{
  "repo": "tidbcloud/VictoriaMetrics",
  "binary": "vmauth",
  "binary_path": "app/vmauth/main.go",
  "dependencies": {
    "VMAuthLifecycle.DryRunValidateConfig": {
      "infrastructure": {
        "filesystem": {
          "conditions": [
            "Only when auth.config points to a local file"
          ],
          "operations": [
            {
              "operation": "READ CONFIG",
              "trigger": "Validate the auth config and exit without starting listeners",
              "conditions": [
                "dryRun == true",
                "auth.config is a local file path"
              ],
              "implementation": "main -> reloadAuthConfig -> fscore.ReadFileOrHTTP(authConfigPath)"
            }
          ]
        },
        "http": {
          "conditions": [
            "Only when auth.config points to an HTTP URL"
          ],
          "operations": [
            {
              "operation": "GET CONFIG",
              "trigger": "Validate a remotely hosted auth config and exit without starting listeners",
              "conditions": [
                "dryRun == true",
                "auth.config is an HTTP URL"
              ],
              "implementation": "main -> reloadAuthConfig -> fscore.ReadFileOrHTTP(authConfigPath)"
            }
          ]
        },
        "environment": {
          "conditions": [
            "Only when the auth config contains ${ENV_VAR} placeholders"
          ],
          "operations": [
            {
              "operation": "EXPAND ENV VARS",
              "trigger": "Resolve environment placeholders before YAML parsing",
              "conditions": [
                "dryRun == true",
                "reloadAuthConfigData(data) reaches parseAuthConfig"
              ],
              "implementation": "parseAuthConfig -> envtemplate.ReplaceBytes(data)"
            }
          ]
        }
      },
      "services": []
    },
    "VMAuthLifecycle.Startup": {
      "infrastructure": {},
      "services": []
    },
    "VMAuthLifecycle.InitializeAuthConfig": {
      "infrastructure": {
        "filesystem": {
          "conditions": [
            "Only when auth.config points to a local file"
          ],
          "operations": [
            {
              "operation": "READ CONFIG",
              "trigger": "Load the initial auth config before accepting proxy traffic",
              "conditions": [
                "len(auth.config) > 0",
                "auth.config is a local file path"
              ],
              "implementation": "initAuthConfig -> reloadAuthConfig -> fscore.ReadFileOrHTTP(authConfigPath)"
            }
          ]
        },
        "http": {
          "conditions": [
            "Only when auth.config points to an HTTP URL"
          ],
          "operations": [
            {
              "operation": "GET CONFIG",
              "trigger": "Load the initial auth config before accepting proxy traffic",
              "conditions": [
                "len(auth.config) > 0",
                "auth.config is an HTTP URL"
              ],
              "implementation": "initAuthConfig -> reloadAuthConfig -> fscore.ReadFileOrHTTP(authConfigPath)"
            }
          ]
        },
        "environment": {
          "conditions": [
            "Only when the auth config contains ${ENV_VAR} placeholders"
          ],
          "operations": [
            {
              "operation": "EXPAND ENV VARS",
              "trigger": "Expand environment placeholders before parsing the auth config",
              "conditions": [
                "reloadAuthConfigData(data) reaches parseAuthConfig"
              ],
              "implementation": "parseAuthConfig -> envtemplate.ReplaceBytes(data)"
            }
          ]
        }
      },
      "services": []
    },
    "VMAuthLifecycle.RunAuthConfigReloader": {
      "infrastructure": {
        "filesystem": {
          "conditions": [
            "Only when auth.config points to a local file and a reload is triggered"
          ],
          "operations": [
            {
              "operation": "READ CONFIG",
              "trigger": "Refresh the auth config on SIGHUP or configCheckInterval ticks",
              "conditions": [
                "stopCh is not closed",
                "either configCheckInterval > 0 or a SIGHUP arrives",
                "auth.config is a local file path"
              ],
              "implementation": "authConfigReloader.updateFn -> reloadAuthConfig -> fscore.ReadFileOrHTTP(authConfigPath)"
            }
          ]
        },
        "http": {
          "conditions": [
            "Only when auth.config points to an HTTP URL and a reload is triggered"
          ],
          "operations": [
            {
              "operation": "GET CONFIG",
              "trigger": "Refresh the auth config from a remote URL on SIGHUP or configCheckInterval ticks",
              "conditions": [
                "stopCh is not closed",
                "either configCheckInterval > 0 or a SIGHUP arrives",
                "auth.config is an HTTP URL"
              ],
