ref=f23e44]
@@ -0,0 +1,7 @@
 - main [ref=f24e2]:
  - heading "AP3 · Backend-for-Frontend" [level=1] [ref=f24e3]
  - paragraph [ref=f24e4]: 브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource Server 요청에 붙입니다.
  - button "Keycloak 로그인" [ref=f24e5] [cursor=pointer]
  - button "token 경계 확인" [ref=f24e6] [cursor=pointer]
  - button "BFF 경유 API 호출" [ref=f24e7] [cursor=pointer]
  - button "CSRF token으로 상태 변경" [ref=f24e8] [cursor=pointer]
@@ -0,0 +1,16 @@
 - generic [ref=f25e3]:
  - banner [ref=f25e4]:
    - generic [ref=f25e5]: keycloak-patterns
  - main [ref=f25e6]:
    - heading "Sign in to your account" [level=1] [ref=f25e8]
    - generic [ref=f25e12]:
      - generic [ref=f25e13]:
        - generic [ref=f25e14]: Username or email
        - textbox "Username or email" [active] [ref=f25e17]
      - generic [ref=f25e18]:
        - generic [ref=f25e19]: Password
        - generic [ref=f25e21]:
          - textbox "Password" [ref=f25e24]
          - button "Show password" [ref=f25e26] [cursor=pointer]:
            - generic [aria-hidden] [ref=f25e27]: 
      - button "Sign In" [ref=f25e30] [cursor=pointer]
@@ -0,0 +1,9 @@
 - generic [ref=f26e2]:
  - heading "Login with OAuth 2.0" [level=2] [ref=f26e3]
  - alert [ref=f26e4]: Invalid credentials
  - table [ref=f26e5]:
    - rowgroup [ref=f26e6]:
      - row [ref=f26e7]:
        - cell [ref=f26e8]:
          - link "keycloak" [ref=f26e9] [cursor=pointer]:
            - /url: /oauth2/authorization/keycloak
@@ -0,0 +1,7 @@
 - main [ref=f27e2]:
  - heading "AP3 · Backend-for-Frontend" [level=1] [ref=f27e3]
  - paragraph [ref=f27e4]: 브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource Server 요청에 붙입니다.
  - button "Keycloak 로그인" [ref=f27e5] [cursor=pointer]
  - button "token 경계 확인" [ref=f27e6] [cursor=pointer]
  - button "BFF 경유 API 호출" [ref=f27e7] [cursor=pointer]
  - button "CSRF token으로 상태 변경" [ref=f27e8] [cursor=pointer]
@@ -0,0 +1,7 @@
 - main [ref=f27e2]:
  - heading "AP3 · Backend-for-Frontend" [level=1] [ref=f27e3]
  - paragraph [ref=f27e4]: 브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource Server 요청에 붙입니다.
  - button "Keycloak 로그인" [ref=f27e5] [cursor=pointer]
  - button "token 경계 확인" [ref=f27e6] [cursor=pointer]
  - button "BFF 경유 API 호출" [ref=f27e7] [cursor=pointer]
  - button "CSRF token으로 상태 변경" [ref=f27e8] [cursor=pointer]
@@ -0,0 +1,7 @@
 - main [ref=f27e2]:
  - heading "AP3 · Backend-for-Frontend" [level=1] [ref=f27e3]
  - paragraph [ref=f27e4]: 브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource Server 요청에 붙입니다.
  - button "Keycloak 로그인" [ref=f27e5] [cursor=pointer]
  - button "token 경계 확인" [ref=f27e6] [cursor=pointer]
  - button "BFF 경유 API 호출" [ref=f27e7] [cursor=pointer]
  - button "CSRF token으로 상태 변경" [ref=f27e8] [cursor=pointer]
@@ -0,0 +1 @@
 - generic [active] [ref=f28e1]: "{\"pattern\":\"AP3-backend-for-frontend\",\"principal\":\"labuser\",\"accessTokenStoredOnServer\":true,\"refreshTokenStoredOnServer\":true,\"browserTokenCount\":0,\"csrfProtectionEnabled\":true}"
@@ -0,0 +1 @@
 target/
@@ -0,0 +1,14 @@
 FROM maven:3.9.11-eclipse-temurin-21-alpine AS build
 WORKDIR /workspace
 COPY pom.xml .
 RUN mvn --batch-mode dependency:go-offline
 COPY src src
 RUN mvn --batch-mode verify
 FROM eclipse-temurin:21-jre-alpine
 RUN addgroup -S spring && adduser -S spring -G spring
 WORKDIR /app
 COPY --from=build /workspace/target/keycloak-bff.jar app.jar
 USER spring:spring
 EXPOSE 8083
 ENTRYPOINT ["java", "-jar", "/app/app.jar"]
@@ -0,0 +1,58 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.5.16</version>
        <relativePath/>
    </parent>
    <groupId>com.example</groupId>
    <artifactId>keycloak-bff</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>keycloak-bff</name>
    <properties>
        <java.version>21</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-oauth2-client</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>
    <build>
        <finalName>keycloak-bff</finalName>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>
 </project>
@@ -0,0 +1,12 @@
 package com.example.keycloakpattern.bff;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
 public class BffApplication {
    public static void main(String[] args) {
        SpringApplication.run(BffApplication.class, args);
    }
 }
@@ -0,0 +1,112 @@
 package com.example.keycloakpattern.bff;
 import java.util.LinkedHashMap;
 import java.util.Map;
 import java.util.concurrent.atomic.AtomicReference;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.CacheControl;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.client.RestClient;
 import org.springframework.web.server.ResponseStatusException;
 import static org.springframework.http.HttpStatus.UNAUTHORIZED;
@RestController
 public class BffController {
    private final OAuth2AuthorizedClientService authorizedClientService;
    private final OAuth2AuthorizedClientManager authorizedClientManager;
    private final RestClient resourceApi;
    private final AtomicReference<String> theme = new AtomicReference<>("system");
    public BffController(
        OAuth2AuthorizedClientService authorizedClientService,
        OAuth2AuthorizedClientManager authorizedClientManager,
        RestClient.Builder restClientBuilder,
        @Value("${resource-api.base-url}") String resourceApiBaseUrl
    ) {
        this.authorizedClientService = authorizedClientService;
        this.authorizedClientManager = authorizedClientManager;
        this.resourceApi = restClientBuilder.baseUrl(resourceApiBaseUrl).build();
    }
    @GetMapping("/bff/token-boundary")
    ResponseEntity<Map<String, Object>> tokenBoundary(Authentication authentication) {
        OAuth2AuthorizedClient client = authorizedClientService.loadAuthorizedClient(
            "keycloak",
            authentication.getName()
        );
        Map<String, Object> response = new LinkedHashMap<>();
        response.put("pattern", "AP3-backend-for-frontend");
        response.put("principal", authentication.getName());
        response.put("accessTokenStoredOnServer", client != null
            && client.getAccessToken() != null);
        response.put("refreshTokenStoredOnServer", client != null
            && client.getRefreshToken() != null);
        response.put("browserTokenCount", 0);
        response.put("csrfProtectionEnabled", true);
        return ResponseEntity.ok()
            .cacheControl(CacheControl.noStore())
            .header("Pragma", "no-cache")
            .body(response);
    }
    @GetMapping("/bff/api/me")
    ResponseEntity<?> currentUser(Authentication authentication) {
        OAuth2AuthorizedClient client = authorizedClient(authentication);
        return resourceApi.get()
            .uri("/api/me")
            .header(
                HttpHeaders.AUTHORIZATION,
                "Bearer " + client.getAccessToken().getTokenValue()
            )
            .retrieve()
            .toEntity(Map.class);
    }
    @PostMapping("/bff/api/preferences")
    Map<String, Object> updatePreference(
        Authentication authentication,
        @RequestParam(defaultValue = "system") String theme
    ) {
        this.theme.set(theme);
        return Map.of(
            "updated", true,
            "theme", this.theme.get(),
            "principal", authentication.getName()
        );
    }
    @GetMapping("/bff/api/preferences")
    Map<String, String> preference() {
