OpenID Connect login application diagrams

OpenID Connect login application

Start with how the application begins, then follow data between its folders. Open an operation to see its decisions, calls, failures and cleanup. Its explanation supplies the exact contract and linked dependencies.

This view includes 22 application source files. Package and interface boundaries show checked contracts; their runtime implementations are not expanded. The views describe the checked program, not desired requirements or a recorded execution.

Where execution begins

HTTP configuration

Listen on 127.0.0.1. Limit request bodies to 16384 bytes and buffered responses to 1048576 bytes. Serve OpenAPI at /openapi.json and API docs at /docs.

Providers

Crypto is provided by GnuTlsCrypto. The same instance is shared. Clock is provided by SystemClock. The same instance is shared.

HttpClient is provided by WebHttpClient. The same instance is shared.

SigningKeys is provided by MemorySigningKeys. The same instance is shared. Shared mutation is allowed.

ExpiringStore<LoginTransaction> is provided by MemoryStore<LoginTransaction>. The same instance is shared. Shared mutation is allowed.

ExpiringStore<AuthorizationRequest> is provided by MemoryStore<AuthorizationRequest>. The same instance is shared. Shared mutation is allowed.

ExpiringStore<AuthorizationCode> is provided by MemoryStore<AuthorizationCode>. The same instance is shared. Shared mutation is allowed.

ExpiringStore<SessionClaims> is provided by MemoryStore<SessionClaims>. The same instance is shared. Shared mutation is allowed.

ExpiringStore<AccessGrant> is provided by MemoryStore<AccessGrant>. The same instance is shared. Shared mutation is allowed.

Startup

It tries to call initializeKeys using injected Crypto for crypto and SigningKeys for keys. If this work raises CryptoError, it prints "Cryptographic initialization failed"; then it calls exit with status 1. If this work raises KeyError, it prints "Signing keys could not be initialized"; then it calls exit with status 1. It serves home, me, logout, startLogin, loginCallback, discovery, jwks, authorize, providerLogin, token, and userinfo on port 8787. source

Data flow

100%

Mermaid source

flowchart TD
    n0["HTTP requests"]
    n1["client"]
    n2["common"]
    n3["Startup"]
    n4["provider"]
    n0 -->|"5 HTTP routes → Html response / UserInfo response"| n1
    n0 -->|"6 HTTP routes → Discovery / Html response + 2 more"| n4
    n1 -->|"Page(title, children) / SigningKeys.session + 3 more → Headers / Html + 2 more"| n2
    n3 -->|"initializeKeys"| n2
    n4 -->|"Page(title, children) / SigningKeys.provider + 3 more → Headers / Html + 2 more"| n2

Package boundaries

client package calls

100%

Mermaid source

flowchart LR
    n0["client"]
    n1["memory"]
    n2["json"]
    n3["web"]
    n4["crypto"]
    n5["time"]
    n0 -->|"ExpiringStore.get(key, now) / ExpiringStore.put(key, value, …) + 1 more → optional LoginTransaction / optional Sessio…"| n1
    n0 -->|"parse(input) → Json"| n2
    n0 -->|"HttpClient.request(method, url, …) / urlEncode(input) → Bytes response / string"| n3
    n0 -->|"Crypto.equal(left, right) / Crypto.publicRsa(key) + 5 more → Bytes / Json + 3 more"| n4
    n0 -->|"Clock.now → int"| n5

common package calls

100%

Mermaid source

flowchart LR
    n0["common"]
    n1["web"]
    n2["crypto"]
    n0 -->|"cookie(name, value, …) → Headers"| n1
    n0 -->|"Crypto.generateRsa → RsaPrivateKey"| n2

provider package calls

100%

Mermaid source

flowchart LR
    n0["memory"]
    n1["web"]
    n2["crypto"]
    n3["time"]
    n4["provider"]
    n4 -->|"ExpiringStore.get(key, now) / ExpiringStore.put(key, value, …) + 1 more → optional AccessGrant / optional Authorizati…"| n0
    n4 -->|"urlEncode(input) → string"| n1
    n4 -->|"Crypto.decodeBase64url(input) / Crypto.equal(left, right) + 6 more → Bytes / RsaJwk + 3 more"| n2
    n4 -->|"Clock.now → int"| n3

Follow the data

Each row opens the complete operations and call sites behind one pair of logical units. A grouped arrow records calls between those units; connected arrows need not belong to the same execution path.

