# AP3 session cookie에서 BFF downstream Bearer까지
# Question: AP3에서 브라우저의 AP3_SESSION은 어떻게 BFF가 만든 downstream Bearer 요청과 중계 JSON이 되는가?
direction: right
n0: "브라우저" {
  shape: rectangle
}
n1: "Spring BFF" {
  shape: rectangle
}
n2: "Authorized-client store" {
  shape: rectangle
}
n3: "Resource Server" {
  shape: rectangle
}
n0 -> n1: "GET /bff/api/me + AP3_SESSION"
n1 -> n2: "authorize current principal"
n2 -> n1: "server-held access token"
n1 -> n3: "GET /api/me · Bearer access token"
n3 -> n1: "subject · username · issuer · audience"
n1 -> n0: "BFF ResponseEntity → browser JSON"