{
  "repo": "tidbcloud/account",
  "binary": "admin-server",
  "binary_path": "admin/cmd/server/main.go",
  "dependencies": {
    "AdminServerLifecycle.LoadFlags": {
      "infrastructure": {
        "cli-flags": {
          "conditions": [
            "Process startup"
          ],
          "operations": [
            {
              "operation": "Parse",
              "trigger": "Read the startup flags before any config-dependent initialization runs",
              "conditions": [
                "Always at process start"
              ],
              "implementation": "flag.Parse()"
            }
          ]
        }
      },
      "services": []
    },
    "AdminServerLifecycle.InitConfig": {
      "infrastructure": {
        "config": {
          "conditions": [
            "config-path flag resolved"
          ],
          "operations": [
            {
              "operation": "InitConfig",
              "trigger": "Load the admin server config file before constructing downstream dependencies",
              "conditions": [
                "Always after flag.Parse"
              ],
              "implementation": "config.InitConfig(*configPath)"
            }
          ]
        }
      },
      "services": []
    },
    "AdminServerLifecycle.InitPortalAuth0Config": {
      "infrastructure": {
        "config": {
          "conditions": [
            "config.InitConfig succeeded"
          ],
          "operations": [
            {
              "operation": "Read",
              "trigger": "Build the Auth0 validator config for the management portal token validator",
              "conditions": [
                "Always after config initialization"
              ],
              "implementation": "config.Global().Auth0Config.ManagementPortalAuth0Audience / ManagementPortalAuth0Secret / ManagementPortalAuth0Domain / ManagementPortalAuth0ClientAudience"
            }
          ]
        }
      },
      "services": []
    },
    "AdminServerLifecycle.InitMySQL": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always during startup after config.InitConfig"
          ],
          "operations": [
            {
              "operation": "CONNECT",
              "trigger": "Initialize the shared MySQL connection used by admin models and handlers",
              "conditions": [
                "isUnitTest is false in admin/cmd/server/main.go"
              ],
              "implementation": "models.InitMySQL(false) -> database.Initialize(ctx, mysqlConfig)"
            }
          ]
        }
      },
      "services": []
    },
    "AdminServerLifecycle.InitTokenValidator": {
      "infrastructure": {},
      "services": [
        {
          "name": "auth0",
          "target_repo": "external",
          "target_interface": "JWKS endpoint",
          "operation_type": "http_get",
          "conditions": [
            "Always during startup after portalAuth0 config is built"
          ],
          "operations": [
            {
              "operation": "HTTP GET",
              "trigger": "Fetch JWKS for Management Portal token validation",
              "conditions": [
                "Always"
              ],
              "implementation": "api.InitTokenValidator(portalAuth0) -> auth0.GetJWKS(conf.Domain)"
            }
          ]
        }
      ]
    },
    "AdminServerLifecycle.InitAdminModel": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "models.InitMySQL(false) succeeded"
          ],
          "operations": [
            {
              "operation": "Initialize",
              "trigger": "Construct the admin model facade used by admin handlers",
              "conditions": [
                "Always after InitMySQL"
              ],
              "implementation": "models.InitAdminModel()"
            }
          ]
        }
      },
      "services": []
    },
    "AdminServerLifecycle.SetupLoggerAndSentry": {
      "infrastructure": {
        "observability": {
          "conditions": [
            "config.InitConfig succeeded"
          ],
          "operations": [
            {
              "operation": "SetupLoggerAndSentry",
              "trigger": "Initialize structured logging and Sentry reporting for the admin binary",
              "conditions": [
                "Always after config initialization"
              ],
              "implementation": "utils.SetupLoggerAndSentry()"
            }
          ]
        }
      },
      "services": []
    },
    "AdminServerLifecycle.StartEventbus": {
      "infrastructure": {
        "eventbus": {
          "conditions": [
            "config.IsLocalEnv() is false"
          ],
          "operations": [
            {
              "operation": "Run",
              "trigger": "Start the shared event bus in non-local environments",
              "conditions": [
                "Only outside local env"
              ],
              "implementation": "eventbus.Get().Run()"
            }
          ]
        }
      },
      "services": []
    },
    "AdminServerLifecycle.InitJobQueueAndDeps": {
      "infrastructure": {
        "jobqueue": {
          "conditions": [
            "config.InitConfig succeeded"
          ],
          "operations": [
            {
              "operation": "InitDefaultJobQueue",
              "trigger": "Initialize the default job queue client and DLQ wiring used by admin jobs",
              "conditions": [
                "Always after config initialization"
              ],
              "implementation": "jobqueue.InitDefaultJobQueue(ctx, config.Global().JobQueueConfig.JobQueueURL, config.Global().JobQueueConfig.JobQueueDLURL, config.Global().JobQueueConfig.JobQueueRegion, config.Global().JobQueueConfig.JobQueueTimeout)"
            },
            {
              "operation": "InitDeps",
              "trigger": "Initialize background job dependencies such as the Salesforce client",