From	To	Operations	Read
HTTP requests	client	5	Inputs, results and call sites
HTTP requests	provider	6	Inputs, results and call sites
client	common	5	Inputs, results and call sites
client	memory	5	Inputs, results and call sites
client	json	1	Inputs, results and call sites
client	web	4	Inputs, results and call sites
client	crypto	10	Inputs, results and call sites
client	time	1	Inputs, results and call sites
client	provider	2	Inputs, results and call sites
common	web	1	Inputs, results and call sites
common	crypto	1	Inputs, results and call sites
Startup	common	1	Inputs, results and call sites
provider	common	5	Inputs, results and call sites
provider	memory	6	Inputs, results and call sites
provider	web	1	Inputs, results and call sites
provider	crypto	9	Inputs, results and call sites
provider	time	1	Inputs, results and call sites

Data crossing these boundaries (64 contracts)

HTTP requests → client

5 operations, 5 sites

GET / · HTTP endpoint

Inputs: token: optional string from cookie. Result: HttpResponse<Html>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

GET /login/callback · HTTP endpoint

Inputs: code: string from query, state: string from query, browser: optional string from cookie. Result: HttpResponse<Html>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

GET /login/start · HTTP endpoint

No caller-supplied inputs. Result: HttpResponse<Html>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

GET /me · HTTP endpoint

Inputs: token: optional string from cookie. Result: HttpResponse<UserInfo>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

POST /logout · HTTP endpoint

Inputs: input: LogoutForm from form, token: optional string from cookie, origin: optional string from header. Result: HttpResponse<Html>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

HTTP requests → provider

6 operations, 6 sites

GET /provider/.well-known/openid-configuration · HTTP endpoint

No caller-supplied inputs. Result: Discovery.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

GET /provider/authorize · HTTP endpoint

Inputs: response_type: string from query, client_id: string from query, redirect_uri: string from query, requestedScope: string from query, state: string from query, nonce: string from query, code_challenge: string from query, code_challenge_method: string from query. Result: HttpResponse<Html>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

GET /provider/jwks · HTTP endpoint

No caller-supplied inputs. Result: RsaJwks.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

GET /provider/userinfo · HTTP endpoint

Inputs: authorization: optional string from header. Result: HttpResponse<Json>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

POST /provider/login · HTTP endpoint

Inputs: form: LoginForm from form, browser: optional string from cookie, origin: optional string from header. Result: HttpResponse<Html>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

POST /provider/token · HTTP endpoint

Inputs: http: HttpRequest from request. Result: HttpResponse<Json>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

client → common

5 operations, 21 sites

Page

Inputs: title: string, children: List<Html>. Result: Html.

Caller or entry	Evidence
LoginPage	Call site · Caller explanation
Welcome	Call site · Caller explanation

SigningKeys.session · interface dispatch

No caller-supplied inputs. Result: RsaPrivateKey.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation
authenticate	Call site · Caller explanation

securityHeaders

No caller-supplied inputs. Result: Headers.

Caller or entry	Evidence
home	Call site · Caller explanation
home	Call site · Caller explanation
me	Call site · Caller explanation
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation
logout	Call site · Caller explanation

settings

No caller-supplied inputs. Result: Settings.

Caller or entry	Evidence
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation
logout	Call site · Caller explanation
discover	Call site · Caller explanation
validateIdentity	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation
authenticate	Call site · Caller explanation

withCookie

Inputs: headers: Headers, name: string, value: string, path: string, maxAge: int, secure: bool. Result: Headers.

Caller or entry	Evidence
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
logout	Call site · Caller explanation

client → memory

5 operations, 5 sites

ExpiringStore.get · interface dispatch

Inputs: key: string, now: int. Result: optional SessionClaims.

