{
  "repo": "tidbcloud/account",
  "binary": "acl",
  "binary_path": "central/cmd/acl/main.go",
  "dependencies": {
    "AccessService.GetOpenAPIAccess": {
      "infrastructure": {
        "database": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT api_key",
              "trigger": "Get API key by access key",
              "conditions": ["Always"],
              "implementation": "a.apiKeySvc.GetApiKeyByAccessKey(ctx, req.PublicKey)"
            },
            {
              "operation": "SELECT api_key_resource_info",
              "trigger": "Get resource infos by API key ID",
              "conditions": ["Always"],
              "implementation": "a.apiKeySvc.ListResourceInfosByApiKeyID(ctx, &param)"
            },
            {
              "operation": "SELECT projects",
              "trigger": "Get active projects for org",
              "conditions": ["Always"],
              "implementation": "project.GetActiveProjects(ctx, tx, entity.ID(orgId))"
            }
          ]
        }
      },
      "services": []
    },
    "AccessService.HasAdminAccess": {
      "infrastructure": {
        "database": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT users",
              "trigger": "Get user by ID",
              "conditions": ["Always"],
              "implementation": "usersvc.GetUserByID(tx, entity.ID(userID))"
            },
            {
              "operation": "SELECT user_roles, role_bindings",
              "trigger": "Check if user in PingCAP org",
              "conditions": ["Always"],
              "implementation": "org.IsUserInOrg(ctx, tx, user.ID, entity.PingCAPTenantID)"
            }
          ]
        }
      },
      "services": []
    },
    "AccessService.GetJwtByToken": {
      "infrastructure": {
        "database": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT users",
              "trigger": "Get user by email",
              "conditions": ["Always"],
              "implementation": "userSvc.GetUserByEmail(ctx, email)"
            },
            {
              "operation": "SELECT role_bindings",
              "trigger": "List user roles for cluster permission",
              "conditions": ["Always"],
              "implementation": "rbacSvc.ListUserRoles(ctx, user.ID.Uint64(), []entity.ScopeType{entity.RoleBindingScopeOrg}, []entity.ID{entity.ID(cluster.TenantId)})"
            },
            {
              "operation": "SELECT role_bindings",
              "trigger": "Check user role in project scope",
              "conditions": ["User is org member"],
              "implementation": "rbacSvc.CheckUserRoleInScope(ctx, user.ID.Uint64(), entity.RoleBindingScopeProject, cluster.ProjectId, []string{})"
            },
            {
              "operation": "SELECT org_keys",
              "trigger": "Get org key for JWT signing",
              "conditions": ["Always"],
              "implementation": "s.ListOrgKeys(ctx, filter)"
            }
          ]
        },
        "auth0": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "ValidateToken",
              "trigger": "Validate Auth0 token and extract email",
              "conditions": ["Always"],
              "implementation": "tokenSvc.GetUserEmailByToken(ctx, req.Auth0Token)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "core-svc",
          "target_interface": "CoreService.GetClusterById",
          "target_repo": "tidbcloud/core-svc",
          "operation_type": "grpc",
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "GetClusterById",
              "trigger": "Get cluster info for JWT generation",
              "conditions": ["Always"],
              "implementation": "infra.GetHandler().GetClusterById(ctx, clusterId, true)"
            }
          ]
        }
      ]
    },
    "AccessService.GetJwtByUser": {
      "infrastructure": {
        "database": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT users",
              "trigger": "Get user by email or ID",
              "conditions": ["req.Email provided"],
              "implementation": "userSvc.GetUserByEmail(ctx, req.Email)"
            },
            {
              "operation": "SELECT users",
              "trigger": "Get user by ID",
              "conditions": ["req.UserID provided"],
              "implementation": "userSvc.GetUserByID(ctx, req.UserID)"
            },
            {
              "operation": "SELECT role_bindings",
              "trigger": "List user roles for cluster permission",
              "conditions": ["Always"],
              "implementation": "rbacSvc.ListUserRoles(ctx, user.ID.Uint64(), []entity.ScopeType{entity.RoleBindingScopeOrg}, []entity.ID{entity.ID(cluster.TenantId)})"
            },
            {
              "operation": "SELECT role_bindings",
              "trigger": "Check user role in project scope",
              "conditions": ["User is org member"],
              "implementation": "rbacSvc.CheckUserRoleInScope(ctx, user.ID.Uint64(), entity.RoleBindingScopeProject, cluster.ProjectId, []string{})"
            },
            {
              "operation": "SELECT org_keys",
              "trigger": "Get org key for JWT signing",
              "conditions": ["Always"],
              "implementation": "s.ListOrgKeys(ctx, filter)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "core-svc",
          "target_interface": "CoreService.GetClusterById",
          "target_repo": "tidbcloud/core-svc",
          "operation_type": "grpc",
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "GetClusterById",
              "trigger": "Get cluster info for JWT generation",
              "conditions": ["Always"],
              "implementation": "infra.GetHandler().GetClusterById(ctx, clusterId, true)"
            }
          ]
        }
      ]
    },
    "AccessService.GetOpenAPIKeyByToken": {
      "infrastructure": {
        "database": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT api_key",
              "trigger": "Get API key by access key",
              "conditions": ["Always"],
              "implementation": "a.apiKeySvc.GetApiKeyByAccessKey(ctx, req.PublicKey)"
            },
            {
              "operation": "SELECT api_key_resource_info",
              "trigger": "Get resource infos by API key ID",
              "conditions": ["Always"],
              "implementation": "a.apiKeySvc.ListResourceInfosByApiKeyID(ctx, &param)"
            }
          ]
        }
      },
      "services": []
    },
    "AccessService.GetJwtByApiKey": {
      "infrastructure": {
        "database": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT api_key",
              "trigger": "Get API key by access key",
              "conditions": ["req.AccessKey provided"],
              "implementation": "apiKeySvc.GetApiKeyByAccessKey(ctx, req.AccessKey)"
            },
            {
              "operation": "SELECT api_key",
              "trigger": "Get API key by ID",
              "conditions": ["req.ApiKeyID provided"],
              "implementation": "apiKeySvc.GetApiKeyByID(ctx, req.ApiKeyId)"
            },
            {
              "operation": "SELECT org_keys",
              "trigger": "Get org key for JWT signing",
              "conditions": ["Always"],
              "implementation": "s.ListOrgKeys(ctx, filter)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "core-svc",
          "target_interface": "CoreService.GetClusterById",
          "target_repo": "tidbcloud/core-svc",
          "operation_type": "grpc",
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "GetClusterById",
              "trigger": "Get cluster info for JWT generation",
              "conditions": ["Always"],
              "implementation": "infra.GetHandler().GetClusterById(ctx, clusterId, true, infra.SupportDBUserStatus...)"
            }
          ]
        },
        {
          "name": "core-svc",
          "target_interface": "CoreService.CreateDBUser",
          "target_repo": "tidbcloud/core-svc",
          "operation_type": "grpc",
          "conditions": ["Async background check"],
          "operations": [
            {
              "operation": "CreateDBUser",
              "trigger": "Async: Check and create DB user if needed",
              "conditions": ["Background goroutine"],
              "implementation": "infra.GetHandler().CreateDBUser(ctx, clusterId, operator.Username, clusterproxy.AuthMethodToken, operator.Credential, \"\", *resp.dbUser, true, nil, entity.DbRoleAdmin)"
            }
          ]
        }
      ]
    }
  }
}