              "conditions": [
                "Only after InitDefaultJobQueue succeeds"
              ],
              "implementation": "jobs.InitDeps()"
            }
          ]
        }
      },
      "services": []
    },
    "AdminServerLifecycle.InitJaeger": {
      "infrastructure": {
        "tracing": {
          "conditions": [
            "config.InitConfig succeeded"
          ],
          "operations": [
            {
              "operation": "InitJaeger",
              "trigger": "Initialize the Jaeger trace provider for the admin HTTP server",
              "conditions": [
                "Always after config initialization"
              ],
              "implementation": "titracing.InitJaeger(\"account-admin\")"
            }
          ]
        }
      },
      "services": []
    },
    "AdminServerLifecycle.BuildRouter": {
      "infrastructure": {
        "http-router": {
          "conditions": [
            "Startup dependencies initialized"
          ],
          "operations": [
            {
              "operation": "InitRouter",
              "trigger": "Build the Gin router with recovery, sentry, metrics, cors, and route registration",
              "conditions": [
                "Always after startup initialization"
              ],
              "implementation": "api.InitRouter()"
            }
          ]
        }
      },
      "services": []
    },
    "AdminServerLifecycle.RunHTTPServer": {
      "infrastructure": {
        "http-server": {
          "conditions": [
            "Router initialized successfully"
          ],
          "operations": [
            {
              "operation": "ListenAndServe",
              "trigger": "Start the admin HTTP listener on AdminListenAddr",
              "conditions": [
                "Always after api.InitRouter succeeds"
              ],
              "implementation": "r.Run(config.Global().ServerConfig.AdminListenAddr)"
            }
          ]
        }
      },
      "services": []
    },
    "HTTP GET /swagger/*any": {
      "infrastructure": {
        "swagger-ui": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Serve static docs",
              "trigger": "Expose the embedded Swagger UI and generated admin API docs",
              "conditions": [
                "Always"
              ],
              "implementation": "r.GET(\"/swagger/*any\", ginSwagger.WrapHandler(swaggerFiles.Handler))"
            }
          ]
        }
      },
      "services": []
    },
    "HTTP GET /ping": {
      "infrastructure": {
        "http-response": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Success/Fail",
              "trigger": "Return the public ping response, with an optional failure branch when shouldFail is present",
              "conditions": [
                "Fail path when c.Query(\"shouldFail\") != \"\"",
                "Success path otherwise"
              ],
              "implementation": "Ping(c) -> Fail(c, errs.ErrInvalidToken, http.StatusBadRequest) | Success(c, \"pong\", http.StatusOK)"
            }
          ]
        }
      },
      "services": []
    },
    "HTTP GET /healthz": {
      "infrastructure": {
        "http-response": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Success/Fail",
              "trigger": "Return the public health-check response through the shared Ping handler",
              "conditions": [
                "Fail path when c.Query(\"shouldFail\") != \"\"",
                "Success path otherwise"
              ],
              "implementation": "Ping(c) -> Fail(c, errs.ErrInvalidToken, http.StatusBadRequest) | Success(c, \"pong\", http.StatusOK)"
            }
          ]
        }
      },
      "services": []
    },
    "HTTP GET /api/v1/admin/system-settings": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/dashboard/stats": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/orgs": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Query binding succeeded"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load tenant rows with filter, search, sort, and pagination applied",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "userContext.ListTenants(ctx, param) -> m.listTenants(ctx, tx, req) -> tx.Find(&tenants)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        },
        {
          "name": "billing2",
          "target_repo": "external",
          "target_interface": "GetTenantPlanInfo",
          "operation_type": "http_or_rpc",
          "conditions": [
            "req.Brief is false",
            "Per tenant returned from the tenant query"
          ],
          "operations": [
            {
              "operation": "GetTenantPlanInfo",
              "trigger": "Populate plan, discount, and remaining credit in the full tenant response",
              "conditions": [
                "Only when ListTenantsReq.Brief is false"
              ],
              "implementation": "tenantctx.Context.GetOrganization(ctx) -> billing2.GetHandler().GetTenantPlanInfo(ctx, tenantEntity.ID.Uint64())"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/orgs/:org_id": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Path binding succeeded"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the single tenant row by org_id",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "userContext.ListTenants(ctx, &admin.ListTenantsReq{Filter: admin.TenantFilter{ID: ...}, NoLimit: true}) -> tx.Find(&tenants)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        },
        {
          "name": "billing2",
          "target_repo": "external",
          "target_interface": "GetTenantPlanInfo",
          "operation_type": "http_or_rpc",
          "conditions": [
            "Tenant row exists"
          ],
          "operations": [
            {
              "operation": "GetTenantPlanInfo",