Caller or entry	Evidence
authenticate	Call site · Caller explanation

ExpiringStore.put · interface dispatch

Inputs: key: string, value: LoginTransaction, expires: int, now: int. Result: void.

Caller or entry	Evidence
startLogin	Call site · Caller explanation

ExpiringStore.put · interface dispatch

Inputs: key: string, value: SessionClaims, expires: int, now: int. Result: void.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

ExpiringStore.take · interface dispatch

Inputs: key: string, now: int. Result: optional LoginTransaction.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

ExpiringStore.take · interface dispatch

Inputs: key: string, now: int. Result: optional SessionClaims.

Caller or entry	Evidence
logout	Call site · Caller explanation

client → json

1 operation, 1 site

parse

Inputs: input: string. Result: Json.

Caller or entry	Evidence
responseJson	Call site · Caller explanation

client → web

4 operations, 13 sites

HttpClient.request · interface dispatch

Inputs: method: string, url: string, headers: Headers, body: Bytes. Result: HttpResponse<Bytes>.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

HttpClient.request · interface dispatch

Inputs: method: string, url: string, headers: Headers, body: optional Bytes. Result: HttpResponse<Bytes>.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

HttpClient.request · interface dispatch

Inputs: method: string, url: string, headers: optional Headers, body: optional Bytes. Result: HttpResponse<Bytes>.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation
discover	Call site · Caller explanation

urlEncode

Inputs: input: string. Result: string.

Caller or entry	Evidence
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation

client → crypto

10 operations, 23 sites

Crypto.equal · interface dispatch

Inputs: left: Bytes, right: Bytes. Result: bool.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation
logout	Call site · Caller explanation
validateIdentity	Call site · Caller explanation
authenticate	Call site · Caller explanation

Crypto.generateRsa · interface dispatch

No caller-supplied inputs. Result: RsaPrivateKey.

Caller or entry	Evidence
test validateIdentity	Call site · Caller explanation

Crypto.publicRsa · interface dispatch

Inputs: key: RsaPrivateKey. Result: RsaPublicKey.

Caller or entry	Evidence
test validateIdentity	Call site · Caller explanation
authenticate	Call site · Caller explanation

Crypto.random · interface dispatch

Inputs: size: int. Result: Bytes.

Caller or entry	Evidence
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation

Crypto.sha256 · interface dispatch

Inputs: input: Bytes. Result: Bytes.

Caller or entry	Evidence
startLogin	Call site · Caller explanation

RsaJwks · value construction

Inputs: keys: List<RsaJwk>. Result: RsaJwks.

Caller or entry	Evidence
test validateIdentity	Call site · Caller explanation

importJwk

Inputs: jwk: RsaJwk. Result: RsaPublicKey.

Caller or entry	Evidence
validateIdentity	Call site · Caller explanation

rsaJwk

Inputs: publicKey: RsaPublicKey, kid: string. Result: RsaJwk.

Caller or entry	Evidence
test validateIdentity	Call site · Caller explanation

signJwt

Inputs: key: RsaPrivateKey, claims: Json, kid: string, tokenType: string. Result: string.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation

verifyJwt

Inputs: token: string, publicKey: RsaPublicKey, kid: string, tokenType: string. Result: Json.

Caller or entry	Evidence
validateIdentity	Call site · Caller explanation
authenticate	Call site · Caller explanation

client → time

1 operation, 7 sites

Clock.now · interface dispatch

No caller-supplied inputs. Result: int.

Caller or entry	Evidence
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
logout	Call site · Caller explanation
authenticate	Call site · Caller explanation

client → provider

2 operations, 4 sites

IdClaims · value construction

Inputs: iss: string, sub: string, aud: string, exp: int, iat: int, nonce: string, name: string. Result: IdClaims.

Caller or entry	Evidence
test validateIdentity	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation

UserInfo · value construction

Inputs: sub: string, name: string. Result: UserInfo.

Caller or entry	Evidence
me	Call site · Caller explanation

common → web

1 operation, 1 site

cookie

Inputs: name: string, value: string, path: string, maxAge: int, secure: bool. Result: Headers.

