{
  "repo": "tidbcloud/account",
  "binary": "provider",
  "binary_path": "central/cmd/provider/main.go",
  "dependencies": {
    "AccountAPIService.GetUserByEmail": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get user by email",
              "conditions": [
                "Always"
              ],
              "implementation": "userSvc.GetUserByEmail(ctx, req.Email)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetUserByID": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get user by ID",
              "conditions": [
                "Always"
              ],
              "implementation": "userSvc.GetUserByID(ctx, req.UserId)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetUserByToken": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get user by email from token",
              "conditions": [
                "Always"
              ],
              "implementation": "userSvc.GetUserByEmail(ctx, email)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "authn-service",
          "target_interface": "CheckUserLoginStateWhetherRevoked",
          "target_repo": "tidbcloud/account",
          "operation_type": "internal",
          "conditions": [
            "tokenType != TokenTypeTest"
          ],
          "operations": [
            {
              "operation": "Check token revocation",
              "trigger": "Verify token not revoked",
              "conditions": [
                "Not test token"
              ],
              "implementation": "authnsvc.CheckUserLoginStateWhetherRevoked(ctx, claims)"
            }
          ]
        }
      ]
    },
    "AccountAPIService.ListUsers": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List users by the explicit user_id set provided in the request",
              "conditions": [
                "Always"
              ],
              "implementation": "userSvc.ListUsers(ctx, req.UserIds)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ListUsersByFilter": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "req.Filter != nil"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List only active users that match the normalized scope/target/role filter",
              "conditions": [
                "Always after req.Filter is converted into userDao.ListUsersFilter"
              ],
              "implementation": "userSvc.ListUsersByFilter(ctx, filter)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ListUsersByPage": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Run the paginated user search assembled from exact-match and like filters",
              "conditions": [
                "Always after params are built from req.QueryParam and req.Pager"
              ],
              "implementation": "userSvc.ListUsersByPage(ctx, params)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ValidateToken": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Validate org token",
              "conditions": [
                "Always"
              ],
              "implementation": "orgTokenAuthSvc.AuthOrgToken(ctx, authParam)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetScopeUser": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "req.ScopeType is org or project"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Resolve the single role-binding user within the requested org/project scope",
              "conditions": [
                "Always after ScopeTypePb2Model-equivalent switch sets f.ScopeType"
              ],
              "implementation": "userSvc.ListRoleBindingUsers(ctx, f)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetSystemUser": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "req.OrgId != 0"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the system user bound to the org",
              "conditions": [
                "Always after org_id validation succeeds"
              ],
              "implementation": "userSvc.GetSystemUserByOrgID(ctx, req.OrgId)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetOrCreateSystemUser": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "req.OrgId != 0"
          ],
          "operations": [
            {
              "operation": "SELECT/INSERT",
              "trigger": "Get the org system user or create it if it does not exist yet",
              "conditions": [
                "Always after org_id validation succeeds"
              ],
              "implementation": "userSvc.GetOrCreateSystemUserByOrgID(ctx, req.OrgId)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetAuthUser": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get auth user info with org and projects",
              "conditions": [
                "Always"
              ],
              "implementation": "userSvc.GetAuthUserByEmail(ctx, userEmail, orgId, skipCheckOrg)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetProjectByID": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the project row for the requested project ID",
              "conditions": [
                "Always"
              ],
              "implementation": "projectSvc.GetProjectByID(ctx, req.Id) -> dao.Project.GetProjectByID(ctx, tx, req.Id)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ListProjects": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List projects with filters",
              "conditions": [
                "Always"
              ],
              "implementation": "projectSvc.ListProjects(ctx, orgIds, ids, status)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ListProjectsByOrgs": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List active projects by org IDs",