        return Map.of("theme", theme.get());
    }
    private OAuth2AuthorizedClient authorizedClient(Authentication authentication) {
        OAuth2AuthorizeRequest request = OAuth2AuthorizeRequest
            .withClientRegistrationId("keycloak")
            .principal(authentication)
            .build();
        OAuth2AuthorizedClient client = authorizedClientManager.authorize(request);
        if (client == null || client.getAccessToken() == null) {
            throw new ResponseStatusException(
                UNAUTHORIZED,
                "No authorized Keycloak client is available"
            );
        }
        return client;
    }
 }
@@ -0,0 +1,25 @@
 package com.example.keycloakpattern.bff;
 import java.util.Map;
 import org.springframework.http.CacheControl;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.web.csrf.CsrfToken;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;
@RestController
 public class CsrfController {
    @GetMapping("/bff/csrf")
    ResponseEntity<Map<String, String>> csrf(CsrfToken csrfToken) {
        return ResponseEntity.ok()
            .cacheControl(CacheControl.noStore())
            .header("Pragma", "no-cache")
            .body(Map.of(
                "headerName", csrfToken.getHeaderName(),
                "parameterName", csrfToken.getParameterName(),
                "token", csrfToken.getToken()
            ));
    }
 }
@@ -0,0 +1,85 @@
 package com.example.keycloakpattern.bff;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.oauth2.client.AuthorizedClientServiceOAuth2AuthorizedClientManager;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
 import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
 import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizationRequestResolver;
 import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestCustomizers;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
@Configuration
 public class SecurityConfig {
    @Bean
    SecurityFilterChain bffSecurity(
        HttpSecurity http,
        ClientRegistrationRepository clientRegistrationRepository
    ) throws Exception {
        DefaultOAuth2AuthorizationRequestResolver authorizationRequestResolver =
            new DefaultOAuth2AuthorizationRequestResolver(
                clientRegistrationRepository,
                "/oauth2/authorization"
            );
        authorizationRequestResolver.setAuthorizationRequestCustomizer(
            OAuth2AuthorizationRequestCustomizers.withPkce()
        );
        CookieCsrfTokenRepository csrfTokenRepository =
            CookieCsrfTokenRepository.withHttpOnlyFalse();
        csrfTokenRepository.setCookiePath("/");
        return http
            .csrf(csrf -> csrf
                .csrfTokenRepository(csrfTokenRepository)
                .csrfTokenRequestHandler(new SpaCsrfTokenRequestHandler()))
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers(
                    "/",
                    "/index.html",
                    "/app.js",
                    "/favicon.ico",
                    "/actuator/health",
                    "/actuator/health/**",
                    // 실험대 전용 — B-0 은 "자동구성이 실제로 무엇을 골랐는가"를
                    // 밖에서 읽어야 답할 수 있다. 운영에서는 절대 열지 않는다:
                    // /actuator/beans 와 /actuator/env 는 내부 구조와 설정값을
                    // 그대로 드러낸다.
                    "/actuator/**"
                )
                .permitAll()
                .anyRequest()
                .authenticated())
            .oauth2Login(oauth2 -> oauth2
                .authorizationEndpoint(endpoint -> endpoint
                    .authorizationRequestResolver(authorizationRequestResolver))
                .defaultSuccessUrl("/", true))
            .build();
    }
    @Bean
    OAuth2AuthorizedClientManager authorizedClientManager(
        ClientRegistrationRepository clientRegistrationRepository,
        OAuth2AuthorizedClientService authorizedClientService
    ) {
        OAuth2AuthorizedClientProvider authorizedClientProvider =
            OAuth2AuthorizedClientProviderBuilder.builder()
                .authorizationCode()
                .refreshToken()
                .build();
        AuthorizedClientServiceOAuth2AuthorizedClientManager manager =
            new AuthorizedClientServiceOAuth2AuthorizedClientManager(
                clientRegistrationRepository,
                authorizedClientService
            );
        manager.setAuthorizedClientProvider(authorizedClientProvider);
        return manager;
    }
 }
@@ -0,0 +1,40 @@
 package com.example.keycloakpattern.bff;
 import java.util.function.Supplier;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import org.springframework.security.web.csrf.CsrfToken;
 import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
 import org.springframework.security.web.csrf.CsrfTokenRequestHandler;
 import org.springframework.security.web.csrf.XorCsrfTokenRequestAttributeHandler;
 import org.springframework.util.StringUtils;
 final class SpaCsrfTokenRequestHandler implements CsrfTokenRequestHandler {
    private final CsrfTokenRequestHandler plain =
        new CsrfTokenRequestAttributeHandler();
    private final CsrfTokenRequestHandler xor =
        new XorCsrfTokenRequestAttributeHandler();
    @Override
    public void handle(
        HttpServletRequest request,
        HttpServletResponse response,
        Supplier<CsrfToken> deferredCsrfToken
    ) {
        xor.handle(request, response, deferredCsrfToken);
    }
    @Override
    public String resolveCsrfTokenValue(
        HttpServletRequest request,
        CsrfToken csrfToken
    ) {
        if (StringUtils.hasText(request.getHeader(csrfToken.getHeaderName()))) {
            return plain.resolveCsrfTokenValue(request, csrfToken);
        }
        return xor.resolveCsrfTokenValue(request, csrfToken);
    }
 }
@@ -0,0 +1,52 @@
 server:
  port: ${SERVER_PORT:8083}
  servlet:
    session:
      cookie:
        name: AP3_SESSION
        http-only: true
        same-site: lax
 spring:
  application:
    name: keycloak-bff
  security:
    oauth2:
      client:
        registration:
          keycloak:
            provider: keycloak
            client-id: bff-confidential
            client-secret: ${KEYCLOAK_CLIENT_SECRET}
            client-authentication-method: client_secret_basic
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope:
              - openid
              - profile
              - email
        provider:
          keycloak:
            # 브라우저가 리다이렉트되는 주소와 BFF 가 서버끼리 부르는 주소는 다르다.
            # 앞의 것은 외부에서 닿는 이름이어야 하고, 뒤의 것은 클러스터 안 주소여도 된다.
            authorization-uri: ${KC_ISSUER_EXTERNAL:http://localhost:8080/realms/keycloak-patterns}/protocol/openid-connect/auth
            token-uri:         ${KC_ISSUER_INTERNAL:http://keycloak:8080/realms/keycloak-patterns}/protocol/openid-connect/token
            jwk-set-uri:       ${KC_ISSUER_INTERNAL:http://keycloak:8080/realms/keycloak-patterns}/protocol/openid-connect/certs
            user-info-uri:     ${KC_ISSUER_INTERNAL:http://keycloak:8080/realms/keycloak-patterns}/protocol/openid-connect/userinfo
            user-name-attribute: preferred_username
 resource-api:
  base-url: ${RESOURCE_API_BASE_URL:http://localhost:8081}
 management:
  endpoint:
    health:
      probes:
        enabled: true
      show-details: always
  endpoints:
    web:
      exposure:
        # beans / conditions 는 B-0 에서 "자동구성이 실제로 무엇을 골랐는가"를
        # 보기 위해 연다. 운영에 그대로 두면 내부 구조가 노출된다.
        include: health,info,beans,conditions,env
@@ -0,0 +1,59 @@
 const result = document.querySelector("#result");
 function render(value) {
  result.textContent = JSON.stringify(value, null, 2);
 }
 function readCookie(name) {
  const prefix = `${encodeURIComponent(name)}=`;
  const value = document.cookie
    .split("; ")
    .find((cookie) => cookie.startsWith(prefix));
  return value ? decodeURIComponent(value.slice(prefix.length)) : null;
 }
 async function request(path, options = {}) {
  const response = await fetch(path, {
    ...options,
    headers: { Accept: "application/json", ...options.headers },
  });
  if (response.redirected || response.status === 401) {
    window.location.assign("/oauth2/authorization/keycloak");
    return null;
  }
  const body = await response.json();
  render({ status: response.status, ...body });
  return { response, body };
 }
 document.querySelector("#login").addEventListener("click", () => {
  window.location.assign("/oauth2/authorization/keycloak");
 });
 document.querySelector("#inspect").addEventListener("click", () => {
  void request("/bff/token-boundary");
 });
 document.querySelector("#call-bff").addEventListener("click", () => {
  void request("/bff/api/me");
 });
 document.querySelector("#change-with-csrf").addEventListener("click", async () => {
  const csrfResponse = await fetch("/bff/csrf", {
    headers: { Accept: "application/json" },
  });
  const csrf = await csrfResponse.json();
  const csrfToken = readCookie("XSRF-TOKEN");
  if (!csrfToken) {
    render({ status: 500, error: "XSRF-TOKEN cookie was not created" });
    return;
  }
  await request("/bff/api/preferences", {
    method: "POST",
    body: new URLSearchParams({ theme: "dark" }),
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
      [csrf.headerName]: csrfToken,
    },
  });
 });
@@ -0,0 +1,31 @@
 <!doctype html>
 <html lang="ko">
 <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>AP3 · Backend-for-Frontend</title>
  <style>
    :root { color-scheme: light dark; font-family: system-ui, sans-serif; }
    body { max-width: 58rem; margin: 6vh auto; padding: 0 1.5rem; line-height: 1.6; }
    button { margin: 0 0.5rem 0.5rem 0; padding: 0.6rem 0.9rem; cursor: pointer; }
    pre { min-height: 9rem; padding: 1rem; border-radius: 0.4rem;
      background: color-mix(in srgb, CanvasText 9%, Canvas); white-space: pre-wrap; }
  </style>
 </head>
 <body>
  <main>
    <h1>AP3 · Backend-for-Frontend</h1>
    <p>
      브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session
      cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource
      Server 요청에 붙입니다.
    </p>
    <button id="login" type="button">Keycloak 로그인</button>
    <button id="inspect" type="button">token 경계 확인</button>
    <button id="call-bff" type="button">BFF 경유 API 호출</button>
    <button id="change-with-csrf" type="button">CSRF token으로 상태 변경</button>
    <pre id="result" aria-live="polite"></pre>
  </main>
  <script type="module" src="/app.js"></script>
 </body>
 </html>
@@ -0,0 +1,90 @@
 package com.example.keycloakpattern.bff;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.oidcLogin;
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
 import org.springframework.security.oauth2.core.OAuth2AccessToken;
 import org.springframework.security.oauth2.core.OAuth2RefreshToken;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.servlet.MockMvc;
@SpringBootTest(properties = {
    "KEYCLOAK_CLIENT_SECRET=test-only-secret",
    "resource-api.base-url=http://127.0.0.1:9"
 })
@AutoConfigureMockMvc
 class BffControllerTest {
    @Autowired
    private MockMvc mockMvc;
    @MockitoBean
    private OAuth2AuthorizedClientService authorizedClientService;
    @MockitoBean
    private OAuth2AuthorizedClientManager authorizedClientManager;
    @Test
    void reportsServerTokenCustodyWithoutReturningTokens() throws Exception {
        OAuth2AuthorizedClient client = mock(OAuth2AuthorizedClient.class);
        when(client.getAccessToken()).thenReturn(mock(OAuth2AccessToken.class));
        when(client.getRefreshToken()).thenReturn(mock(OAuth2RefreshToken.class));
        when(authorizedClientService.loadAuthorizedClient("keycloak", "test-subject"))
            .thenReturn(client);
        mockMvc.perform(get("/bff/token-boundary").with(oidcLogin()
                .idToken(token -> token.subject("test-subject"))))
            .andExpect(status().isOk())
            .andExpect(header().string("Cache-Control", "no-store"))
            .andExpect(jsonPath("$.accessTokenStoredOnServer").value(true))
            .andExpect(jsonPath("$.refreshTokenStoredOnServer").value(true))
            .andExpect(jsonPath("$.browserTokenCount").value(0))
            .andExpect(jsonPath("$.csrfProtectionEnabled").value(true))
            .andExpect(jsonPath("$.access_token").doesNotExist())
            .andExpect(jsonPath("$.refresh_token").doesNotExist());
    }
    @Test
    void rejectsStateChangeWithoutCsrfToken() throws Exception {
        mockMvc.perform(post("/bff/api/preferences")
                .param("theme", "attacker")
                .with(oidcLogin().idToken(token -> token.subject("test-subject"))))
            .andExpect(status().isForbidden());
    }
    @Test
    void acceptsStateChangeWithCsrfToken() throws Exception {
        mockMvc.perform(post("/bff/api/preferences")
                .param("theme", "dark")
                .with(oidcLogin().idToken(token -> token.subject("test-subject")))
                .with(csrf()))
            .andExpect(status().isOk())
            .andExpect(jsonPath("$.updated").value(true))
            .andExpect(jsonPath("$.theme").value("dark"));
    }
    @Test
    void exposesSpaCsrfTokenWithoutCaching() throws Exception {
        mockMvc.perform(get("/bff/csrf").with(oidcLogin()
                .idToken(token -> token.subject("test-subject"))))
            .andExpect(status().isOk())
            .andExpect(header().string("Cache-Control", "no-store"))
            .andExpect(header().exists("Set-Cookie"))
            .andExpect(jsonPath("$.headerName").value("X-XSRF-TOKEN"))
            .andExpect(jsonPath("$.token").isNotEmpty());
    }
 }
@@ -0,0 +1,161 @@
 # BFF (2 replicas) + Redis, for the B-layer experiments.
 #
 # The BFF is deployed FIRST WITHOUT any session store wiring. That is deliberate:
 # B-0 asks what Spring Boot's autoconfiguration actually picks when nothing is
 # configured, and the only honest way to answer is to look at a running instance
 # that has been given nothing. Redis is deployed alongside but left unused until
 # B-1 turns it on.
 #
 #   kubectl apply -f deploy/lab/k8s/bff-redis.yaml
 #
 # Image comes from the workstation, not a registry:
 #   docker build -t keycloak-pattern-bff:lab bff/
 #   docker save keycloak-pattern-bff:lab | ssh test-server "ssh kc-lab-1 'sudo k3s ctr images import -'"
 #   (repeat for kc-lab-2)
 # so imagePullPolicy must stay Never on both replicas.
 apiVersion: v1
 kind: Secret
 metadata:
  name: bff-secrets
  namespace: keycloak-lab
 type: Opaque
 stringData:
  # Matches the client created with kcadm in the keycloak-patterns realm.
  # Base64 in etcd is not encryption — see D-3.
  KEYCLOAK_CLIENT_SECRET: bff-lab-secret
 ---
 # Redis. No persistence yet: `--save ""` and no appendonly, so a restart loses
 # everything. B-5 and B-6 compare that against RDB and AOF, which is easier to
 # reason about when the starting point is "nothing survives".
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: redis
  namespace: keycloak-lab
 spec:
  replicas: 1
  selector:
    matchLabels: { app: redis }
  template:
    metadata:
      labels: { app: redis }
    spec:
      # Same node as postgres so a node-loss experiment takes both stores at
      # once, matching how A-4 was set up.
      nodeSelector:
        kubernetes.io/hostname: kc-lab-2
      containers:
        - name: redis
          image: redis:7.4-alpine
          args: ["redis-server", "--save", "", "--appendonly", "no"]
          ports:
            - containerPort: 6379
              name: redis
          readinessProbe:
            exec: { command: ["redis-cli", "ping"] }
            initialDelaySeconds: 3
          resources:
            requests: { memory: 32Mi, cpu: 20m }
            limits:   { memory: 128Mi }
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: redis
  namespace: keycloak-lab
 spec:
  selector: { app: redis }
  ports:
    - port: 6379
      targetPort: redis
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: bff
  namespace: keycloak-lab
 spec:
  # Two replicas is the whole point: Q1 and Q2 only exist because a request can
  # land on an instance that did not handle the login.
  replicas: 2
  selector:
    matchLabels: { app: bff }
  template:
    metadata:
      labels: { app: bff }
    spec:
      # Spread across both nodes so "the other instance" is genuinely another
      # machine, not another process on the same kernel.
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels: { app: bff }
      containers:
        - name: bff
          image: keycloak-pattern-bff:lab
          imagePullPolicy: Never
          ports:
            - containerPort: 8083
              name: http
          env:
            # The browser is redirected to the public name; the BFF calls the
            # token endpoint over the cluster network. Getting these two the same
            # way round is what the 2-hop header experiment was about.
            - name: KC_ISSUER_EXTERNAL
              value: https://auth.hyeonworks.com/realms/keycloak-patterns
            - name: KC_ISSUER_INTERNAL
              value: http://keycloak.keycloak-lab.svc:8080/realms/keycloak-patterns
            - name: RESOURCE_API_BASE_URL
              value: http://echo.keycloak-lab.svc:8080
            - name: KEYCLOAK_CLIENT_SECRET
              valueFrom:
                secretKeyRef: { name: bff-secrets, key: KEYCLOAK_CLIENT_SECRET }
            # Spring needs to know it is behind TLS termination, for the same
            # reason Keycloak needs KC_PROXY_HEADERS. Without it the redirect_uri
            # it builds comes back as http:// and Keycloak rejects it.
            - name: SERVER_FORWARD_HEADERS_STRATEGY
              value: native
            - name: JAVA_TOOL_OPTIONS
              value: "-Xms128m -Xmx320m"
          readinessProbe:
            httpGet: { path: /actuator/health/readiness, port: http }
            initialDelaySeconds: 20
            failureThreshold: 30
          livenessProbe:
            httpGet: { path: /actuator/health/liveness, port: http }
            initialDelaySeconds: 60
          resources:
            requests: { memory: 320Mi, cpu: 100m }
            limits:   { memory: 512Mi }
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: bff
  namespace: keycloak-lab
 spec:
  selector: { app: bff }
  ports:
    - port: 8083
      targetPort: http
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: bff
  namespace: keycloak-lab
 spec:
  ingressClassName: traefik
  rules:
    - host: app1.hyeonworks.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: bff
                port:
                  number: 8083
@@ -0,0 +1,18 @@
 === 비교를 위해 세션을 비운다 ===
 DELETE 151
 === volatile 모드로 전환 ===
 namespace/keycloak-lab unchanged
 secret/keycloak-lab-secrets configured
 persistentvolumeclaim/postgres-data unchanged
 deployment.apps/postgres unchanged
 service/postgres unchanged
 statefulset.apps/keycloak configured
 service/keycloak-headless unchanged
 service/keycloak unchanged
 ingress.networking.k8s.io/keycloak unchanged
 Waiting for 1 pods to be ready...
 partitioned roll out complete: 2 new pods have been updated...
 === [검증] 정말 꺼졌는가 ===
 ["start","--features-disabled=persistent-user-sessions"]
@@ -0,0 +1,15 @@
  keycloak-0=10.42.1.94  keycloak-1=10.42.0.45
 === [A-0 재실행] keycloak-0 에만 로그인 5회 → 캐시가 어디에 담기는가 ===
 로그인완료
  keycloak-0  sessions 캐시 5.0 건
  keycloak-1  sessions 캐시 0.0 건
 === DB 에는 들어갔는가 (persistent 였을 때는 5건이 들어갔다) ===
 offline_flag | count 
 --------------+-------
 (0 rows)
 === 교차 노드 세션은 되는가 ===
  keycloak-0 로그인 → keycloak-1 에서 refresh  HTTP 200
@@ -0,0 +1,13 @@
 === [A-8 재실행] 재시작 전 로그인 ===
  sid = aVwYnzKZFFvMqD3bpSeiILuM
 === 롤링 재시작 ===
 statefulset.apps/keycloak restarted
 partitioned roll out complete: 2 new pods have been updated...
 === ★ 재시작 전 토큰이 아직 통하는가 (persistent 였을 때는 200) ===
  keycloak-0 에서 refresh  HTTP 400
  --- 오류 본문 ---
 {"error":"invalid_grant","error_description":"Session not active"}
 === 캐시 상태 ===
  keycloak-1  sessions 캐시 1.0 건
@@ -0,0 +1,21 @@
 === [A-1 재실행] volatile 에서 7800 을 막으면 ===
  keycloak-0=10.42.1.99  keycloak-1=10.42.0.46
  [대조군] 차단 전 교차 노드 refresh
    keycloak-1 에서 refresh  HTTP 200
  차단 적용 (A-5 에서 확인한 raw 테이블 방식, 양방향)
  분단이 성립할 때까지 대기...
    +25초  cluster_size(k0 k1) = [2.0 2.0 ]
    +50초  cluster_size(k0 k1) = [1.0 ]
    +75초  cluster_size(k0 k1) = [1.0 ]
    +100초  cluster_size(k0 k1) = []
    +125초  cluster_size(k0 k1) = [1.0 ]
    +150초  cluster_size(k0 k1) = [1.0 ]
    +175초  cluster_size(k0 k1) = [1.0 ]
    +200초  cluster_size(k0 k1) = []
 === ★ 분단 상태에서 교차 노드 세션 (persistent 였을 때는 200) ===
  keycloak-0 로그인 → keycloak-0 에서 refresh  HTTP 200  ← 대조군
  keycloak-0 로그인 → keycloak-1 에서 refresh  HTTP 400  ← 시험군
  --- 시험군 오류 본문 ---
 {"error":"invalid_grant","error_description":"Session not active"}
@@ -0,0 +1,12 @@
 차단 해제, 클러스터 재형성 대기...
 === [A-2 재실행] volatile 에서 DB 를 내리면 — 세션이 메모리에 있으니 살아남는가? ===
  DB 정지 전 로그인 완료
 deployment.apps/postgres scaled
  postgres 정지
  ① 캐시를 가진 노드에서 refresh  HTTP 500
  ② 새 로그인                     HTTP 200
 === DB 복구 후 원복 ===
 deployment.apps/postgres scaled
 deployment "postgres" successfully rolled out
@@ -0,0 +1,12 @@
 === persistent 모드로 원복 ===
 statefulset.apps/keycloak configured
 partitioned roll out complete: 2 new pods have been updated...
 === [검증] persistent 로 돌아왔는가 — 로그인 후 DB 에 행이 생기는가 ===
 ["start"]
 로그인
  DB 온라인 세션: 1 건  (1 이면 persistent 복귀)
 keycloak-0                  1/1   Running   0     67s
 keycloak-1                  1/1   Running   0     89s
 postgres-7b474b88c8-t6rrf   1/1   Running   0     2m8s
  외부 진입점 HTTP 200
@@ -0,0 +1,23 @@
 # A-7 — volatile 모드 비교 증거
 2026-09-04 13:45–14:15 KST
 해설: [`docs/experiment-a7-volatile-comparison.md`](../../experiment-a7-volatile-comparison.md)
 | 파일 | 무엇을 보여주는가 |
 |---|---|
 | `01-switch-to-volatile.txt` | `--features-disabled=persistent-user-sessions` 적용, args 확인 |
 | `02-a0-rerun.txt` | **DB 0건**인데 교차 노드 refresh `200` — 경로가 DB 에서 클러스터로 바뀌었다 |
 | `03-a8-rerun-restart.txt` | **롤링 재시작 후 `400 Session not active`** — persistent 에서는 `200` 이었다 |
 | `04-a1-rerun-partition.txt` | **7800 차단 시 교차 노드 `400`** — persistent 에서는 `200`. 대조군(같은 노드)은 `200` 유지 |
 | `05-a2-rerun-db-loss.txt` | DB 정지 중 **새 로그인 `200`**(persistent 에서는 500), refresh 는 `500` |
 | `06-restore-persistent.txt` | 원복 확인 — `args: ["start"]`, 로그인 후 DB 1건, 외부 200 |
 ## 뒤집힌 결과
 | 실험 | persistent | volatile |
 |---|---|---|
 | A-1 7800 차단 후 교차 refresh | `200` | **`400`** |
 | A-8 롤링 재시작 후 refresh | `200` | **`400`** |
 | A-2 DB 정지 중 새 로그인 | `500` | **`200`** |
 **같은 주입, 같은 관측, 정반대 결과.** A층 전체가 버전 조건부임을 보여주는 대조군이다.
@@ -0,0 +1,21 @@
 === 배포 전 자원 ===
 Mem:           11648        7329         280           4        4377        4319
 NAME       CPU(cores)   CPU(%)   MEMORY(bytes)   MEMORY(%)   
 kc-lab-1   115m         5%       2192Mi          44%         
 kc-lab-2   121m         6%       1324Mi          33%         
 === 배포 ===
 secret/bff-secrets created
 deployment.apps/redis created
 service/redis created
 deployment.apps/bff created
 service/bff created
 ingress.networking.k8s.io/bff created
 deployment "redis" successfully rolled out
 Waiting for deployment "bff" rollout to finish: 1 of 2 updated replicas are available...
