# AP4 proxy session에서 trusted identity JSON까지
# Question: AP4에서 AP4_SESSION은 어떤 순서로 검증되고 allowlisted identity header와 internal token을 거쳐 JSON이 되는가?
direction: right
n0: "브라우저" {
  shape: rectangle
}
n1: "Nginx edge" {
  shape: rectangle
}
n2: "oauth2-proxy" {
  shape: rectangle
}
n3: "Spring upstream" {
  shape: rectangle
}
n0 -> n1: "GET /api/edge + AP4_SESSION"
n1 -> n2: "internal /oauth2/auth subrequest"
n2 -> n1: "authenticated user + email"
n1 -> n3: "GET /edge/me · trusted headers + internal token"
n3 -> n1: "trusted identity JSON"
n1 -> n0: "pattern + user + email + identityHeader"