              "conditions": [
                "Always"
              ],
              "implementation": "projectSvc.ListActiveProjectsByOrgIDs(ctx, req.OrgIds)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ListProjectsByOrgsInUser": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List user visible projects",
              "conditions": [
                "Always"
              ],
              "implementation": "projectSvc.ListUserVisibleProjects(ctx, req.UserId, req.OrgIds)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.DeleteProjectByID": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "req.ProjectId != 0"
          ],
          "operations": [
            {
              "operation": "DELETE",
              "trigger": "Delete the project row and its related state by project ID",
              "conditions": [
                "Always after project_id validation succeeds"
              ],
              "implementation": "projectSvc.DeleteProject(ctx, req.ProjectId)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetOrgByID": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the tenant row for the requested org ID",
              "conditions": [
                "Always"
              ],
              "implementation": "orgSvc.GetOrgByID(ctx, req.Id) -> dao.Org.GetOrgByOrgID(ctx, tx, req.Id)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "billing-service",
          "target_interface": "GetTenantPlanInfo",
          "target_repo": "tidbcloud/billing-service",
          "operation_type": "http_get",
          "conditions": [
            "!req.IsBrief"
          ],
          "operations": [
            {
              "operation": "HTTP GET /tenants/{tenantID}/plans",
              "trigger": "Fetch the effective billing plan when the caller requested the non-brief org view",
              "conditions": [
                "Not brief request"
              ],
              "implementation": "billing2.GetHandler().GetTenantPlanInfo(ctx, org.ID.Uint64()) -> doRequest(GET, /tenants/{tenantID}/plans)"
            }
          ]
        }
      ]
    },
    "AccountAPIService.ListOrgs": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List orgs with filters",
              "conditions": [
                "Always"
              ],
              "implementation": "orgSvc.ListOrgs(ctx, listOrgsParam)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ListOrgsAdvance": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Run the advanced org list query with optional filter/search/sort/pager clauses",
              "conditions": [
                "Always after orgDao.ListOrgsParam is assembled from req.Filter, req.Search, req.Sorter, and req.Pager"
              ],
              "implementation": "orgSvc.ListOrgs(ctx, orgDao.ListOrgsParam{Filter: filter, Search: req.Search, SortBy: sortBy, Order: order, Limit: limit, Offset: offset})"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ListOrgsByUser": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get user by email if userId not provided",
              "conditions": [
                "req.Email != '' && req.UserId == 0"
              ],
              "implementation": "userSvc.GetUserByEmail(ctx, req.Email)"
            },
            {
              "operation": "SELECT",
              "trigger": "List orgs by user ID",
              "conditions": [
                "Always"
              ],
              "implementation": "orgSvc.ListOrgsByUserID(ctx, userId)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.DeleteOrgByID": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "DELETE",
              "trigger": "Delete org and related resources",
              "conditions": [
                "Always"
              ],
              "implementation": "orgSvc.DeleteOrgByID(ctx, req.OrgId, true)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.DeleteOrgAdvanced": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "DELETE",
              "trigger": "Delete the org and optionally cascade its resources depending on req.IsDeleteResource",
              "conditions": [
                "Always"
              ],
              "implementation": "orgSvc.DeleteOrgByID(ctx, req.OrgId, req.IsDeleteResource)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.UpdateOrg": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "UPDATE",
              "trigger": "Update org",
              "conditions": [
                "Always"
              ],
              "implementation": "orgSvc.UpdateOrg(ctx, updateOrgParam)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.VerifyUserOrgAndProjects": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get user orgs and projects",
              "conditions": [
                "Always"
              ],
              "implementation": "projectSvc.GetUserOrgsProjects(ctx, req.UserId)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.CreateAuditLog": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "trigger": "Create audit log",
              "conditions": [
                "Always"
              ],
              "implementation": "securitySvc.CreateAuditLog(ctx, orgId, user, content)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.BatchCreateAuditLogs": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "len(req.AuditLogs) >= 0"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "trigger": "Create each audit log by iterating the batch through the single-row CreateAuditLog path",