              "trigger": "Populate plan and billing fields for the tenant detail view",
              "conditions": [
                "Always for the matching tenant"
              ],
              "implementation": "tenantctx.Context.GetOrganization(ctx) -> billing2.GetHandler().GetTenantPlanInfo(ctx, tenantEntity.ID.Uint64())"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/orgs/:org_id/data-resource": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Path binding succeeded"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load active project IDs under the org before checking resources",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "getProjectIds(ctx, req.OrgID) -> comsvc.ListEntities(ctx, params, &entity.Project{})"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        },
        {
          "name": "infra-api",
          "target_repo": "tidbcloud/infra-api",
          "target_interface": "CheckOrgResource",
          "operation_type": "grpc_or_http",
          "conditions": [
            "Project ID list loaded successfully"
          ],
          "operations": [
            {
              "operation": "CheckOrgResource",
              "trigger": "Inspect whether the org or its projects still own infrastructure resources",
              "conditions": [
                "Always after getProjectIds succeeds"
              ],
              "implementation": "infra.CheckOrgResource(ctx, req.OrgID, pids)"
            }
          ]
        }
      ]
    },
    "HTTP PATCH /api/v1/admin/orgs/:org_id": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "URI and JSON body binding both succeeded"
          ],
          "operations": [
            {
              "operation": "UPDATE",
              "trigger": "Persist mutable org fields such as alias, email, org type, and third-party account fields",
              "conditions": [
                "At least one corresponding field is present in the request body"
              ],
              "implementation": "orgSvc.UpdateOrg(ctx, updateParam) -> s.hub.Org.UpdateOrg(ctx, s.db.WithContext(ctx), param)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        },
        {
          "name": "eventbus",
          "target_repo": "tidbcloud/account",
          "target_interface": "PublishOrgEvent",
          "operation_type": "event_publish",
          "conditions": [
            "UpdateOrg DB write succeeded"
          ],
          "operations": [
            {
              "operation": "PublishOrgEvent",
              "trigger": "Emit an org update event after the org row is updated",
              "conditions": [
                "Always after UpdateOrg succeeds"
              ],
              "implementation": "orgSvc.UpdateOrg(ctx, updateParam) -> publish.PublishOrgEvent(ctx, dto.OrgEventData{OrgId: param.Id, OrgEventType: entity.EntityEventTypeUpdate})"
            }
          ]
        }
      ]
    },
    "HTTP DELETE /api/v1/admin/orgs/:org_id": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Path binding succeeded"
          ],
          "operations": [
            {
              "operation": "SELECT/UPDATE/DELETE",
              "trigger": "Mark the org and its active projects deleted and remove org/project role bindings",
              "conditions": [
                "DeleteOrgByID reaches the DB transaction after partner-org and resource checks pass"
              ],
              "implementation": "orgSvc.DeleteOrgByID(c, req.OrgID, false) -> s.db.Transaction(...MarkProjectAsDeletedByID / MarkOrgAsDeleted / DeleteRoleBindingByScopeInfo / DeleteOrgImpersonates...)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        },
        {
          "name": "infra-api",
          "target_repo": "tidbcloud/infra-api",
          "target_interface": "CheckOrgResource",
          "operation_type": "grpc_or_http",
          "conditions": [
            "Org is not a partner org",
            "isDeleteResource is false in admin handler"
          ],
          "operations": [
            {
              "operation": "CheckOrgResource",
              "trigger": "Reject deletion when the org still owns resources",
              "conditions": [
                "Always before delete transaction when isDeleteResource=false"
              ],
              "implementation": "orgSvc.DeleteOrgByID(ctx, orgID, false) -> infra.CheckOrgResource(ctx, orgID, projectIds)"
            }
          ]
        },
        {
          "name": "eventbus",
          "target_repo": "tidbcloud/account",
          "target_interface": "PublishOrgEvent",
          "operation_type": "event_publish",
          "conditions": [
            "DeleteOrgByID completed successfully"
          ],
          "operations": [
            {
              "operation": "PublishOrgEvent",
              "trigger": "Emit an org delete event after delete transaction completes",
              "conditions": [
                "Always after successful delete"
              ],
              "implementation": "orgSvc.DeleteOrgByID(ctx, orgID, false) -> publish.PublishOrgEvent(ctx, dto.OrgEventData{OrgId: orgID, OrgEventType: entity.EntityEventTypeDelete})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/orgs/user-org": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Query binding succeeded"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List orgs related to the requested user ID",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "orgSvc.ListOrgsByUserID(ctx, req.UserId) -> s.hub.Cross.ListOrgsByUserID(ctx, s.db.WithContext(ctx), userID, nil)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/orgs/:org_id/users": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "URI and query binding succeeded"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List role-binding users scoped to the org",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "listRoleBindingUsers(ctx, param) -> userSvc.ListRoleBindingUsers(ctx, f)"
