{
  "repo": "tidbcloud/account",
  "binary": "openapi",
  "binary_path": "central/cmd/openapi/main.go",
  "dependencies": {
    "ProjectService.CreateProject": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "INSERT",
              "trigger": "Create project for OpenAPI",
              "conditions": ["Always"],
              "implementation": "tenantctx.CreateProjectForOpenAPI(ctx, createProjectReq)"
            }
          ]
        },
        "nats_jsm": {
          "conditions": ["jsmClient.IsEnable()"],
          "operations": [
            {
              "operation": "Publish",
              "trigger": "Notify JSM about project creation",
              "conditions": ["JSM enabled"],
              "implementation": "jsmClient.NotifyCreateProjectMessage(ctx, projectID, orgId)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "rbac",
          "target_interface": "CheckApiKeyPermission",
          "target_repo": "tidbcloud/tiinf",
          "operation_type": "internal_call",
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "CheckApiKeyPermission",
              "trigger": "Verify API key has permission to create project",
              "conditions": ["Always"],
              "implementation": "useadapter.CheckApiKeyPermission(ctx, accessKey, resource, resourceParam)"
            }
          ]
        }
      ]
    },
    "ProjectService.ListProjects": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List projects by org",
              "conditions": ["Always"],
              "implementation": "tenantctx.ListProjectsByOrg(ctx, entity.ID(orgId), false)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "rbac",
          "target_interface": "CheckApiKeyPermission",
          "target_repo": "tidbcloud/tiinf",
          "operation_type": "internal_call",
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "CheckApiKeyPermission",
              "trigger": "Verify API key has permission to list projects",
              "conditions": ["Always"],
              "implementation": "useadapter.CheckApiKeyPermission(ctx, accessKey, resource, resourceParam)"
            }
          ]
        }
      ]
    },
    "ProjectAPI.ListProjectHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List user visible projects",
              "conditions": ["Auth type = access_token"],
              "implementation": "projectSvc.ListUserVisibleProjects(ctx, userId, []uint64{orgId})"
            },
            {
              "operation": "SELECT",
              "trigger": "List active projects by org",
              "conditions": ["Auth type = api_key"],
              "implementation": "projectSvc.ListActiveProjectsByOrgID(ctx, orgId)"
            },
            {
              "operation": "SELECT",
              "trigger": "List role bindings for user count",
              "conditions": ["Always"],
              "implementation": "roleBindingSvc.ListRoleBindings(ctx, filter)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "core-svc",
          "target_interface": "CountClustersByProject",
          "target_repo": "tidbcloud/core-svc",
          "operation_type": "grpc_unary",
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "CountClustersByProject",
              "trigger": "Get cluster count for each project",
              "conditions": ["Always"],
              "implementation": "infra.GetHandler().CountClustersByProject(ctx, []uint64{project.ID.Uint64()})"
            }
          ]
        }
      ]
    },
    "ProjectAPI.CreateProjectHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "INSERT",
              "trigger": "Create project",
              "conditions": ["Always"],
              "implementation": "projectSvc.CreateProject(ctx, createProjectReq)"
            }
          ]
        },
        "nats_jsm": {
          "conditions": ["jsmClient.IsEnable()"],
          "operations": [
            {
              "operation": "Publish",
              "trigger": "Notify JSM about project creation",
              "conditions": ["JSM enabled"],
              "implementation": "jsmClient.NotifyCreateProjectMessage(ctx, project.ID.Uint64(), orgId)"
            }
          ]
        }
      },
      "services": []
    },
    "UserAPI.UserInfoHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Auth type = access_token"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get user by email",
              "conditions": ["Always"],
              "implementation": "userSvc.GetUserByEmail(ctx, email)"
            }
          ]
        }
      },
      "services": []
    },
    "ApiKeyAPI.CreateApiKeyHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get org by ID",
              "conditions": ["Always"],
              "implementation": "orgSvc.GetOrgByID(ctx, orgId)"
            },
            {
              "operation": "INSERT",
              "trigger": "Create API key",
              "conditions": ["Always"],
              "implementation": "keySvc.CreateApiKey(ctx, &param)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "rbac",
          "target_interface": "CheckApiKeyPermission",
          "target_repo": "tidbcloud/tiinf",
          "operation_type": "internal_call",
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "CheckApiKeyPermission",
              "trigger": "Verify API key has permission",
              "conditions": ["Always"],
              "implementation": "checkAccessKeyPermission(ctx, accessKey, resourceUri, orgId, projectId)"
            }
          ]
        }
      ]
    },
    "ApiKeyAPI.GetApiKeyHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get API key by access key",