              "conditions": [
                "For each req.AuditLogs item until one CreateAuditLog call fails"
              ],
              "implementation": "for _, tmp := range req.AuditLogs { s.CreateAuditLog(ctx, createAuditLogReq) -> securitySvc.CreateAuditLog(ctx, orgId, user, content) }"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ListTrials": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List trial records for the org and trial type",
              "conditions": [
                "Always"
              ],
              "implementation": "orgSvc.ListTrials(ctx, req.OrgId, req.TrialType)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.CreateTrial": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "req.Trial.StartedAt != nil"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "trigger": "Create a new org trial window using the request timestamps and trial type",
              "conditions": [
                "Always after StartedAt validation succeeds"
              ],
              "implementation": "orgSvc.CreateTrial(ctx, req.Trial.CreatedById, req.Trial.OrgId, *startedAt, estimatedEndedAt, endedAt, req.Trial.TrialType)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.HasPermissionForUser": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Check user permission",
              "conditions": [
                "Always"
              ],
              "implementation": "permission.GetRbacPermissionSvc().HasPermissionForUser(ctx, userId, resourceUri, pureResourceUri)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.HasPermissionForIdentity": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Check identity permission",
              "conditions": [
                "Always"
              ],
              "implementation": "permission.HasPermissionForUser/ApiKey/AccessToken(ctx, ...)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.CheckIdentityAndPermission": {
      "infrastructure": {},
      "services": []
    },
    "AccountAPIService.SaveAuthorizationData": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "trigger": "Create role bindings for access token",
              "conditions": [
                "Always"
              ],
              "implementation": "rbacRoleBindingSvc.CreateRoleBindings(ctx, roleBindingArr)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.SendEmail": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT/INSERT",
              "trigger": "Email unique ID management",
              "conditions": [
                "Always"
              ],
              "implementation": "messageSvc.SendEmail(ctx, ...)"
            }
          ]
        },
        "redis": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SET",
              "trigger": "Email deduplication cache",
              "conditions": [
                "Always"
              ],
              "implementation": "messageSvc.SendEmail(ctx, ...)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "email-service",
          "target_interface": "SendMail",
          "target_repo": "third-party",
          "operation_type": "http_post",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "HTTP POST send email",
              "trigger": "Send email via template",
              "conditions": [
                "Always"
              ],
              "implementation": "messageSvc.SendEmail(ctx, subject, orgId, scene, identifier, emails, ccEmails, templateId, templateVars)"
            }
          ]
        }
      ]
    },
    "AccountAPIService.SendEmailByLabels": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get users by email labels",
              "conditions": [
                "Always"
              ],
              "implementation": "messageSvc.SendEmailByLabels(ctx, ...)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "email-service",
          "target_interface": "SendMail",
          "target_repo": "third-party",
          "operation_type": "http_post",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "HTTP POST send email by labels",
              "trigger": "Send email to org role members",
              "conditions": [
                "Always"
              ],
              "implementation": "messageSvc.SendEmailByLabels(ctx, subject, orgId, scene, identifier, toLabel, ccLabels, templateId, templateVars)"
            }
          ]
        }
      ]
    },
    "AccountAPIService.HoldEmailUniqueID": {
      "infrastructure": {
        "message-reminder-store": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "HoldEmailUniqueID",
              "trigger": "Reserve the deduplication token used to suppress duplicate reminder emails",
              "conditions": [
                "Always"
              ],
              "implementation": "messageSvc.HoldEmailUniqueID(ctx, req.OrgId, req.Scene, req.Identifier)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ClearEmailUniqueID": {
      "infrastructure": {
        "message-reminder-store": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ClearEmailUniqueID",
              "trigger": "Release the deduplication token after the email workflow is complete",
              "conditions": [
                "Always"
              ],
              "implementation": "messageSvc.ClearEmailUniqueID(ctx, req.OrgId, req.Scene, req.Identifier)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.QueryEmailUniqueID": {
      "infrastructure": {
