donghyeon.kang/technical-visualization-haness
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

chore: readme 수정

Browse Source
This commit is contained in:
DongHyeonka
2026-07-29 18:03:21 +09:00
parent 8daa568746
commit 741c79b69f
180 changed files with 62890 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.work/keycloak-four-patterns/final/assets/ap2-mediator-architecture/ap2-mediator-architecture.alt.md
+23
View File
@@ -0,0 +1,23 @@
# AP2는 refresh custody와 API caller를 서로 다른 경계에 둔다
## Alternative text
브라우저가 Spring mediator에서 access token만 받아 Resource Server를 직접 호출하고 refresh token은 authorized-client store에 남기는 AP2 split-custody 아키텍처.
## Long description
브라우저는 AP2_SESSION으로 confidential Spring mediator의 login state를 사용한다. Mediator는 code를 교환한 뒤 access와 refresh token을 server-side authorized-client service에 저장한다. 현재 access token의 값, type, expiry만 브라우저로 전달되고 refresh token은 server 경계에 남는다. 브라우저는 memory에 있는 access token으로 Resource Server용 Bearer header를 만든다.
## Elements and evidence
- **Browser** (actor): AP2_SESSION을 사용하고 전달받은 access token으로 API를 직접 호출하는 주체. Evidence: L156–L160.
- **Spring mediator** (service): Confidential OAuth client로 code를 교환하고 browser에 access-only 응답을 제공한다. Evidence: L156–L158.
- **Authorized-client store** (database): Access와 refresh token을 server-side state로 보관한다. Evidence: L156–L160.
- **Resource Server** (service): 브라우저가 만든 Bearer header를 직접 받으며 downstream audience를 검증하는 API. Evidence: L156–L160.
## Relationships
- **Browser → Resource Server:** Bearer header. Evidence: L158–L160.
- **Browser → Spring mediator:** AP2_SESSION. Evidence: L158–L160.
- **Spring mediator → Browser:** access_token · type · expiry. Evidence: L158–L158.
- **Spring mediator → Authorized-client store:** 보관 · 현재 access 조회. Evidence: L156–L160.
.work/keycloak-four-patterns/final/assets/ap2-mediator-architecture/ap2-mediator-architecture.d2
+19
View File
@@ -0,0 +1,19 @@
# AP2는 refresh custody와 API caller를 서로 다른 경계에 둔다
# Question: AP2에서 server-held refresh token과 browser-held access token은 어떻게 Resource Server 직접 호출로 이어지는가?
direction: right
n0: "Browser" {
shape: person
}
n1: "Spring mediator" {
shape: rectangle
}
n2: "Authorized-client store" {
shape: sql_table
}
n3: "Resource Server" {
shape: rectangle
}
n0 -> n1: "AP2_SESSION"
n1 -> n2: "보관 · 현재 access 조회"
n1 -> n0: "access_token · type · expiry"
n0 -> n3: "Bearer header"
.work/keycloak-four-patterns/final/assets/ap2-mediator-architecture/ap2-mediator-architecture.dot
+13
View File
@@ -0,0 +1,13 @@
digraph techviz {
graph [rankdir=LR, splines=ortho, nodesep=0.55, ranksep=0.85];
node [fontname=Helvetica, fontsize=11, margin="0.18,0.12", style="rounded,filled", fillcolor=white, color="#2d4357", penwidth=1.5];
edge [fontname=Helvetica, fontsize=10, color="#364b5f", penwidth=1.4, arrowsize=0.75];
n0 [label="Browser", shape=box, style="rounded,dashed,filled"];
n1 [label="Spring mediator", shape=box, style="rounded,filled"];
n2 [label="Authorized-client store", shape=cylinder, style="rounded,filled"];
n3 [label="Resource Server", shape=box, style="rounded,filled"];
n0 -> n1 [label="AP2_SESSION", style=solid];
n1 -> n2 [label="보관 · 현재 access 조회", style=solid];
n1 -> n0 [label="access_token · type · expiry", style=solid];
n0 -> n3 [label="Bearer header", style=solid];
}
.work/keycloak-four-patterns/final/assets/ap2-mediator-architecture/ap2-mediator-architecture.drawio
+43
View File
@@ -0,0 +1,43 @@
<?xml version="1.0" encoding="UTF-8"?>
<mxfile host="app.diagrams.net" modified="2026-07-23T00:00:00.000Z" agent="techviz-harness" version="24.7.17" type="device">
<diagram id="ap2-mediator-architecture" name="AP2는 refresh custody와 API caller를 서로 다른 경계에 둔다">
<mxGraphModel dx="925" dy="393" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="925" pageHeight="1169" math="0" shadow="0">
<root>
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<mxCell id="n_browser" value="Browser&lt;br/&gt;HttpOnly AP2_SESSION&lt;br/&gt;access token in memory" tooltip="AP2_SESSION을 사용하고 전달받은 access token으로 API를 직접 호출하는 주체. | Evidence: L156-L160" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;dashed=1;fillColor=#f5f7fa;" vertex="1" parent="1">
<mxGeometry x="70.0" y="128.0" width="170.0" height="88.0" as="geometry"/>
</mxCell>
<mxCell id="n_api-resource-server" value="Resource Server" tooltip="브라우저가 만든 Bearer header를 직접 받으며 downstream audience를 검증하는 API. | Evidence: L156-L160" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
<mxGeometry x="408.5" y="60.0" width="150.0" height="64.0" as="geometry"/>
</mxCell>
<mxCell id="n_mediator" value="Spring mediator&lt;br/&gt;oauth2Login&lt;br/&gt;confidential client" tooltip="Confidential OAuth client로 code를 교환하고 browser에 access-only 응답을 제공한다. | Evidence: L156-L158" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
