Архитектура

flowchart TB
    admin[["👤 Administrator"]]
    user[["👤 End user"]]

    subgraph versola["⚡ Versola"]
        proxy["versola-proxy<br/><i>nginx</i><br/>Routing and admin console files"]
        edge["edge<br/><i>traffic plane</i><br/>Sessions, policies, native gateway"]
        auth["auth<br/><i>data plane</i><br/>OAuth 2.1 and OIDC server"]
        central["central<br/><i>control plane</i><br/>Configuration and Central API"]
        db[("Postgres<br/>one database<br/>schemas auth, central, edge")]
    end

    upstream{{"🔌 Upstream APIs"}}
    notifications{{"📧 OTP delivery"}}

    admin -->|Console and API| proxy
    user -->|Login and API calls| proxy

    proxy --> edge
    proxy --> auth
    edge -->|Token, PAR, userinfo| auth
    edge -->|Console API calls| central
    edge -.->|Sync| central
    auth -.->|Sync| central
    edge -->|Proxy| upstream
    auth -->|Request OTP| notifications

    central --> db
    auth --> db
    edge --> db

    style admin fill:#92400e,stroke:#92400e,color:#fff
    style user fill:#166534,stroke:#166534,color:#fff
    style proxy fill:#334155,stroke:#e6edf3,color:#fff
    style central fill:#155e75,stroke:#e6edf3,color:#fff
    style edge fill:#155e75,stroke:#e6edf3,color:#fff
    style auth fill:#155e75,stroke:#e6edf3,color:#fff
    style db fill:#0e4a5c,stroke:#e6edf3,color:#fff
    style upstream fill:#334155,stroke:#e6edf3,color:#fff
    style notifications fill:#334155,stroke:#e6edf3,color:#fff
    style versola fill:#eaf3f5,stroke:#155e75,stroke-width:2px,color:#15171c

flowchart TB
    admin[["👤 Admin<br/><i>Manages platform</i>"]]
    user[["👤 End User<br/><i>Accesses apps</i>"]]

    versola["⚡ Versola<br/><b>Identity & Authorization Platform</b>"]

    upstream{{"🔌 Upstream<br/>Backend APIs"}}
    notifications{{"📧 Notification Channel<br/>Notifications"}}

    admin -->|Manage| versola
    user -->|Auth| versola
    versola -->|Proxy| upstream
    versola -->|Request Notification| notifications

    style admin fill:#92400e,stroke:#92400e,color:#fff
    style user fill:#166534,stroke:#166534,color:#fff
    style versola fill:#155e75,stroke:#e6edf3,color:#fff,stroke-width:3px
    style upstream fill:#334155,stroke:#e6edf3,color:#fff
    style notifications fill:#334155,stroke:#e6edf3,color:#fff

sequenceDiagram
    autonumber
    participant B as Browser
    participant E as edge
    participant A as auth
    participant U as Upstream

    B->>E: GET /login/:presetId
    E->>A: POST /par (when the client requires PAR)
    E-->>B: 302 → auth /authorize (PKCE, state)

    note over B,A: Challenge flow (password / OTP / passkey)

    A-->>B: 302 → edge /complete?code=…&state=…
    B->>E: GET /complete?code=…
    E->>A: POST /token (code + PKCE verifier)
    A-->>E: access_token + refresh_token
    E->>E: Store refresh token in DB
    E-->>B: 302 → app  +  Set-Cookie: EDGE_SESSION

    note over B,E: Session active — every request carries the cookie

    B->>E: GET /resources/api/v1/data
    E->>E: Validate token, check revocation, evaluate CEL rules
    E->>U: Forward + inject Authorization header (Basic / Bearer)
    U-->>E: 200 OK
    E-->>B: 200 OK (upstream Set-Cookie stripped)

sequenceDiagram
    autonumber
    participant M as Mobile app
    participant E as edge
    participant A as auth
    participant U as Upstream

    M->>E: POST /native/start/{clientId} + DPoP proof (device key)
    E->>A: POST /par as the client (PKCE, state, dpop_jkt)
    E-->>M: request_uri, sealed blob

    note over M,A: System browser opens auth /authorize, user signs in

    A-->>M: Redirect to the App Link with code and state
    M->>E: POST /native/complete/{clientId} + blob + DPoP proof
    E->>A: POST /token (code + PKCE verifier from blob)
    A-->>E: DPoP-bound access_token + refresh_token
    E-->>M: Token response relayed unchanged
    M->>M: Store tokens and device key (Keychain / Keystore)

    note over M,E: Session active — app sends DPoP-bound calls

    M->>E: GET /resources/api/v1/data + Authorization: DPoP + DPoP proof
    E->>E: Check revocation, token binding, permissions and CEL rules
    E->>U: Forward + inject Authorization header
    U-->>E: 200 OK
    E-->>M: 200 OK

    note over M,E: Refresh

    M->>E: POST /native/token/{clientId} (refresh_token) + DPoP proof
    E->>A: POST /token as the client
    A-->>E: new tokens
    E-->>M: new tokens