        "message-reminder-store": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "QueryEmailUniqueID",
              "trigger": "Read the stored deduplication record and return its ID plus created_at timestamp",
              "conditions": [
                "Always"
              ],
              "implementation": "messageSvc.QueryEmailUniqueID(ctx, req.OrgId, req.Scene, req.Identifier)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetDBUsers": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List users by scope for DB users",
              "conditions": [
                "Always"
              ],
              "implementation": "rbacUserSvc.ListUsersByScope(ctx, scopeType, scopeId)"
            },
            {
              "operation": "SELECT",
              "trigger": "Get API keys for resource",
              "conditions": [
                "createApiKeyDbUsers"
              ],
              "implementation": "apiKeySvc.ListApiKeysByResourceID(ctx, &param)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.CreateApiKey": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "trigger": "Create API key",
              "conditions": [
                "Always"
              ],
              "implementation": "apiKeySvc.CreateApiKey(ctx, &keyReq)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.UpdateApiKey": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "UPDATE",
              "trigger": "Update API key",
              "conditions": [
                "Always"
              ],
              "implementation": "apiKeySvc.UpdateApiKey(ctx, &keyReq)"
            },
            {
              "operation": "UPDATE",
              "trigger": "Change API key role if role changed",
              "conditions": [
                "req.NewRole != '' && req.NewRole != req.OriginRole"
              ],
              "implementation": "apiKeySvc.ChangeApiKeyRefResourceRole(ctx, &param)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.DeleteApiKey": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "DELETE",
              "trigger": "Delete API key",
              "conditions": [
                "Always"
              ],
              "implementation": "apiKeySvc.DeleteApiKey(ctx, &keyReq)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.RecoverApiKeyPermission": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "req.ApiKeyId != 0",
            "req.ResourceId != 0",
            "req.Operator != \"\""
          ],
          "operations": [
            {
              "operation": "UPSERT",
              "trigger": "Restore the API key role binding on the target resource",
              "conditions": [
                "Always after request validation and operator-type defaulting succeed"
              ],
              "implementation": "apiKeySvc.RecoverApiKeyPermission(ctx, &apikey2.RecoverApiKeyParam{ApiKeyId: req.ApiKeyId, ScopeType: req.ScopeType, ResourceId: req.ResourceId, Role: req.Role, Operator: req.Operator, OperatorType: int32(*req.OperatorType)})"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetApiKeysByResource": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List API keys by resource",
              "conditions": [
                "Always"
              ],
              "implementation": "apiKeySvc.ListApiKeysByResourceID(ctx, &keyReq)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetApiKeyByAccessKey": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get API key by access key",
              "conditions": [
                "Always"
              ],
              "implementation": "apiKeySvc.GetApiKeyByAccessKey(ctx, req.AccessKey)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.RecoverResourceRefAllApiKeyPermission": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "req.ResourceId != 0",
            "req.Operator != \"\""
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load all API keys currently referencing the resource before replaying their permissions",
              "conditions": [
                "Always after request validation and operator-type defaulting succeed"
              ],
              "implementation": "apiKeySvc.ListApiKeysByResourceID(ctx, &apikey2.ListKeysByResourceIDParam{ScopeType: req.ScopeType, ResourceId: req.ResourceId})"
            },
            {
              "operation": "UPSERT",
              "trigger": "Recover each resource-role binding for every API key returned by ListApiKeysByResourceID",
              "conditions": [
                "For each apiKey.ResourceInfos item returned from ListApiKeysByResourceID"
              ],
              "implementation": "apiKeySvc.RecoverApiKeyPermission(ctx, &apikey2.RecoverApiKeyParam{ApiKeyId: apiKey.Id, ScopeType: resourceInfo.ScopeType, ResourceId: resourceInfo.ResourceId, Role: resourceInfo.Role, Operator: req.Operator, OperatorType: int32(*req.OperatorType)})"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.BatchUpdateApiKeyExpireTime": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "len(req.ApiKeyIds) > 0",
            "req.ExpiredAt != nil"
          ],
          "operations": [
            {
              "operation": "UPDATE",
              "trigger": "Batch-set the expiration timestamp for the provided API keys",
              "conditions": [
                "Always after api_key_ids and expired_at validation succeed"
              ],
