# AP2 server-held token에서 브라우저 Bearer 요청까지
# Question: AP2에서 AP2_SESSION으로 찾은 server-side authorized client는 어떻게 브라우저의 직접 Bearer API 호출이 되는가?
direction: right
n0: "브라우저" {
  shape: rectangle
}
n1: "Spring mediator" {
  shape: rectangle
}
n2: "Authorized-client store" {
  shape: rectangle
}
n3: "Resource Server" {
  shape: rectangle
}
n0 -> n1: "GET /token/access + AP2_SESSION"
n1 -> n2: "authorize current principal"
n2 -> n1: "current access token"
n1 -> n0: "access token + type + expiry"
n0 -> n3: "GET /api/me · browser-created Bearer"
n3 -> n0: "subject · username · issuer · audience"