              "conditions": ["Always"],
              "implementation": "svc.GetApiKeyByAccessKey(ctx, req.AccessKey)"
            }
          ]
        }
      },
      "services": []
    },
    "ApiKeyAPI.ListApiKeysHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List API keys by resource ID",
              "conditions": ["Always"],
              "implementation": "svc.ListApiKeysByResourceID(ctx, &param)"
            }
          ]
        }
      },
      "services": []
    },
    "ApiKeyAPI.PatchApiKeyHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["req.DisplayName != ''"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get API key by access key",
              "conditions": ["Always"],
              "implementation": "svc.GetApiKeyByAccessKey(ctx, keyReq.AccessKey)"
            },
            {
              "operation": "UPDATE",
              "trigger": "Update API key description",
              "conditions": ["DisplayName changed"],
              "implementation": "svc.UpdateApiKey(ctx, &param)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "rbac",
          "target_interface": "UpdateRoleOrStatus",
          "target_repo": "tidbcloud/account",
          "operation_type": "internal_call",
          "conditions": ["req.Role != ''"],
          "operations": [
            {
              "operation": "UpdateRoleOrStatus",
              "trigger": "Update API key role binding",
              "conditions": ["Role provided"],
              "implementation": "bindingSvc.UpdateRoleOrStatus(ctx, binding)"
            }
          ]
        }
      ]
    },
    "ApiKeyAPI.DeleteApiKeyHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get API key by access key",
              "conditions": ["Always"],
              "implementation": "svc.GetApiKeyByAccessKey(ctx, req.AccessKey)"
            },
            {
              "operation": "DELETE",
              "trigger": "Delete API key",
              "conditions": ["Always"],
              "implementation": "svc.DeleteApiKey(ctx, &param)"
            }
          ]
        }
      },
      "services": []
    },
    "SqlUserAPI.ListSqlUserHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get CM operator",
              "conditions": ["Always"],
              "implementation": "dbUserSvc.GetCMOperator(ctx, getCMOperatorReq)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "core-svc",
          "target_interface": "ListDBUsers",
          "target_repo": "tidbcloud/core-svc",
          "operation_type": "grpc_unary",
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "ListSqlUser",
              "trigger": "List SQL users from cluster",
              "conditions": ["Always"],
              "implementation": "infra.GetHandler().ListSqlUser(ctx, listDBUsersReq)"
            }
          ]
        }
      ]
    },
    "SqlUserAPI.CreateSqlUserHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get CM operator",
              "conditions": ["Always"],
              "implementation": "dbUserSvc.GetCMOperator(ctx, getCMOperatorReq)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "core-svc",
          "target_interface": "CreateDBUser",
          "target_repo": "tidbcloud/core-svc",
          "operation_type": "grpc_unary",
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "CreateGeneralDBUser",
              "trigger": "Create SQL user in cluster",
              "conditions": ["Always"],
              "implementation": "infra.GetHandler().CreateGeneralDBUser(ctx, createSqlUserReq, checkCloudBuiltinRole)"
            },
            {
              "operation": "QueryFormCM",
              "trigger": "Query created SQL user",
              "conditions": ["After creation"],
              "implementation": "svc.QueryFormCM(ctx, param, *operator)"
            }
          ]
        }
      ]
    },
    "SqlUserAPI.UpdateSqlUserHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get CM operator",
              "conditions": ["Always"],
              "implementation": "dbUserSvc.GetCMOperator(ctx, getCMOperatorReq)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "core-svc",
          "target_interface": "UpdateDBUser",
          "target_repo": "tidbcloud/core-svc",
          "operation_type": "grpc_unary",
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "UpdateSqlUser",
              "trigger": "Update SQL user in cluster",
              "conditions": ["Always"],
              "implementation": "svc.UpdateSqlUserToCM(ctx, param, updateCustomRoleFlag, *operator)"
            }
          ]
        }
      ]
    },
    "SqlUserAPI.DeleteSqlUserHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get CM operator",
              "conditions": ["Always"],
              "implementation": "dbUserSvc.GetCMOperator(ctx, getCMOperatorReq)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "core-svc",
          "target_interface": "DeleteDBUser",
          "target_repo": "tidbcloud/core-svc",
          "operation_type": "grpc_unary",
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "DeleteSqlUser",
              "trigger": "Delete SQL user from cluster",
              "conditions": ["Always"],
              "implementation": "infra.GetHandler().DeleteSqlUser(ctx, operator.DBUserOperator, deleteUsername, clusterId)"
            }
          ]
        }
      ]
    },
    "DbUserAPI.GetDbuserHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List org keys for JWT signing",
              "conditions": ["Always"],
              "implementation": "s.ListOrgKeys(ctx, filter)"
            }
          ]
        },