            },
            {
              "operation": "SELECT",
              "trigger": "Load user last-login history for returned role-binding users",
              "conditions": [
                "At least one scoped user returned"
              ],
              "implementation": "getUserLoginTime(ctx, userList)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP DELETE /api/v1/admin/orgs/:org_id/users/:user_id": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/orgs/:org_id/users/:user_id": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/orgs/:org_id/impersonation": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        },
        {
          "name": "account-provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.AddImpersonateUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "Path binding succeeded"
          ],
          "operations": [
            {
              "operation": "AddImpersonateUser",
              "trigger": "Create an impersonation record for the current admin email and target org",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "userContext.AddImpersonation(ctx, &impersonate) -> m.accountAPI.AddImpersonateUser(ctx, &account_proto.AddImpersonateUserReq{...})"
            }
          ]
        }
      ]
    },
    "HTTP DELETE /api/v1/admin/orgs/:org_id/impersonation": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        },
        {
          "name": "account-provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.DeleteImpersonateUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "Path binding succeeded"
          ],
          "operations": [
            {
              "operation": "DeleteImpersonateUser",
              "trigger": "Delete the impersonation record for the current admin email and target org",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "userContext.DeleteImpersonation(c, req.OrgID) -> m.accountAPI.DeleteImpersonateUser(ctx, &account_proto.DeleteImpersonateUserReq{...})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/orgs/:org_id/salesforce": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/orgs/:org_id/projects": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP DELETE /api/v1/admin/orgs/:org_id/projects/:project_id": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/orgs/:org_id/projects/:project_id/users": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "URI and query binding succeeded"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List role-binding users scoped to the project",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "listRoleBindingUsers(ctx, param) -> userSvc.ListRoleBindingUsers(ctx, f)"
            },
            {
              "operation": "SELECT",
              "trigger": "Load user last-login history for returned project-scoped users",
              "conditions": [
                "At least one scoped user returned"
              ],
              "implementation": "getUserLoginTime(ctx, userList)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/orgs/:org_id/projects/:project_id/users/:user_id": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP DELETE /api/v1/admin/orgs/:org_id/projects/:project_id/users/:user_id": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/orgs/:org_id/projects/:project_id/data-resource": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        },
        {
          "name": "infra-api",
          "target_repo": "tidbcloud/infra-api",
          "target_interface": "CheckProjectResource",
          "operation_type": "grpc_or_http",
          "conditions": [
            "Path binding succeeded"
          ],
          "operations": [
            {
              "operation": "CheckProjectResource",
              "trigger": "Inspect whether the project still owns infrastructure resources",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "infra.CheckProjectResource(ctx, req.ProjectID)"
            }
          ]
        }
      ]
    },
    "HTTP DELETE /api/v1/admin/users/:user_id": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Path binding succeeded"
          ],
          "operations": [
            {
              "operation": "UPDATE/DELETE",
              "trigger": "Remove the target user from all org memberships",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "userSvc.DeleteUserFromAllOrg(ctx, reqUri.UserID)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/users": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Query binding succeeded"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List users with exact and fuzzy filters through generic pagination query",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "comsvc.ListEntitiesByPage(ctx, params, &entity.User{})"
            },
            {
              "operation": "SELECT",
              "trigger": "Load last login history for the returned user page",
              "conditions": [
                "At least one user row returned"
              ],
              "implementation": "loginHistorySvc.GetUserLastHistory(ctx, userIDs, entity.HistoryEventLogin)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/access-logs": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Query binding succeeded"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List management portal audit logs for the requested org and filters",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "userContext.ListAccessLog(tenantID, &query) -> auditlog.ListAuditLogs(entity.ID(tenantID), query)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/orgs/:org_id/access-logs": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "URI and query binding succeeded"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List audit logs for the target org with pagination",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "userContext.ListAccessLog(tenantID, &query) -> auditlog.ListAuditLogs(entity.ID(tenantID), query)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "Runtime AdminBillingProxy.Proxy": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        },