 deployment "bff" successfully rolled out
 bff-574c6d658b-8cz4x        true   kc-lab-1
 bff-574c6d658b-zpkbp        true   kc-lab-2
 redis-568bd7c4-5c5vc        true   kc-lab-2
@@ -0,0 +1,13 @@
 === B-0: 자동구성이 실제로 고른 구현체 ===
  Q1 확인한 사실: "코드에 저장소를 직접 생성하는 Bean 이 없기 때문에,
   어떤 구현체가 실제로 사용되는지는 자동구성 결과까지 확인해야 정확하게 알 수 있다"
  File "<stdin>", line 9
    print(f"    {name:46} {t.rsplit(\".\",1)[-1]}")
                                     ^
 SyntaxError: unexpected character after line continuation character
 === HttpSession 은 어디에 있는가 (서블릿 컨테이너 기본) ===
 === 외부 진입점 ===
  https://app1.hyeonworks.com/  HTTP 200
@@ -0,0 +1,29 @@
 === B-0 — 자동구성이 실제로 고른 구현체 ===
  컨텍스트: keycloak-bff
  전체 빈 수: 321
  --- 세션 · 토큰 저장소 관련 ---
    authorizedClientManager                        -> AuthorizedClientServiceOAuth2AuthorizedClientManager
    authorizedClientManagerRegistrar               -> OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerRegistrar
    authorizedClientRepository                     -> AuthenticatedPrincipalOAuth2AuthorizedClientRepository
    authorizedClientService                        -> InMemoryOAuth2AuthorizedClientService
    org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientConfigurations$OAuth2AuthorizedClientServiceConfiguration -> OAuth2ClientConfigurations$OAuth2AuthorizedClientServiceConfiguration
    org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerConfiguration -> OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerConfiguration
  --- OAuth2 클라이언트 관련 전체 ---
    authorizedClientManager                        -> AuthorizedClientServiceOAuth2AuthorizedClientManager
    authorizedClientManagerRegistrar               -> OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerRegistrar
    authorizedClientRepository                     -> AuthenticatedPrincipalOAuth2AuthorizedClientRepository
    authorizedClientService                        -> InMemoryOAuth2AuthorizedClientService
    clientRegistrationRepository                   -> InMemoryClientRegistrationRepository
    org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientAutoConfiguration -> OAuth2ClientAutoConfiguration
    org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientConfigurations$ClientRegistrationRepositoryConfiguration -> OAuth2ClientConfigurations$ClientRegistrationRepositoryConfiguration
    org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientConfigurations$OAuth2AuthorizedClientServiceConfiguration -> OAuth2ClientConfigurations$OAuth2AuthorizedClientServiceConfiguration
    org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientWebSecurityAutoConfiguration -> OAuth2ClientWebSecurityAutoConfiguration
    org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration -> OAuth2ClientConfiguration
    org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerConfiguration -> OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerConfiguration
    org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2ClientWebMvcSecurityConfiguration -> OAuth2ClientConfiguration$OAuth2ClientWebMvcSecurityConfiguration
    spring.security.oauth2.client-org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientProperties -> OAuth2ClientProperties
  --- Redis / Spring Session 이 구성되었는가 ---
    ★ 없음 — Redis 도 Spring Session 도 구성되지 않았다
@@ -0,0 +1,18 @@
 # B-0 — BFF·Redis 배포와 자동구성 확인 증거
 2026-09-04 14:20–14:50 KST
 해설: [`docs/experiment-b0-bff-redis-deploy.md`](../../experiment-b0-bff-redis-deploy.md)
 | 파일 | 무엇을 보여주는가 |
 |---|---|
 | `01-deploy.txt` | 배포 전 자원, Redis·BFF 롤아웃, 두 노드에 하나씩 배치됨 |
 | `02-autoconfiguration.txt` | 첫 조회 시도(파싱 실패)와 **외부 진입점 `HTTP 200`** |
 | `03-beans-analysis.txt` | **B-0 의 답** — `InMemoryOAuth2AuthorizedClientService`, `AuthenticatedPrincipalOAuth2AuthorizedClientRepository`, **Redis·Spring Session 없음** |
 | `b0-bff-login-success-single-replica.png` | replica 1 에서 로그인 성공한 BFF 화면 |
 | `b0-bff-token-boundary.png` | `/bff/token-boundary` — `principal: labuser`, `accessTokenStoredOnServer: true`, **`browserTokenCount: 0`** |
 ## 핵심 세 줄
 1. **`AuthenticatedPrincipalOAuth2AuthorizedClientRepository`** — 조회 키가 principal 이고 session ID 가 없다. Q1·Q3 문제의 기제가 이 빈 하나에 있다.
 2. **Redis 를 붙여도 그건 안 고쳐진다.** 저장소 공유와 조회 키는 다른 문제다.
 3. **replica 2개에서는 로그인 자체가 실패한다.** 인가 코드 흐름의 왕복 두 번이 같은 인스턴스로 가야 하는데, 인가 요청이 인스턴스 메모리에 있다.
@@ -0,0 +1,267 @@
 # A-7 — 옛 방식(volatile)이었다면 무엇이 달라지는가
 브랜치 `feature/keycloak-a7-volatile-comparison` ·
 증거 [`docs/evidence/a7-volatile-comparison/`](evidence/a7-volatile-comparison/) ·
 2026-09-04 13:45–14:15 KST
 **A층의 결론 전체가 "Keycloak 26 기본값"이라는 전제 위에 있다.**
 전제를 뒤집어 같은 실험을 반복한 것이 이 실험이다.
 ---
 ## 0. 결론부터 — 비교표
 | 실험 | persistent (KC 26 기본) | **volatile (KC 24 이전 방식)** |
 |---|---|---|
 | **A-0** 세션 저장 위치 | DB 에 행이 생긴다 | **DB 0건.** 메모리에만 |
 | **A-1** 7800 차단 후 교차 노드 refresh | **`200`** — 안 깨진다 | **`400 Session not active`** — 깨진다 |
 | **A-8** 롤링 재시작 후 refresh | **`200`** — 세션 생존 | **`400 Session not active`** — 전원 로그아웃 |
 | **A-2** DB 정지 중 새 로그인 | `500` | **`200`** — 된다 |
 | A-2 DB 정지 중 refresh | `500` | `500` |
 **세 개가 정반대로 뒤집혔다.** 예측한 그대로다.
 > **"세션 공유는 7800 을 안 탄다"는 A-1 의 결론은 버전에 달린 사실이다.**
 > 인터넷 자료 대부분이 24 이전 기준이므로 **거기서는 통념이 맞다.**
 > 틀린 것은 자료가 아니라 **버전을 확인하지 않고 적용하는 것**이다.