        "kms": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "GetJwtToken",
              "trigger": "Generate JWT token for DB user",
              "conditions": ["Always"],
              "implementation": "utils.GetJwtToken(ctx, keyService, orgKey.KeyID, email, sub, expiredTime, iss)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "core-svc",
          "target_interface": "GetClusterById",
          "target_repo": "tidbcloud/core-svc",
          "operation_type": "grpc_unary",
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "GetClusterById",
              "trigger": "Get cluster info for JWT generation",
              "conditions": ["Always"],
              "implementation": "infra.GetHandler().GetClusterById(ctx, clusterId, true)"
            }
          ]
        }
      ]
    },
    "MspCustomerAPI.GetMspCustomerHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get MSP customer by customer ID",
              "conditions": ["Always"],
              "implementation": "svc.GetCustomerByCustomerID(ctx, entity.ID(req.CustomerOrgId))"
            },
            {
              "operation": "SELECT",
              "trigger": "Get org by ID",
              "conditions": ["Always"],
              "implementation": "orgSvc.GetOrgByID(ctx, customer.CustomerOrgID.Uint64())"
            }
          ]
        }
      },
      "services": []
    },
    "MspCustomerAPI.ListMspCustomersHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get customers by MSP ID",
              "conditions": ["Always"],
              "implementation": "svc.GetCustomerByMspID(ctx, entity.ID(orgId))"
            }
          ]
        }
      },
      "services": []
    },
    "MspCustomerAPI.CreateMspCustomerSignupUrlHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get MSP org by ID",
              "conditions": ["Always"],
              "implementation": "orgSvc.GetOrgByID(ctx, orgId)"
            },
            {
              "operation": "INSERT",
              "trigger": "Create invite token",
              "conditions": ["Always"],
              "implementation": "userSvc.CreateInviteToken(ctx, mspOrg.ID.Uint64(), mspOrg.Email, method)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.SearchUsersHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Search SCIM users",
              "conditions": ["Always"],
              "implementation": "svc.SearchResources(ctx, orgId, req)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.CreateUserHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "INSERT",
              "trigger": "Create SCIM user",
              "conditions": ["Always"],
              "implementation": "svc.CreateResource(ctx, orgID, cr)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.ReplaceUserHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "UPDATE",
              "trigger": "Replace SCIM user",
              "conditions": ["Always"],
              "implementation": "svc.ReplaceResource(ctx, orgID, req)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.PatchUserHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "UPDATE",
              "trigger": "Patch SCIM user",
              "conditions": ["Always"],
              "implementation": "svc.PatchResource(ctx, orgID, req)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.DeleteUserHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "DELETE",
              "trigger": "Delete SCIM user",
              "conditions": ["Always"],
              "implementation": "svc.DeleteResource(ctx, orgID, req)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.SearchGroupsHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Search SCIM groups",
              "conditions": ["Always"],
              "implementation": "svc.SearchResources(ctx, orgId, req)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.CreateGroupHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "INSERT",
              "trigger": "Create SCIM group",
              "conditions": ["Always"],
              "implementation": "svc.CreateResource(ctx, orgID, cr)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.ReplaceGroupHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "UPDATE",
              "trigger": "Replace SCIM group",
              "conditions": ["Always"],
              "implementation": "svc.ReplaceResource(ctx, orgID, req)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.PatchGroupHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "UPDATE",
              "trigger": "Patch SCIM group",
              "conditions": ["Always"],
              "implementation": "svc.PatchResource(ctx, orgID, req)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.DeleteGroupHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Always"],
          "operations": [
            {
              "operation": "DELETE",
              "trigger": "Delete SCIM group",
              "conditions": ["Always"],
              "implementation": "svc.DeleteResource(ctx, orgID, req)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiApiKeyService.CreateApiKey": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata", "req.ApiKey is not nil", "display_name and role validation passed"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the authenticated org to decide org tag and operator behavior",
              "conditions": ["Always after auth and validation"],
              "implementation": "orgSvc.GetOrgByID(ctx, authOrgId)"
            },
            {
              "operation": "INSERT",
              "trigger": "Persist the new org-scoped API key",
              "conditions": ["Always after org lookup succeeds"],