              "implementation": "authConfigReloader.updateFn -> reloadAuthConfig -> fscore.ReadFileOrHTTP(authConfigPath)"
            }
          ]
        },
        "environment": {
          "conditions": [
            "Only when refreshed auth config contains ${ENV_VAR} placeholders"
          ],
          "operations": [
            {
              "operation": "EXPAND ENV VARS",
              "trigger": "Re-expand environment placeholders before parsing refreshed auth config data",
              "conditions": [
                "reloadAuthConfigData(data) reaches parseAuthConfig"
              ],
              "implementation": "parseAuthConfig -> envtemplate.ReplaceBytes(data)"
            }
          ]
        }
      },
      "services": []
    },
    "VMAuthLifecycle.StartMainHTTPServer": {
      "infrastructure": {},
      "services": []
    },
    "VMAuthLifecycle.StartInternalHTTPServer": {
      "infrastructure": {},
      "services": []
    },
    "VMAuthLifecycle.InitializePushMetrics": {
      "infrastructure": {},
      "services": []
    },
    "VMAuthLifecycle.WaitForSigterm": {
      "infrastructure": {},
      "services": []
    },
    "VMAuthLifecycle.StopPushMetrics": {
      "infrastructure": {},
      "services": []
    },
    "VMAuthLifecycle.StopMainHTTPServer": {
      "infrastructure": {},
      "services": []
    },
    "VMAuthLifecycle.StopAuthConfig": {
      "infrastructure": {},
      "services": []
    },
    "HTTP ANY /-/reload": {
      "infrastructure": {
        "local_process": {
          "conditions": [
            "reloadAuthKey auth passes",
            "The route is served on the internal listener when httpInternalListenAddr is set, otherwise on the main listener"
          ],
          "operations": [
            {
              "operation": "SELF SIGHUP",
              "trigger": "Trigger an immediate auth-config reload without restarting the process",
              "conditions": [
                "httpserver.CheckAuthFlag(w, r, reloadAuthKey) == true"
              ],
              "implementation": "internalRequestHandler -> procutil.SelfSIGHUP()"
            }
          ]
        }
      },
      "services": []
    },
    "HTTP GET /health": {
      "infrastructure": {},
      "services": []
    },
    "HTTP ANY /ping": {
      "infrastructure": {},
      "services": []
    },
    "HTTP GET /metrics": {
      "infrastructure": {},
      "services": []
    },
    "HTTP GET /-/healthy": {
      "infrastructure": {},
      "services": []
    },
    "HTTP GET /-/ready": {
      "infrastructure": {},
      "services": []
    },
    "HTTP GET /debug/pprof/*": {
      "infrastructure": {},
      "services": []
    },
    "HTTP GET /favicon.ico": {
      "infrastructure": {},
      "services": []
    },
    "VMAuthProxy.ServeUnauthorizedProxyRequest": {
      "infrastructure": {},
      "services": [
        {
          "name": "configured-backend-http",
          "target_interface": "HTTP url_prefix/default_url backend",
          "operation_type": "http_proxy",
          "conditions": [
            "No auth token is present in allowed auth headers or URL userinfo",
            "authConfig.Load().UnauthorizedUser != nil",
            "ProcessUserRequest continues past concurrency checks"
          ],
          "operations": [
            {
              "operation": "PROXY REQUEST",
              "trigger": "Proxy unauthenticated traffic using the unauthorized_user routing config",
              "conditions": [
                "Unauthorized user config exists",
                "A route or default_url is selected"
              ],
              "implementation": "requestHandler -> processUserRequest(w, r, unauthorizedUser) -> processRequest -> tryProcessingRequest -> ui.rt.RoundTrip(req)"
            }
          ]
        }
      ]
    },
    "VMAuthProxy.RejectMissingAuthorization": {
      "infrastructure": {},
      "services": []
    },
    "VMAuthProxy.RejectInvalidAuthToken": {
      "infrastructure": {},
      "services": []
    },
    "VMAuthProxy.ProcessUserRequest": {
      "infrastructure": {},
      "services": []
    },
    "VMAuthProxy.MatchConfiguredRoute": {
      "infrastructure": {},
      "services": []
    },
    "VMAuthProxy.ServeDefaultRoute": {
      "infrastructure": {},
      "services": [
        {
          "name": "configured-backend-http",
          "target_interface": "HTTP default_url backend",
          "operation_type": "http_proxy",
          "conditions": [
            "No url_map entry matched the normalized request",
            "ui.DefaultURL != nil"
          ],
          "operations": [
            {
              "operation": "PROXY REQUEST",
              "trigger": "Forward unmatched requests to the user's default_url backend with the original request path preserved as request_path",
              "conditions": [
                "ui.DefaultURL is configured",
                "No explicit url_map route matched"
              ],
              "implementation": "processRequest -> ui.DefaultURL -> targetURL.Query().Set(\"request_path\", u.String()) -> tryProcessingRequest -> ui.rt.RoundTrip(req)"