        {
          "name": "account-provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetUserByEmail",
          "operation_type": "grpc_unary",
          "conditions": [
            "AuthTokenClaimKey exists in Gin context"
          ],
          "operations": [
            {
              "operation": "GetUserByEmail",
              "trigger": "Resolve the current admin user ID that will be forwarded to billing2",
              "conditions": [
                "Always before constructing the reverse proxy headers"
              ],
              "implementation": "GetUserContext(c).GetAccountUser(c) -> m.accountAPI.GetUserByEmail(ctx, &account_proto.GetUserByEmailRequest{Email: m.userEmail})"
            }
          ]
        },
        {
          "name": "billing2",
          "target_repo": "external",
          "target_interface": "Reverse proxy path under Billing2BaseURL",
          "operation_type": "http_reverse_proxy",
          "conditions": [
            "Current admin user resolved successfully",
            "Billing2BaseURL parses successfully"
          ],
          "operations": [
            {
              "operation": "ReverseProxy",
              "trigger": "Forward the matched billing admin request with account and source headers",
              "conditions": [
                "Always after GetAccountUser and target URL parsing succeed"
              ],
              "implementation": "proxy.ServeHTTP(c.Writer, c.Request) with billing2.AccountIDHeader and billing2.RequestSource"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/rbac/role/create": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/rbac/role/list": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/rbac/role/get/:id": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/rbac/role/update": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/rbac/role/delete/:id": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/rbac/privilege/create": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/rbac/privilege/list": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/rbac/privilege/get/:id": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/rbac/privilege/update": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/rbac/privilege/delete/:id": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/rbac/privilege/system-list": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/rbac/role-privilege/create": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/rbac/role-privilege/add": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/rbac/role-privilege/delete": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/rbac/role-privilege/list/:role_id": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/rbac/role-binding/create": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/rbac/role-binding/delete": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/upload": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        },
        {
          "name": "cdn",
          "target_repo": "external",
          "target_interface": "UploadFile",
          "operation_type": "object_storage_put",
          "conditions": [
            "Multipart form binding succeeded",
            "Uploaded file can be opened"
          ],
          "operations": [
            {
              "operation": "UploadFile",
              "trigger": "Store the uploaded admin attachment in CDN-backed storage",
              "conditions": [
                "Always after file open succeeds"
              ],
              "implementation": "cdn.Get().UploadFile(ctx, key, form.File.Size, body)"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/uploaded/*file_path": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        },
        {
          "name": "cdn",
          "target_repo": "external",
          "target_interface": "GetCDNFile",
          "operation_type": "object_storage_get",
          "conditions": [
            "URI binding succeeded"
          ],
          "operations": [
            {
              "operation": "GetCDNFile",
              "trigger": "Read the stored admin attachment before streaming it to the caller",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "cdn.Get().GetCDNFile(path)"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/partner/msp/upload-logo": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/partner/msp/create": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "JSON binding succeeded"
          ],
          "operations": [
            {
              "operation": "INSERT/UPDATE",
              "trigger": "Create MSP org, invitation state, and follow-up invite tokens",
              "conditions": [
                "Always after request binding"
              ],
              "implementation": "svc.CreateMsp(ctx, req); userSvc.CreateInviteToken(...); inviteSvc.InviteUser(ctx, param); sessionSvc.InsertUserInviteToken(...)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        },
        {
          "name": "account-provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.SendEmail",
          "operation_type": "grpc_unary",
          "conditions": [
            "All token generation steps succeeded"
          ],
          "operations": [
            {
              "operation": "SendEmail",
              "trigger": "Send bootstrap email for first MSP key and signup flow",
              "conditions": [
                "sendEmailForFirstKey is reached"
              ],
              "implementation": "sendEmailForFirstKey(ctx, req, createKeyToken, registerToken, inviteToken) -> account.GetHandler().SendEmail(...)"