Caller or entry	Evidence
withCookie	Call site · Caller explanation

common → crypto

1 operation, 2 sites

Crypto.generateRsa · interface dispatch

No caller-supplied inputs. Result: RsaPrivateKey.

Caller or entry	Evidence
initializeKeys	Call site · Caller explanation
initializeKeys	Call site · Caller explanation

Startup → common

1 operation, 1 site

initializeKeys

No caller-supplied inputs. Result: void.

Caller or entry	Evidence
Startup	Call site · Caller explanation

provider → common

5 operations, 22 sites

Page

Inputs: title: string, children: List<Html>. Result: Html.

Caller or entry	Evidence
ProviderLogin	Call site · Caller explanation
ProviderFailure	Call site · Caller explanation

SigningKeys.provider · interface dispatch

No caller-supplied inputs. Result: RsaPrivateKey.

Caller or entry	Evidence
jwks	Call site · Caller explanation
token	Call site · Caller explanation

securityHeaders

No caller-supplied inputs. Result: Headers.

Caller or entry	Evidence
authorize	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
_oauthError	Call site · Caller explanation
token	Call site · Caller explanation
userinfo	Call site · Caller explanation
userinfo	Call site · Caller explanation

settings

No caller-supplied inputs. Result: Settings.

Caller or entry	Evidence
authorize	Call site · Caller explanation
providerLogin	Call site · Caller explanation
discovery	Call site · Caller explanation
token	Call site · Caller explanation

withCookie

Inputs: headers: Headers, name: string, value: string, path: string, maxAge: int, secure: bool. Result: Headers.

Caller or entry	Evidence
authorize	Call site · Caller explanation
providerLogin	Call site · Caller explanation

provider → memory

6 operations, 6 sites

ExpiringStore.get · interface dispatch

Inputs: key: string, now: int. Result: optional AccessGrant.

Caller or entry	Evidence
userinfo	Call site · Caller explanation

ExpiringStore.put · interface dispatch

Inputs: key: string, value: AccessGrant, expires: int, now: int. Result: void.

Caller or entry	Evidence
token	Call site · Caller explanation

ExpiringStore.put · interface dispatch

Inputs: key: string, value: AuthorizationCode, expires: int, now: int. Result: void.

Caller or entry	Evidence
providerLogin	Call site · Caller explanation

ExpiringStore.put · interface dispatch

Inputs: key: string, value: AuthorizationRequest, expires: int, now: int. Result: void.

Caller or entry	Evidence
authorize	Call site · Caller explanation

ExpiringStore.take · interface dispatch

Inputs: key: string, now: int. Result: optional AuthorizationRequest.

Caller or entry	Evidence
providerLogin	Call site · Caller explanation

ExpiringStore.take · interface dispatch

Inputs: key: string, now: int. Result: optional AuthorizationCode.

Caller or entry	Evidence
token	Call site · Caller explanation

provider → web

1 operation, 2 sites

urlEncode

Inputs: input: string. Result: string.

Caller or entry	Evidence
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation

provider → crypto

9 operations, 18 sites

Crypto.decodeBase64url · interface dispatch

Inputs: input: string. Result: Bytes.

Caller or entry	Evidence
authorize	Call site · Caller explanation
verifyCredentials	Call site · Caller explanation

Crypto.equal · interface dispatch

Inputs: left: Bytes, right: Bytes. Result: bool.

Caller or entry	Evidence
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
verifyCredentials	Call site · Caller explanation
verifyCredentials	Call site · Caller explanation
token	Call site · Caller explanation

Crypto.passwordHash · interface dispatch

Inputs: password: Bytes, salt: Bytes, iterations: int. Result: Bytes.

Caller or entry	Evidence
verifyCredentials	Call site · Caller explanation

Crypto.publicRsa · interface dispatch

Inputs: key: RsaPrivateKey. Result: RsaPublicKey.

Caller or entry	Evidence
jwks	Call site · Caller explanation

Crypto.random · interface dispatch

Inputs: size: int. Result: Bytes.

