# etda/thaid-csharp-rp architecture

> Architecture diagram of the GitHub repository etda/thaid-csharp-rp, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/etda/thaid-csharp-rp
- Repository: https://github.com/etda/thaid-csharp-rp

## Overview

ThaIDAuthenExample is an ASP.NET MVC sample for ThaID OpenID Connect login; ThaIDAuthenAPIExample is a companion resource-server-style API demonstrating token inspection and revocation. The web flow starts at login, obtains tokens on callback, stores them in session, and supports refresh and ID-token validation. The API accepts bearer tokens and delegates inspection or revocation to ThaID. Relationships are based on the README and shown source excerpts; unsampled views and configuration are represented only where their paths are present in the tree.

Main entry points: [`ThaIDAuthenExample/Controllers/HomeController.cs`](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Controllers/HomeController.cs) (Authentication controller), [`ThaIDAuthenExample/Services/AuthenticationService.cs`](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Services/AuthenticationService.cs) (OIDC service), [`ThaIDAuthenAPIExample/Services/AuthenticationService.cs`](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Services/AuthenticationService.cs) (Token operations), [`ThaIDAuthenExample/Program.cs`](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Program.cs) (Token session)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_web["Web authentication"]
  node_webapp["MVC routes<br/>[Program.cs]"]
  node_home["Authentication controller<br/>[HomeController.cs]"]
  node_views["Authentication views"]
  node_session["Token session<br/>[Program.cs]"]
end

subgraph group_identity["Identity services"]
  node_authservice["OIDC service"]
  node_thaid{{"ThaID identity provider"}}
  node_jwks{{"ThaID JWKS"}}
end

subgraph group_api["Resource API"]
  node_apiapp["API routes<br/>[Program.cs]"]
  node_inspect["Token inspection endpoint"]
  node_revoke["Token revocation endpoint"]
  node_apiservice["Token operations"]
  node_dopa{{"ThaID resource APIs"}}
end

subgraph group_models["Token and response models"]
  node_tokenmodel["OIDC token model<br/>[TokenModel.cs]"]
  node_errormodel["Error response model<br/>[ErrorViewModel.cs]"]
  node_apiinspectmodel["Inspection response<br/>[TokenModel.cs]"]
  node_apirevokemodel["Revocation response<br/>[TokenModel.cs]"]
end

node_user(("Browser user"))
node_apiuser(("API caller"))

node_user -->|"opens login"| node_home
node_home -->|"creates provider"| node_authservice
node_home -->|"requests tokens"| node_authservice
node_authservice -->|"OIDC exchange"| node_thaid
node_home -->|"stores tokens"| node_session
node_home -->|"reads tokens"| node_session
node_home -->|"refreshes tokens"| node_authservice
node_home -->|"validates ID token"| node_authservice
node_authservice -->|"fetches keys"| node_jwks
node_authservice -->|"deserializes tokens"| node_tokenmodel
node_home -->|"renders"| node_views
node_home -->|"creates error model"| node_errormodel
node_webapp -->|"registers service"| node_authservice
node_webapp -->|"enables session"| node_session
node_apiuser -->|"submits bearer token"| node_inspect
node_apiuser -->|"submits bearer token"| node_revoke
node_apiapp -->|"registers service"| node_apiservice
node_inspect -->|"requests inspection"| node_apiservice
node_revoke -->|"requests revocation"| node_apiservice
node_apiservice -->|"posts inspection"| node_dopa
node_apiservice -->|"posts revocation"| node_dopa
node_apiservice -->|"deserializes response"| node_apiinspectmodel
node_apiservice -->|"deserializes response"| node_apirevokemodel

