# AP1은 OAuth client와 token custody를 브라우저에 둔다
# Question: AP1에서 code 교환, token 보관, Resource Server JWT 입력은 어느 구성 요소에 놓이는가?
direction: right
n0: "Public SPA" {
  shape: rectangle
}
n1: "Browser JS memory" {
  shape: sql_table
}
n2: "Keycloak" {
  shape: rectangle
}
n3: "Resource Server" {
  shape: rectangle
}
n0 -> n2: "Authorization Code + PKCE S256"
n2 -> n0: "access · refresh · ID token"
n0 -> n1: "token set 보관"
n0 -> n3: "memory-held access JWT · Bearer"