# eternityradiance/vault_v3.0 architecture

> Architecture diagram of the GitHub repository eternityradiance/vault_v3.0, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/eternityradiance/vault_v3.0
- Repository: https://github.com/eternityradiance/vault_v3.0

## Overview

Vault is a FastAPI OAuth 2.0/OIDC provider with REST and GraphQL APIs plus server-rendered user and admin interfaces. The main user flow is browser login, OAuth authorization and consent, then a client exchanges an authorization code or refresh token for tokens and uses OIDC endpoints. The graph also includes registration/login, administration, audit, and persistence. Relationships use README documentation and the supplied source index; unsampled grant and endpoint internals are represented by their exact tree paths, without assuming their internal call chain.

Main entry points: [`app/auth/service.py`](https://github.com/eternityradiance/vault_v3.0/blob/main/app/auth/service.py) (Registration and login), [`app/main.py`](https://github.com/eternityradiance/vault_v3.0/blob/main/app/main.py) (FastAPI application), [`app/oauth/router.py`](https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/router.py) (OAuth routes), [`app/oauth/token.py`](https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/token.py) (Token endpoint)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_api["Application APIs"]
  node_app["FastAPI application<br/>[main.py]"]
  node_restauth["Auth REST routes<br/>[router.py]"]
  node_authsvc["Registration and login<br/>[service.py]"]
  node_graphql["Admin GraphQL API<br/>[resolvers.py]"]
end

subgraph group_oauth["OAuth and OIDC"]
  node_oauthrouter["OAuth routes<br/>[router.py]"]
  node_authorize["Authorization endpoint<br/>[authorize.py]"]
  node_token["Token endpoint<br/>[token.py]"]
  node_authgrant["Authorization-code grant"]
  node_refreshgrant["Refresh-token grant<br/>[refresh_token.py]"]
  node_clientauth["Client authentication<br/>[client_auth.py]"]
  node_oidc["OIDC discovery and keys<br/>[discovery.py]"]
  node_tokenops["Token introspection and revocation<br/>[introspect.py]"]
  node_userinfo["UserInfo endpoint<br/>[userinfo.py]"]
end

subgraph group_web["Web experience"]
  node_consent["Consent workflow<br/>[consent_router.py]"]
  node_webui["User web interface<br/>[router.py]"]
  node_admin["Admin console<br/>[admin_router.py]"]
end

subgraph group_infra["Identity and state"]
  node_audit["Audit service<br/>[service.py]"]
  node_jwt["JWT and RSA security<br/>[jwt.py]"]
  node_users[("User records<br/>[user.py]")]
  node_clients[("OAuth client records<br/>[oauth_client.py]")]
  node_postgres[("PostgreSQL<br/>[session.py]")]
  node_redis[("Redis state<br/>[redis_client.py]")]
end

node_user(("End user"))
node_client(("OAuth client"))

node_user -->|"uses"| node_webui
node_webui -->|"authenticates via"| node_authsvc
node_authsvc -->|"reads and writes"| node_users
node_authsvc -->|"issues access token"| node_jwt
node_authsvc -->|"records events"| node_audit
node_client -->|"requests authorization"| node_authorize
node_authorize -->|"routes for consent"| node_consent
node_user -->|"grants consent"| node_consent
node_client -->|"exchanges grant"| node_token
node_oauthrouter -->|"routes to"| node_authorize
node_oauthrouter -->|"routes to"| node_token
node_oauthrouter -->|"routes to"| node_tokenops
node_oauthrouter -->|"routes to"| node_userinfo
node_token -.->|"dispatches grants"| node_authgrant
node_token -.->|"dispatches grants"| node_refreshgrant
node_token -.->|"authenticates client"| node_clientauth
node_clientauth -->|"checks credentials"| node_clients
node_app -->|"mounts routes"| node_restauth
node_app -->|"mounts routes"| node_oauthrouter
node_app -->|"mounts schema"| node_graphql
node_app -->|"mounts routes"| node_webui
node_app -->|"serves discovery"| node_oidc
node_admin -->|"manages users"| node_users
node_admin -->|"manages clients"| node_clients
node_admin -->|"queries audit"| node_audit
node_restauth -->|"calls"| node_authsvc
node_graphql -->|"uses account service"| node_authsvc
node_postgres -.->|"persists"| node_users
node_tokenops -.->|"blacklists tokens"| node_redis