              "implementation": "apiKeySvc.BatchSetApiKeyExpireTime(ctx, &apikey2.BatchSetApiKeyExpireTimeParam{ApiKeyIds: req.ApiKeyIds, ExpiredAt: utils.FromTimestamp(req.ExpiredAt)})"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetIdentityByAccessToken": {
      "infrastructure": {},
      "services": [
        {
          "name": "auth-server",
          "target_interface": "GetIdentityByAccessToken",
          "target_repo": "tidbcloud/auth-server",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetIdentityByAccessToken",
              "trigger": "Get identity by access token",
              "conditions": [
                "Always"
              ],
              "implementation": "authserver.GetIdentityByAccessToken(ctx, req.RawAccessToken)"
            }
          ]
        }
      ]
    },
    "AccountAPIService.IsHitExp": {
      "infrastructure": {
        "feature-flag": {
          "conditions": [
            "req.ExpName != \"\""
          ],
          "operations": [
            {
              "operation": "ListHitFeatureFlagNames",
              "trigger": "Resolve experiment membership by delegating to the feature-flag hit list and checking membership of req.ExpName",
              "conditions": [
                "Always after exp name validation succeeds"
              ],
              "implementation": "s.IsHitFeatureFlag(ctx, &account.HitFeatureFlagReq{FlagName: req.ExpName, OrgId: req.OrgId, Email: req.Email}) -> flagsvc.GetFeatureFlagSvc().ListHitFeatureFlagNames(ctx, req.Email, req.OrgId)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetExpConfByName": {
      "infrastructure": {
        "feature-flag": {
          "conditions": [
            "req.ExpName != \"\""
          ],
          "operations": [
            {
              "operation": "GetFeatureFlagByName",
              "trigger": "Resolve experiment config by delegating to the feature-flag config lookup",
              "conditions": [
                "Always after exp name validation succeeds"
              ],
              "implementation": "s.GetFeatureFlagConf(ctx, &account.GetFeatureFlagConfReq{FlagName: req.ExpName}) -> flagsvc.GetFeatureFlagSvc().GetFeatureFlagByName(ctx, req.ExpName)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetFeatureFlagConf": {
      "infrastructure": {
        "feature-flag": {
          "conditions": [
            "req != nil",
            "req.FlagName != \"\""
          ],
          "operations": [
            {
              "operation": "GetFeatureFlagByName",
              "trigger": "Load the stored org/email/min-org rollout config for the named feature flag",
              "conditions": [
                "Always after flag_name validation succeeds"
              ],
              "implementation": "flagsvc.GetFeatureFlagSvc().GetFeatureFlagByName(ctx, req.FlagName)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ListHitFeatureFlagNames": {
      "infrastructure": {
        "feature-flag": {
          "conditions": [
            "req != nil",
            "req.OrgId != 0 or req.Email != \"\""
          ],
          "operations": [
            {
              "operation": "ListHitFeatureFlagNames",
              "trigger": "Resolve all feature flags that match the provided org/email rollout attributes",
              "conditions": [
                "Always after parameter validation succeeds"
              ],
              "implementation": "flagsvc.GetFeatureFlagSvc().ListHitFeatureFlagNames(ctx, req.Email, req.OrgId)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.IsHitFeatureFlag": {
      "infrastructure": {
        "feature-flag": {
          "conditions": [
            "req != nil",
            "req.FlagName != \"\""
          ],
          "operations": [
            {
              "operation": "ListHitFeatureFlagNames",
              "trigger": "List the matching feature flags and check whether req.FlagName is present",
              "conditions": [
                "Always after flag_name validation succeeds"
              ],
              "implementation": "flagsvc.GetFeatureFlagSvc().ListHitFeatureFlagNames(ctx, req.Email, req.OrgId)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ConfigFeatureFlagOrg": {
      "infrastructure": {
        "feature-flag": {
          "conditions": [
            "req != nil",
            "req.FlagName != \"\"",
            "len(req.OrgIds) > 0"
          ],
          "operations": [
            {
              "operation": "UPSERT",
              "trigger": "Persist the org rollout list for the named feature flag",
              "conditions": [
                "Always after request validation succeeds"
              ],
              "implementation": "flagsvc.GetFeatureFlagSvc().ConfigFeatureFlagOrg(ctx, req.FlagName, req.OrgIds)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetOpenAPIAccess": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get API key by access key",
              "conditions": [
                "Always"
              ],
              "implementation": "apiKeySvc.GetApiKeyByAccessKey(ctx, req.PublicKey)"
            },
            {
              "operation": "SELECT",
              "trigger": "List active projects by org",
              "conditions": [
                "Always"
              ],
              "implementation": "projectSvc.ListActiveProjectsByOrgID(ctx, orgId)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.AddImpersonateUser": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get user by email",
              "conditions": [
                "Always"
              ],