 ---
 ## 1. 전환 방법
 ```bash
 # 이 버전에서 끌 수 있는지부터 확인한다
 kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kc.sh build --help-all \
  | tr ',' '\n' | grep -i persistent
 #   persistent-user-sessions[:v1]      ← 목록에 있다
 ```
 ```yaml
 # deploy/lab/k8s/keycloak-cluster.yaml
 args: ["start", "--features-disabled=persistent-user-sessions"]
 ```
 ```bash
 kubectl apply -f deploy/lab/k8s/keycloak-cluster.yaml
 kubectl -n keycloak-lab rollout status statefulset/keycloak --timeout=500s
 ```
 **빌드 옵션이므로 기동 시 재빌드가 일어나 평소보다 오래 걸린다.**
 ---
 ## 2. A-0 재실행 — 세션이 DB 에 안 들어간다
 ```
 === keycloak-0 에만 로그인 5회 ===
  keycloak-0  sessions 캐시 5.0 건
  keycloak-1  sessions 캐시 0.0 건
 === DB 에는 들어갔는가 (persistent 였을 때는 5건) ===
 offline_flag | count
 --------------+-------
 (0 rows)                    ← 0 건
 === 교차 노드 세션은 되는가 ===
  keycloak-0 로그인 → keycloak-1 에서 refresh  HTTP 200
 ```
 **DB 는 비어 있는데 교차 노드가 된다.** persistent 때와 겉보기 결과가 같지만
 **경로가 완전히 다르다** — 이제는 DB 가 아니라 **클러스터를 타고** 있다.
 > 캐시 엔트리 수가 `5 / 0` 인 것은 persistent 때와 같다.
 > `approximate_entries_unique` 는 **그 노드가 소유한 엔트리**만 세므로,
 > 백업본을 들고 있어도 0 으로 보인다. **이 지표만으로는 두 모드를 구분할 수
 > 없다** — 구분하려면 7800 을 끊어봐야 한다. 그게 다음 절이다.
 ---
 ## 3. A-1 재실행 — **정반대다**
 A-5 에서 확립한 `raw` 테이블 양방향 차단을 그대로 썼다.
 ```
  [대조군] 차단 전 교차 노드 refresh   HTTP 200
  차단 적용 → 분단 성립
    +25초  cluster_size(k0 k1) = [2.0 2.0]
    +50초  cluster_size(k0 k1) = [1.0 ...]     ← 갈라졌다
 === 분단 상태에서 ===
  keycloak-0 로그인 → keycloak-0 에서 refresh  HTTP 200  ← 대조군
  keycloak-0 로그인 → keycloak-1 에서 refresh  HTTP 400  ← 시험군
  {"error":"invalid_grant","error_description":"Session not active"}
 ```
 **대조군이 200 인 것이 중요하다.** 차단이 모든 것을 망가뜨린 게 아니라
 **교차 노드만** 끊었다는 증거다.
 ```
   persistent :  세션 ── PostgreSQL ──▶ 양쪽이 본다      7800 무관
   volatile   :  세션 ── 클러스터(7800) ─▶ 상대에게 간다   7800 필수
 ```
 **같은 주입, 같은 관측, 정반대 결과.** 이 한 쌍이 A층 전체의 근거다.
 ---
 ## 4. A-8 재실행 — 배포가 곧 로그아웃
 ```
 === 재시작 전 로그인 ===
  sid = aVwYnzKZFFvMqD3bpSeiILuM
 === 롤링 재시작 ===
 partitioned roll out complete: 2 new pods have been updated...
 === ★ 재시작 전 토큰이 아직 통하는가 (persistent 였을 때는 200) ===
  keycloak-0 에서 refresh  HTTP 400
  {"error":"invalid_grant","error_description":"Session not active"}
 ```
 **배포할 때마다 전원 로그아웃된다.**
 | | persistent | volatile |
 |---|---|---|
 | 배포 | 자유롭다 | **모든 사용자가 다시 로그인** |
 | 파드 재시작 (OOM, 노드 교체) | 무해 | **그 노드가 처리하던 세션 소멸** |
 | 무중단 여부 | 무중단 (A-8) | 접속은 되지만 **로그인 상태가 사라진다** |
 > **A-8 에서 "이것이 persistent 를 켜는 진짜 이유"라고 썼는데, 여기서 증명된다.**
 > 24 이전 버전을 쓰는 곳에서 "배포하면 로그아웃된다"가 당연하게 여겨졌던 이유다.
 ---
 ## 5. A-2 재실행 — 예상 못 한 비대칭
 ```
  ① 캐시를 가진 노드에서 refresh   HTTP 500
  ② 새 로그인                      HTTP 200      ← persistent 에서는 500 이었다
 ```
 **새 로그인은 되는데 refresh 가 안 된다.** 순서가 거꾸로다.
 ### 왜 새 로그인이 되는가
 ```
   로그인에 필요한 것
     ├─ realm 설정   → Infinispan `realms` 캐시에 있다
     ├─ 사용자 자격  → `users` 캐시에 있다
     └─ 세션 저장    → volatile 이므로 메모리
   → DB 없이 완결된다
 ```
 **A-2 에서 persistent 로 했을 때 로그인이 실패한 이유는 "세션을 DB 에 써야
 해서"였다.** 그 쓰기가 없어지니 로그인이 통과한다.
 ### refresh 가 500 인 이유 — 가설
 **측정은 확실하지만 원인은 확정하지 못했다.** 유력한 후보는
 `REVOKED_TOKEN` 테이블이다 — refresh token 회전에서 **이미 쓴 토큰인지**
 확인하려면 그 테이블을 봐야 하고, 그 경로는 캐시되지 않는다.
 ```
 kubectl -n keycloak-lab exec deploy/postgres -- psql -U keycloak -d keycloak -c "\dt" | grep revoked
 public | revoked_token | table | keycloak
 ```
 **확정하려면 A-3 에서 쓴 문장 로깅을 켜고 다시 재현해야 한다.** 여기서는
 **가설로 남긴다.**
 > **volatile 이 "DB 없이 돌아간다"는 뜻은 아니다.**
 > realm·사용자·클라이언트·취소 토큰은 **여전히 DB 에 있다.**
 > 세션만 메모리로 옮긴 것이다.
 ---
 ## 6. 원복
 ```bash
 # args 를 되돌린다
 args: ["start"]
 kubectl apply -f deploy/lab/k8s/keycloak-cluster.yaml
 ```
 ```
 === [검증] persistent 로 돌아왔는가 ===
 ["start"]
  DB 온라인 세션: 1 건  (로그인 1회 후 → persistent 복귀 확인)
  외부 진입점 HTTP 200
 ```
 **전환 자체는 설정 한 줄이고 되돌리기도 한 줄이다.** 다만 전환 시점에
 **기존 세션은 전부 사라진다** (저장 위치가 바뀌므로).
 ---
 ## 7. 개념
 ### 두 모드의 데이터 흐름
 ```
   persistent (KC 25+, 26 기본)
      로그인 ──▶ PostgreSQL (진실)  +  로컬 캐시 (사본)
      조회   ──▶ 캐시에 없으면 DB
      공유   ──▶ 같은 DB 를 보는 것
   volatile (KC 24 이전)
      로그인 ──▶ Infinispan (진실)
      조회   ──▶ 클러스터에서 찾는다
      공유   ──▶ 7800 을 통한 복제
 ```
 ### 무엇을 맞바꾸는가
 | | persistent | volatile |
 |---|---|---|
 | 재시작 내구성 | **있다** | 없다 |
 | 7800 의존 | 낮다 (무효화만) | **높다 (세션 자체)** |
 | DB 부하 | **로그인·refresh 마다 쓰기** | 세션 관련 없음 |
 | 노드 확장 | DB 가 병목 | **복제 트래픽이 N² 로 증가** |
 | 지연 민감도 | **DB 왕복에 민감** (A-6) | 클러스터 왕복에 민감 |
 **26 이 기본을 바꾼 이유가 이 표에 있다** — 운영에서 가장 아픈 것이
 "배포하면 로그아웃"이었기 때문이다.