            }
          ]
        }
      ]
    },
    "VMAuthProxy.DiscoverBackendAddrs": {
      "infrastructure": {
        "dns": {
          "conditions": [
            "Only when the selected URLPrefix has discover_backend_ips enabled and nextDiscoveryDeadline has expired"
          ],
          "operations": [
            {
              "operation": "LOOKUP IP",
              "trigger": "Refresh backend IPs for hostname-based url_prefix entries",
              "conditions": [
                "discover_backend_ips is enabled",
                "backend host does not start with srv+"
              ],
              "implementation": "URLPrefix.discoverBackendAddrsIfNeeded -> netutil.Resolver.LookupIPAddr(ctx, host)"
            },
            {
              "operation": "LOOKUP SRV",
              "trigger": "Refresh backend targets for srv+ hostname url_prefix entries",
              "conditions": [
                "discover_backend_ips is enabled",
                "backend host starts with srv+"
              ],
              "implementation": "URLPrefix.discoverBackendAddrsIfNeeded -> netutil.Resolver.LookupSRV(ctx, \"\", \"\", srvHost)"
            }
          ]
        }
      },
      "services": []
    },
    "VMAuthProxy.ProxyToBackend": {
      "infrastructure": {},
      "services": [
        {
          "name": "configured-backend-http",
          "target_interface": "HTTP selected url_prefix backend",
          "operation_type": "http_proxy",
          "conditions": [
            "A user or unauthorized_user config has been selected",
            "A URLPrefix or default_url backend has been selected",
            "beginConcurrencyLimit succeeds",
            "global maxConcurrentRequests limit is not exceeded"
          ],
          "operations": [
            {
              "operation": "PROXY REQUEST",
              "trigger": "Forward the request to the selected backend with sanitized hop headers and configured request/response header mutations",
              "conditions": [
                "tryProcessingRequest is called for a selected backendURL"
              ],
              "implementation": "processRequest -> sanitizeRequestHeaders -> updateHeadersByConfig -> ui.rt.RoundTrip(req)"
            }
          ]
        }
      ]
    },
    "VMAuthProxy.RetrySameBackendOnTrivialNetworkError": {
      "infrastructure": {},
      "services": [
        {
          "name": "configured-backend-http",
          "target_interface": "HTTP selected url_prefix backend",
          "operation_type": "http_proxy",
          "conditions": [
            "ui.rt.RoundTrip(req) returns a trivial network error",
            "req.Body is a readTrackingBody",
            "readTrackingBody.canRetry() == true",
            "The one-shot local retry has not already happened"
          ],
          "operations": [
            {
              "operation": "RETRY SAME BACKEND",
              "trigger": "Re-send a retryable request body to the same backend URL after a trivial network error such as idle timeout/socket close",
              "conditions": [
                "netutil.IsTrivialNetworkError(err) == true"
              ],
              "implementation": "tryProcessingRequest -> return needLocalRetry=true -> processRequest again: goto again"
            }
          ]
        }
      ]
    },
    "VMAuthProxy.RetryDifferentBackendOnRetryStatus": {
      "infrastructure": {},
      "services": [
        {
          "name": "configured-backend-http",
          "target_interface": "HTTP selected url_prefix backend",
          "operation_type": "http_proxy",
          "conditions": [
            "A backend response status is present in retry_status_codes",
            "req.Body is a readTrackingBody",
            "readTrackingBody.canRetry() == true"
          ],
          "operations": [
            {
              "operation": "RETRY OTHER BACKEND",
              "trigger": "Retry the request against another backend after a retryable backend response",
              "conditions": [
                "slices.Contains(retryStatusCodes, res.StatusCode) == true"
              ],
              "implementation": "tryProcessingRequest -> return ok=false, needLocalRetry=false -> processRequest loop selects another backendURL"
            }
          ]
        }
      ]
    },
    "VMAuthProxy.ReturnBackendUnavailable": {
      "infrastructure": {},
      "services": []
    }
  },
  "notes": [
    "Builtin lib/httpserver routes and /-/reload shift between the main listener and the internal listener based on httpInternalListenAddr; the method set stays stable but listener placement is conditional.",
    "vmauth is a request-driven auth proxy, so the fresh method-level mapping models auth token resolution, route selection, backend discovery, and retry branches instead of pretending there is a fixed business endpoint inventory.",
    "configured-backend-http intentionally stays generic because vmauth proxies to user-defined backends from auth config rather than to one statically owned service."
  ]
}