              "implementation": "userSvc.GetUserByEmail(ctx, req.Email)"
            },
            {
              "operation": "SELECT",
              "trigger": "Get org by ID",
              "conditions": [
                "Always"
              ],
              "implementation": "orgSvc.GetOrgByID(ctx, req.OrgId)"
            },
            {
              "operation": "SELECT",
              "trigger": "Get impersonated user",
              "conditions": [
                "Always"
              ],
              "implementation": "userSvc.GetImpersonatedUser(ctx, user.ID.Uint64())"
            },
            {
              "operation": "INSERT",
              "trigger": "Add impersonate user",
              "conditions": [
                "impersonatedUser == nil"
              ],
              "implementation": "userSvc.AddImpersonateUser(ctx, user.ID.Uint64(), org.ID.Uint64())"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.DeleteImpersonateUser": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get user by email",
              "conditions": [
                "Always"
              ],
              "implementation": "userSvc.GetUserByEmail(ctx, req.Email)"
            },
            {
              "operation": "SELECT",
              "trigger": "Get impersonated user",
              "conditions": [
                "Always"
              ],
              "implementation": "userSvc.GetImpersonatedUser(ctx, user.ID.Uint64())"
            },
            {
              "operation": "DELETE",
              "trigger": "Delete impersonate user",
              "conditions": [
                "impersonatedUser.TenantID == req.OrgId"
              ],
              "implementation": "userSvc.DeleteImpersonateUser(ctx, user.ID.Uint64(), req.OrgId)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.GetImpersonateUser": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get user by email",
              "conditions": [
                "Always"
              ],
              "implementation": "userSvc.GetUserByEmail(ctx, req.Email)"
            },
            {
              "operation": "SELECT",
              "trigger": "Get impersonated user",
              "conditions": [
                "Always"
              ],
              "implementation": "userSvc.GetImpersonatedUser(ctx, user.ID.Uint64())"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ListPartnerCustomers": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List partner customers",
              "conditions": [
                "Always"
              ],
              "implementation": "mspSvc.ListCustomers(ctx, req)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ListClusterDbUsers": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List DB users for cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "dbUserWatchDogSvc.ListDbUsers(ctx, &listDbUsersReq)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.TestClusterDbUser": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Test DB user connection",
              "conditions": [
                "Always"
              ],
              "implementation": "dbUserWatchDogSvc.TestDbUser(ctx, &testDbUserReq)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.CreateClusterUser": {
      "infrastructure": {},
      "services": []
    },
    "AccountAPIService.GetClusterUser": {
      "infrastructure": {},
      "services": []
    },
    "AccountAPIService.CreateCloudAdmin": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "trigger": "Create cloud admin cluster user",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterUserSvc.CreateClusterUser(ctx, &param)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "authcenter",
          "target_interface": "DecryptCredential",
          "target_repo": "tidbcloud/account",
          "operation_type": "internal",
          "conditions": [
            "req.EncryptedPasswd != ''"
          ],
          "operations": [
            {
              "operation": "Decrypt credential",
              "trigger": "Decrypt encrypted password",
              "conditions": [
                "Encrypted password provided"
              ],
              "implementation": "authcenter.DecryptCredential(ctx, req.EncryptedPasswd)"
            }
          ]
        },
        {
          "name": "authcenter",
          "target_interface": "EncryptCredential",
          "target_repo": "tidbcloud/account",
          "operation_type": "internal",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Encrypt credential",
              "trigger": "Encrypt cloud admin password",
              "conditions": [
                "Always"
              ],
              "implementation": "authcenter.EncryptCredential(ctx, user.Credential)"
            }
          ]
        }
      ]
    },
    "AccountAPIService.GetCloudAdminCredential": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get cloud admin cluster user",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterUserSvc.GetClusterUser(ctx, req.ClusterId, CloudAdminUsername, 0)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "authcenter",
          "target_interface": "EncryptCredential",
          "target_repo": "tidbcloud/account",
          "operation_type": "internal",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Encrypt credential",
              "trigger": "Encrypt cloud admin password",
              "conditions": [
                "Always"
              ],
              "implementation": "authcenter.EncryptCredential(ctx, user.Credential)"