click node_webapp "https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Program.cs"
click node_home "https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Controllers/HomeController.cs"
click node_views "https://github.com/etda/thaid-csharp-rp/tree/main/ThaIDAuthenExample/Views/Home"
click node_session "https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Program.cs"
click node_authservice "https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Services/AuthenticationService.cs"
click node_tokenmodel "https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Models/TokenModel.cs"
click node_errormodel "https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Models/ErrorViewModel.cs"
click node_apiapp "https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Program.cs"
click node_inspect "https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Controllers/TokenInspectController.cs"
click node_revoke "https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Controllers/TokenRevokeController.cs"
click node_apiservice "https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Services/AuthenticationService.cs"
click node_apiinspectmodel "https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Models/TokenModel.cs"
click node_apirevokemodel "https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Models/TokenModel.cs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_webapp,node_home,node_views,node_session,node_user toneBlue
class node_authservice,node_thaid,node_jwks toneAmber
class node_apiapp,node_inspect,node_revoke,node_apiservice,node_dopa,node_apiuser toneMint
class node_tokenmodel,node_errormodel,node_apiinspectmodel,node_apirevokemodel toneRose
```

## Components

### Web authentication

- [MVC routes](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Program.cs): `ThaIDAuthenExample/Program.cs`
- [Authentication controller](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Controllers/HomeController.cs): `ThaIDAuthenExample/Controllers/HomeController.cs`
- [Authentication views](https://github.com/etda/thaid-csharp-rp/tree/main/ThaIDAuthenExample/Views/Home): `ThaIDAuthenExample/Views/Home`
- [Token session](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Program.cs): `ThaIDAuthenExample/Program.cs`

### Identity services

- [OIDC service](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Services/AuthenticationService.cs): `ThaIDAuthenExample/Services/AuthenticationService.cs`
- **ThaID identity provider**
- **ThaID JWKS**

### Resource API

- [API routes](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Program.cs): `ThaIDAuthenAPIExample/Program.cs`
- [Token inspection endpoint](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Controllers/TokenInspectController.cs): `ThaIDAuthenAPIExample/Controllers/TokenInspectController.cs`
- [Token revocation endpoint](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Controllers/TokenRevokeController.cs): `ThaIDAuthenAPIExample/Controllers/TokenRevokeController.cs`
- [Token operations](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Services/AuthenticationService.cs): `ThaIDAuthenAPIExample/Services/AuthenticationService.cs`
- **ThaID resource APIs**

### Token and response models

- [OIDC token model](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Models/TokenModel.cs): `ThaIDAuthenExample/Models/TokenModel.cs`
- [Error response model](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenExample/Models/ErrorViewModel.cs): `ThaIDAuthenExample/Models/ErrorViewModel.cs`
- [Inspection response](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Models/TokenModel.cs): `ThaIDAuthenAPIExample/Models/TokenModel.cs`
- [Revocation response](https://github.com/etda/thaid-csharp-rp/blob/main/ThaIDAuthenAPIExample/Models/TokenModel.cs): `ThaIDAuthenAPIExample/Models/TokenModel.cs`

### Other components

- **Browser user**
- **API caller**

## Connections

- Browser user → Authentication controller: opens login (evidence: `README.md`)
- Authentication controller → OIDC service: creates provider (evidence: `ThaIDAuthenExample/Controllers/HomeController.cs`)
- Authentication controller → OIDC service: requests tokens (evidence: `ThaIDAuthenExample/Controllers/HomeController.cs`)
- OIDC service → ThaID identity provider: OIDC exchange (evidence: `ThaIDAuthenExample/Services/AuthenticationService.cs`)
- Authentication controller → Token session: stores tokens (evidence: `README.md`)
- Authentication controller → Token session: reads tokens (evidence: `ThaIDAuthenExample/Controllers/HomeController.cs`)
- Authentication controller → OIDC service: refreshes tokens (evidence: `ThaIDAuthenExample/Controllers/HomeController.cs`)
- Authentication controller → OIDC service: validates ID token (evidence: `ThaIDAuthenExample/Controllers/HomeController.cs`)
- OIDC service → ThaID JWKS: fetches keys (evidence: `ThaIDAuthenExample/Services/AuthenticationService.cs`)
- OIDC service → OIDC token model: deserializes tokens (evidence: `README.md`)
- Authentication controller → Authentication views: renders (evidence: `ThaIDAuthenExample/Controllers/HomeController.cs`)
- Authentication controller → Error response model: creates error model (evidence: `ThaIDAuthenExample/Controllers/HomeController.cs`)
- MVC routes → OIDC service: registers service (evidence: `ThaIDAuthenExample/Program.cs`)
- MVC routes → Token session: enables session (evidence: `ThaIDAuthenExample/Program.cs`)
- API caller → Token inspection endpoint: submits bearer token (evidence: `ThaIDAuthenAPIExample/Controllers/TokenInspectController.cs`)
- API caller → Token revocation endpoint: submits bearer token (evidence: `ThaIDAuthenAPIExample/Controllers/TokenRevokeController.cs`)
- API routes → Token operations: registers service (evidence: `ThaIDAuthenAPIExample/Program.cs`)
- Token inspection endpoint → Token operations: requests inspection (evidence: `ThaIDAuthenAPIExample/Controllers/TokenInspectController.cs`)
- Token revocation endpoint → Token operations: requests revocation (evidence: `ThaIDAuthenAPIExample/Controllers/TokenRevokeController.cs`)
- Token operations → ThaID resource APIs: posts inspection (evidence: `ThaIDAuthenAPIExample/Services/AuthenticationService.cs`)
- Token operations → ThaID resource APIs: posts revocation (evidence: `ThaIDAuthenAPIExample/Services/AuthenticationService.cs`)
- Token operations → Inspection response: deserializes response (evidence: `ThaIDAuthenAPIExample/Services/AuthenticationService.cs`)
- Token operations → Revocation response: deserializes response (evidence: `ThaIDAuthenAPIExample/Services/AuthenticationService.cs`)