{ "repo": "tidbcloud/account", "binary": "central", "binary_path": "central/cmd/central/main.go", "dependencies": { "AuthService.Meta": { "infrastructure": { "auth0": { "conditions": [ "Always" ], "operations": [ { "operation": "User.ListByEmail", "trigger": "Get user metadata from Auth0", "conditions": [ "Always" ], "implementation": "s.management.User.ListByEmail(email)" } ] } }, "services": [] }, "AuthService.VerifyEmailPassword": { "infrastructure": {}, "services": [ { "name": "auth0", "target_interface": "POST /co/authenticate", "target_repo": "auth0.com", "operation_type": "http_post", "conditions": [ "Always" ], "operations": [ { "operation": "HTTP POST /co/authenticate", "trigger": "Verify email password with Auth0", "conditions": [ "Always" ], "implementation": "auth0.VerifyEmailPassword(ctx, email, req.Password)" } ] } ] }, "AuthService.VerifyOtpCode": { "infrastructure": {}, "services": [ { "name": "auth0", "target_interface": "POST /mfa/challenge", "target_repo": "auth0.com", "operation_type": "http_post", "conditions": [ "Always" ], "operations": [ { "operation": "HTTP POST MFA challenge", "trigger": "Verify OTP code with Auth0", "conditions": [ "Always" ], "implementation": "auth0.VerifyOtpCode(ctx, req.MfaToken, req.OtpCode)" } ] } ] }, "AuthService.VerifyRecoveryCode": { "infrastructure": {}, "services": [ { "name": "auth0", "target_interface": "POST /mfa/challenge", "target_repo": "auth0.com", "operation_type": "http_post", "conditions": [ "Always" ], "operations": [ { "operation": "HTTP POST MFA recovery", "trigger": "Verify recovery code with Auth0", "conditions": [ "Always" ], "implementation": "auth0.VerifyRecoveryCode(ctx, req.MfaToken, req.RecoveryCode)" } ] } ] }, "AuthService.StartEnableMFA": { "infrastructure": { "auth0": { "conditions": [ "Always" ], "operations": [ { "operation": "User.Update", "trigger": "Update user metadata use_mfa flag", "conditions": [ "Always" ], "implementation": "s.management.User.Update(*u.ID, updateUser)" }, { "operation": "User.ListByEmail", "trigger": "Get user from Auth0", "conditions": [ "Always" ], "implementation": "s.management.User.ListByEmail(email)" } ] } }, "services": [ { "name": "auth0", "target_interface": "POST /co/authenticate", "target_repo": "auth0.com", "operation_type": "http_post", "conditions": [ "Always" ], "operations": [ { "operation": "HTTP POST authenticate", "trigger": "Verify email password", "conditions": [ "Always" ], "implementation": "auth0.VerifyEmailPassword(ctx, email, req.Password)" }, { "operation": "POST /mfa/associate", "trigger": "Enroll OTP authenticator", "conditions": [ "MFA required" ], "implementation": "auth0.EnrollOtpAuthenticator(ctx, mfaToken)" } ] } ] }, "AuthService.DisableMFA": { "infrastructure": { "auth0": { "conditions": [ "Always" ], "operations": [ { "operation": "User.Update", "trigger": "Update user metadata", "conditions": [ "Always" ], "implementation": "s.management.User.Update(*u.ID, updateUser)" }, { "operation": "DELETE /mfa/authenticators", "trigger": "Delete MFA methods", "conditions": [ "Disable MFA" ], "implementation": "auth0.DeleteMfaMethods(ctx, *u.ID)" } ] } }, "services": [ { "name": "auth0", "target_interface": "POST /co/authenticate", "target_repo": "auth0.com", "operation_type": "http_post", "conditions": [ "emailPasswordLoginUser" ], "operations": [ { "operation": "HTTP POST authenticate", "trigger": "Verify email password", "conditions": [ "email/password login user" ], "implementation": "auth0.VerifyEmailPassword(ctx, email, req.Password)" } ] } ] }, "AuditLogService.Auth0AuditLog": { "infrastructure": { "auditlog-sdk": { "conditions": [ "req != nil", "user exists in gRPC context" ], "operations": [ { "operation": "Submit", "trigger": "Record the Auth0 sign-in/sign-out result as a login/logout audit event", "conditions": [ "Always after user2.GetUserFromContext(ctx) succeeds", "eventType = login when req.Operation == SIGNIN; otherwise logout" ], "implementation": "auditlog.NewEvent(ctx, eventType).SetOperatorType(auditlog.OperatorTypeUser).SetOperatorEmail(user.Email).SetOperatorID(user.ID.Uint64()).SetOrgID(req.OrgId).SetResult(req.IsSuccess).SetDetails(details.Build()).Submit()" } ] } }, "services": [] }, "TenantService.Registration": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "INSERT", "trigger": "Create organization and user", "conditions": [ "Always" ], "implementation": "userContext.CreateOrg(ctx, createOrgParams, req.ReturnUrl)" }, { "operation": "SELECT", "trigger": "Get user by email", "conditions": [ "req.Channel" ], "implementation": "userSvc.GetUserByEmail(ctx, email)" }, { "operation": "INSERT", "trigger": "Create user landing action", "conditions": [ "req.Channel" ], "implementation": "userSvc.CreateUserLandingAction(ctx, userLandingAction)" } ] }, "redis": { "conditions": [ "clientIP != ''" ], "operations": [ { "operation": "INCR", "trigger": "Rate limiting for registration", "conditions": [ "Rate control enabled" ], "implementation": "rateController.Access(ctx, clientIP, req.Email, now)" } ] }, "sqs": { "conditions": [ "config.Global().MarketPlaceConfig.AWSUserEventSQS != ''" ], "operations": [ { "operation": "SendMessage", "trigger": "Send user event to SQS", "conditions": [ "login success" ], "implementation": "SendToUserEventSQS(event)" } ] } }, "services": [ { "name": "auth0", "target_interface": "GET /userinfo", "target_repo": "auth0.com", "operation_type": "http_get", "conditions": [ "connectionType != Auth0DatabaseConnection" ], "operations": [ { "operation": "HTTP GET userinfo", "trigger": "Get Auth0 user info from token", "conditions": [ "SSO registration" ], "implementation": "userContext.GetUserFromAuth0(ctx, connectionType, req.Auth0Token)" } ] }, { "name": "auth0", "target_interface": "POST /dbconnections/signup", "target_repo": "auth0.com", "operation_type": "http_post", "conditions": [ "connectionType == Auth0DatabaseConnection" ], "operations": [ { "operation": "HTTP POST signup", "trigger": "Create Auth0 user for database connection", "conditions": [ "Email/password signup" ], "implementation": "auth0.CreateUser(ctx, email, password)" } ] }, { "name": "recaptcha", "target_interface": "POST /api/siteverify", "target_repo": "google.com", "operation_type": "http_post", "conditions": [ "config.Global().ServerConfig.EnableRecaptcha && connectionType == Auth0DatabaseConnection" ], "operations": [ { "operation": "HTTP POST siteverify", "trigger": "Validate reCAPTCHA", "conditions": [ "recaptcha enabled" ], "implementation": "recaptchaHandle.ValidateReCAPTCHA(req.RecaptchaResponse)" } ] }, { "name": "org-sso", "target_interface": "RegisterSsoUser", "target_repo": "tidbcloud/account", "operation_type": "grpc_unary", "conditions": [ "SSO org with auto provision" ], "operations": [ { "operation": "gRPC RegisterSsoUser", "trigger": "Auto-provision SSO user", "conditions": [ "orgID != 0 && orgType == enterprise && autoProvision" ], "implementation": "svc.RegisterSsoUser(ctx, ¶m)" } ] } ] }, "TenantService.ListOrganizations": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "List organizations for user", "conditions": [ "Always" ], "implementation": "userContext.ListOrganizations(ctx)" }, { "operation": "SELECT", "trigger": "Check if new user", "conditions": [ "Always" ], "implementation": "userSvc.IsNewUser(ctx, &userId)" }, { "operation": "SELECT", "trigger": "Get new user default cluster", "conditions": [ "isNewUser" ], "implementation": "userSvc.GetNewUserDefaultCluster(ctx, &userId, nil)" } ] } }, "services": [] }, "TenantService.UpdateOrganization": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Get organization by ID", "conditions": [ "Always" ], "implementation": "orgSvc.GetOrgByID(ctx, req.OrgId)" }, { "operation": "UPDATE", "trigger": "Update organization", "conditions": [ "Always" ], "implementation": "userContext.UpdateOrganization(ctx, request)" } ] } }, "services": [] }, "TenantService.ListUsers": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "List role binding users", "conditions": [ "Always" ], "implementation": "userSvc.ListRoleBindingUsers(ctx, f)" } ] } }, "services": [] }, "TenantService.UpdateUser": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Get user email and role", "conditions": [ "Always" ], "implementation": "tenant2.GetUserEmailAndRole(ctx, orgID, userID)" }, { "operation": "UPDATE", "trigger": "Update user role", "conditions": [ "Always" ], "implementation": "userContext.UpdateUser(ctx, updateUserReq)" } ] } }, "services": [ { "name": "cm-service", "target_interface": "CommandUserAction", "target_repo": "tidbcloud/cm-api", "operation_type": "grpc_unary", "conditions": [ "isActiveInOrg && roleChanged" ], "operations": [ { "operation": "gRPC CreateCommandUserAction", "trigger": "Create/delete DB user based on role", "conditions": [ "user active in org && role changed to/from owner" ], "implementation": "dbUserSvc.CreateCommandUserAction(ctx, ...)" } ] } ] }, "TenantService.DeleteUser": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Get role binding user", "conditions": [ "Always" ], "implementation": "userSvc.GetRoleBindingUser(ctx, entity.RoleBindingScopeOrg, req.OrgId, req.UserId)" }, { "operation": "DELETE", "trigger": "Remove user from org", "conditions": [ "Always" ], "implementation": "userSvc.RemoveUserFromOrg(ctx, req.UserId, operator.ID.Uint64(), req.OrgId)" } ] } }, "services": [] }, "TenantService.CreateProject": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "INSERT", "trigger": "Create project", "conditions": [ "Always" ], "implementation": "userContext.CreateProject(ctx, createProjectReq)" } ] } }, "services": [ { "name": "jsm", "target_interface": "NotifyCreateProjectMessage", "target_repo": "tidbcloud/jsm", "operation_type": "mq_publish", "conditions": [ "jsmClient.IsEnable()" ], "operations": [ { "operation": "NATS publish", "trigger": "Notify JSM about project creation", "conditions": [ "JSM enabled" ], "implementation": "jsmClient.NotifyCreateProjectMessage(ctx, project.Id, req.OrgId)" } ] } ] }, "TenantService.DeleteProjectUser": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Get user email and role", "conditions": [ "Always" ], "implementation": "tenantctx.GetUserEmailAndRole(ctx, orgID, userID)" }, { "operation": "DELETE", "trigger": "Delete project user", "conditions": [ "Always" ], "implementation": "userContext.DeleteProjectUser(ctx, orgID, projectID, userID)" } ] } }, "services": [ { "name": "cm-service", "target_interface": "CommandUserAction", "target_repo": "tidbcloud/cm-api", "operation_type": "grpc_unary", "conditions": [ "!ignore" ], "operations": [ { "operation": "gRPC CreateCommandUserAction", "trigger": "Create