mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
675668c430
Introduce docs/diagrams/ with the README index and 8 versioned Mermaid sources that reflect the v3.8.0 platform: - request-pipeline.mmd /v1/chat/completions request pipeline - auto-combo-9factor.mmd Auto-Combo 9-factor scoring weights - resilience-3layers.mmd Provider breaker / cooldown / model lockout - i18n-flow.mmd Hash-based incremental doc translation - mcp-tools-37.mmd MCP Server tool inventory by category - cloud-agent-flow.mmd Codex / Devin / Jules task lifecycle - authz-pipeline.mmd 3-class authz pipeline (PUBLIC/CLIENT_API/MANAGEMENT) - db-schema-overview.mmd Selected core SQLite relations Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
24 lines
1.1 KiB
Plaintext
24 lines
1.1 KiB
Plaintext
%% AuthZ pipeline (3 route classes + policy evaluation)
|
|
%% Reflects: src/middleware.ts, src/server/authz/pipeline.ts,
|
|
%% src/server/authz/policies/{public,clientApi,management}.ts
|
|
%% v3.8.0
|
|
flowchart LR
|
|
Req["Incoming request"] --> Strip["Strip trusted internal headers<br/>(x-omniroute-auth-*)"]
|
|
Strip --> Classify["classifyRoute()"]
|
|
Classify -->|PUBLIC| PubP["publicPolicy<br/>(login, health, status)"]
|
|
Classify -->|CLIENT_API| CliP["clientApiPolicy<br/>(/api/v1/*, /v1/*)"]
|
|
Classify -->|MANAGEMENT| MgmtP["managementPolicy<br/>(dashboard, settings, admin)"]
|
|
|
|
PubP -->|allow| Stamp["Stamp x-omniroute-auth-*<br/>(kind / id / label / scopes)"]
|
|
CliP -->|extract Bearer| Validate["validateApiKey()"]
|
|
Validate -->|valid| Stamp
|
|
Validate -->|"invalid (REQUIRE_API_KEY=true)"| Reject401["401 AUTH_002"]
|
|
Validate -->|"absent (REQUIRE_API_KEY=false)"| Anon["anonymous fallthrough"] --> Stamp
|
|
|
|
MgmtP -->|session ok| Stamp
|
|
MgmtP -->|Bearer w/ manage scope| Stamp
|
|
MgmtP -->|"Bearer invalid"| Reject403["403 AUTH_001"]
|
|
MgmtP -->|no auth| Reject401Mgmt["401 / 302 /login"]
|
|
|
|
Stamp --> Handler["Handler<br/>(uses assertAuth)"]
|