{
  "repo": "tidbcloud/auth-server",
  "binary": "auth-server",
  "binary_path": "cmd/auth-server/main.go",
  "surface_kind": "mixed_service",
  "type": "mixed_service",
  "extensions": {
    "notes": [
      "This repo exposes one Cobra binary with three steady-state runtime modes: `http`, `grpc`, and `migrate`.",
      "When no subcommand is provided, Execute rewrites argv to run the `http` mode by default.",
      "The root PersistentPreRunE always runs config.InitConfig(configPath), so remote config load and the background Viper watcher are part of every command mode.",
      "Inner `/api/v1/*` HTTP routes always inherit request-size checking, `/api/`-prefixed CORS, metrics middleware, and auth that switches between `CheckAuthByTestHeader` in local env and `tigin.CheckAuthByAuth0(accountClient)` otherwise."
    ]
  },
  "services": [
    {
      "name": "AuthServerCobra",
      "package": "main",
      "methods": [
        {
          "name": "Execute",
          "name_key": "AuthServerCobra.Execute",
          "input": "os.Args",
          "output": "dispatches to http, grpc, or migrate command; defaults to http when no subcommand is given",
          "type": "local"
        },
        {
          "name": "LoadConfig",
          "name_key": "AuthServerCobra.LoadConfig",
          "input": "-config flag path",
          "output": "global CentralConfig loaded from local file and remote config provider",
          "type": "local"
        },
        {
          "name": "WatchRemoteConfig",
          "name_key": "AuthServerCobra.WatchRemoteConfig",
          "input": "loaded Viper remote provider state",
          "output": "background watcher goroutine that periodically refreshes remote config",
          "type": "local"
        }
      ]
    },
    {
      "name": "AuthServerHTTPLifecycle",
      "package": "main",
      "methods": [
        {
          "name": "Startup",
          "name_key": "AuthServerHTTPLifecycle.Startup",
          "input": "global config",
          "output": "initialized tracing, logging, sentry, MySQL, DI container, metrics listener, and main HTTP router",
          "type": "local"
        },
        {
          "name": "InitializeTracing",
          "name_key": "AuthServerHTTPLifecycle.InitializeTracing",
          "input": "componentName=auth-server",
          "output": "Jaeger tracer provider",
          "type": "local"
        },
        {
          "name": "InitializeLoggerAndSentry",
          "name_key": "AuthServerHTTPLifecycle.InitializeLoggerAndSentry",
          "input": "log levels + DSN + environment",
          "output": "configured logger and sentry hooks",
          "type": "local"
        },
        {
          "name": "InitializeDatabase",
          "name_key": "AuthServerHTTPLifecycle.InitializeDatabase",
          "input": "centralConfig + DB_PASSWORD env var",
          "output": "shared MySQL GORM handle",
          "type": "local"
        },
        {
          "name": "InitializeContainer",
          "name_key": "AuthServerHTTPLifecycle.InitializeContainer",
          "input": "*gorm.DB",
          "output": "oauth2 service, provider controller, oauth2 controller, and account-provider client",
          "type": "local"
        },
        {
          "name": "StartMetricsServer",
          "name_key": "AuthServerHTTPLifecycle.StartMetricsServer",
          "input": "serverConfig.MetricsPort",
          "output": "Gin metrics HTTP listener on 0.0.0.0:<metrics-port>",
          "type": "local"
        },
        {
          "name": "StartHTTPServer",
          "name_key": "AuthServerHTTPLifecycle.StartHTTPServer",
          "input": "serverConfig.HttpPort + registered OAuth2 routes",
          "output": "main HTTP API listener",
          "type": "local"
        }
      ]
    },
    {
      "name": "AuthServerMetricsHTTP",
      "type": "http",
      "methods": [
        {
          "name": "GET /metrics",
          "name_key": "HTTP GET /metrics",
          "input": "Prometheus scrape request",
          "output": "Prometheus metrics payload",
          "path": "/metrics",
          "type": "http"
        }
      ]
    },
    {
      "name": "AuthServerHTTP",
      "type": "http",
      "methods": [
        {
          "name": "GET /healthz",
          "name_key": "HTTP GET /healthz",
          "input": "none",
          "output": "HTTP 200",
          "path": "/healthz",
          "type": "http"
        },
        {
          "name": "GET /swagger/*any",
          "name_key": "HTTP GET /swagger/*any",
          "input": "swagger asset path",
          "output": "Swagger UI and OAuth2 API docs",
          "path": "/swagger/*any",
          "type": "http"
        },
        {
          "name": "POST /v1/device_authorization",
          "name_key": "HTTP POST /v1/device_authorization",
          "input": "device authorization request",
          "output": "device code, user code, verification URI, expires_in, and poll interval",
          "path": "/v1/device_authorization",
          "type": "http"
        },
        {
          "name": "POST /v1/token",
          "name_key": "HTTP POST /v1/token",
          "input": "token grant request",
          "output": "token response for device grant, authorization code grant, or refresh token grant",
          "path": "/v1/token",
          "type": "http"
        },
        {
          "name": "POST /v1/revoke",
          "name_key": "HTTP POST /v1/revoke",
          "input": "revoke token request",
          "output": "empty 200 response after best-effort revoke attempt",
          "path": "/v1/revoke",
          "type": "http"
        },
        {
          "name": "GET /v1/userinfo",
          "name_key": "HTTP GET /v1/userinfo",
          "input": "Authorization bearer token",
          "output": "OAuth2 userinfo payload",
          "path": "/v1/userinfo",
          "type": "http"
        },
        {
          "name": "GET /v1/authInfo",
