{
    "$schema": "../../../../schemas/diagram-spec.schema.json",
    "schemaVersion": "1.0",
    "id": "secure-web-system",
    "title": "セキュアWebシステム構成",
    "description": "ネットワーク境界と信頼境界を明示したWebアプリケーションの参照構成。",
    "language": "mixed",
    "legend": [
        {
            "label": "同期リクエスト",
            "variant": "realtime"
        },
        {
            "label": "認証・信頼パス",
            "variant": "warning"
        },
        {
            "label": "外部境界",
            "variant": "external"
        }
    ],
    "boundaries": [
        {
            "id": "public-edge",
            "type": "network",
            "variant": "external",
            "title": "PUBLIC EDGE"
        },
        {
            "id": "application-network",
            "type": "network",
            "variant": "realtime",
            "title": "APPLICATION NETWORK"
        },
        {
            "id": "data-trust-zone",
            "type": "trust",
            "variant": "warning",
            "title": "DATA TRUST ZONE"
        }
    ],
    "nodes": [
        {
            "id": "browser",
            "type": "client",
            "variant": "external",
            "status": "stable",
            "title": "利用者ブラウザ",
            "subtitle": "Untrusted client",
            "icon": "user"
        },
        {
            "id": "cdn-waf",
            "type": "security",
            "variant": "external",
            "status": "stable",
            "title": "CDN / WAF",
            "subtitle": "DDoS and filtering",
            "icon": "shield"
        },
        {
            "id": "api-gateway",
            "type": "api",
            "variant": "realtime",
            "status": "stable",
            "title": "API GATEWAY",
            "subtitle": "Rate limit",
            "icon": "network"
        },
        {
            "id": "web-application",
            "type": "service",
            "variant": "realtime",
            "status": "stable",
            "title": "WEB\nAPPLICATION",
            "subtitle": "Business logic",
            "icon": "monitor"
        },
        {
            "id": "auth-service",
            "type": "security",
            "variant": "warning",
            "status": "stable",
            "title": "認証サービス",
            "subtitle": "OIDC / policy",
            "icon": "shield"
        },
        {
            "id": "session-cache",
            "type": "cache",
            "variant": "delegated",
            "status": "stable",
            "title": "SESSION CACHE",
            "subtitle": "Short-lived state",
            "icon": "storage"
        },
        {
            "id": "application-db",
            "type": "database",
            "variant": "warning",
            "status": "stable",
            "title": "APPLICATION DB",
            "subtitle": "Encrypted records",
            "icon": "database"
        },
        {
            "id": "secrets-manager",
            "type": "security",
            "variant": "critical",
            "status": "stable",
            "title": "SECRETS\nMANAGER",
            "subtitle": "Keys and credentials",
            "icon": "shield"
        }
    ],
    "edges": [
        {
            "id": "browser-to-edge",
            "from": "browser",
            "to": "cdn-waf",
            "type": "sync-request",
            "variant": "external",
            "label": "HTTPS",
            "direction": "bidirectional",
            "protocol": "HTTPS"
        },
        {
            "id": "edge-to-gateway",
            "from": "cdn-waf",
            "to": "api-gateway",
            "type": "sync-request",
            "variant": "realtime",
            "label": "FILTERED HTTPS",
            "direction": "forward",
            "protocol": "HTTPS"
        },
        {
            "id": "gateway-to-app",
            "from": "api-gateway",
            "to": "web-application",
            "type": "sync-request",
            "variant": "realtime",
            "label": "REQUEST",
            "direction": "bidirectional",
            "protocol": "HTTP"
        },
        {
            "id": "app-to-db",
            "from": "web-application",
            "to": "application-db",
            "type": "data-read",
            "variant": "warning",
            "label": "ENCRYPTED SQL",
            "direction": "bidirectional",
            "protocol": "TLS"
        },
        {
            "id": "gateway-to-auth",
            "from": "api-gateway",
            "to": "auth-service",
            "type": "authentication",
            "variant": "warning",
            "label": "TOKEN VERIFY",
            "direction": "bidirectional",
            "protocol": "OIDC"
        },
        {
            "id": "app-to-auth",
            "from": "web-application",
            "to": "auth-service",
            "type": "authentication",
            "variant": "warning",
            "label": "POLICY CHECK",
            "direction": "forward"
        },
        {
            "id": "app-to-cache",
            "from": "web-application",
            "to": "session-cache",
            "type": "data-read",
            "variant": "delegated",
            "label": "SESSION",
            "direction": "bidirectional"
        },
        {
            "id": "cache-to-db",
            "from": "session-cache",
            "to": "application-db",
            "type": "data-write",
            "variant": "delegated",
            "label": "PERSIST",
            "direction": "forward",
            "protocol": "TLS"
        },
        {
            "id": "auth-to-secrets",
            "from": "auth-service",
            "to": "secrets-manager",
            "type": "authentication",
            "variant": "critical",
            "label": "KEY ACCESS",
            "direction": "bidirectional",
            "protocol": "mTLS"
        }
    ]
}