            }
          ]
        },
        {
          "name": "eventbus",
          "target_repo": "tidbcloud/account",
          "target_interface": "PublishOrgEvent",
          "operation_type": "event_publish",
          "conditions": [
            "MSP org create succeeded"
          ],
          "operations": [
            {
              "operation": "PublishOrgEvent",
              "trigger": "Emit create-org event after MSP org creation",
              "conditions": [
                "Always after CreateMsp succeeds"
              ],
              "implementation": "publish.PublishOrgEvent(ctx, dto.OrgEventData{OrgId: mspOrg.ID.Uint64(), OrgEventType: entity.EntityEventTypeCreate})"
            }
          ]
        },
        {
          "name": "salesforce-job",
          "target_repo": "tidbcloud/account",
          "target_interface": "SaveSalesforceJobData",
          "operation_type": "async_enqueue",
          "conditions": [
            "MSP org create succeeded"
          ],
          "operations": [
            {
              "operation": "SaveSalesforceJobData",
              "trigger": "Queue Salesforce sync follow-up for the new MSP org",
              "conditions": [
                "Always after PublishOrgEvent attempt"
              ],
              "implementation": "jobs.SaveSalesforceJobData(ctx, mspOrg.ID.Uint64())"
            }
          ]
        },
        {
          "name": "jsm",
          "target_repo": "external",
          "target_interface": "NotifyCreateOrgMessage | NotifyEnableMspNotificationMessage",
          "operation_type": "message_publish",
          "conditions": [
            "jsmClient.IsEnable()"
          ],
          "operations": [
            {
              "operation": "NotifyCreateOrgMessage",
              "trigger": "Notify JSM that a new MSP org was created",
              "conditions": [
                "JSM client enabled"
              ],
              "implementation": "jsmClient.NotifyCreateOrgMessage(ctx, mspOrg)"
            },
            {
              "operation": "NotifyEnableMspNotificationMessage",
              "trigger": "Enable MSP notifications in JSM for the new org",
              "conditions": [
                "JSM client enabled"
              ],
              "implementation": "jsmClient.NotifyEnableMspNotificationMessage(ctx, mspOrg.ID.Uint64())"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/partner/msp/update": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "JSON binding succeeded",
            "Advertising validation passed"
          ],
          "operations": [
            {
              "operation": "UPSERT",
              "trigger": "Persist MSP branding and advertising config",
              "conditions": [
                "Always after JSON serialization of advertising succeeds"
              ],
              "implementation": "mspSvc.UpdateMspConfig(ctx, mspConfig)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/partner/msp/:org_id": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/partner/msp/:org_id/signup-url": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/partner/msp/:org_id/create-apikey": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/partner/resale/create": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/partner/resale/:org_id/signup-url": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/partner/:org_id/customers": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/partner/partner-customer/create": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP DELETE /api/v1/admin/partner/partner-customer/delete": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/partner/partner-customer/cancel": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/partner/partner-customer/:org_id": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/partner/cppo/create": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/partner/mcpo/create": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/db-users/:cluster_id/list": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/db-users/:cluster_id/test": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        },
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.HasAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Request path does not match any RbacPathWhitelist regex",
            "Caller email is not bypassed by ops-admin.adminUsers"
          ],
          "operations": [
            {
              "operation": "HasAccess",
              "trigger": "Verify the caller can access the exact admin route and HTTP method",
              "conditions": [
                "Always for protected non-whitelisted routes after GetUser succeeds"
              ],
              "implementation": "devops_handler.GetHandler().HasAccess(c.Request.Context(), &auth.HasAccessReq{Email: email, Uri: c.FullPath(), Method: strings.ToUpper(c.Request.Method)})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/db-users/:cluster_id/jwt": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        }
      ]
    },
    "HTTP GET /api/v1/admin/db-users/:cluster_id/jwt": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        }
      ]
    },
    "HTTP POST /api/v1/admin/db-users/feature/whitelist": {
      "infrastructure": {},
      "services": [
        {
          "name": "devops",
          "target_repo": "tidbcloud/devops",
          "target_interface": "AuthService.GetUser",
          "operation_type": "grpc_unary",
          "conditions": [
            "config.IsLocalEnv() is false",
            "Bearer token or AK/SK validation in adminAuth succeeded"
          ],
          "operations": [
            {
              "operation": "GetUser",
              "trigger": "Resolve the authenticated admin email against DevOps before RBAC evaluation",
              "conditions": [
                "Always for protected routes in non-local env after email extraction"
              ],
              "implementation": "devops_handler.GetHandler().GetUser(c, &auth.GetUserReq{Email: email})"
            }
          ]
        }
      ]
    }
  }
}