<mxGeometry x="400.0" y="196.0" width="167.0" height="88.0" as="geometry"/>
</mxCell>
<mxCell id="n_authorized-client-store" value="Authorized-client store&lt;br/&gt;access token&lt;br/&gt;refresh token" tooltip="Access와 refresh token을 server-side state로 보관한다. | Evidence: L156-L160" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;shape=cylinder3;boundedLbl=1;backgroundOutline=1;fillColor=#eef6fb;" vertex="1" parent="1">
<mxGeometry x="727.0" y="118.0" width="153.0" height="108.0" as="geometry"/>
</mxCell>
<mxCell id="e_browser-to-api" value="Bearer header" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_browser" target="n_api-resource-server">
<mxGeometry relative="1" as="geometry">
<mxPoint x="348.2" y="123.0" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_browser-to-mediator" value="AP2_SESSION" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_browser" target="n_mediator">
<mxGeometry relative="1" as="geometry">
<mxPoint x="344.0" y="201.5" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_mediator-to-browser" value="access_token · type · expiry" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_mediator" target="n_browser">
<mxGeometry relative="1" as="geometry">
<mxPoint x="297.2" y="376.0" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_mediator-to-store" value="보관 · 현재 access 조회" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_mediator" target="n_authorized-client-store">
<mxGeometry relative="1" as="geometry">
<mxPoint x="671.0" y="206.0" as="offset"/>
</mxGeometry>
</mxCell>
</root>
</mxGraphModel>
</diagram>
</mxfile>
.work/keycloak-four-patterns/final/assets/ap2-mediator-architecture/ap2-mediator-architecture.excalidraw
+685
View File
@@ -0,0 +1,685 @@
{
"type": "excalidraw",
"version": 2,
"source": "techviz-harness",
"elements": [
{
"id": "edge-browser-to-api",
"type": "arrow",
"x": 240.0,
"y": 92.0,
"width": 168.5,
"height": 62.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 483845717,
"version": 1,
"versionNonce": 315895803,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
62.0
],
[
84.25,
62.0
],
[
84.25,
0.0
],
[
168.5,
0.0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-browser",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-api-resource-server",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-browser-to-api",
"type": "text",
"x": 296.25,
"y": 111.0,
"width": 104,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 505204354,
"version": 1,
"versionNonce": 1198512764,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "Bearer header",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "Bearer header",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "edge-browser-to-mediator",
"type": "arrow",
"x": 240.0,
"y": 172.0,
"width": 160.0,
"height": 59.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 158073357,
"version": 1,
"versionNonce": 843980499,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
0.0
],
[
80.0,
0.0
],
[
80.0,
59.0
],
[
160.0,
59.0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-browser",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-mediator",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-browser-to-mediator",
"type": "text",
"x": 299.0,
"y": 189.5,
"width": 90,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 969862946,
"version": 1,
"versionNonce": 816956638,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "AP2_SESSION",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "AP2_SESSION",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "edge-mediator-to-browser",
"type": "arrow",
"x": 167.0,
"y": 216.0,
"width": 328.5,
"height": 132.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 1097322181,
"version": 1,
"versionNonce": 162636169,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
328.5,
68.0
],
[
328.5,
132.0
],
[
0.0,
132.0
],
[
0.0,
0.0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-mediator",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-browser",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-mediator-to-browser",
"type": "text",
"x": 185.25,
"y": 364.0,
"width": 224,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 337989394,
"version": 1,
"versionNonce": 498879847,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "access_token · type · expiry",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "access_token · type · expiry",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "edge-mediator-to-store",
"type": "arrow",
"x": 567.0,
"y": 172.0,
"width": 160.0,
"height": 68.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 1992079740,
"version": 1,
"versionNonce": 539106131,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
68.0
],
[
80.0,
68.0
],
[
80.0,
0.0
],
[
160.0,