command to delete DB user", "conditions": [ "project user not ignored" ], "implementation": "dbUserSvc.CreateCommandUserAction(ctx, ...)" } ] }, { "name": "jsm", "target_interface": "NotifyRemoveUserFromProjectMessage", "target_repo": "tidbcloud/jsm", "operation_type": "mq_publish", "conditions": [ "jsmClient.IsEnable()" ], "operations": [ { "operation": "NATS publish", "trigger": "Notify user removed from project", "conditions": [ "JSM enabled" ], "implementation": "jsmClient.NotifyRemoveUserFromProjectMessage(ctx, req.ProjectId, uint64(userID))" } ] } ] }, "OpenAPIKeyService.CreateOpenAPIKey": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "INSERT", "trigger": "Create API key", "conditions": [ "Always" ], "implementation": "svc.CreateApiKey(ctx, param)" } ] } }, "services": [] }, "OpenAPIKeyService.ListOpenAPIKeys": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "List API keys by resource", "conditions": [ "Always" ], "implementation": "svc.ListApiKeysByResourceID(ctx, ¶m)" } ] } }, "services": [] }, "MetricsService.LoginMetrics": { "infrastructure": { "mysql": { "conditions": [ "eventType == LOGIN && eventResult == SUCCESS" ], "operations": [ { "operation": "INSERT", "trigger": "Create login history", "conditions": [ "Login success" ], "implementation": "loginHistorySvc.CreateEventHistory(ctx, &history)" } ] }, "sqs": { "conditions": [ "eventType == LOGIN && eventResult == SUCCESS" ], "operations": [ { "operation": "SendMessage", "trigger": "Send login event to SQS", "conditions": [ "Login success" ], "implementation": "SendToUserEventSQS(event)" } ] } }, "services": [ { "name": "acl-service", "target_interface": "GetJwtByApiKey", "target_repo": "tidbcloud/acl-service", "operation_type": "grpc_unary", "conditions": [ "!config.IsProdEnv() && req.AccessKey != ''" ], "operations": [ { "operation": "gRPC GetJwtByApiKey", "trigger": "Get JWT by API key", "conditions": [ "Non-prod && AccessKey provided" ], "implementation": "client.GetJwtByApiKey(ctx, &rpcReq)" } ] }, { "name": "acl-service", "target_interface": "GetJwtByUser", "target_repo": "tidbcloud/acl-service", "operation_type": "grpc_unary", "conditions": [ "!config.IsProdEnv() && (req.Email != '' || req.UserId != 0)" ], "operations": [ { "operation": "gRPC GetJwtByUser", "trigger": "Get JWT by user", "conditions": [ "Non-prod && Email/UserId provided" ], "implementation": "client.GetJwtByUser(ctx, &rpcReq)" } ] }, { "name": "acl-service", "target_interface": "GetJwtByToken", "target_repo": "tidbcloud/acl-service", "operation_type": "grpc_unary", "conditions": [ "!config.IsProdEnv() && req.Token != ''" ], "operations": [ { "operation": "gRPC GetJwtByToken", "trigger": "Get JWT by token", "conditions": [ "Non-prod && Token provided" ], "implementation": "client.GetJwtByToken(ctx, &rpcReq)" } ] }, { "name": "cm-service", "target_interface": "SyncClusterRelations", "target_repo": "tidbcloud/cm-api", "operation_type": "grpc_unary", "conditions": [ "req.SyncCmClusterUser == '1'" ], "operations": [ { "operation": "gRPC SyncClusterRelations", "trigger": "Sync cluster relations", "conditions": [ "Sync requested" ], "implementation": "monitor.SyncClusterRelations(ctx, req.SyncCmClusterUserOrgId)" } ] } ] }, "ApiKeyService.CreateApiKeyForMsp": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Validate user invite token", "conditions": [ "Always" ], "implementation": "userSvc.ValidateUserInviteTokenIgnoreEmail(ctx, req.Token, true)" }, { "operation": "INSERT", "trigger": "Create API key", "conditions": [ "Always" ], "implementation": "svc.CreateApiKey(ctx, ¶m)" } ] } }, "services": [] }, "DbJwtService.GetJwtByToken": { "infrastructure": {}, "services": [ { "name": "authcenter", "target_interface": "GetJwtByToken", "target_repo": "tidbcloud/account", "operation_type": "grpc_unary", "conditions": [ "Always" ], "operations": [ { "operation": "gRPC GetJwtByToken", "trigger": "Get database JWT by Auth0 token", "conditions": [ "Always" ], "implementation": "dbjwt.GlobalDBJwtSvc.GetJwtByToken(ctx, ¶m)" } ] }, { "name": "authcenter", "target_interface": "GetJwtByUser", "target_repo": "tidbcloud/account", "operation_type": "grpc_unary", "conditions": [ "req.UserId != 0 || req.Email != ''" ], "operations": [ { "operation": "gRPC GetJwtByUser", "trigger": "Get database JWT by user", "conditions": [ "UserId or Email provided" ], "implementation": "dbjwt.GlobalDBJwtSvc.GetJwtByUser(ctx, ¶m)" } ] } ] }, "DbJwtService.GetJwtByApiKey": { "infrastructure": {}, "services": [ { "name": "authcenter", "target_interface": "GetJwtByApiKey", "target_repo": "tidbcloud/account", "operation_type": "grpc_unary", "conditions": [ "Always" ], "operations": [ { "operation": "gRPC GetJwtByApiKey", "trigger": "Get database JWT by API key", "conditions": [ "Always" ], "implementation": "dbjwt.GlobalDBJwtSvc.GetJwtByApiKey(ctx, ¶m)" } ] } ] }, "DbJwtService.GetJwtByBuiltinUser": { "infrastructure": {}, "services": [ { "name": "cm-service", "target_interface": "GetClusterById", "target_repo": "tidbcloud/cm-api", "operation_type": "grpc_unary", "conditions": [ "orgId in whitelist && username in whitelist" ], "operations": [ { "operation": "gRPC GetClusterById", "trigger": "Get cluster info from CM", "conditions": [ "Whitelisted" ], "implementation": "infra.GetHandler().GetClusterById(ctx, param.ClusterId, true)" } ] }, { "name": "authcenter", "target_interface": "GenJwtToken", "target_repo": "tidbcloud/account", "operation_type": "grpc_unary", "conditions": [ "cluster found && org matches" ], "operations": [ { "operation": "gRPC GenJwtToken", "trigger": "Generate JWT token for builtin user", "conditions": [ "Cluster valid && org matches" ], "implementation": "svc.GenJwtToken(ctx, param.ClusterId, clusterUsername, userEmail, tokenExpiredTime)" } ] } ] }, "OrgAuthMethodService.UpdateAuthMethod": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "UPSERT", "trigger": "Update auth method", "conditions": [ "Always" ], "implementation": "svc.UpdateAuthMethod(ctx, req)" } ] } }, "services": [] }, "OrgAuthMethodService.ListAuthMethods": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "List auth methods", "conditions": [ "Always" ], "implementation": "svc.ListAuthMethods(ctx, filter)" } ] } }, "services": [] }, "OrgAuthMethodService.CreateBearerToken": { "infrastructure": { "mysql": { "conditions": [ "req.Description != \"\"", "req.OrgId != 0" ], "operations": [ { "operation": "INSERT", "trigger": "Create the SCIM bearer token bound to the org auth method setup", "conditions": [ "Always after description and org validation succeed" ], "implementation": "svc.CreateBearerToken(ctx, req)" } ] } }, "services": [] }, "UserService.CreateSqlUser": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Get CM operator", "conditions": [ "Always" ], "implementation": "dbUserSvc.GetCMOperator(ctx, getCMOperatorReq)" } ] } }, "services": [ { "name": "cm-service", "target_interface": "CreateSqlUser", "target_repo": "tidbcloud/cm-api", "operation_type": "grpc_unary", "conditions": [ "Always" ], "operations": [ { "operation": "gRPC CreateSqlUserToCm", "trigger": "Create SQL user in cluster", "conditions": [ "Always" ], "implementation": "svc.CreateSqlUserToCm(ctx, req, *operator)" } ] } ] }, "UserService.DeleteSqlUser": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Get CM operator", "conditions": [ "Always" ], "implementation": "dbUserSvc.GetCMOperator(ctx, getCMOperatorReq)" } ] } }, "services": [ { "name": "cm-service", "target_interface": "DeleteSqlUser", "target_repo": "tidbcloud/cm-api", "operation_type": "grpc_unary", "conditions": [ "Always" ], "operations": [ { "operation": "gRPC DeleteSqlUserToCM", "trigger": "Delete SQL user in cluster", "conditions": [ "Always" ], "implementation": "svc.DeleteSqlUserToCM(ctx, req.ClusterId, req.UserName, *operator)" } ] } ] }, "UserService.UpdateSqlUser": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Get CM operator", "conditions": [ "Always" ], "implementation": "dbUserSvc.GetCMOperator(ctx, getCMOperatorReq)" } ] } }, "services": [ { "name": "cm-service", "target_interface": "UpdateSqlUser", "target_repo": "tidbcloud/cm-api", "operation_type": "grpc_unary", "conditions": [ "Always" ], "operations": [ { "operation": "gRPC UpdateSqlUserToCM", "trigger": "Update SQL user in cluster", "conditions": [ "Always" ], "implementation": "svc.UpdateSqlUserToCM(ctx, req, updateCustomRoleFlag, *operatorResp)" } ] } ] }, "UserService.ListSqlUsers": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Get CM operator", "conditions": [ "Always" ], "implementation": "dbUserSvc.GetCMOperator(ctx, getCMOperatorReq)" } ] } }, "services": [ { "name": "cm-service", "target_interface": "ListSqlUsers", "target_repo": "tidbcloud/cm-api", "operation_type": "grpc_unary", "conditions": [ "Always" ], "operations": [ { "operation": "gRPC ListSqlUserFormCM", "trigger": "List SQL users from cluster", "conditions": [ "Always" ], "implementation": "svc.ListSqlUserFormCM(ctx, req.ClusterId, *operator)" } ] } ] }, "UserService.GetUserUIPrivileges": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Get user roles and privileges", "conditions": [ "Always" ], "implementation": "svc.GetUserRolesAndPrivileges(ctx, user.ID.Uint64(), systems)" } ] } }, "services": [] }, "UserService.CreateUserVisitHistory": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Get user last visit history", "conditions": [ "Always" ], "implementation": "s.GetUserLastVisitHistory(ctx, nil)" }, { "operation": "INSERT", "trigger": "Create visit org/project history", "conditions": [ "Always" ], "implementation": "loginHistorySvc.CreateEventHistory(ctx, &history)" } ] } }, "services": [] }, "UserService.GetUserLastVisitHistory": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "List event history last", "conditions": [ "Always" ], "implementation": "loginHistorySvc.ListEventHistoryLast(ctx, filter)" }, { "operation": "SELECT", "trigger": "Get user org IDs", "conditions": [ "Always" ], "implementation": "roleBindingSvc.GetUserOrgIds(ctx, user.ID.Uint64())" }, { "operation": "SELECT", "trigger": "List user visible project IDs", "conditions": [ "Always" ], "implementation": "projectSvc.ListUserVisibleProjectIds(ctx, user.ID.Uint64(), []uint64{resp.OrgId})" } ] } }, "services": [] }, "UserService.GetUserProfileV2": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "List orgs by user ID", "conditions": [ "Always" ], "implementation": "orgSvc.ListOrgsByUserID(ctx, user.ID.Uint64())" }, { "operation": "SELECT", "trigger": "List user visible projects", "conditions": [ "Always" ], "implementation": "projectSvc.ListUserVisibleProjects(ctx, user.ID.Uint64(), orgIds)" }, { "operation": "SELECT", "trigger": "Check