How eternityradiance/vault_v3.0 works
Vault is a FastAPI OAuth 2.0/OIDC provider with REST and GraphQL APIs plus server-rendered user and admin interfaces. The main user flow is browser login, OAuth authorization and consent, then a client exchanges an authorization code or refresh token for tokens and uses OIDC endpoints. The graph also includes registration/login, administration, audit, and persistence. Relationships use README documentation and the supplied source index; unsampled grant and endpoint internals are represented by their exact tree paths, without assuming their internal call chain.
Main entry points: service.py Registration and login · main.py FastAPI application · router.py OAuth routes · token.py Token endpoint
Components 24
Application APIs
- FastAPI application
app/main.py - Auth REST routes
app/auth/router.py - Registration and login
app/auth/service.py - Admin GraphQL API
app/graphql/resolvers.py
OAuth and OIDC
- OAuth routes
app/oauth/router.py - Authorization endpoint
app/oauth/authorize.py - Token endpoint
app/oauth/token.py - Authorization-code grant
app/oauth/grants/authorization_code.py - Refresh-token grant
app/oauth/grants/refresh_token.py - Client authentication
app/oauth/client_auth.py - OIDC discovery and keys
app/oauth/discovery.py - Token introspection and revocation
app/oauth/introspect.py - UserInfo endpoint
app/oauth/userinfo.py
Web experience
- Consent workflow
app/web/consent_router.py - User web interface
app/web/router.py - Admin console
app/web/admin_router.py
Identity and state
- Audit service
app/audit/service.py - JWT and RSA security
app/core/jwt.py - User records
app/models/user.py - OAuth client records
app/models/oauth_client.py - PostgreSQL
app/db/session.py - Redis state
app/redis_client.py
Other components
- End user
- OAuth client
Connections 29
- End user → User web interface: uses
README.md - User web interface → Registration and login: authenticates via
app/web/router.py - Registration and login → User records: reads and writes
app/auth/service.py - Registration and login → JWT and RSA security: issues access token
app/auth/service.py - Registration and login → Audit service: records events
app/auth/service.py - OAuth client → Authorization endpoint: requests authorization
README.md - Authorization endpoint → Consent workflow: routes for consent
README.md - End user → Consent workflow: grants consent
README.md - OAuth client → Token endpoint: exchanges grant
README.md - OAuth routes → Authorization endpoint: routes to
app/oauth/router.py - OAuth routes → Token endpoint: routes to
app/oauth/router.py - OAuth routes → Token introspection and revocation: routes to
app/oauth/router.py - OAuth routes → UserInfo endpoint: routes to
app/oauth/router.py - Token endpoint → Authorization-code grant: dispatches grants
- Token endpoint → Refresh-token grant: dispatches grants
- Token endpoint → Client authentication: authenticates client
- Client authentication → OAuth client records: checks credentials
app/oauth/client_auth.py - FastAPI application → Auth REST routes: mounts routes
app/main.py - FastAPI application → OAuth routes: mounts routes
app/main.py - FastAPI application → Admin GraphQL API: mounts schema
app/main.py - FastAPI application → User web interface: mounts routes
app/main.py - FastAPI application → OIDC discovery and keys: serves discovery
app/main.py - Admin console → User records: manages users
app/web/admin_router.py - Admin console → OAuth client records: manages clients
app/web/admin_router.py - Admin console → Audit service: queries audit
app/web/admin_router.py - Auth REST routes → Registration and login: calls
app/auth/router.py - Admin GraphQL API → Registration and login: uses account service
app/graphql/resolvers.py - PostgreSQL → User records: persists
- Token introspection and revocation → Redis state: blacklists tokens