0.0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-mediator",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-authorized-client-store",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-mediator-to-store",
"type": "text",
"x": 603.0,
"y": 194.0,
"width": 136,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1654668376,
"version": 1,
"versionNonce": 26635985,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "보관 · 현재 access 조회",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "보관 · 현재 access 조회",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-browser",
"type": "rectangle",
"x": 70.0,
"y": 128.0,
"width": 170.0,
"height": 88.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "dashed",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1549664096,
"version": 1,
"versionNonce": 397227867,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-browser",
"type": "text",
"x": 80.0,
"y": 138.0,
"width": 150.0,
"height": 68.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 225442297,
"version": 1,
"versionNonce": 1441680053,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "Browser\nHttpOnly AP2_SESSION\naccess token in memory",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "Browser\nHttpOnly AP2_SESSION\naccess token in memory",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-api-resource-server",
"type": "rectangle",
"x": 408.5,
"y": 60.0,
"width": 150.0,
"height": 64.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1241561907,
"version": 1,
"versionNonce": 950374087,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-api-resource-server",
"type": "text",
"x": 418.5,
"y": 70.0,
"width": 130.0,
"height": 44.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 138484242,
"version": 1,
"versionNonce": 528224855,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "Resource Server",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "Resource Server",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-mediator",
"type": "rectangle",
"x": 400.0,
"y": 196.0,
"width": 167.0,
"height": 88.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 846864641,
"version": 1,
"versionNonce": 308227677,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-mediator",
"type": "text",
"x": 410.0,
"y": 206.0,
"width": 147.0,
"height": 68.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 597421764,
"version": 1,
"versionNonce": 193256573,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "Spring mediator\noauth2Login\nconfidential client",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "Spring mediator\noauth2Login\nconfidential client",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-authorized-client-store",
"type": "rectangle",
"x": 727.0,
"y": 118.0,
"width": 153.0,
"height": 108.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#e7f5ff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1233315239,
"version": 1,
"versionNonce": 1888174234,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-authorized-client-store",
"type": "text",
"x": 737.0,
"y": 128.0,
"width": 133.0,
"height": 88.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 448517001,
"version": 1,
"versionNonce": 123295628,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "Authorized-client store\naccess token\nrefresh token",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "Authorized-client store\naccess token\nrefresh token",
"autoResize": true,
"lineHeight": 1.25
}
],
"appState": {
"gridSize": 10,
"viewBackgroundColor": "#ffffff",
"currentItemFontFamily": 5
},
"files": {}
}
.work/keycloak-four-patterns/final/assets/ap2-mediator-architecture/ap2-mediator-architecture.manifest.json
+32
View File
@@ -0,0 +1,32 @@
{
"harness_version": "0.2.0",
"spec_id": "ap2-mediator-architecture",
"spec_version": "1.1",
"spec_sha256": "00183e9d9c71bd0743bb35922fe89898c7cce05f9b13492d1b38fe98be41ba1d",
"source_context": {
"document": "document.md",
"document_sha256": "df4d1a604c74e756672b5b40510abfedb8c67b39af280a5f51985ea9972f5371",
"anchor": {
"kind": "marker",
"value": "ap2-mediator-architecture",
"line": 162
}
},
"outputs": [
"ap2-mediator-architecture.svg",
"ap2-mediator-architecture.drawio",
"ap2-mediator-architecture.mmd",
"ap2-mediator-architecture.d2",
"ap2-mediator-architecture.dot",
"ap2-mediator-architecture.excalidraw",
"ap2-mediator-architecture.alt.md"
],
"lint_issue_count": 0,
"assumption_count": 0,
"assumptions_allowed": false,
"composition_profile": "component-flow",
"reference_ids": [
"payment-event-flow"
],
"diagram_only": true
}
.work/keycloak-four-patterns/final/assets/ap2-mediator-architecture/ap2-mediator-architecture.mmd
+13
View File
@@ -0,0 +1,13 @@
%% AP2는 refresh custody와 API caller를 서로 다른 경계에 둔다
%% question: AP2에서 server-held refresh token과 browser-held access token은 어떻게 Resource Server 직접 호출로 이어지는가?