              "implementation": "keySvc.CreateApiKey(ctx, &param)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiApiKeyService.GetApiKey": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the API key by access key before org ownership validation",
              "conditions": ["Always after auth"],
              "implementation": "svc.GetApiKeyByAccessKey(ctx, accessKey)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiApiKeyService.ListApiKeys": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List org-scoped API keys for the authenticated org",
              "conditions": ["Always after auth"],
              "implementation": "svc.ListApiKeysByResourceID(ctx, &param)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiApiKeyService.ListApiKeyRoles": {
      "infrastructure": {},
      "services": []
    },
    "OpenApiApiKeyService.DeleteApiKey": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata", "request access key is not the caller's own API key"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Resolve the target API key and validate it belongs to the authenticated org",
              "conditions": ["Always after auth"],
              "implementation": "svc.GetApiKeyByAccessKey(ctx, accessKey)"
            },
            {
              "operation": "DELETE",
              "trigger": "Delete the target API key after ownership checks pass",
              "conditions": ["Target API key exists and belongs to authOrgId"],
              "implementation": "svc.DeleteApiKey(ctx, &param)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiOrgService.GetOrg": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the authenticated org and ensure it is active",
              "conditions": ["Always after auth"],
              "implementation": "orgSvc.GetOrgByID(ctx, authOrgId)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiOrgService.ListPartnerOrgs": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated identity extracted from gRPC metadata"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Resolve accessible org IDs from API key or user-token role bindings when needed",
              "conditions": ["Identity type is API key or user token"],
              "implementation": "listIdentityCanAccessOrgIds(ctx, identInfo) -> svc.GetUserOrgIds(ctx, userId)"
            },
            {
              "operation": "SELECT",
              "trigger": "List active MSP, CPPO, reseller, and Alicloud orgs within the caller's accessible org set",
              "conditions": ["At least one accessible org ID exists"],
              "implementation": "orgSvc.ListOrgsByFilter(ctx, orgdao.ListOrgsFilter{...})"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiUserService.GetCurrentUser": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Identity type is user token or access token"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the current user by resolved user ID",
              "conditions": ["Always after supported auth type resolution"],
              "implementation": "svc.GetUserByID(ctx, userId)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiUserService.UpdateCurrentUser": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata", "Identity type is user token or access token", "Caller belongs to authOrgId"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Verify the caller still belongs to the authenticated org through role bindings",
              "conditions": ["Always after auth"],
              "implementation": "checkAccessUserBelongToAuthOrg(ctx, userId, authOrgId) -> svc.ListRoleBindings(ctx, role.RoleBindingFilter{...})"
            },
            {
              "operation": "SELECT",
              "trigger": "Load the mutable user row",
              "conditions": ["Belong check passed"],
              "implementation": "svc.GetUserByID(ctx, userId)"
            },
            {
              "operation": "UPDATE",
              "trigger": "Persist the updated first and last name",
              "conditions": ["Belong check passed and user exists"],
              "implementation": "svc.UpdateUserByID(ctx, user)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiUserService.DeleteOrgUser": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata", "Target user belongs to authOrgId"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Verify the target user belongs to the authenticated org",
              "conditions": ["Always after auth"],
              "implementation": "checkAccessUserBelongToAuthOrg(ctx, userId, authOrgId) -> svc.ListRoleBindings(ctx, role.RoleBindingFilter{...})"
            },
            {
              "operation": "UPDATE/DELETE",
              "trigger": "Remove the user's org membership",
              "conditions": ["Belong check passed"],
              "implementation": "svc.RemoveUserFromOrg(ctx, userId, operatorId, authOrgId)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiUserService.DeleteProjectUser": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata", "Target user belongs to authOrgId"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Verify the target user belongs to the authenticated org before touching the project binding",
              "conditions": ["Always after auth"],
              "implementation": "checkAccessUserBelongToAuthOrg(ctx, userId, authOrgId) -> svc.ListRoleBindings(ctx, role.RoleBindingFilter{...})"
            },
            {
              "operation": "UPDATE/DELETE",
              "trigger": "Remove the user's project membership",