 ---
 ## 8. 재현 절차 (명령어)
 ```bash
 # 1. 끌 수 있는지 확인
 kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kc.sh build --help-all \
  | tr ',' '\n' | grep -i persistent
 # 2. 세션을 비우고 전환 (비교 기준을 맞추기 위해)
 kubectl -n keycloak-lab exec deploy/postgres -- psql -U keycloak -d keycloak \
  -c "delete from offline_user_session"
 #   args: ["start", "--features-disabled=persistent-user-sessions"]
 kubectl apply -f deploy/lab/k8s/keycloak-cluster.yaml
 kubectl -n keycloak-lab rollout status statefulset/keycloak --timeout=500s
 # 3. volatile 확인 — 로그인 후 DB 가 비어 있어야 한다
 kubectl -n keycloak-lab exec deploy/postgres -- psql -U keycloak -d keycloak \
  -c "select offline_flag, count(*) from offline_user_session group by offline_flag"
 # 4. A-1 / A-8 을 그대로 반복한다 (증거 파일 참조)
 # 5. 원복
 #   args: ["start"]
 kubectl apply -f deploy/lab/k8s/keycloak-cluster.yaml
 ```
 ---
 ## 9. 이 실험이 A층에 남기는 것
 | | |
 |---|---|
 | **A-0~A-6 의 결론은 모두 "26 기본값" 조건부다** | 버전이 다르면 답이 다르다 |
 | **A-1 이 통념과 어긋난 이유가 확정됐다** | 통념은 24 이전에서 맞다 |
 | **버전 확인이 1순위** | `kc.sh --version` 을 먼저 본다 |
 | **volatile 이 DB 독립을 뜻하지 않는다** | realm·사용자·취소 토큰은 여전히 DB |
 ### 미해결로 남긴 것
 **volatile 에서 refresh 만 500 이 되는 이유** — `REVOKED_TOKEN` 조회 가설을
 세웠지만 확정하지 못했다. A-3 의 문장 로깅 기법으로 재현하면 답이 나온다.
@@ -0,0 +1,283 @@
 # B-0 — 자동구성은 실제로 무엇을 골랐는가 (그리고 배포에서 겪은 것들)
 브랜치 `feature/keycloak-b0-bff-redis-deploy` ·
 증거 [`docs/evidence/b0-bff-redis-deploy/`](evidence/b0-bff-redis-deploy/) ·
 2026-09-04 14:20–14:50 KST
 **Q1 이 직접 요구한 확인이다.**
 > 코드에 저장소를 직접 생성하는 Bean 이 없기 때문에, 어떤 구현체가 실제로
 > 사용되는지는 **Spring Boot 의 자동구성 결과까지 확인해야** 정확하게 알 수 있다.
 ---
 ## 0. 결론부터
 ```
 authorizedClientService      -> InMemoryOAuth2AuthorizedClientService
 authorizedClientRepository   -> AuthenticatedPrincipalOAuth2AuthorizedClientRepository
 authorizedClientManager      -> AuthorizedClientServiceOAuth2AuthorizedClientManager
 clientRegistrationRepository -> InMemoryClientRegistrationRepository
 SessionRepository            -> 없음 (서블릿 컨테이너 in-memory)
 Redis / Spring Session       -> ★ 없음
 ```
 **추측이 맞았지만, 추측으로 두면 안 되는 이유가 두 번째 줄에 있다.**
 `AuthenticatedPrincipalOAuth2AuthorizedClientRepository` — 이름이 곧 설명이다.
 **"인증된 주체(principal) 기준"** 으로 authorized client 를 찾는다.
 **session ID 가 아니다.** Q1·Q3 가 지적한 "같은 사용자의 여러 브라우저가 같은
 token 을 공유한다"는 문제의 **기제가 이 빈 하나에 들어 있다.**
 그리고 배포하자마자 **Q1 의 문제가 실험을 시작하기도 전에 나타났다** —
 replica 2개에서는 **로그인 자체가 실패한다.**
 ---
 ## 1. 배포에서 겪은 문제 다섯 가지
 ### 문제 ① — `bff/` 가 소스 없이 빌드 산출물만 있었다
 ```
 bff/target/classes/...   9개 파일
 bff/src/                 없음
 ```
 `.gitignore` 에 `target/` 이 없어 클래스 파일만 커밋되어 있었다.
 소스는 다른 브랜치에 있었다.
 ```bash
 git checkout origin/develop-keycloak-pattern3 -- bff/
 ```
 ### 문제 ② — YAML 중복 키로 빌드가 깨졌다
 actuator 를 열려고 `management:` 아래에 `endpoint:` 블록을 **하나 더** 넣었다.
 이미 있는데.
 ```
 org.yaml.snakeyaml.constructor.SafeConstructor.processDuplicateKeys
 ```
 **Docker 빌드 로그가 `tail` 로 잘려 원인이 안 보였다.** `--progress=plain` 으로
 전체를 받아서야 스택트레이스에서 `processDuplicateKeys` 를 찾았다.
 ```bash
 docker build --progress=plain -t keycloak-pattern-bff:lab . > /tmp/build.log 2>&1
 grep -nE "Tests run|Caused by|\.java:[0-9]" /tmp/build.log
 ```
 > **빌드 실패는 마지막 15줄에 안 들어 있는 경우가 많다.** 전체를 파일로 받는다.
 ### 문제 ③ — 환경변수에 기본값을 안 줘서 테스트가 죽었다
 `${KC_ISSUER_EXTERNAL}` 처럼 기본값 없이 쓰면 **테스트에서 컨텍스트가 안 뜬다.**
 테스트는 그 환경변수를 모른다.
 ```yaml
 authorization-uri: ${KC_ISSUER_EXTERNAL:http://localhost:8080/realms/keycloak-patterns}/protocol/openid-connect/auth
 ```
 ### 문제 ④ — actuator 가 인증에 막혀 있었다
 `/actuator/beans` 를 부르면 `200` 이 왔는데, **Keycloak 로그인 페이지**였다.
 `-L` 로 리다이렉트를 따라간 결과였다.
 ```java
 "/actuator/health",
 "/actuator/health/**",
 // 실험대 전용 — 운영에서는 절대 열지 않는다
 "/actuator/**"
 ```
 > **`200` 이 곧 성공은 아니다.** 무엇이 왔는지 봐야 한다.
 ### 문제 ⑤ — 큰 응답이 프록시에서 `Bad Gateway`
 `/actuator/beans` 는 117KB 다. nginx → Traefik 을 거치면서 실패했다.
 ```
 $ curl https://app1.hyeonworks.com/actuator/beans
 Bad Gateway
 ```
 파드 안에서 직접 받아 해결했다. **alpine 기반 JRE 이미지에 `wget` 이 있다.**
 ```bash
 kubectl -n keycloak-lab exec <bff-pod> -- wget -qO- http://localhost:8083/actuator/beans
 ```
 ---
 ## 2. 배포 구성
 ```
   브라우저 ──https──▶ nginx ──▶ Traefik ──▶ bff (2 replica)
                                              │
                                              ├──▶ Keycloak  (realm: keycloak-patterns)
                                              └──▶ echo      (resource server 대역)
   redis  ── kc-lab-2 (postgres 와 같은 노드)  ← 아직 연결하지 않았다
 ```
 **Redis 는 배포만 하고 BFF 에 연결하지 않았다.** B-0 의 질문이 "아무것도 주지
 않았을 때 자동구성이 무엇을 고르는가"이므로, 아무것도 주지 않은 상태를 먼저
 측정해야 한다.
 ### Keycloak realm 준비 (kcadm)
 ```bash
 kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh config credentials \
  --server http://localhost:8080 --realm master --user admin --password <pw>
 kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh create realms \
  -s realm=keycloak-patterns -s enabled=true -s accessTokenLifespan=60
 kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh create clients -r keycloak-patterns \
  -s clientId=bff-confidential -s publicClient=false -s secret=bff-lab-secret \
  -s 'redirectUris=["https://app1.hyeonworks.com/*"]'
 ```
 **`accessTokenLifespan=60`** 으로 둔 것은 B-3(refresh 경쟁)을 위해서다.
 만료를 기다리는 시간이 짧아야 재현이 된다.