Caller or entry	Evidence
authorize	Call site · Caller explanation
authorize	Call site · Caller explanation
authorize	Call site · Caller explanation
providerLogin	Call site · Caller explanation
token	Call site · Caller explanation

Crypto.sha256 · interface dispatch

Inputs: input: Bytes. Result: Bytes.

Caller or entry	Evidence
token	Call site · Caller explanation

RsaJwks · value construction

Inputs: keys: List<RsaJwk>. Result: RsaJwks.

Caller or entry	Evidence
jwks	Call site · Caller explanation

rsaJwk

Inputs: publicKey: RsaPublicKey, kid: string. Result: RsaJwk.

Caller or entry	Evidence
jwks	Call site · Caller explanation

signJwt

Inputs: key: RsaPrivateKey, claims: Json, kid: string, tokenType: string. Result: string.

Caller or entry	Evidence
token	Call site · Caller explanation

provider → time

1 operation, 5 sites

Clock.now · interface dispatch

No caller-supplied inputs. Result: int.

Caller or entry	Evidence
authorize	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
token	Call site · Caller explanation
userinfo	Call site · Caller explanation

Open a folder

Folder	Read
client	Folder data flow
common	Folder data flow
provider	Folder data flow

Open a module

Module	Read
client/contracts.aug	Flow and sequences · Explanation
client/endpoints.aug	Flow and sequences · Explanation
client/export.aug	Flow and sequences · Explanation
client/login.aug	Flow and sequences · Explanation
client/logout.aug	Flow and sequences · Explanation
client/protocol.aug	Flow and sequences · Explanation
client/session.aug	Flow and sequences · Explanation
client/views.aug	Flow and sequences · Explanation
common/export.aug	Flow and sequences · Explanation
common/headers.aug	Flow and sequences · Explanation
common/keys.aug	Flow and sequences · Explanation
common/settings.aug	Flow and sequences · Explanation
common/views.aug	Flow and sequences · Explanation
main.aug	Flow and sequences · Explanation
provider/authorization.aug	Flow and sequences · Explanation
provider/contracts.aug	Flow and sequences · Explanation
provider/credentials.aug	Flow and sequences · Explanation
provider/discovery.aug	Flow and sequences · Explanation
provider/export.aug	Flow and sequences · Explanation
provider/token.aug	Flow and sequences · Explanation
provider/userinfo.aug	Flow and sequences · Explanation
provider/views.aug	Flow and sequences · Explanation

These are static call boundaries, not a request trace. Interface implementations and foreign internals stop at their checked contracts. Dotted arrows defer a callback or browser action. Imports alone do not imply a call.

HTTP APIs

API	Operation
GET /	home
GET /me	me
GET /login/start	startLogin
GET /login/callback	loginCallback
POST /logout	logout
GET /provider/authorize	authorize
POST /provider/login	providerLogin
GET /provider/.well-known/openid-configuration	discovery
GET /provider/jwks	jwks
POST /provider/token	token
GET /provider/userinfo	userinfo

OpenID Connect login application diagrams ​

Where execution begins ​

HTTP configuration ​

Providers ​

Startup ​

Data flow ​

Package boundaries ​

Follow the data ​

Data crossing these boundaries (64 contracts) ​

HTTP requests → client ​

HTTP requests → provider ​

client → common ​

client → memory ​

client → json ​

client → web ​

client → crypto ​

client → time ​

client → provider ​

common → web ​

common → crypto ​

Startup → common ​

provider → common ​

provider → memory ​

provider → web ​

provider → crypto ​

provider → time ​

Open a folder ​

Open a module ​

HTTP APIs ​

OpenID Connect login application diagrams

Where execution begins

HTTP configuration

Providers

Startup

Data flow

Package boundaries

Follow the data

Data crossing these boundaries (64 contracts)

HTTP requests → client

HTTP requests → provider

client → common

client → memory

client → json

client → web

client → crypto

client → time

client → provider

common → web

common → crypto

Startup → common

provider → common

provider → memory

provider → web

provider → crypto

provider → time

Open a folder

Open a module

HTTP APIs