              "conditions": ["Belong check passed"],
              "implementation": "svc.RemoveUserFromProject(ctx, userId, operatorId, projectId)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiUserService.ListUsers": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List role-binding users for the org or project scope",
              "conditions": ["Always after auth; req.ProjectId switches scope from org to project"],
              "implementation": "userSvc.ListRoleBindingUsers(ctx, f)"
            },
            {
              "operation": "SELECT",
              "trigger": "Load last-login audit history for the returned page of users",
              "conditions": ["At least one paged user is returned"],
              "implementation": "loginHistorySvc.ListEventHistoryLast(ctx, historyFilter)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiInvitationService.CreateOrgInvitation": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata", "Invitee email validation passed", "Role is valid for the org type"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the authenticated org to validate partner-domain and role rules",
              "conditions": ["Always after auth"],
              "implementation": "orgSvc.GetOrgByID(ctx, authOrgId)"
            },
            {
              "operation": "SELECT/INSERT/UPDATE",
              "trigger": "Create or update invite state for each invitee email",
              "conditions": ["Always after org validation"],
              "implementation": "svc.InviteUser(ctx, param) -> dao.GetDaoHub().Org.GetOrgByOrgID / dao.GetDaoHub().User / dao.GetDaoHub().RoleBinding / saveInviteUser"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.SendEmail",
          "operation_type": "grpc_unary",
          "conditions": ["WithoutEmail is false inside invite flow", "Per invitee after invite token generation succeeds"],
          "operations": [
            {
              "operation": "SendEmail",
              "trigger": "Send invitation emails for successfully created org invites",
              "conditions": ["Per invitee email when InviteOneUser reaches sendInviteEmail or sendPartnerInviteEmail"],
              "implementation": "invite.sendInviteEmail / invite.sendPartnerInviteEmail -> account.GetHandler().SendEmail(ctx, &accountpb.SendEmailReq{...})"
            }
          ]
        }
      ]
    },
    "OpenApiInvitationService.CreateProjectInvitation": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata", "Invitee email validation passed", "Project role is valid"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the authenticated org to validate invitee emails and project scope",
              "conditions": ["Always after auth"],
              "implementation": "orgSvc.GetOrgByID(ctx, authOrgId)"
            },
            {
              "operation": "SELECT/INSERT/UPDATE",
              "trigger": "Create or update invite state for each project invitee",
              "conditions": ["Always after org validation"],
              "implementation": "svc.InviteUser(ctx, param) -> dao.GetDaoHub().Project.GetProjectByID / dao.GetDaoHub().User / dao.GetDaoHub().RoleBinding / saveInviteUser"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.SendEmail",
          "operation_type": "grpc_unary",
          "conditions": ["WithoutEmail is false inside invite flow", "Per invitee after invite token generation succeeds"],
          "operations": [
            {
              "operation": "SendEmail",
              "trigger": "Send invitation emails for successfully created project invites",
              "conditions": ["Per invitee email when InviteOneUser reaches sendInviteEmail or sendPartnerInviteEmail"],
              "implementation": "invite.sendInviteEmail / invite.sendPartnerInviteEmail -> account.GetHandler().SendEmail(ctx, &accountpb.SendEmailReq{...})"
            }
          ]
        }
      ]
    },
    "OpenApiPartnerService.CreateSignupUrl": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata", "Authenticated org tag is MSP or resale partner"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the authenticated partner org and validate its tag",
              "conditions": ["Always after auth"],
              "implementation": "orgSvc.GetOrgByID(ctx, authOrgId)"
            },
            {
              "operation": "INSERT",
              "trigger": "Persist a one-time invite token used in the signup URL",
              "conditions": ["Partner org tag is MSP or resale partner"],
              "implementation": "userSvc.CreateInviteToken(ctx, mspOrg.ID.Uint64(), mspOrg.Email, method) -> s.NewUserInviteToken(ctx, inviterToken, period)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiPartnerService.ListCustomers": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List all partner customers and their org rows for the authenticated partner org",
              "conditions": ["Always after auth"],
              "implementation": "svc.GetCustomerByMspID(ctx, entity.ID(authOrgId))"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiPartnerService.GetPartnerProfile": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load MSP branding config for the authenticated org",
              "conditions": ["Always after auth"],
              "implementation": "mspSvc.GetMspConfigByOrgID(ctx, entity.ID(authOrgId))"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiPartnerService.UpdatePartnerProfile": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Authenticated org identity extracted from gRPC metadata", "Advertising payload validation passed"],
          "operations": [