flowchart LR
n0(["Browser"])
n1["Spring mediator"]
n2[("Authorized-client store")]
n3["Resource Server"]
n0 -->|"AP2_SESSION"| n1
n1 -->|"보관 · 현재 access 조회"| n2
n1 -->|"access_token · type · expiry"| n0
n0 -->|"Bearer header"| n3
classDef external stroke-dasharray: 6 4
class n0 external
.work/keycloak-four-patterns/final/assets/ap2-mediator-architecture/ap2-mediator-architecture.svg
+88
View File
@@ -0,0 +1,88 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="925" height="393" viewBox="0 0 925 393" role="img" aria-labelledby="diagram-title diagram-description">
<title id="diagram-title">AP2는 refresh custody와 API caller를 서로 다른 경계에 둔다</title>
<desc id="diagram-description">브라우저는 AP2_SESSION으로 confidential Spring mediator의 login state를 사용한다. Mediator는 code를 교환한 뒤 access와 refresh token을 server-side authorized-client service에 저장한다. 현재 access token의 값, type, expiry만 브라우저로 전달되고 refresh token은 server 경계에 남는다. 브라우저는 memory에 있는 access token으로 Resource Server용 Bearer header를 만든다.</desc>
<metadata>{&quot;techviz&quot;:{&quot;spec_version&quot;:&quot;1.1&quot;,&quot;id&quot;:&quot;ap2-mediator-architecture&quot;,&quot;profile&quot;:&quot;component-flow&quot;},&quot;source_context&quot;:{&quot;document&quot;:&quot;document.md&quot;,&quot;document_sha256&quot;:&quot;df4d1a604c74e756672b5b40510abfedb8c67b39af280a5f51985ea9972f5371&quot;,&quot;anchor&quot;:{&quot;kind&quot;:&quot;marker&quot;,&quot;value&quot;:&quot;ap2-mediator-architecture&quot;,&quot;line&quot;:162}},&quot;evidence_policy&quot;:&quot;Each factual element cites source lines or is marked assumption.&quot;,&quot;diagram_only&quot;:true}</metadata>
<defs>
<marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
<path d="M 0 0 L 10 5 L 0 10 z" />
</marker>
<style>
:root { color-scheme: light; }
text { font-family: Inter, Pretendard, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; fill: #111827; }
.canvas { fill: #ffffff; }
.group-box { fill: #ffffff; stroke: #9ca3af; stroke-width: 1.4; stroke-dasharray: 7 5; }
.group-label-bg { fill: #ffffff; }
.group-label { font-size: 13px; font-weight: 650; fill: #374151; }
.edge { fill: none; stroke: #374151; stroke-width: 1.8; stroke-linejoin: round; stroke-linecap: round; marker-end: url(#arrow); }
.edge.style-dashed, .edge.semantic-dashed, .edge.assumption { stroke-dasharray: 7 5; }
.edge.style-dotted { stroke-dasharray: 2 5; }
.edge.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
.edge.emphasis-muted { stroke: #9ca3af; }
.edge.emphasis-warning, .edge.kind-failure, .edge.kind-error { stroke: #dc2626; stroke-width: 2.2; }
.edge-label-bg { fill: #ffffff; }
.edge-label { font-size: 12px; font-weight: 560; text-anchor: middle; }
.node-shape { fill: #ffffff; stroke: #4b5563; stroke-width: 1.7; }
.node-shape.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
.node-shape.emphasis-muted { stroke: #9ca3af; fill: #f9fafb; }
.node-shape.emphasis-warning { stroke: #d97706; stroke-width: 2; fill: #fffdf5; }
.node-shape.kind-database, .node-shape.kind-datastore, .node-shape.kind-storage { fill: #f8fafc; }
.node-shape.kind-queue, .node-shape.kind-event, .node-shape.kind-topic { fill: #fafafa; }
.node-shape.assumption { stroke-dasharray: 4 4; }
.storage-bottom, .controller-divider { fill: none; stroke: #4b5563; stroke-width: 1.4; }
.controller-led { fill: #4b5563; }
.actor-symbol { fill: none; stroke: #4b5563; stroke-width: 1.8; stroke-linecap: round; }
.actor-symbol.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
.node-label { font-size: 14px; font-weight: 650; text-anchor: middle; }
.node-role { font-size: 10px; letter-spacing: 0.04em; text-anchor: middle; fill: #6b7280; }
.node-detail-divider { stroke: #d1d5db; stroke-width: 1; }
.node-detail { font-size: 11px; fill: #374151; }
.assumption-badge { font-size: 9px; font-weight: 700; fill: #92400e; }