if new user", "conditions": [ "Always" ], "implementation": "userSvc.IsNewUser(ctx, &userId)" }, { "operation": "SELECT", "trigger": "Get new user default cluster", "conditions": [ "isNewUser" ], "implementation": "userSvc.GetNewUserDefaultCluster(ctx, &userId, nil)" } ] } }, "services": [] }, "UserService.ListConsoleUsers": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "List console users", "conditions": [ "Always" ], "implementation": "consoleuser.GetConsoleUserSvc().ListConsoleUsers(ctx, req, operator)" } ] } }, "services": [] }, "MessageService.QueryNotice": { "infrastructure": {}, "services": [ { "name": "oneconfig", "target_interface": "message.notice", "target_repo": "tidbcloud/oneconfig", "operation_type": "http_get", "conditions": [ "!config.IsLocalEnv()" ], "operations": [ { "operation": "HTTP GET oneconfig", "trigger": "Get notice message from oneconfig", "conditions": [ "Non-local environment" ], "implementation": "viper.GetString('message.notice')" } ] } ] }, "ScimGroupService.ListScimGroups": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "List SCIM groups", "conditions": [ "Always" ], "implementation": "svc.ListScimGroups(ctx, req.OrgId, offset, limit)" } ] } }, "services": [] }, "ScimGroupService.UpdateScimGroupRole": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "UPDATE", "trigger": "Update SCIM group role", "conditions": [ "Always" ], "implementation": "svc.UpdateScimGroupRole(ctx, req.GroupId, req.OrgRole, req.ProjectRole, req.ProjectIds)" } ] } }, "services": [] }, "AuditLogService.CreateAuditLog": { "infrastructure": { "mysql": { "conditions": [ "req.OperatorEmail != \"\"" ], "operations": [ { "operation": "SELECT", "trigger": "Resolve operator ID before submitting the audit event", "conditions": [ "Only when OperatorEmail is present" ], "implementation": "database.Transaction(func(tx *gorm.DB) error { user2.GetUserByEmail(tx, req.OperatorEmail) })" } ] }, "auditlog-sdk": { "conditions": [ "Always" ], "operations": [ { "operation": "Submit", "trigger": "Emit the normalized auditlog event after decoding req.Details", "conditions": [ "Always after req.Details JSON unmarshal succeeds" ], "implementation": "auditlog.NewEvent(ctx, eventType).SetUserToken(req.UserToken).SetOperatorEmail(req.OperatorEmail).SetOperatorID(operatorID).SetOperatorLoginMethod(operatorLoginMethod).SetDetails(d.Build()).SetOrgID(req.OrgId).SetProjectID(req.ProjectId).SetClusterID(req.ClusterId).Submit()" } ] } }, "services": [] }, "AuthService.ConfirmMfaAuthenticators": { "infrastructure": { "auth0": { "conditions": [ "req != nil", "req.Password != \"\"", "req.OtpCode != \"\"" ], "operations": [ { "operation": "User.ListByEmail", "trigger": "Resolve the current Auth0 user before toggling use_mfa metadata", "conditions": [ "Always before the enable/rollback metadata update" ], "implementation": "s.updateCurrentUserAuth0MetadataUseMfa(ctx, email, auth0UserID, true/false) -> s.management.User.ListByEmail(email)" }, { "operation": "User.Update", "trigger": "Optimistically enable MFA metadata and roll it back on verification failure", "conditions": [ "Set to true before password+OTP verification", "Set back to false in defer when confirmOK becomes false" ], "implementation": "s.updateCurrentUserAuth0MetadataUseMfa(ctx, email, auth0UserID, true/false)" } ] }, "auditlog-sdk": { "conditions": [ "verifyOtpCodeRet.OK == true" ], "operations": [ { "operation": "Submit", "trigger": "Record the successful MFA enablement only after OTP verification passes", "conditions": [ "Only on the success path" ], "implementation": "auditlog.NewEvent(ctx, auditlog.EventSetMFA).SetResult(true).SetDetails(...).Submit()" } ] } }, "services": [ { "name": "auth0", "target_repo": "auth0.com", "target_interface": "POST /co/authenticate", "operation_type": "http_post", "conditions": [ "use_mfa metadata update to true succeeded" ], "operations": [ { "operation": "HTTP POST /co/authenticate", "trigger": "Re-authenticate the current user to obtain the MFA challenge token", "conditions": [ "Always after updateCurrentUserAuth0MetadataUseMfa(..., true) succeeds" ], "implementation": "auth0.VerifyEmailPassword(ctx, email, req.Password)" } ] }, { "name": "auth0", "target_repo": "auth0.com", "target_interface": "POST /mfa/challenge", "operation_type": "http_post", "conditions": [ "verifyPasswordRet.ErrorRet != nil", "verifyPasswordRet.ErrorRet.Error == auth0.MfaRequiredError" ], "operations": [ { "operation": "HTTP POST MFA challenge", "trigger": "Verify the supplied OTP against the MFA token returned by Auth0", "conditions": [ "Only when VerifyEmailPassword returns the expected MFA-required challenge" ], "implementation": "auth0.VerifyOtpCode(ctx, verifyPasswordRet.ErrorRet.MfaToken, req.OtpCode)" } ] } ] }, "AuditLogService.PaymentMethodAuditLog": { "infrastructure": { "auditlog-sdk": { "conditions": [ "Always" ], "operations": [ { "operation": "AuditLog", "trigger": "Record payment-method add/update/delete result with masked card suffix", "conditions": [ "Always; err is synthesized when req.IsSuccess is false" ], "implementation": "auditlog2.AuditLog(ctx, err, auditEvent, zap.String(\"cardNumber\", req.CardNumberLast4))" } ] } }, "services": [] }, "TenantService.SendVerificationEmail": { "infrastructure": { "rate-controller": { "conditions": [ "req != nil", "req.Email != \"\"" ], "operations": [ { "operation": "AllowAll", "trigger": "Enforce the registration-verification email rate limit before any token or email work", "conditions": [ "Always after req.Email is sanitized" ], "implementation": "singleton.RateControllerManager.WithScene(rateConf.Scene).AllowAll(ctx, accessor, target, now, rateConf.Rates...)" }, { "operation": "Access", "trigger": "Consume the send-verification-email quota after the rate-limit check passes", "conditions": [ "AllowAll returned true" ], "implementation": "rateController.Access(ctx, accessor, target, now)" } ] }, "mysql": { "conditions": [ "Rate limit check passed" ], "operations": [ { "operation": "SELECT", "trigger": "Load the pending user row by email before regenerating the verification token", "conditions": [ "Always inside userContext.SendVerificationEmail" ], "implementation": "usersvc.GetUserByEmail(tx, email)" }, { "operation": "SELECT", "trigger": "Load the org bound to the pending user", "conditions": [ "User exists and is neither active nor inactive nor invited" ], "implementation": "org3.ListOrgsByUserIDStatus(ctx, tx, user.ID, []string{entity.RoleBindingStatusActive, entity.RoleBindingStatusInactive})" }, { "operation": "INSERT", "trigger": "Create a new registration-verification token for the pending user", "conditions": [ "User and org lookup succeeded" ], "implementation": "c.session.InsertUserInviteToken(tx, 0, org.ID, tokensvc.RegistrationVerificationMethod, email, 24*time.Hour, true)" } ] } }, "services": [ { "name": "account-service", "target_interface": "AccountAPIService.SendEmail", "target_repo": "tidbcloud/account", "operation_type": "grpc_unary", "conditions": [ "Rate limit check passed", "Verification token insertion succeeded" ], "operations": [ { "operation": "SendEmail", "trigger": "Send the registration-verification email with the generated verification URL", "conditions": [ "Always after userContext.SendVerificationEmail completes its DB transaction", "return_url is appended only when req.ReturnUrl != \"\"" ], "implementation": "c.sendVerificationEmail(ctx, email, user.FirstName, token, returnUrl, org.ID.Uint64()) -> c.accountAPI.SendEmail(ctx, &accountpb.SendEmailReq{...})" } ] } ] }, "TenantService.AcknowledgeCNPolicy": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "auditlog3.GetClientIP(ctx) succeeded" ], "operations": [ { "operation": "INSERT", "trigger": "Persist the CN policy acknowledgement with the resolved client IP", "conditions": [ "Always after IP extraction succeeds" ], "implementation": "userContext.AcknowledgeCNPolicy(ipAddress) -> acknowledgeCNPolicy.Create(tx)" } ] } }, "services": [] }, "TenantService.GetUserProfile": { "infrastructure": { "mysql": { "conditions": [ "req != nil" ], "operations": [ { "operation": "SELECT", "trigger": "Load the full user entity backing the authenticated tenant user", "conditions": [ "Always inside controllerorg.GlobalOrgController.GetUserProfile" ], "implementation": "userSvc.GetUserByID(ctx, tenantUser.ID.Uint64())" }, { "operation": "SELECT", "trigger": "Load the projects visible to the user inside the org", "conditions": [ "tenantUser.Role == ORG_ROLE_OWNER or tenantUser.IsImpersonated -> ListActiveProjectsByOrgID", "Otherwise -> ListUserVisibleProjects" ], "implementation": "projectSvc.ListActiveProjectsByOrgID(ctx, req.OrgId) / projectSvc.ListUserVisibleProjects(ctx, tenantUser.ID.Uint64(), []uint64{req.OrgId})" }, { "operation": "SELECT", "trigger": "Load the current org and RBAC binding for the response profile", "conditions": [ "Always" ], "implementation": "userSvc.GetUserOrg(ctx); s.getUserRbacRole(ctx, user.ID.Uint64(), entity.RoleBindingScopeOrg, org.ID.Uint64())" }, { "operation": "SELECT", "trigger": "Resolve new-user state and default cluster hints for the profile", "conditions": [ "Always for IsNewUser", "GetNewUserDefaultCluster only when isNewUser == true" ], "implementation": "userSvc.IsNewUser(ctx, &userId); userSvc.GetNewUserDefaultCluster(ctx, &userId, nil)" } ] } }, "services": [ { "name": "org-controller", "target_interface": "OrgController.GetUserProfile", "target_repo": "tidbcloud/account", "operation_type": "internal_call", "conditions": [ "Always" ], "operations": [ { "operation": "GetUserProfile", "trigger": "Delegate the tenant-facing profile lookup to the org controller implementation", "conditions": [ "Always" ], "implementation": "controllerorg.GlobalOrgController.GetUserProfile(ctx, req)" } ] } ] }, "TenantService.UpdateUserProfile": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "controllers.IsValidUsername(firstName, lastName) succeeded" ], "operations": [ { "operation": "UPDATE", "trigger": "Persist the sanitized profile fields for the current user", "conditions": [ "Always after validation succeeds" ], "implementation": "s.userContext(ctx).UpdateUserProfile(entity.ID(req.OrgId), updateUserProfileReq) -> usersvc.GetUserByEmail(tx, req.Email); (&user).Update(tx, entity.UserDBSchema.FirstName, entity.UserDBSchema.LastName, entity.UserDBSchema.PhoneNumber)" } ] }, "auditlog-sdk": { "conditions": [ "controllers.IsValidUsername(firstName, lastName) succeeded" ], "operations": [ { "operation": "Submit", "trigger": "Record the profile-update audit event with old/new name and phone fields", "conditions": [ "Always after