          "name_key": "HTTP GET /v1/authInfo",
          "input": "Authorization bearer token",
          "output": "access token identity payload",
          "path": "/v1/authInfo",
          "type": "http"
        },
        {
          "name": "POST /api/v1/oauth/device/check",
          "name_key": "HTTP POST /api/v1/oauth/device/check",
          "input": "inner device check request",
          "output": "device grant metadata for a valid pending user_code",
          "path": "/api/v1/oauth/device/check",
          "type": "http"
        },
        {
          "name": "POST /api/v1/oauth/device/confirmation",
          "name_key": "HTTP POST /api/v1/oauth/device/confirmation",
          "input": "inner device confirmation request",
          "output": "approve or deny result for a device grant",
          "path": "/api/v1/oauth/device/confirmation",
          "type": "http"
        },
        {
          "name": "POST /api/v1/oauth/authorize/check",
          "name_key": "HTTP POST /api/v1/oauth/authorize/check",
          "input": "authorization code pre-check request",
          "output": "validated app metadata and redirect decision state",
          "path": "/api/v1/oauth/authorize/check",
          "type": "http"
        },
        {
          "name": "POST /api/v1/oauth/authorize/confirmation",
          "name_key": "HTTP POST /api/v1/oauth/authorize/confirmation",
          "input": "authorization code approval request",
          "output": "authorization code grant creation result plus redirect target",
          "path": "/api/v1/oauth/authorize/confirmation",
          "type": "http"
        },
        {
          "name": "GET /api/v1/oauth/console/token",
          "name_key": "HTTP GET /api/v1/oauth/console/token",
          "input": "application query for current user",
          "output": "latest non-expired token summary for the application",
          "path": "/api/v1/oauth/console/token",
          "type": "http"
        },
        {
          "name": "POST /api/v1/oauth/console/token",
          "name_key": "HTTP POST /api/v1/oauth/console/token",
          "input": "application revoke request for current user",
          "output": "successful revoke response",
          "path": "/api/v1/oauth/console/token",
          "type": "http"
        },
        {
          "name": "GET /api/v1/oauth/console/application/user-authorized",
          "name_key": "HTTP GET /api/v1/oauth/console/application/user-authorized",
          "input": "current user context",
          "output": "cloud applications with authorization state and last-used metadata",
          "path": "/api/v1/oauth/console/application/user-authorized",
          "type": "http"
        },
        {
          "name": "POST /api/v1/oauth/console/application",
          "name_key": "HTTP POST /api/v1/oauth/console/application",
          "input": "application creation request for whitelisted operators",
          "output": "created client secret for a new OAuth2 application",
          "path": "/api/v1/oauth/console/application",
          "type": "http"
        }
      ]
    },
    {
      "name": "AuthServerGRPCLifecycle",
      "package": "main",
      "methods": [
        {
          "name": "Startup",
          "name_key": "AuthServerGRPCLifecycle.Startup",
          "input": "global config",
          "output": "initialized tracing, logging, sentry, MySQL, DI container, metrics listener, and gRPC server",
          "type": "local"
        },
        {
          "name": "InitializeTracing",
          "name_key": "AuthServerGRPCLifecycle.InitializeTracing",
          "input": "componentName=auth-server",
          "output": "Jaeger tracer provider",
          "type": "local"
        },
        {
          "name": "InitializeLoggerAndSentry",
          "name_key": "AuthServerGRPCLifecycle.InitializeLoggerAndSentry",
          "input": "log levels + DSN + environment",
          "output": "configured logger and sentry hooks",
          "type": "local"
        },
        {
          "name": "InitializeDatabase",
          "name_key": "AuthServerGRPCLifecycle.InitializeDatabase",
          "input": "centralConfig + DB_PASSWORD env var",
          "output": "shared MySQL GORM handle",
          "type": "local"
        },
        {
          "name": "InitializeContainer",
          "name_key": "AuthServerGRPCLifecycle.InitializeContainer",
          "input": "*gorm.DB",
          "output": "oauth2 service, provider controller, and account-provider client",
          "type": "local"
        },
        {
          "name": "StartMetricsServer",
          "name_key": "AuthServerGRPCLifecycle.StartMetricsServer",
          "input": "serverConfig.MetricsPort",
          "output": "Gin metrics HTTP listener on 0.0.0.0:<metrics-port>",
          "type": "local"
        },
        {
          "name": "StartGRPCServer",
          "name_key": "AuthServerGRPCLifecycle.StartGRPCServer",
          "input": "serverConfig.GrpcPort + registered provider service",
          "output": "gRPC listener serving AuthServerService",
          "type": "local"
        }
      ]
    },
    {
      "name": "AuthServerProviderGRPC",
      "package": "provider",
      "transport": "grpc",
      "methods": [
        {
          "name": "GetIdentityByAccessToken",
          "name_key": "AuthServerProviderGRPC.GetIdentityByAccessToken",
          "input": "GetIdentityByAccessTokenReq",
          "output": "access token identity or base response error payload",
          "type": "grpc"
        }
      ]
    },
    {
      "name": "AuthServerMigrateLifecycle",
      "package": "main",
      "methods": [
        {
          "name": "RunMigrations",
          "name_key": "AuthServerMigrateLifecycle.RunMigrations",
          "input": "global config + DB_PASSWORD env var",
          "output": "auth-server schema and migration records applied to MySQL",
          "type": "local"
        }
      ]
    }
  ]
}