            {
              "operation": "UPSERT",
              "trigger": "Persist updated MSP branding config and advertising JSON",
              "conditions": ["Always after advertising validation"],
              "implementation": "mspSvc.UpdateMspConfig(ctx, mspConfig)"
            }
          ]
        }
      },
      "services": []
    },
    "OpenApiFileUploadService.UploadLogo": {
      "infrastructure": {},
      "services": [
        {
          "name": "cdn",
          "target_repo": "external",
          "target_interface": "UploadLogoImageWithReadSeeker",
          "operation_type": "object_storage_put",
          "conditions": ["req.FileName is non-empty", "req.Content is non-empty", "content-type header exists"],
          "operations": [
            {
              "operation": "PUT object",
              "trigger": "Upload the partner logo bytes into the configured CDN bucket",
              "conditions": ["Always after request validation"],
              "implementation": "UploadFile2CDN -> cdn.UploadLogoImagWithReadSeeker(ctx, contentType, path, size, sectionReader, bucket)"
            }
          ]
        }
      ]
    },
    "Runtime OpenApiGatewayTransport.ApiKeysCollection": {
      "infrastructure": {},
      "services": [
        {
          "name": "account-openapi",
          "target_repo": "tidbcloud/account",
          "target_interface": "OpenApiApiKeyService.CreateApiKey | OpenApiApiKeyService.ListApiKeys",
          "operation_type": "grpc_gateway_proxy",
          "conditions": ["Path matches /v1beta1/apiKeys", "grpc-gateway auth and permission interceptors succeeded"],
          "operations": [
            {
              "operation": "Proxy to local gRPC server",
              "trigger": "Dispatch collection API-key requests into the secondary gRPC runtime",
              "conditions": ["Always for matching path"],
              "implementation": "eng.Any(\"/v1beta1/apiKeys\", gin.WrapH(...grpcGwMux)) -> RegisterApiKeyServiceHandler(ctx, grpcGwMux, conn)"
            }
          ]
        }
      ]
    },
    "Runtime OpenApiGatewayTransport.ApiKeysItem": {
      "infrastructure": {},
      "services": [
        {
          "name": "account-openapi",
          "target_repo": "tidbcloud/account",
          "target_interface": "OpenApiApiKeyService.GetApiKey | OpenApiApiKeyService.DeleteApiKey | OpenApiApiKeyService.ListApiKeyRoles",
          "operation_type": "grpc_gateway_proxy",
          "conditions": ["Path matches /v1beta1/apiKeys/*", "grpc-gateway auth and permission interceptors succeeded"],
          "operations": [
            {
              "operation": "Proxy to local gRPC server",
              "trigger": "Dispatch item and roles API-key requests into the secondary gRPC runtime",
              "conditions": ["Always for matching path"],
              "implementation": "eng.Any(\"/v1beta1/apiKeys/*any\", gin.WrapH(...grpcGwMux)) -> RegisterApiKeyServiceHandler(ctx, grpcGwMux, conn)"
            }
          ]
        }
      ]
    },
    "Runtime OpenApiGatewayTransport.Org": {
      "infrastructure": {},
      "services": [
        {
          "name": "account-openapi",
          "target_repo": "tidbcloud/account",
          "target_interface": "OpenApiOrgService.GetOrg",
          "operation_type": "grpc_gateway_proxy",
          "conditions": ["Path matches /v1beta1/org", "grpc-gateway auth and permission interceptors succeeded"],
          "operations": [
            {
              "operation": "Proxy to local gRPC server",
              "trigger": "Dispatch org requests into the secondary gRPC runtime",
              "conditions": ["Always for matching path"],
              "implementation": "eng.Any(\"/v1beta1/org\", gin.WrapH(...grpcGwMux)) -> RegisterOrgServiceHandler(ctx, grpcGwMux, conn)"
            }
          ]
        }
      ]
    },
    "Runtime OpenApiGatewayTransport.UsersCollection": {
      "infrastructure": {},
      "services": [
        {
          "name": "account-openapi",
          "target_repo": "tidbcloud/account",
          "target_interface": "OpenApiUserService.ListUsers",
          "operation_type": "grpc_gateway_proxy",
          "conditions": ["Path matches /v1beta1/users", "grpc-gateway auth and permission interceptors succeeded"],
          "operations": [
            {
              "operation": "Proxy to local gRPC server",
              "trigger": "Dispatch list-user requests into the secondary gRPC runtime",
              "conditions": ["Always for matching path"],
              "implementation": "eng.Any(\"/v1beta1/users\", gin.WrapH(...grpcGwMux)) -> RegisterUserServiceHandler(ctx, grpcGwMux, conn)"
            }
          ]
        }
      ]
    },
    "Runtime OpenApiGatewayTransport.UsersItem": {
      "infrastructure": {},
      "services": [
        {
          "name": "account-openapi",
          "target_repo": "tidbcloud/account",
          "target_interface": "OpenApiUserService.GetCurrentUser | OpenApiUserService.UpdateCurrentUser | OpenApiUserService.DeleteOrgUser",
          "operation_type": "grpc_gateway_proxy",
          "conditions": ["Path matches /v1beta1/users/*", "grpc-gateway auth and permission interceptors succeeded"],
          "operations": [
            {
              "operation": "Proxy to local gRPC server",
              "trigger": "Dispatch current-user and org-user deletion requests into the secondary gRPC runtime",
              "conditions": ["Always for matching path"],
              "implementation": "eng.Any(\"/v1beta1/users/*any\", gin.WrapH(...grpcGwMux)) -> RegisterUserServiceHandler(ctx, grpcGwMux, conn)"