UpdateUserProfile returns" ], "implementation": "auditlog.NewEvent(ctx, auditlog.EventUpdateProfile).SetResult(err == nil).SetDetails(details.Build()).Submit()" } ] } }, "services": [] }, "TenantService.ListProjects": { "infrastructure": { "mysql": { "conditions": [ "req != nil" ], "operations": [ { "operation": "SELECT", "trigger": "Load the project list visible to the tenant user within the org", "conditions": [ "Impersonated users list all active org projects", "Other users list only visible projects" ], "implementation": "s.userContext(ctx).ListProjects(ctx, entity.ID(req.OrgId)) -> projectSvc.ListActiveProjectsByOrgID(...) / projectSvc.ListUserVisibleProjects(...)" } ] } }, "services": [ { "name": "core-svc", "target_interface": "CountClustersByProject", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc_unary", "conditions": [ "Always while converting each project to the central.Project model" ], "operations": [ { "operation": "CountClustersByProject", "trigger": "Fetch per-project cluster counts during project model conversion", "conditions": [ "Always inside ConvertProjectEntityToModel", "A degraded -1 count is used when downgradeClusterCount is true and the call fails" ], "implementation": "infra.GetHandler().CountClustersByProject(ctx, []uint64{project.ID.Uint64()})" } ] } ] }, "TenantService.UpdateProject": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "controllers.IsValidProjectName(projectName) succeeded" ], "operations": [ { "operation": "SELECT", "trigger": "Load the existing project name for audit logging before update", "conditions": [ "Always" ], "implementation": "tenantctx.GetProjectName(ctx, orgID, projectID)" }, { "operation": "UPDATE", "trigger": "Persist the new project name", "conditions": [ "Always after validation succeeds" ], "implementation": "userContext.UpdateProject(ctx, updateProjectReq) -> projectSvc.UpdateProjectName(ctx, req.ProjectID.Uint64(), req.ProjectName)" } ] }, "auditlog-sdk": { "conditions": [ "Project name validation passed" ], "operations": [ { "operation": "Submit", "trigger": "Record the project rename audit event", "conditions": [ "Always after UpdateProject returns" ], "implementation": "auditlog.NewEvent(ctx, auditlog.EventEditProject).SetDetails(details.Build()).SetResult(err == nil).SetOrgID(req.OrgId).SetProjectID(req.ProjectId).Submit()" } ] } }, "services": [] }, "TenantService.DeleteProject": { "infrastructure": { "mysql": { "conditions": [ "req != nil" ], "operations": [ { "operation": "SELECT", "trigger": "Load the project name before deletion for audit detail construction", "conditions": [ "Always" ], "implementation": "tenantctx.GetProjectName(ctx, orgID, projectID)" }, { "operation": "UPDATE", "trigger": "Mark the project deleted and clean related bindings inside the tenantctx delete flow", "conditions": [ "Always after the project-name lookup succeeds" ], "implementation": "tenantctx.DeleteProject(ctx, orgID, projectID)" } ] }, "auditlog-sdk": { "conditions": [ "Project name lookup succeeded" ], "operations": [ { "operation": "Submit", "trigger": "Record the project deletion audit event", "conditions": [ "Always after DeleteProject returns" ], "implementation": "auditlog.NewEvent(ctx, auditlog.EventDeleteProject).SetDetails(details.Build()).SetResult(err == nil).SetOrgID(req.OrgId).SetProjectID(req.ProjectId).Submit()" } ] } }, "services": [] }, "TenantService.ListProjectUsers": { "infrastructure": { "mysql": { "conditions": [ "req != nil" ], "operations": [ { "operation": "SELECT", "trigger": "List project-scope role-binding users that match the email/order filter", "conditions": [ "Always" ], "implementation": "userSvc.ListRoleBindingUsers(ctx, f)" }, { "operation": "SELECT", "trigger": "Load user login times for the listed project users", "conditions": [ "Always after the project user list is built" ], "implementation": "historysvc.GetHistorySvc().SetUserLoginTime(ctx, &users)" } ] } }, "services": [] }, "TenantService.InviteUser": { "infrastructure": { "rate-controller": { "conditions": [ "req != nil" ], "operations": [ { "operation": "AllowAll", "trigger": "Rate-limit project invite traffic per inviter before any invite work", "conditions": [ "Always" ], "implementation": "singleton.RateControllerManager.WithScene(rateConf.Scene).AllowAll(ctx, accessor, \"\", now, rateConf.Rates...)" }, { "operation": "Access", "trigger": "Consume the invite-user quota after the rate-limit check passes", "conditions": [ "AllowAll returned true" ], "implementation": "rateController.Access(ctx, accessor, req.Email, now)" } ] } }, "services": [ { "name": "invite-service", "target_interface": "InviteUserSvc.InviteUser", "target_repo": "tidbcloud/account", "operation_type": "internal_call", "conditions": [ "Rate limit check passed", "validateInviteUserReq(inviteUserReq) succeeded" ], "operations": [ { "operation": "InviteUser", "trigger": "Create/update invitee bindings, persist invite tokens, audit the invite, and send invite emails", "conditions": [ "Always after validation succeeds" ], "implementation": "userContext.InviteUser(ctx, inviteUserReq) -> invite.GetInviteUserSvc().InviteUser(ctx, &inviteUserParam)" } ] } ] }, "TenantService.InviteUserToOrg": { "infrastructure": { "rate-controller": { "conditions": [ "req != nil" ], "operations": [ { "operation": "AllowAll", "trigger": "Rate-limit org invite traffic per inviter before any invite work", "conditions": [ "Always" ], "implementation": "singleton.RateControllerManager.WithScene(rateConf.Scene).AllowAll(ctx, accessor, \"\", now, rateConf.Rates...)" }, { "operation": "Access", "trigger": "Consume the org-invite quota after the rate-limit check passes", "conditions": [ "AllowAll returned true" ], "implementation": "rateController.Access(ctx, accessor, req.Email, now)" } ] } }, "services": [ { "name": "invite-service", "target_interface": "InviteUserSvc.InviteUser", "target_repo": "tidbcloud/account", "operation_type": "internal_call", "conditions": [ "Rate limit check passed", "validateInviteUserReq(inviteUserReq) succeeded" ], "operations": [ { "operation": "InviteUser", "trigger": "Invite one or more users into the org with org-level RBAC and email delivery", "conditions": [ "Always after validation succeeds" ], "implementation": "userContext.InviteUser(ctx, inviteUserReq) -> invite.GetInviteUserSvc().InviteUser(ctx, &inviteUserParam)" } ] } ] }, "TenantService.UpdateProjectUserRole": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "IsValidUserProjectRbacRole(req.RbacRole) succeeded" ], "operations": [ { "operation": "SELECT", "trigger": "Load the user and existing role bindings before project-role mutation", "conditions": [ "Always inside userContext.UpdateProjectUserRole" ], "implementation": "daoHub.User.GetUserByID(ctx, tx, userID.Uint64()); daoHub.Role.ListRolesByTargetAndScope(ctx, tx, ...)" }, { "operation": "UPDATE", "trigger": "Change the project-scope role binding to the requested role", "conditions": [ "User is not an org owner and the new role differs from the existing binding" ], "implementation": "daoHub.Role.ChangeRoleTo(ctx, tx, entity.RoleBindingTargetUser, userID.Uint64(), entity.RoleBindingScopeProject, projectID.Uint64(), existedRoleBinding.Role, role)" } ] }, "auditlog-sdk": { "conditions": [ "Role validation passed" ], "operations": [ { "operation": "Submit", "trigger": "Record the project user-role change audit event", "conditions": [ "Always after UpdateProjectUserRole returns" ], "implementation": "auditlog.NewEvent(ctx, auditlog.EventUpdateUserRole).SetOrgID(orgID.Uint64()).SetProjectID(projectID.Uint64()).SetDetails(details.Build()).SetResult(err == nil).Submit()" } ] } }, "services": [] }, "TenantService.AcceptInvitation": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "CurrentUser(ctx) exists", "req.Email matches the email in the current bearer token" ], "operations": [ { "operation": "SELECT", "trigger": "Validate and load the invite/user state before accepting the invitation", "conditions": [ "Always inside userContext.AcceptInvitation" ], "implementation": "c.session.GenUserInviteToken(tx, tenantID, tokensvc.InvitationVerificationMethod, email); usersvc.GetUserByEmail(tx, email)" }, { "operation": "UPDATE", "trigger": "Activate the user and org/project/cluster bindings for the invitation", "conditions": [ "Invitation validation succeeded" ], "implementation": "userContext.AcceptInvitation(ctx, tenantID, req.GetEmail(), firstName, lastName) -> entityUser.Update(...); updateUserOrgRelationToActive(...); updateUserProjectRelationToActive(...); updateUserClusterRoleBinding2Active(...)" }, { "operation": "INSERT", "trigger": "Create login/visit history and follow-up DB user action records for the accepted invite", "conditions": [ "AcceptInvitation succeeded" ], "implementation": "insertHistory(ctx, entityUser, req.OrgId); insertUserActionInInvite(ctx, dbUserSvc, email, tenantID, userInviteToken)" } ] } }, "services": [ { "name": "auth0", "target_interface": "Management API ListByEmail", "target_repo": "auth0.com", "operation_type": "http_get", "conditions": [ "req.FirstName == \"\"", "req.LastName == \"\"", "pkg_http.GetBearerToken(ctx) succeeded" ], "operations": [ { "operation": "GET users-by-email", "trigger": "Backfill first/last name from Auth0 when the invitation accept request omits them", "conditions": [ "Only on the blank-name path" ], "implementation": "userContext.GetUserBasicInfoFromAuth0(ctx, tokenRaw) -> c.management.ListByEmail(email)" } ] } ] }, "TenantService.CreateAuth0User": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "controllers.IsValidUserPassword(req.Password) succeeded" ], "operations": [ { "operation": "SELECT", "trigger": "Validate the invitation token and resolve the invite target before creating the Auth0 user", "conditions": [ "Always inside userContext.CreateAuth0User" ], "implementation": "c.session.ValidateUserInviteToken(ctx, token, true)" } ] } }, "services": [ { "name": "auth0", "target_interface": "Management API Create User", "target_repo": "auth0.com", "operation_type": "http_post", "conditions": [ "Password validation succeeded", "Invitation token validated successfully" ], "operations": [ { "operation": "POST /api/v2/users", "trigger": "Create or reuse the Auth0 database-connection user for the invited account", "conditions": [ "Always after ValidateUserInviteToken succeeds", "Auth0 user-exists errors are tolerated and not returned as failures" ], "implementation": "c.management.Create(&u)" } ] } ] }, "TenantService.ListTenantAccessLogs": { "infrastructure": { "mysql": { "conditions": [ "req != nil" ], "operations": [ { "operation": "SELECT", "trigger": "List tenant audit-log rows filtered by time/user/content", "conditions": [ "Always" ], "implementation": "s.userContext(c).ListAccessLog(&auditlog3.ListAccessLogQuery{...