            }
          ]
        }
      ]
    },
    "AccountAPIService.GetClusterAuthPubKey": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get cluster auth public key",
              "conditions": [
                "Always"
              ],
              "implementation": "dbUserSvc.GetClusterAuthPubKey(ctx, req.OrgId, req.ClusterId, req.IsDevTier)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.AddClusterRelations": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "UPSERT",
              "trigger": "Upsert TiDB-to-org and TiDB-to-project resource relation rows for the cluster",
              "conditions": [
                "req.ClusterId != 0 and at least one of req.OrgId / req.ProjectId is non-zero"
              ],
              "implementation": "rbac.GetResourceRelationSvc().UpsertClusterRelations(ctx, &operClusterRelationReq) -> dao.ResourceRelation.BatchUpsertResourceRelations(...)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.DeleteClusterRelations": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "DELETE/DELETE",
              "trigger": "Delete the cluster resource relations and the TiDB-scoped role bindings in one transaction",
              "conditions": [
                "req.ClusterId != 0"
              ],
              "implementation": "rbac.GetResourceRelationSvc().DeleteClusterRelations(ctx, req.ClusterId) -> dao.ResourceRelation.DeleteResourceRelationsByResource(...) + dao.Role.DeleteRoleBindingByScopeInfo(...)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.CheckOperatorHasClusterRole": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Check operator has cluster roles",
              "conditions": [
                "Always"
              ],
              "implementation": "usersvc.CheckTargetHasClusterRoles(ctx, targetType, operatorId, clusterIds, roles)"
            }
          ]
        }
      },
      "services": []
    },
    "AccountAPIService.ListUserRoleBindings": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "List user role bindings",
              "conditions": [
                "Always"
              ],
              "implementation": "usersvc.ListUserRoleBindings(ctx, req.UserId, req.OrgId)"
            }
          ]
        }
      },
      "services": []
    },
    "HTTP POST /inner/account-provider/api/v1/api-key/authn": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get API key by access key",
              "conditions": [
                "Always"
              ],
              "implementation": "apikeysvc.AuthnApiKey(ctx, ak, sk)"
            }
          ]
        },
        "redis": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "GET",
              "trigger": "Cache API key validation",
              "conditions": [
                "Always"
              ],
              "implementation": "apikeysvc.AuthnApiKey(ctx, ak, sk)"
            }
          ]
        }
      },
      "services": []
    },
    "HTTP POST /inner/account-provider/api/v1/api-key/authz": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Check API key permission",
              "conditions": [
                "Always"
              ],
              "implementation": "permission.HasPermissionForApiKey(ctx, publicKey, reqUri, resourceUri)"
            }
          ]
        }
      },
      "services": []
    },
    "HTTP POST /inner/account-provider/api/v1/user/authn": {
      "infrastructure": {
        "auth0_token": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ValidateToken",
              "trigger": "Validate Auth0 token claims locally",
              "conditions": [
                "Always"
              ],
              "implementation": "tokenSvc.GetClaimsFromToken(ctx, auth0Token)"
            }
          ]
        },
        "redis": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "GET/EXISTS",
              "trigger": "Check if user login state is revoked",
              "conditions": [
                "Always"
              ],
              "implementation": "CheckUserLoginStateWhetherRevoked(ctx, claims)"
            }
          ]
        },
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Get user by email from database",
              "conditions": [
                "Always"
              ],
              "implementation": "userSvc.GetUserByEmail(ctx, email)"
            }
          ]
        }
      },
      "services": []
    },
    "HTTP POST /inner/account-provider/api/v1/user/authz": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Check user permission",
              "conditions": [
                "Always"
              ],
              "implementation": "permission.HasPermissionForUser(ctx, userID, reqUri, resourceUri)"
            }
          ]
        }
      },
      "services": []
    },
    "HTTP POST /inner/account-provider/api/v1/user/authn-session": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Validate user session",
              "conditions": [
                "Always"
              ],
              "implementation": "session.AuthnLoginSession(ctx, &req)"
            }
          ]
        },
        "redis": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "GET/SET",
              "trigger": "Session cache management",
              "conditions": [
                "Always"
              ],
              "implementation": "session.GetUserSessionSvc().AuthnLoginSession(ctx, &req)"
            }
          ]
        }
      },
      "services": []
    }
  }
}