 ### 브라우저용 URL 과 백채널 URL 을 분리했다
 ```yaml
 authorization-uri: ${KC_ISSUER_EXTERNAL}/protocol/openid-connect/auth   # 브라우저가 간다
 token-uri:         ${KC_ISSUER_INTERNAL}/protocol/openid-connect/token  # BFF 가 서버끼리
 ```
 ```yaml
 - name: KC_ISSUER_EXTERNAL
  value: https://auth.hyeonworks.com/realms/keycloak-patterns
 - name: KC_ISSUER_INTERNAL
  value: http://keycloak.keycloak-lab.svc:8080/realms/keycloak-patterns
 ```
 **2홉 헤더 실험에서 배운 것이 그대로 쓰인다** — 브라우저가 보는 이름과
 서버가 부르는 주소는 다르고, 섞으면 리다이렉트가 깨진다.
 `SERVER_FORWARD_HEADERS_STRATEGY=native` 도 같은 이유다. 없으면 Spring 이
 `redirect_uri` 를 `http://` 로 만들어 Keycloak 이 거부한다.
 ---
 ## 3. 동작 확인 — 브라우저 증거
 ![로그인 성공](evidence/b0-bff-redis-deploy/b0-bff-login-success-single-replica.png)
 ![token 경계](evidence/b0-bff-redis-deploy/b0-bff-token-boundary.png)
 ```json
 {"pattern":"AP3-backend-for-frontend","principal":"labuser",
 "accessTokenStoredOnServer":true,"refreshTokenStoredOnServer":true,
 "browserTokenCount":0,"csrfProtectionEnabled":true}
 ```
 **BFF 패턴이 성립한다** — 브라우저에 토큰이 0개이고, 서버가 access/refresh 를
 들고 있다.
 ---
 ## 4. B-0 의 답 — 자동구성 결과
 전체 빈 321개 중 관련된 것들이다.
 | 빈 | 구현체 | 뜻 |
 |---|---|---|
 | `authorizedClientService` | **`InMemoryOAuth2AuthorizedClientService`** | **프로세스 메모리.** 재시작하면 사라진다 |
 | `authorizedClientRepository` | **`AuthenticatedPrincipalOAuth2AuthorizedClientRepository`** | **principal 기준 조회.** session ID 가 없다 |
 | `authorizedClientManager` | `AuthorizedClientServiceOAuth2AuthorizedClientManager` | **service**(공유) 를 쓴다 |
 | `clientRegistrationRepository` | `InMemoryClientRegistrationRepository` | 설정에서 읽은 것 |
 | SessionRepository | **없음** | Tomcat 의 기본 `StandardSession` |
 | Redis / Spring Session | **없음** | 의존성 자체가 없다 |
 ### `AuthenticatedPrincipalOAuth2AuthorizedClientRepository` 가 핵심이다
 ```
   요청이 인증되어 있으면
     └─▶ OAuth2AuthorizedClientService 에 위임
            └─▶ 키: (clientRegistrationId, principalName)
                        └─ session ID 가 없다   ★
   인증되어 있지 않으면
     └─▶ HttpSession 에 임시 보관
 ```
 **같은 사용자가 두 브라우저에서 로그인하면 principalName 이 같으므로
 같은 항목을 본다.** Q1 의 미지수 3 과 Q3 의 제약이 여기서 나온다.
 > **Redis 를 붙여도 이건 안 고쳐진다.** 저장소를 공유해도 **키에 session ID 가
 > 없기 때문**이다. Q1 이 "Session Store 를 공유 저장소로 바꾸는 것만으로는
 > 충분하지 않다"고 쓴 이유다.
 ---
 ## 5. 예상 못 한 것 — **replica 2개에서 로그인 자체가 안 된다**
 배포 직후 브라우저에서 로그인하니 `/login?error` 로 떨어졌다.
 BFF 로그에는 아무 오류도 없었다 (Spring Security 는 로그인 실패를 DEBUG 로만 남긴다).
 **가설** — 인가 요청(state, PKCE verifier)은 `HttpSession` 에 저장된다.
 그런데 그 세션은 **인스턴스 메모리**다. 콜백이 다른 replica 로 가면 저장된
 인가 요청이 없어 실패한다.
 **검증** — replica 를 1로 줄이고 다시 시도했다.
 ```bash
 kubectl -n keycloak-lab scale deployment/bff --replicas=1
 ```
 **로그인이 성공했다.** 가설 확정.
 ```
   replica 2 + 스티키 없음 → 로그인 실패 (콜백이 다른 인스턴스로)
   replica 1              → 로그인 성공
 ```
 > **Q1 의 문제가 실험을 시작하기도 전에 나타났다.**
 > "다중 인스턴스에서 어떻게 운영할 것인가"는 **로그인한 뒤의 문제가 아니라
 > 로그인 자체의 문제**다. 인가 코드 흐름은 **왕복 두 번**이고, 두 번 다 같은
 > 인스턴스로 가야 한다.
 >
 > 이건 B-2 의 검증 1번("한쪽에서 로그인한 뒤 다른 인스턴스로 요청")보다
 > **앞선 단계**다. 로그인이 끝나야 그 검증을 할 수 있는데, 로그인부터 막힌다.
 ---
 ## 6. 재현 절차 (명령어)
 ```bash
 # 1. 소스 가져오기 (target/ 만 커밋되어 있었다)
 git checkout origin/develop-keycloak-pattern3 -- bff/
 # 2. 빌드 — 실패하면 전체 로그를 파일로
 docker build --progress=plain -t keycloak-pattern-bff:lab bff/ > /tmp/build.log 2>&1
 grep -nE "Tests run|Caused by" /tmp/build.log
 # 3. 두 노드에 적재 (레지스트리 없음 → imagePullPolicy: Never)
 docker save keycloak-pattern-bff:lab | ssh test-server "ssh kc-lab-1 'sudo k3s ctr images import -'"
 docker save keycloak-pattern-bff:lab | ssh test-server "ssh kc-lab-2 'sudo k3s ctr images import -'"
 # 4. realm · client · user
 kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh create realms -s realm=keycloak-patterns ...
 # 5. 배포
 kubectl apply -f deploy/lab/k8s/bff-redis.yaml
 # 6. 자동구성 결과 — 파드 안에서 (프록시는 큰 응답에서 502)
 kubectl -n keycloak-lab exec <bff-pod> -- wget -qO- http://localhost:8083/actuator/beans > beans.json
 python3 -c "import json;d=json.load(open('beans.json'));[print(n,'->',i['type']) for n,i in
  list(d['contexts'].values())[0]['beans'].items() if 'AuthorizedClient' in i['type']]"
 ```
 ---
 ## 7. 다음 실험에 남기는 것
 | 실험 | 이 실험이 준 것 |
 |---|---|
 | **B-1** 저장소 결정 | **전환 후 이 빈들이 바뀌는지 다시 찍는다.** "Redis 붙였다"고 믿는데 자동구성이 안 걸리는 경우가 흔하다 |
 | **B-2** 다중 인스턴스 | **로그인 자체가 실패한다**는 것이 이미 관측됐다. 그것이 검증 0번이다 |
 | **B-3** refresh 경쟁 | `accessTokenLifespan=60` 으로 realm 을 만들어뒀다 |
 | 운영 | actuator `beans`/`env` 는 **내부 구조를 그대로 드러낸다.** 실험대에서만 연다 |
		`@@ -0,0 +1 @@`
							`[ 207ms] [ERROR] Failed to load resource: the server responded with a status of 404 () @ https://app1.hyeonworks.com/favicon.ico:0`
		`@@ -0,0 +1 @@`
							`- generic [active] [ref=f28e1]: "{\"pattern\":\"AP3-backend-for-frontend\",\"principal\":\"labuser\",\"accessTokenStoredOnServer\":true,\"refreshTokenStoredOnServer\":true,\"browserTokenCount\":0,\"csrfProtectionEnabled\":true}"`