}) -> centralModel.ListAuditLogs(c.tenantAndUser.TenantID, query) -> accesslog.ListAccessLog(tx, tenantID, query)" } ] } }, "services": [] }, "TenantService.GetClientIP": { "infrastructure": {}, "services": [] }, "TenantService.ListRolesByUserID": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "req.UserId != 0", "All req.ScopeTypes values parse to valid entity.ScopeType values when provided" ], "operations": [ { "operation": "SELECT", "trigger": "Load the active role bindings and RBAC role definitions for the requested user", "conditions": [ "Always after validation succeeds" ], "implementation": "srv.ListUserRoles(ctx, req.UserId, filterScopeTypes, []entity.ID{}) -> r.hub.Role.ListRoleBindings(ctx, r.db, filter); r.hub.Rbac.ListRbacRolesByIDs(ctx, r.db, rbacRoleIDs)" } ] } }, "services": [] }, "TenantService.ListUsersByScope": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "req.ScopeId != 0", "entity.ParseScopeType(strings.ToUpper(req.ScopeType)) != entity.RoleBindingScopeInvalid" ], "operations": [ { "operation": "SELECT", "trigger": "Load active role bindings in the requested scope and hydrate the corresponding users", "conditions": [ "Always after validation succeeds" ], "implementation": "srv.ListUsersByScope(ctx, scopeType, req.ScopeId) -> r.hub.Role.ListRolesByScope(ctx, r.db, scopeType, scopeID, []string{}); r.hub.User.ListUsers(ctx, r.db, userIds, nil)" } ] } }, "services": [] }, "TenantService.ListLoginUserRoles": { "infrastructure": {}, "services": [ { "name": "tenant-service", "target_interface": "TenantService.ListRolesByUserID", "target_repo": "tidbcloud/account", "operation_type": "internal_call", "conditions": [ "CurrentUser(ctx) exists" ], "operations": [ { "operation": "ListRolesByUserID", "trigger": "Reuse the generic user-role listing path for the currently authenticated user", "conditions": [ "Always after user lookup succeeds" ], "implementation": "s.ListRolesByUserID(ctx, ¢ral.ListRolesByUserIDReq{UserId: user.ID.Uint64(), ScopeTypes: req.ScopeTypes})" } ] } ] }, "TenantService.ListOrgActiveAuthMethods": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "req.CompanyName != \"\" or req.OrgId != \"\"" ], "operations": [ { "operation": "SELECT", "trigger": "Resolve the target org and the enabled auth methods configured for it", "conditions": [ "Always inside org-sso GetOrgActiveAuthMethods" ], "implementation": "svc.GetOrgActiveAuthMethods(ctx, req) -> s.hub.Org.GetOrgByOrgID(...) / s.hub.Org.GetOrgByCompanyName(...); s.hub.OrgAuthMethod.ListOrgAuthMethodsByOrgID(ctx, s.db, org.ID.Uint64())" } ] } }, "services": [ { "name": "org-sso", "target_interface": "OrgSsoSvc.GetOrgActiveAuthMethods", "target_repo": "tidbcloud/account", "operation_type": "internal_call", "conditions": [ "req.CompanyName != \"\" or req.OrgId != \"\"" ], "operations": [ { "operation": "GetOrgActiveAuthMethods", "trigger": "Delegate org auth-method discovery to the org-sso service and then reorder the password/email method to the end", "conditions": [ "Always after request validation succeeds" ], "implementation": "orgsso2.GetOrgSsoSvc().GetOrgActiveAuthMethods(ctx, req)" } ] } ] }, "TenantService.GetOrgByCompanyName": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "req.CompanyName != \"\"" ], "operations": [ { "operation": "SELECT", "trigger": "Resolve the org entity by custom/company name", "conditions": [ "Always after request validation succeeds" ], "implementation": "s.userContext(ctx).GetOrganizationByCustomName(ctx, req.CompanyName)" } ] } }, "services": [] }, "TenantService.OrgBindThirdParty": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "req.ThirdPartyFreeTrial == false" ], "operations": [ { "operation": "SELECT", "trigger": "Validate the org and current marketplace-binding state before persisting the provider binding", "conditions": [ "Always inside userContext.OrgBindThirdParty" ], "implementation": "ValidateThirdPartyToken(...); dao.GetDaoHub().Org.GetOrgByOrgID(ctx, database.DBConn.DB, params.OrgID.Uint64())" }, { "operation": "UPDATE", "trigger": "Persist the third-party account provider/code binding onto the org row", "conditions": [ "Token resolved successfully", "The marketplace account is not already bound elsewhere", "The org does not already have a marketplace account code" ], "implementation": "entity.NewTenantQuerySet(tx).IDEq(params.OrgID).GetUpdater().SetThirdPartyAccountProvider(...).SetThirdPartyAccountCode(...).SetThirdPartyFreeTrial(...).Update()" } ] } }, "services": [ { "name": "billing2", "target_interface": "GetAWSSubscriptionFreeTrialStatus", "target_repo": "tidbcloud/account", "operation_type": "http_get", "conditions": [ "req.ThirdPartyAccountProvider == handler.AWSAccountProvider" ], "operations": [ { "operation": "GetAWSSubscriptionFreeTrialStatus", "trigger": "Reject marketplace accounts that are still in AWS free trial when binding the org", "conditions": [ "Only on the AWS provider path" ], "implementation": "billing2.GetHandler().GetAWSSubscriptionFreeTrialStatus(context.Background(), accountCode)" } ] }, { "name": "salesforce", "target_interface": "UpdateAccount", "target_repo": "tidbcloud/account", "operation_type": "http_post", "conditions": [ "The org third-party binding transaction committed successfully" ], "operations": [ { "operation": "UpdateAccount", "trigger": "Sync the provider-source information to Salesforce after the org binding is persisted", "conditions": [ "Always after the DB transaction commits", "Salesforce sync errors are logged but not returned" ], "implementation": "c.salesforceClient.UpdateAccount(ctx, salesforce.Account{Source: params.ThirdPartyAccountProvider, PortalID: strconv.FormatUint(params.OrgID.Uint64(), 10)})" } ] } ] }, "TenantService.ValidateThirdPartyToken": { "infrastructure": { "mysql": { "conditions": [ "req != nil" ], "operations": [ { "operation": "COUNT", "trigger": "Check whether the resolved third-party account code is already bound to another org", "conditions": [ "Account code resolution succeeded" ], "implementation": "entity.NewTenantQuerySet(db).ThirdPartyAccountCodeEq(*accountCode).ThirdPartyAccountProviderEq(params.ThirdPartyAccountProvider).Count()" } ] } }, "services": [ { "name": "third-party-account-provider", "target_interface": "ResolveAccountCode", "target_repo": "external-marketplace", "operation_type": "http_get", "conditions": [ "req.ThirdPartyAccountProvider != \"\"", "req.ThirdPartyAccountToken != \"\"" ], "operations": [ { "operation": "ResolveAccountCode", "trigger": "Resolve the provider-specific marketplace token into the stable third-party account code", "conditions": [ "Always before the duplicate-binding COUNT query" ], "implementation": "tenant2.ValidateThirdPartyToken(ctx, ...) -> getThirdPartyAccountCode(params.ThirdPartyAccountProvider, params.ThirdPartyAccountToken)" } ] } ] }, "TenantService.OpenOrgSso": { "infrastructure": { "mysql": { "conditions": [ "req != nil" ], "operations": [ { "operation": "UPDATE", "trigger": "Promote the org to enterprise mode and create the default org auth-method rows", "conditions": [ "Always inside org-sso OpenOrgSso" ], "implementation": "orgSsoSvc.OpenOrgSso(ctx, req) -> s.hub.Org.OpenOrgSso(ctx, tx, req.OrgId, string(entity.OrgTypeEnterprise), req.CompanyName); s.hub.OrgAuthMethod.CreateOrgAuthMethod(ctx, tx, obj)" }, { "operation": "UPDATE", "trigger": "Mark affected org/project users pending while SSO is being enabled", "conditions": [ "Always inside the same transaction after org auth methods are created" ], "implementation": "s.setUsersStatusPendingInOrg(ctx, *org, *user, req.CompanyName); s.setUsersStatusInProject(ctx, *org, *user)" } ] }, "auditlog-sdk": { "conditions": [ "OpenOrgSso transaction completed", "!config.IsLocalEnv()" ], "operations": [ { "operation": "Submit", "trigger": "Record the Cloud Organization SSO enablement audit event", "conditions": [ "Only outside local env" ], "implementation": "auditlog.NewEvent(ctx, auditlog.EventEnableCloudOrganizationSSO).SetOrgID(req.OrgId).SetDetails(details.Build()).SetOperatorEmail(user.Email).SetResult(err == nil).Submit()" } ] } }, "services": [ { "name": "org-sso", "target_interface": "OrgSsoSvc.OpenOrgSso", "target_repo": "tidbcloud/account", "operation_type": "internal_call", "conditions": [ "req != nil" ], "operations": [ { "operation": "OpenOrgSso", "trigger": "Delegate the tenant-facing SSO enablement request to the org-sso service", "conditions": [ "Always" ], "implementation": "controllerorg.GlobalOrgController.OpenOrgSso(ctx, req) -> orgSsoSvc.OpenOrgSso(ctx, req)" } ] } ] }, "TenantService.GetExpWhiteList": { "infrastructure": {}, "services": [ { "name": "account-service", "target_interface": "AccountAPIService.ListHitFeatureFlagNames", "target_repo": "tidbcloud/account", "operation_type": "grpc_unary", "conditions": [ "usersvc.GetUserFromContext(ctx) succeeded" ], "operations": [ { "operation": "ListHitFeatureFlagNames", "trigger": "Resolve the feature-flag/experiment names hit by the current user within the org", "conditions": [ "Always after the current user email is resolved from context" ], "implementation": "account.GetHandler().ListHitFeatureFlagNames(ctx, &accountpb.ListHitFeatureFlagNamesReq{OrgId: req.OrgId, Email: user.Email})" } ] } ] }, "TenantService.CreatePocApplication": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "buildCreatePocParams(sanitizedRequest, userID) succeeded" ], "operations": [ { "operation": "INSERT", "trigger": "Persist the POC application questionnaire and extra fields", "conditions": [ "Always after parameter building succeeds" ], "implementation": "userContext.CreatePocApplication(ctx, pocApplication) -> pocApplicationEntity.Create(tx)" } ] }, "jobqueue": { "conditions": [ "POC application insert succeeded" ], "operations": [ { "operation": "Enqueue", "trigger": "Queue the sync-poc-application background job after the POC record is created", "conditions": [ "Always after the DB insert succeeds" ], "implementation": "jobqueue.Enqueue(ctx, config.JobSyncPocApplication, queuePayload)" } ] } }, "services": [] }, "TenantService.GetMspConfig": { "infrastructure": { "mysql": { "conditions": [ "req != nil" ], "operations": [ { "operation": "SELECT", "trigger": "Resolve the active MSP org and its config plus optional advertising payload", "conditions": [ "Always inside OrgController.GetMspConfig" ], "implementation": "orgSvc.ListOrgsByFilter(ctx, orgFilter); mspSvc.GetMspConfigByOrgID(ctx, mspOrg.ID)" } ] } }, "services": [ { "name": "org-controller", "target_interface": "OrgController.GetMspConfig", "target_repo": "tidbcloud/account", "operation_type": "internal_call", "conditions": [ "req != nil" ], "operations": [ { "operation": "GetMspConfig", "trigger": "Delegate MSP config materialization to the org controller implementation", "conditions": [ "Always" ], "implementation": "controllerorg.GlobalOrgController.GetMspConfig(ctx, req)" } ] } ] }, "TenantService.GetMspCustomer": { "infrastructure": { "mysql": { "conditions": [ "req != nil" ], "operations": [ { "operation": "SELECT", "trigger": "Resolve the MSP customer org, partner customer row, and partner MSP config", "conditions": [ "Always inside OrgController.GetMspCustomer" ], "implementation": "orgSvc.GetOrgByID(ctx, req.OrgId); mspSvc.GetCustomerByCustomerID(ctx, customerOrg.ID); mspSvc.GetMspConfigByOrgID(ctx, customer.PartnerOrgID)" } ] } }, "services": [ { "name": "org-controller", "target_interface": "OrgController.GetMspCustomer", "target_repo": "tidbcloud/account", "operation_type": "internal_call", "conditions": [ "req != nil" ], "operations": [ { "operation": "GetMspCustomer", "trigger": "Delegate MSP-customer materialization to the org controller implementation", "conditions": [ "Always" ], "implementation": "controllerorg.GlobalOrgController.GetMspCustomer(ctx, req)" } ] } ] }, "TenantService.GetPartnerByCustomerId": { "infrastructure": { "mysql": { "conditions": [ "req != nil" ], "operations": [ { "operation": "SELECT", "trigger": "Resolve the customer org, partner-customer relation, and partner org/profile", "conditions": [ "Always inside OrgController.GetPartnerByCustomerId" ], "implementation": "orgSvc.GetOrgByID(ctx, req.OrgId); mspSvc.GetCustomerByCustomerID(ctx, customerOrg.ID); orgSvc.GetOrgByID(ctx, customer.PartnerOrgID.Uint64())" }, { "operation": "SELECT", "trigger": "Load MSP branding when the partner type is MSP", "conditions": [ "customer.PartnerType == string(entity.PartnerTypeMsp)" ], "implementation": "mspSvc.GetMspConfigByOrgID(ctx, customer.PartnerOrgID)" } ] } }, "services": [ { "name": "org-controller", "target_interface": "OrgController.GetPartnerByCustomerId", "target_repo": "tidbcloud/account", "operation_type": "internal_call", "conditions": [ "req != nil" ], "operations": [ { "operation": "GetPartnerByCustomerId", "trigger": "Delegate partner-by-customer lookup to the org controller implementation", "conditions": [ "Always" ], "implementation": "controllerorg.GlobalOrgController.GetPartnerByCustomerId(ctx, req)" } ] } ] }, "TenantService.ConfigFeatureFlagForProviderSource": { "infrastructure": { "mysql": { "conditions": [ "req != nil", "req.OrgId != 0", "req.ProviderSource != \"\"" ], "operations": [ { "operation": "SELECT", "trigger": "Load the org and ensure it is not already bound to a marketplace account", "conditions": [ "Always after request validation succeeds" ], "implementation": "svc.GetOrgByID(ctx, req.OrgId)" } ] }, "eventbus": { "conditions": [ "Org lookup succeeded", "dbOrg.ThirdPartyAccountCode is nil or empty" ], "operations": [ { "operation": "PublishOrgRegistrationProviderSourceEvent", "trigger": "Emit the provider-source event for downstream consumers after validation succeeds", "conditions": [ "Always on the non-duplicate path" ], "implementation": "publish.PublishOrgRegistrationProviderSourceEvent(ctx, req.OrgId, req.ProviderSource)" } ] } }, "services": [] }, "OpenAPIKeyService.CreateProjectOpenAPIKey": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "INSERT", "trigger": "Create a project-scoped API key record", "conditions": [ "Always" ], "implementation": "svc.CreateApiKey(ctx, &apikey2.CreateApiKeyParam{ScopeType: string(entity.RoleBindingScopeProject), ResourceIds: []uint64{req.ProjectId}, ...})" } ] }, "auditlog-sdk": { "conditions": [ "Always" ], "operations": [ { "operation": "Submit", "trigger": "Emit project-level API key creation audit event", "conditions": [ "Always after svc.CreateApiKey returns" ], "implementation": "auditlog.NewEvent(ctx, auditlog.EventCreateAPIKey).SetOrgID(req.OrgId).SetProjectID(req.ProjectId).SetDetails(details.Build()).SetResult(err == nil).Submit()" } ] } }, "services": [] }, "OpenAPIKeyService.ListProjectOpenAPIKeys": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "List project-scoped API keys by resource ID", "conditions": [ "Always" ], "implementation": "svc.ListApiKeysByResourceID(ctx, &apikey2.ListKeysByResourceIDParam{ScopeType: string(entity.RoleBindingScopeProject), ResourceId: req.ProjectId, ...})" } ] } }, "services": [] }, "OpenAPIKeyService.UpdateOpenAPIKey": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Verify the API key belongs to the org before mutation", "conditions": [ "Always" ], "implementation": "svc.CheckApiKeyBelongToResource(ctx, &apikey2.CheckApiKeyBelongToResourceParam{ScopeType: entity.RoleBindingScopeOrg.String(), ResourceId: req.OrgId, ApiKeyId: req.ApiKeyId})" }, { "operation": "UPDATE", "trigger": "Update the API key description", "conditions": [ "Only after ownership check succeeds" ], "implementation": "svc.UpdateApiKey(ctx, &apikey2.UpdateApiKeyParam{ApiKeyId: req.ApiKeyId, Description: req.Description, Operator: o.CurrentUser(ctx).Email})" }, { "operation": "UPDATE", "trigger": "Change the org role bound to the API key", "conditions": [ "Only when req.Role != \"\" and UpdateApiKey succeeded" ], "implementation": "svc.ChangeApiKeyRefResourceRole(ctx, &apikey2.ChangeApiKeyRefResourceRoleParam{ApiKeyId: req.ApiKeyId, ScopeType: entity.RoleBindingScopeOrg.String(), ResourceId: req.OrgId, NewRole: req.Role})" } ] }, "auditlog-sdk": { "conditions": [ "Always" ], "operations": [ { "operation": "Submit", "trigger": "Emit edit audit event for org-level API key changes", "conditions": [ "Always after update path completes or fails" ], "implementation": "auditlog.NewEvent(ctx, auditlog.EventEditAPIKey).SetOrgID(req.OrgId).SetDetails(details.Build()).SetResult(err == nil).Submit()" } ] } }, "services": [] }, "OpenAPIKeyService.UpdateProjectOpenAPIKey": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Verify the API key belongs to the project before mutation", "conditions": [ "Always" ], "implementation": "svc.CheckApiKeyBelongToResource(ctx, &apikey2.CheckApiKeyBelongToResourceParam{ScopeType: entity.RoleBindingScopeProject.String(), ResourceId: req.ProjectId, ApiKeyId: req.ApiKeyId})" }, { "operation": "UPDATE", "trigger": "Update the project API key description", "conditions": [ "Only after ownership check succeeds" ], "implementation": "svc.UpdateApiKey(ctx, &apikey2.UpdateApiKeyParam{ApiKeyId: req.ApiKeyId, Description: req.Description, Operator: o.CurrentUser(ctx).Email})" }, { "operation": "UPDATE", "trigger": "Change the project role bound to the API key", "conditions": [ "Only when req.Role != \"\" and UpdateApiKey succeeded" ], "implementation": "svc.ChangeApiKeyRefResourceRole(ctx, &apikey2.ChangeApiKeyRefResourceRoleParam{ApiKeyId: req.ApiKeyId, ScopeType: entity.RoleBindingScopeProject.String(), ResourceId: req.ProjectId, NewRole: req.Role})" } ] }, "auditlog-sdk": { "conditions": [ "Always" ], "operations": [ { "operation": "Submit", "trigger": "Emit edit audit event for project-level API key changes", "conditions": [ "Always after update path completes or fails" ], "implementation": "auditlog.NewEvent(ctx, auditlog.EventEditAPIKey).SetOrgID(req.OrgId).SetProjectID(req.ProjectId).SetDetails(details.Build()).SetResult(err == nil).Submit()" } ] } }, "services": [] }, "OpenAPIKeyService.DeleteOpenAPIKey": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Verify the org owns the API key before deletion", "conditions": [ "Always" ], "implementation": "svc.CheckApiKeyBelongToResource(ctx, &apikey2.CheckApiKeyBelongToResourceParam{ScopeType: entity.RoleBindingScopeOrg.String(), ResourceId: req.OrgId, ApiKeyId: req.ApiKeyId})" }, { "operation": "SELECT", "trigger": "Load the API key entity for not-found and audit details", "conditions": [ "Only after ownership check succeeds" ], "implementation": "svc.GetApiKeyByID(ctx, req.ApiKeyId)" }, { "operation": "DELETE", "trigger": "Delete the org-level API key", "conditions": [ "Only when keyEntity != nil" ], "implementation": "svc.DeleteApiKey(ctx, &apikey2.DeleteApiKeyParam{ApiKeyId: req.ApiKeyId, Operator: o.CurrentUser(ctx).Email})" } ] }, "auditlog-sdk": { "conditions": [ "Always" ], "operations": [ { "operation": "Submit", "trigger": "Emit delete audit event for the org-level API key", "conditions": [ "Always after delete path completes or fails" ], "implementation": "auditlog.NewEvent(ctx, auditlog.EventDeleteAPIKey).SetOrgID(req.OrgId).SetDetails(details.Build()).SetResult(err == nil).Submit()" } ] } }, "services": [] }, "OpenAPIKeyService.DeleteProjectOpenAPIKey": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "SELECT", "trigger": "Verify the project owns the API key before deletion", "conditions": [ "Always" ], "implementation": "svc.CheckApiKeyBelongToResource(ctx, &apikey2.CheckApiKeyBelongToResourceParam{ScopeType: entity.RoleBindingScopeProject.String(), ResourceId: req.ProjectId, ApiKeyId: req.ApiKeyId})" }, { "operation": "SELECT", "trigger": "Load the API key entity for not-found and audit details", "conditions": [ "Only after ownership check succeeds" ], "implementation": "svc.GetApiKeyByID(ctx, req.ApiKeyId)" }, { "operation": "DELETE", "trigger": "Delete the project-level API key", "conditions": [ "Only when keyEntity != nil" ], "implementation": "svc.DeleteApiKey(ctx, &apikey2.DeleteApiKeyParam{ApiKeyId: req.ApiKeyId, Operator: o.CurrentUser(ctx).Email})" } ] }, "auditlog-sdk": { "conditions": [ "Always" ], "operations": [ { "operation": "Submit", "trigger": "Emit delete audit event for the project-level API key", "conditions": [ "Always after delete path completes or fails" ], "implementation": "auditlog.NewEvent(ctx, auditlog.EventDeleteAPIKey).SetOrgID(req.OrgId).SetProjectID(req.ProjectId).SetDetails(details.Build()).SetResult(err == nil).Submit()" } ] } }, "services": [] }, "OpenAPIKeyService.ListConsoleApiKeys": { "infrastructure": { "mysql": { "conditions": [ "req.OrgId != 0" ], "operations": [ { "operation": "SELECT", "trigger": "List console API keys with org/project/cluster role filters", "conditions": [ "Always after org validation succeeds" ], "implementation": "svc.ListApiKeysV2(ctx, &apikey2.ListApiKeysParam{Type: entity.ApiKeyTypeNormalKey, KeyLike: req.Search, OrgId: req.OrgId, OrgRoles: req.OrgRoles, ProjectId: req.ProjectId, ProjectRoles: req.ProjectRoles, ClusterId: req.ClusterId, ClusterRoles: req.ClusterRoles, Page: pageNo, PerPage: pageSize})" } ] } }, "services": [] }, "OpenAPIKeyService.CreateConsoleApiKey": { "infrastructure": { "mysql": { "conditions": [ "req.Description != \"\"", "req.OrgId != 0", "req.OrgRole != \"\"", "checkProjectAndClusterRolesInvalid(req.ProjectRoles, req.ClusterRoles) == nil" ], "operations": [ { "operation": "INSERT", "trigger": "Create the console API key plus org/project/cluster role bindings", "conditions": [ "Always after request validation succeeds" ], "implementation": "svc.CreateApiKeyV2(ctx, attrs, assignRoleParam)" } ] } }, "services": [] }, "OpenAPIKeyService.UpdateConsoleApiKey": { "infrastructure": { "mysql": { "conditions": [ "req.ApiKeyId != 0", "req.OrgId != 0", "req.OrgRole != \"\"", "checkProjectAndClusterRolesInvalid(req.ProjectRoles, req.ClusterRoles) == nil" ], "operations": [ { "operation": "UPDATE", "trigger": "Update console API key description and role bindings", "conditions": [ "Always after request validation succeeds" ], "implementation": "svc.UpdateApiKeyV2(ctx, req.ApiKeyId, attrs, assignRoleParam)" } ] } }, "services": [] }, "DbJwtService.GetCloudAdminPasswd": { "infrastructure": {}, "services": [ { "name": "authcenter", "target_repo": "tidbcloud/account", "target_interface": "DBJwtService.GetCloudAdminPasswd", "operation_type": "grpc_unary", "conditions": [ "Always" ], "operations": [ { "operation": "GetCloudAdminPasswd", "trigger": "Fetch the cloud-admin password for the requested cluster", "conditions": [ "Always" ], "implementation": "dbjwt.GlobalDBJwtSvc.GetCloudAdminPasswd(ctx, &dbjwt.GetCloudAdminPasswdParam{ClusterID: req.ClusterId})" } ] } ] }, "OrgAuthMethodService.SetAuthMethodStatus": { "infrastructure": { "mysql": { "conditions": [ "Always" ], "operations": [ { "operation": "UPDATE", "trigger": "Enable or disable the stored org auth method record", "conditions": [ "Always" ], "implementation": "svc.SetAuthMethodStatus(ctx, req)" } ] } }, "services": [] }, "OrgAuthMethodService.GetEmailDomains": { "infrastructure": { "mysql": { "conditions": [ "req.OrgId != 0" ], "operations": [ { "operation": "SELECT", "trigger": "List enabled auth methods and merge their allow_email_domain sets", "conditions": [ "Always after org_id validation succeeds" ], "implementation": "svc.ListAuthMethods(ctx, sso.OrgAuthMethodFilter{OrgIds: []uint64{req.OrgId}, Status: []entity.EntityStatus{entity.Enable}})" } ] } }, "services": [] }, "OrgAuthMethodService.ShowAuthMethods": { "infrastructure": { "config": { "conditions": [ "req.OrgId != 0" ], "operations": [ { "operation": "Read", "trigger": "Build callback URLs, Auth0 tenant metadata, and SCIM connector metadata for the response", "conditions": [ "Always after org_id validation succeeds" ], "implementation": "config.Global().SSOConfig.Auth0Tenant / config.Global().SSOConfig.IamOpenApiDomain / getOidcCallBackUrl() / getSamlCallBackUrl(...)" } ] }, "mysql": { "conditions": [ "req.OrgId != 0" ], "operations": [ { "operation": "SELECT", "trigger": "Load the org to determine whether to return only default personal-org auth methods", "conditions": [ "Always after org_id validation succeeds" ], "implementation": "orgSvc.GetOrgByID(ctx, req.OrgId)" }, { "operation": "SELECT", "trigger": "Load persisted auth methods for non-personal orgs", "conditions": [ "Only when org.OrgType != entity.OrgTypePersonal" ], "implementation": "svc.ListAuthMethods(ctx, filter)" } ] } }, "services": [] }, "OrgAuthMethodService.CheckAuthMethod": { "infrastructure": { "mysql": { "conditions": [ "req.Name != \"\"" ], "operations": [ { "operation": "SELECT", "trigger": "Validate the requested auth method against the persisted org SSO configuration", "conditions": [ "Always after name validation succeeds" ], "implementation": "svc.CheckAuthMethod(ctx, req)" } ] } }, "services": [] }, "OrgAuthMethodService.ListBearerTokens": { "infrastructure": { "mysql": { "conditions": [ "req.OrgId != 0" ], "operations": [ { "operation": "SELECT", "trigger": "List stored bearer tokens for the org-level auth method configuration", "conditions": [ "Always after org validation succeeds" ], "implementation": "svc.ListBearerTokens(ctx, req)" } ] } }, "services": [] }, "UserService.QueryUserServicesAgreement": { "infrastructure": { "mysql": { "conditions": [ "req.OrgId != 0", "usersvc.GetUserFromContext(ctx) succeeded" ], "operations": [ { "operation": "SELECT", "trigger": "Check whether the current user has already agreed to MSP service agreements for the org", "conditions": [ "Always after request validation and current-user lookup succeed" ], "implementation": "svc.UserIsAgreeServicesAgreements(ctx, user.ID.Uint64(), req.OrgId)" } ] } }, "services": [] }, "UserService.SaveUserServicesAgreement": { "infrastructure": { "authz": { "conditions": [ "usersvc.GetUserFromContext(ctx) succeeded", "req.OrgId != 0" ], "operations": [ { "operation": "CheckIdentityPermission", "trigger": "Verify the caller can create MSP service-agreement consent for the org", "conditions": [ "Always after current-user lookup and org validation succeed" ], "implementation": "auth.CheckIdentityPermission(ctx, &auth.CheckPermissionParam{IdentityTye: auth.AccessIdentityTypeUserID, IdentityVal: fmt.Sprintf(\"%d\", user.ID), ResourceUri: \"account/orgs/{org_id}/create_msp_service_agreement\", ResourceParam: map[string]string{\"org_id\": fmt.Sprintf(\"%d\", req.OrgId)}})" } ] }, "mysql": { "conditions": [ "permission.HasPermission == true" ], "operations": [ { "operation": "UPDATE", "trigger": "Mark the MSP service agreement as accepted for the user and customer org", "conditions": [ "Only when CheckIdentityPermission grants access" ], "implementation": "mspSvc.UpdateMspUserServicesAgreementByParam(ctx, msp.UserServicesAgreementFilter{UserID: user.ID, CustomerOrgID: entity.ID(req.OrgId), Status: &status}, entity.MspUserServicesAgreement{IsAgree: true})" } ] } }, "services": [] }, "UserService.QuerySqlUser": { "infrastructure": { "mysql": { "conditions": [ "req != nil" ], "operations": [ { "operation": "SELECT", "trigger": "Resolve the CM operator identity used to query SQL users in the target cluster", "conditions": [ "usersvc.GetUserFromContext(ctx) succeeded" ], "implementation": "dbuserSvc.GetCMOperator(ctx, getCMOperatorReq)" } ] } }, "services": [ { "name": "core-svc", "target_interface": "ListDBUsers", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc_unary", "conditions": [ "getCmOperator(ctx, req.OrgId, req.ClusterId) succeeded", "req.Filter.QueryType is user, role, or all" ], "operations": [ { "operation": "ListSqlUser", "trigger": "Query DB users/roles from the target cluster and post-process them into the cloud SQL-user shape", "conditions": [ "Always after CM operator derivation succeeds" ], "implementation": "svc.QueryFormCM(ctx, req, *operator) -> infra.GetHandler().ListSqlUser(ctx, listDBUsersReq)" } ] } ] }, "UserService.GetUserOrgsProjects": { "infrastructure": { "mysql": { "conditions": [ "usersvc.GetUserFromContext(ctx) succeeded" ], "operations": [ { "operation": "SELECT", "trigger": "Load the org and project surface visible to the current user", "conditions": [ "Always after current-user lookup succeeds" ], "implementation": "projectSvc.GetUserOrgsProjects(ctx, user.ID.Uint64())" } ] } }, "services": [] }, "UserService.GetUserLoginExtInfo": { "infrastructure": { "mysql": { "conditions": [ "usersvc.GetUserFromContext(ctx) succeeded" ], "operations": [ { "operation": "SELECT", "trigger": "Load the registration log that carries signup_source", "conditions": [ "Always after current-user lookup succeeds" ], "implementation": "userSvc.GetUserRegistrationLog(ctx, userDao.RegistrationLogParam{UserId: user.ID.Uint64()})" }, { "operation": "SELECT", "trigger": "Check whether the user has the new-user landing action marker", "conditions": [ "Always after current-user lookup succeeds" ], "implementation": "userSvc.ListUserLandingActions(ctx, userDao.LandingActionFilter{UserIDs: []entity.ID{user.ID}, TargetActions: []entity.UserTargetAction{entity.NewUserAction}})" }, { "operation": "SELECT", "trigger": "Determine whether this is the first login based on login history", "conditions": [ "Always after current-user lookup succeeds" ], "implementation": "historySvc.ListEventHistoryLast(ctx, history.EventHistoryFilter{IdentityTypes: []entity.HistoryIdentityType{entity.IdentityTypeUser}, IdentityIDs: []entity.ID{user.ID}, Events: []entity.HistoryEvent{entity.HistoryEventLogin}})" }, { "operation": "SELECT", "trigger": "Check whether the onboarding survey should still be shown", "conditions": [ "Always after current-user lookup succeeds" ], "implementation": "surveySvc.IsShowPlgOnBoardingSurveyPage(ctx, user.Email)" } ] } }, "services": [] }, "UserService.CreatePlgOnBoardingSurvey": { "infrastructure": { "mysql": { "conditions": [ "usersvc.GetUserFromContext(ctx) succeeded" ], "operations": [ { "operation": "INSERT", "trigger": "Persist the onboarding survey answers for the current user", "conditions": [ "Always after current-user lookup succeeds" ], "implementation": "svc.CreatePlgOnBoardingSurvey(ctx, user.Email, req)" } ] } }, "services": [] }, "UserService.AssignConsoleUserRole": { "infrastructure": { "mysql": { "conditions": [ "req.OrgId != 0", "len(req.Emails) > 0", "request role validation succeeded", "usersvc.GetUserFromContext(ctx) succeeded" ], "operations": [ { "operation": "INSERT", "trigger": "Create console-user role bindings for the normalized email list", "conditions": [ "Always after email normalization, role validation, and operator lookup succeed" ], "implementation": "consoleuser.GetConsoleUserSvc().AssignConsoleUserRole(ctx, req, operator)" } ] } }, "services": [] }, "UserService.EditConsoleUserRole": { "infrastructure": { "mysql": { "conditions": [ "req.UserId != 0", "req.OrgId != 0", "request role validation succeeded", "usersvc.GetUserFromContext(ctx) succeeded" ], "operations": [ { "operation": "UPDATE", "trigger": "Mutate org/project/cluster role bindings for the target console user", "conditions": [ "Always after role validation and operator lookup succeed" ], "implementation": "consoleuser.GetConsoleUserSvc().EditConsoleUserRole(ctx, req, operator)" } ] } }, "services": [] }, "UserService.CheckEmailAlreadyHasOrgRole": { "infrastructure": { "mysql": { "conditions": [ "len(req.Emails) > 0", "req.OrgId != 0" ], "operations": [ { "operation": "SELECT", "trigger": "Check whether any candidate email already has an org-level console role", "conditions": [ "Always after parameter validation succeeds" ], "implementation": "consoleuser.GetConsoleUserSvc().CheckEmailAlreadyHasOrgRole(ctx, req)" } ] } }, "services": [] }, "UserService.RevokeUserLoginState": { "infrastructure": {}, "services": [ { "name": "user-session", "target_repo": "tidbcloud/account", "target_interface": "UserSessionService.RevokeLoginSessionByEmail", "operation_type": "grpc_unary", "conditions": [ "usersvc.GetUserFromContext(ctx) succeeded" ], "operations": [ { "operation": "RevokeLoginSessionByEmail", "trigger": "Invalidate every active login session owned by the current user", "conditions": [ "Always after current-user lookup succeeds" ], "implementation": "session.GetUserSessionSvc().RevokeLoginSessionByEmail(ctx, user.Email)" } ] } ] }, "HTTPHandlers.Healthz": { "infrastructure": {}, "services": [] }, "HTTPHandlers.Version": { "infrastructure": { "migration-state": { "conditions": [ "Always" ], "operations": [ { "operation": "Read", "trigger": "Expose the current central DB version in the HTTP response", "conditions": [ "Always" ], "implementation": "migrate.GetCentralDBVersion()" } ] } }, "services": [] }, "HTTPHandlers.InvitationVerification": { "infrastructure": { "mysql": { "conditions": [ "Token validation succeeded" ], "operations": [ { "operation": "SELECT", "trigger": "Load the invited org to build redirect parameters and MSP metadata", "conditions": [ "Always after session.ValidateUserInviteToken succeeds" ], "implementation": "orgSvc.GetOrgByID(ctx, tenantID.Uint64())" }, { "operation": "SELECT", "trigger": "Resolve the invited user by email", "conditions": [ "Always after session.ValidateUserInviteToken succeeds" ], "implementation": "userSvc.GetUserByEmail(ctx, email)" }, { "operation": "SELECT", "trigger": "Check active org role bindings for the invited user", "conditions": [ "Only after user lookup succeeds" ], "implementation": "roleBindingSvc.ListRoleBindings(ctx, filter)" }, { "operation": "SELECT", "trigger": "Resolve the MSP parent org name for MSP-customer invitation redirects", "conditions": [ "Only when inviteOrg.OrgTag == msp_customer and inviteOrg.ThirdPartyAccountCode != nil" ], "implementation": "orgSvc.GetOrgByID(ctx, mspId)" } ] }, "auditlog-sdk": { "conditions": [ "len(userOrgRoleBinding) > 0" ], "operations": [ { "operation": "Submit", "trigger": "Record invitation confirmation for existing active users", "conditions": [ "Only when the invited user already has an active org role binding" ], "implementation": "auditlog.NewEvent(ctx, eventType).SetOperatorIP(parseRemoteIP(r)).SetOperatorEmail(email).SetOperatorID(inviteOrg.ID.Uint64()).SetOperatorType(auditlog.OperatorTypeUser).SetResult(err == nil).SetDetails(details.Build()).SetOrgID(tenantID.Uint64()).Submit()" } ] } }, "services": [ { "name": "account-provider", "target_repo": "tidbcloud/account", "target_interface": "AccountAPIService.ListHitFeatureFlagNames", "operation_type": "grpc_unary", "conditions": [ "userInviteToken != nil", "userInviteToken.TenantID.Uint64() != 0" ], "operations": [ { "operation": "ListHitFeatureFlagNames", "trigger": "Check whether the invited org should redirect to the Alicloud signup domain", "conditions": [ "Only before building the final frontend redirect domain for a non-zero tenant ID" ], "implementation": "checkOrgEnableAliCloud(ctx, userInviteToken.TenantID.Uint64()) -> account.GetHandler().ListHitFeatureFlagNames(ctx, req)" } ] } ] }, "HTTPHandlers.RegistrationVerification": { "infrastructure": { "mysql": { "conditions": [ "req token query param exists" ], "operations": [ { "operation": "UPDATE", "trigger": "Finalize email-registration verification and activate the user/org state", "conditions": [ "Always after token extraction succeeds" ], "implementation": "tenantModel.User(ctx, user).RegistrationVerification(ctx, token, parseRemoteIP(r))" } ] } }, "services": [ { "name": "account-provider", "target_repo": "tidbcloud/account", "target_interface": "AccountAPIService.ListHitFeatureFlagNames", "operation_type": "grpc_unary", "conditions": [ "orgID != 0" ], "operations": [ { "operation": "ListHitFeatureFlagNames", "trigger": "Check whether the verified org should redirect to the Alicloud signup domain", "conditions": [ "Only when RegistrationVerification returns a non-zero orgID" ], "implementation": "checkOrgEnableAliCloud(ctx, orgID) -> account.GetHandler().ListHitFeatureFlagNames(ctx, req)" } ] } ] }, "HTTPHandlers.ActionCallback": { "infrastructure": {}, "services": [ { "name": "org-sso", "target_repo": "tidbcloud/account", "target_interface": "ActionCallbackService.HandleActionCallback", "operation_type": "grpc_unary", "conditions": [ "Query params session_token and state are parsed from the callback URL" ], "operations": [ { "operation": "HandleActionCallback", "trigger": "Exchange the callback payload for the token used in the Auth0 continue redirect", "conditions": [ "Always" ], "implementation": "orgsso.GetActionCallbackSvc().HandleActionCallback(r.Context(), state, token)" } ] } ] }, "HTTPHandlers.ActionVerify": { "infrastructure": {}, "services": [ { "name": "org-sso", "target_repo": "tidbcloud/account", "target_interface": "ActionCallbackService.HandleActionVerify", "operation_type": "grpc_unary", "conditions": [ "session_token query param exists" ], "operations": [ { "operation": "HandleActionVerify", "trigger": "Resolve the org/action metadata returned to the browser", "conditions": [ "Always" ], "implementation": "orgsso.GetActionCallbackSvc().HandleActionVerify(r.Context(), token)" } ] } ] }, "HTTPHandlers.RevokeLoginStateCallback": { "infrastructure": { "jwt": { "conditions": [ "Session token can be parsed from the callback body" ], "operations": [ { "operation": "ParseWithClaims", "trigger": "Validate the Auth0 action callback token using SSOConfig.ActionKey", "conditions": [ "Always after parseCallbackBody succeeds" ], "implementation": "parseRevokeClaims(ctx, body.SessionToken) -> jwt.ParseWithClaims(token, &RevokeLoginStateClaims{}, func(...) { return []byte(config.Global().SSOConfig.ActionKey), nil })" } ] } }, "services": [ { "name": "user-session", "target_repo": "tidbcloud/account", "target_interface": "UserSessionService.RevokeLoginSessionByEmail", "operation_type": "grpc_unary", "conditions": [ "JWT parse succeeded and claims.Email != \"\"" ], "operations": [ { "operation": "RevokeLoginSessionByEmail", "trigger": "Invalidate all login sessions for the email embedded in the action callback token", "conditions": [ "Always after parseRevokeClaims succeeds" ], "implementation": "usersvc.GetUserSessionSvc().RevokeLoginSessionByEmail(ctx, claims.Email)" } ] } ] }, "HTTPHandlers.LoginConfirm": { "infrastructure": { "cookie": { "conditions": [ "req.IDToken != \"\"", "session open succeeded" ], "operations": [ { "operation": "Set-Cookie", "trigger": "Persist the login session ID into the browser cookie", "conditions": [ "Always after OpenLoginSession succeeds" ], "implementation": "setCookie(w, sid, cookieMaxAge)" } ] } }, "services": [ { "name": "user-session", "target_repo": "tidbcloud/account", "target_interface": "UserSessionService.OpenLoginSession", "operation_type": "grpc_unary", "conditions": [ "HTTP body parsed successfully", "req.IDToken != \"\"" ], "operations": [ { "operation": "OpenLoginSession", "trigger": "Exchange the Auth0 ID token for a server-side login session", "conditions": [ "Always after request validation succeeds" ], "implementation": "session.GetUserSessionSvc().OpenLoginSession(ctx, req.IDToken)" } ] } ] }, "HTTPHandlers.Logout": { "infrastructure": { "cookie": { "conditions": [ "Cookie exists and sid != \"\"" ], "operations": [ { "operation": "Set-Cookie", "trigger": "Expire the login cookie after the server-side session is revoked", "conditions": [ "Always after RevokeLoginSessionBySessionID succeeds" ], "implementation": "setCookie(w, sid, -1)" } ] } }, "services": [ { "name": "user-session", "target_repo": "tidbcloud/account", "target_interface": "UserSessionService.RevokeLoginSessionBySessionID", "operation_type": "grpc_unary", "conditions": [ "Cookie exists", "sid != \"\"" ], "operations": [ { "operation": "RevokeLoginSessionBySessionID", "trigger": "Invalidate the current browser login session", "conditions": [ "Always after the session cookie is decoded" ], "implementation": "session.GetUserSessionSvc().RevokeLoginSessionBySessionID(ctx, sid)" } ] } ] }, "HTTPHandlers.ThirdPartyAccountRedirect": { "infrastructure": {}, "services": [ { "name": "account-provider", "target_repo": "tidbcloud/account", "target_interface": "AccountProviderFactory.GetAccountProvider", "operation_type": "grpc_unary", "conditions": [ "Gin URI binding for :third_party_account_provider succeeded" ], "operations": [ { "operation": "GetAccountProvider", "trigger": "Resolve the concrete cloud-account provider implementation", "conditions": [ "Always after URI binding succeeds" ], "implementation": "handler.GetAccountHandler().GetAccountProvider(thirdPartyProvider.Provider)" } ] }, { "name": "third-party-cloud-provider", "target_repo": "external", "target_interface": "GetTokenFromRedirect", "operation_type": "http_callback", "conditions": [ "Account provider resolved successfully" ], "operations": [ { "operation": "GetTokenFromRedirect", "trigger": "Exchange the marketplace callback payload for the provider token", "conditions": [ "Always after provider resolution succeeds" ], "implementation": "provider.GetTokenFromRedirect(context)" }, { "operation": "GetFreeTrialFromRedirect", "trigger": "Resolve the provider-specific free-trial flag included in the frontend redirect URL", "conditions": [ "Always after provider resolution succeeds" ], "implementation": "provider.GetFreeTrialFromRedirect(context)" } ] } ] }, "HTTPHandlers.BillingProxy": { "infrastructure": {}, "services": [ { "name": "account-provider", "target_repo": "tidbcloud/account", "target_interface": "UserService.GetUserFromContext", "operation_type": "grpc_unary", "conditions": [ "Proxy middleware already authenticated the caller and injected user context" ], "operations": [ { "operation": "GetUserFromContext", "trigger": "Resolve the caller tenant and user ID before validating proxy tenancy and headers", "conditions": [ "Always before validateProxyPath and reverse proxy setup" ], "implementation": "usersvc.GetUserFromContext(req.Context())" } ] }, { "name": "billing2", "target_repo": "external", "target_interface": "Reverse proxy path under Billing2BaseURL", "operation_type": "http_reverse_proxy", "conditions": [ "Billing2BaseURL parses successfully", "usersvc.GetUserFromContext(req.Context()) succeeded", "validateProxyPath(proxyPath, req.Method, user) == nil" ], "operations": [ { "operation": "ReverseProxy", "trigger": "Forward the allowlisted billing request with tenant-scoped headers", "conditions": [ "Always after target parsing and path validation succeed" ], "implementation": "(&httputil.ReverseProxy{Director: director}).ServeHTTP(w, req)" } ] } ] } } }