.failure-mark { stroke: #dc2626; stroke-width: 4; stroke-linecap: round; }
.lifeline { stroke: #9ca3af; stroke-width: 1.2; stroke-dasharray: 5 5; }
.timeline-axis { stroke: #374151; stroke-width: 1.8; marker-end: url(#arrow); }
.timeline-stem { stroke: #6b7280; stroke-width: 1.3; }
.timeline-marker { fill: #ffffff; stroke: #374151; stroke-width: 1.7; }
.timeline-marker.primary { fill: #2563eb; stroke: #2563eb; }
.timeline-marker.warning { fill: #dc2626; stroke: #dc2626; }
.timeline-label { font-size: 13px; font-weight: 650; text-anchor: middle; }
.timeline-detail { font-size: 11px; fill: #4b5563; text-anchor: middle; }
</style>
</defs>
<rect class="canvas" width="925" height="393" />
<polyline class="edge kind-request style-solid emphasis-primary" points="240.0,154.0 324.2,154.0 324.2,92.0 408.5,92.0" data-evidence="158-160" />
<rect class="edge-label-bg" x="295.7" y="109.0" width="105.1" height="22" rx="3" />
<text class="edge-label" x="348.2" y="124.0">Bearer header</text>
<polyline class="edge kind-request style-solid emphasis-normal" points="240.0,172.0 320.0,172.0 320.0,231.0 400.0,231.0" data-evidence="158-160" />
<rect class="edge-label-bg" x="298.1" y="187.5" width="91.7" height="22" rx="3" />
<text class="edge-label" x="344.0" y="202.5">AP2_SESSION</text>
<polyline class="edge kind-response style-dashed emphasis-primary semantic-dashed" points="495.5,284.0 495.5,348.0 167.0,348.0 167.0,216.0" data-evidence="158-158" />
<rect class="edge-label-bg" x="194.4" y="362.0" width="205.6" height="22" rx="3" />
<text class="edge-label" x="297.2" y="377.0">access_token · type · expiry</text>
<polyline class="edge kind-data style-solid emphasis-normal" points="567.0,240.0 647.0,240.0 647.0,172.0 727.0,172.0" data-evidence="156-160" />
<rect class="edge-label-bg" x="605.0" y="192.0" width="131.9" height="22" rx="3" />
<text class="edge-label" x="671.0" y="207.0">보관 · 현재 access 조회</text>
<g id="node-browser">
<g class="actor-symbol emphasis-normal" data-evidence="156-160"><circle cx="155.0" cy="148.0" r="11.0" /><line x1="155.0" y1="164.0" x2="155.0" y2="187.0" /><line x1="137.0" y1="174.0" x2="173.0" y2="174.0" /><line x1="155.0" y1="187.0" x2="140.0" y2="204.0" /><line x1="155.0" y1="187.0" x2="170.0" y2="204.0" /></g>
<text class="node-label" x="155.0" y="209.0">Browser</text>
</g>
<g id="node-api-resource-server">
<rect class="node-shape kind-service emphasis-normal role-sink" data-evidence="156-160" x="408.5" y="60.0" width="150.0" height="64.0" rx="7" />
<text class="node-label" x="483.5" y="90.0">Resource Server</text>
</g>
<g id="node-mediator">
<rect class="node-shape kind-service emphasis-primary role-service" data-evidence="156-158" x="400.0" y="196.0" width="167.0" height="88.0" rx="7" />
<text class="node-label" x="483.5" y="223.0">Spring mediator</text>
<line class="node-detail-divider" x1="414.0" y1="244.0" x2="553.0" y2="244.0" />
<text class="node-detail" x="416.0" y="261.0">oauth2Login</text>
<text class="node-detail" x="416.0" y="277.0">confidential client</text>
</g>
<g id="node-authorized-client-store">
<rect class="node-shape kind-database emphasis-normal role-store" data-evidence="156-160" x="727.0" y="131.0" width="153.0" height="82.0" /><ellipse class="node-shape kind-database emphasis-normal role-store" cx="803.5" cy="131.0" rx="76.5" ry="13.0" /><path class="storage-bottom" d="M 727.0 213.0 A 76.5 13.0 0 0 0 880.0 213.0" />
<text class="node-label" x="803.5" y="145.0">Authorized-client</text>
<text class="node-label" x="803.5" y="163.0">store</text>
<line class="node-detail-divider" x1="741.0" y1="184.0" x2="866.0" y2="184.0" />
<text class="node-detail" x="743.0" y="201.0">access token</text>
<text class="node-detail" x="743.0" y="217.0">refresh token</text>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 7.5 KiB