            }
          ]
        }
      ]
    },
    "Runtime OpenApiGatewayTransport.UsersInvite": {
      "infrastructure": {},
      "services": [
        {
          "name": "account-openapi",
          "target_repo": "tidbcloud/account",
          "target_interface": "OpenApiInvitationService.CreateOrgInvitation",
          "operation_type": "grpc_gateway_proxy",
          "conditions": ["Path matches /v1beta1/users:invite", "grpc-gateway auth and permission interceptors succeeded"],
          "operations": [
            {
              "operation": "Proxy to local gRPC server",
              "trigger": "Dispatch org-invitation requests into the secondary gRPC runtime",
              "conditions": ["Always for matching path"],
              "implementation": "eng.Any(\"/v1beta1/users:invite\", gin.WrapH(...grpcGwMux)) -> RegisterInvitationServiceHandler(ctx, grpcGwMux, conn)"
            }
          ]
        }
      ]
    },
    "Runtime OpenApiGatewayTransport.ProjectUsersAndInvites": {
      "infrastructure": {},
      "services": [
        {
          "name": "account-openapi",
          "target_repo": "tidbcloud/account",
          "target_interface": "OpenApiUserService.DeleteProjectUser | OpenApiInvitationService.CreateProjectInvitation",
          "operation_type": "grpc_gateway_proxy",
          "conditions": ["Path matches /v1beta1/projects/:project_id/*", "grpc-gateway auth and permission interceptors succeeded"],
          "operations": [
            {
              "operation": "Proxy to local gRPC server",
              "trigger": "Dispatch project-scoped invitation and user-removal requests into the secondary gRPC runtime",
              "conditions": ["Always for matching path"],
              "implementation": "eng.Any(\"/v1beta1/projects/:project_id/*any\", gin.WrapH(...grpcGwMux)) -> RegisterUserServiceHandler(ctx, grpcGwMux, conn); RegisterInvitationServiceHandler(ctx, grpcGwMux, conn)"
            }
          ]
        }
      ]
    },
    "Runtime OpenApiGatewayTransport.Partners": {
      "infrastructure": {},
      "services": [
        {
          "name": "account-openapi",
          "target_repo": "tidbcloud/account",
          "target_interface": "OpenApiOrgService.ListPartnerOrgs | OpenApiPartnerService.* | OpenApiFileUploadService.UploadLogo",
          "operation_type": "grpc_gateway_proxy",
          "conditions": ["Path matches /v1beta1/partners/*", "grpc-gateway auth and permission interceptors succeeded"],
          "operations": [
            {
              "operation": "Proxy to local gRPC server",
              "trigger": "Dispatch partner, file-upload, and partner-org listing requests into the secondary gRPC runtime",
              "conditions": ["Always for matching path"],
              "implementation": "eng.Any(\"/v1beta1/partners/*any\", gin.WrapH(...grpcGwMux)) -> RegisterOrgServiceHandler(ctx, grpcGwMux, conn); RegisterPartnerServiceHandler(ctx, grpcGwMux, conn); RegisterFileUploadServiceHandler(ctx, grpcGwMux, conn)"
            }
          ]
        }
      ]
    },
    "HealthCheck.Healthz": {
      "infrastructure": {},
      "services": []
    },
    "ApiKeyAPI.ListApiKeyRolesHandler": {
      "infrastructure": {},
      "services": [
        {
          "name": "rbac",
          "target_interface": "CheckApiKeyPermission",
          "target_repo": "tidbcloud/tiinf",
          "operation_type": "internal_call",
          "conditions": [
            "Authenticated API key and org ID were resolved from the OpenAPI auth middleware context"
          ],
          "operations": [
            {
              "operation": "CheckApiKeyPermission",
              "trigger": "Verify the caller can read the supported API-key role list for the org",
              "conditions": [
                "Always after getAccessKeyAndOrgId succeeds"
              ],
              "implementation": "checkAccessKeyPermission(ctx, accessKey, listApiKeyRolesResourceUri, orgId, 0)"
            }
          ]
        }
      ]
    },
    "ApiKeyAPI.UpdateApiKeyRoleHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["Body and URI validation passed", "Caller API key has update_apikey_role permission"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the target API key before assigning new org, project, and cluster roles",
              "conditions": ["Always after request validation"],
              "implementation": "svc.GetApiKeyByAccessKey(ctx, keyReq.AccessKey)"
            },
            {
              "operation": "UPDATE",
              "trigger": "Persist the API key description and assigned role bindings",
              "conditions": ["Target key exists and permission check passed"],
              "implementation": "svc.UpdateApiKeyV2(ctx, key.Id, attrs, assignRoleParam)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "rbac",
          "target_repo": "tidbcloud/tiinf",
          "target_interface": "CheckApiKeyPermission",
          "operation_type": "internal_call",
          "conditions": ["Always after operator API key and org ID are resolved"],
          "operations": [
            {
              "operation": "CheckApiKeyPermission",
              "trigger": "Verify the caller can update API key roles",
              "conditions": ["Always after getAccessKeyAndOrgId succeeds"],
              "implementation": "checkAccessKeyPermission(ctx, operator.AccessKey, updateApiKeyRoleResourceUri, orgId, 0)"
            }
          ]
        }
      ]
    },
    "SqlUserAPI.QuerySqlUserHandler": {
      "infrastructure": {},
      "services": [
        {
          "name": "cluster-manager",
          "target_repo": "tidbcloud/cluster-manager",
          "target_interface": "QuerySqlUser",
          "operation_type": "grpc_unary",
          "conditions": ["cluster_id and user_name are valid", "CM operator derivation succeeded for access-token or API-key identity"],
          "operations": [
            {
              "operation": "QuerySqlUser",
              "trigger": "Query the named SQL user from the target cluster via CM",
              "conditions": ["Always after getCMOperator succeeds"],
              "implementation": "svc.QueryFormCM(ctx, param, *operator)"
            }
          ]
        }
      ]
    },
    "ScimAPI.ServiceProviderConfigHandler": {
      "infrastructure": {
        "scim-schema-registry": {
          "conditions": [
            "SCIM provision, auth, and RBAC middleware passed"
          ],
          "operations": [
            {
              "operation": "ParseServiceProviderConfig",
              "trigger": "Render the static SCIM service-provider capability document for the org-scoped SCIM gateway",
              "conditions": [
                "Always after the SCIM middleware chain succeeds"
              ],
              "implementation": "scim2.ParseServiceProviderConfig()"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.SchemasHandler": {
      "infrastructure": {
        "scim-schema-registry": {
          "conditions": [
            "SCIM provision, auth, and RBAC middleware passed"
          ],
          "operations": [
            {
              "operation": "ListSchemas",
              "trigger": "List the registered SCIM schemas and marshal them through the SCIM search response renderer",
              "conditions": [
                "Always after the SCIM middleware chain succeeds"
              ],
              "implementation": "scim2.ListSchemas() -> handlerutil.WriteSearchResultToResponse(recorder, result)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.SchemaByIdHandler": {
      "infrastructure": {
        "scim-schema-registry": {
          "conditions": [
            "SCIM provision, auth, and RBAC middleware passed"
          ],
          "operations": [
            {
              "operation": "GetSchemaByID",
              "trigger": "Resolve the requested SCIM schema document by URL path ID",
              "conditions": [
                "Always after the SCIM middleware chain succeeds"
              ],
              "implementation": "scim2.GetSchemaByID(c.Param(\"id\"))"
            },
            {
              "operation": "Serialize",
              "trigger": "Serialize the resolved SCIM schema into the SCIM JSON response body",
              "conditions": [
                "Only when schema != nil"
              ],
              "implementation": "scimjson.Serialize(schema)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.ResourceTypesHandler": {
      "infrastructure": {
        "scim-schema-registry": {
          "conditions": [
            "SCIM provision, auth, and RBAC middleware passed"
          ],
          "operations": [
            {
              "operation": "ListResourceTypes",
              "trigger": "List the registered SCIM resource types and marshal them through the SCIM search response renderer",
              "conditions": [
                "Always after the SCIM middleware chain succeeds"
              ],
              "implementation": "scim2.ListResourceTypes() -> handlerutil.WriteSearchResultToResponse(recorder, result)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.ResourceTypeByIdHandler": {
      "infrastructure": {
        "scim-schema-registry": {
          "conditions": [
            "SCIM provision, auth, and RBAC middleware passed"
          ],
          "operations": [
            {
              "operation": "GetResourceTypeByID",
              "trigger": "Resolve the requested SCIM resource-type document by URL path ID",
              "conditions": [
                "Always after the SCIM middleware chain succeeds"
              ],
              "implementation": "scim2.GetResourceTypeByID(c.Param(\"id\"))"
            },
            {
              "operation": "Serialize",
              "trigger": "Serialize the resolved SCIM resource type into the SCIM JSON response body",
              "conditions": [
                "Only when resourceType != nil"
              ],
              "implementation": "scimjson.Serialize(resourceType)"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.GetUserHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["SCIM provision, auth, and RBAC middleware passed"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the SCIM user resource by org ID and SCIM resource ID",
              "conditions": ["Always after middleware and path parsing"],
              "implementation": "svc.GetResource(c.Request.Context(), orgID, &service.GetRequest{ResourceID: resourceID})"
            }
          ]
        }
      },
      "services": []
    },
    "ScimAPI.GetGroupHandler": {
      "infrastructure": {
        "mysql": {
          "conditions": ["SCIM provision, auth, and RBAC middleware passed"],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the SCIM group resource by org ID and SCIM resource ID",
              "conditions": ["Always after middleware and path parsing"],
              "implementation": "svc.GetResource(c.Request.Context(), orgID, &service.GetRequest{ResourceID: resourceID})"
            }
          ]
        }
      },
      "services": []
    }
  }
}