click node_app "https://github.com/eternityradiance/vault_v3.0/blob/main/app/main.py"
click node_restauth "https://github.com/eternityradiance/vault_v3.0/blob/main/app/auth/router.py"
click node_authsvc "https://github.com/eternityradiance/vault_v3.0/blob/main/app/auth/service.py"
click node_graphql "https://github.com/eternityradiance/vault_v3.0/blob/main/app/graphql/resolvers.py"
click node_oauthrouter "https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/router.py"
click node_authorize "https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/authorize.py"
click node_consent "https://github.com/eternityradiance/vault_v3.0/blob/main/app/web/consent_router.py"
click node_token "https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/token.py"
click node_authgrant "https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/grants/authorization_code.py"
click node_refreshgrant "https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/grants/refresh_token.py"
click node_clientauth "https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/client_auth.py"
click node_oidc "https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/discovery.py"
click node_tokenops "https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/introspect.py"
click node_userinfo "https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/userinfo.py"
click node_webui "https://github.com/eternityradiance/vault_v3.0/blob/main/app/web/router.py"
click node_admin "https://github.com/eternityradiance/vault_v3.0/blob/main/app/web/admin_router.py"
click node_audit "https://github.com/eternityradiance/vault_v3.0/blob/main/app/audit/service.py"
click node_jwt "https://github.com/eternityradiance/vault_v3.0/blob/main/app/core/jwt.py"
click node_users "https://github.com/eternityradiance/vault_v3.0/blob/main/app/models/user.py"
click node_clients "https://github.com/eternityradiance/vault_v3.0/blob/main/app/models/oauth_client.py"
click node_postgres "https://github.com/eternityradiance/vault_v3.0/blob/main/app/db/session.py"
click node_redis "https://github.com/eternityradiance/vault_v3.0/blob/main/app/redis_client.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_restauth,node_authsvc,node_graphql,node_user,node_client toneBlue
class node_oauthrouter,node_authorize,node_token,node_authgrant,node_refreshgrant,node_clientauth,node_oidc,node_tokenops,node_userinfo toneAmber
class node_consent,node_webui,node_admin toneMint
class node_audit,node_jwt,node_users,node_clients,node_postgres,node_redis toneRose
```

## Components

### Application APIs

- [FastAPI application](https://github.com/eternityradiance/vault_v3.0/blob/main/app/main.py): `app/main.py`
- [Auth REST routes](https://github.com/eternityradiance/vault_v3.0/blob/main/app/auth/router.py): `app/auth/router.py`
- [Registration and login](https://github.com/eternityradiance/vault_v3.0/blob/main/app/auth/service.py): `app/auth/service.py`
- [Admin GraphQL API](https://github.com/eternityradiance/vault_v3.0/blob/main/app/graphql/resolvers.py): `app/graphql/resolvers.py`

### OAuth and OIDC

- [OAuth routes](https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/router.py): `app/oauth/router.py`
- [Authorization endpoint](https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/authorize.py): `app/oauth/authorize.py`
- [Token endpoint](https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/token.py): `app/oauth/token.py`
- [Authorization-code grant](https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/grants/authorization_code.py): `app/oauth/grants/authorization_code.py`
- [Refresh-token grant](https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/grants/refresh_token.py): `app/oauth/grants/refresh_token.py`
- [Client authentication](https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/client_auth.py): `app/oauth/client_auth.py`
- [OIDC discovery and keys](https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/discovery.py): `app/oauth/discovery.py`
- [Token introspection and revocation](https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/introspect.py): `app/oauth/introspect.py`
- [UserInfo endpoint](https://github.com/eternityradiance/vault_v3.0/blob/main/app/oauth/userinfo.py): `app/oauth/userinfo.py`

### Web experience

- [Consent workflow](https://github.com/eternityradiance/vault_v3.0/blob/main/app/web/consent_router.py): `app/web/consent_router.py`
- [User web interface](https://github.com/eternityradiance/vault_v3.0/blob/main/app/web/router.py): `app/web/router.py`
- [Admin console](https://github.com/eternityradiance/vault_v3.0/blob/main/app/web/admin_router.py): `app/web/admin_router.py`

### Identity and state

- [Audit service](https://github.com/eternityradiance/vault_v3.0/blob/main/app/audit/service.py): `app/audit/service.py`
- [JWT and RSA security](https://github.com/eternityradiance/vault_v3.0/blob/main/app/core/jwt.py): `app/core/jwt.py`
- [User records](https://github.com/eternityradiance/vault_v3.0/blob/main/app/models/user.py): `app/models/user.py`
- [OAuth client records](https://github.com/eternityradiance/vault_v3.0/blob/main/app/models/oauth_client.py): `app/models/oauth_client.py`
- [PostgreSQL](https://github.com/eternityradiance/vault_v3.0/blob/main/app/db/session.py): `app/db/session.py`
- [Redis state](https://github.com/eternityradiance/vault_v3.0/blob/main/app/redis_client.py): `app/redis_client.py`

### Other components

- **End user**
- **OAuth client**

## Connections

- End user → User web interface: uses (evidence: `README.md`)
- User web interface → Registration and login: authenticates via (evidence: `app/web/router.py`)
- Registration and login → User records: reads and writes (evidence: `app/auth/service.py`)
- Registration and login → JWT and RSA security: issues access token (evidence: `app/auth/service.py`)
- Registration and login → Audit service: records events (evidence: `app/auth/service.py`)
- OAuth client → Authorization endpoint: requests authorization (evidence: `README.md`)
- Authorization endpoint → Consent workflow: routes for consent (evidence: `README.md`)
- End user → Consent workflow: grants consent (evidence: `README.md`)
- OAuth client → Token endpoint: exchanges grant (evidence: `README.md`)
- OAuth routes → Authorization endpoint: routes to (evidence: `app/oauth/router.py`)
- OAuth routes → Token endpoint: routes to (evidence: `app/oauth/router.py`)
- OAuth routes → Token introspection and revocation: routes to (evidence: `app/oauth/router.py`)
- OAuth routes → UserInfo endpoint: routes to (evidence: `app/oauth/router.py`)
- Token endpoint → Authorization-code grant: dispatches grants
- Token endpoint → Refresh-token grant: dispatches grants
- Token endpoint → Client authentication: authenticates client
- Client authentication → OAuth client records: checks credentials (evidence: `app/oauth/client_auth.py`)
- FastAPI application → Auth REST routes: mounts routes (evidence: `app/main.py`)
- FastAPI application → OAuth routes: mounts routes (evidence: `app/main.py`)
- FastAPI application → Admin GraphQL API: mounts schema (evidence: `app/main.py`)
- FastAPI application → User web interface: mounts routes (evidence: `app/main.py`)
- FastAPI application → OIDC discovery and keys: serves discovery (evidence: `app/main.py`)
- Admin console → User records: manages users (evidence: `app/web/admin_router.py`)
- Admin console → OAuth client records: manages clients (evidence: `app/web/admin_router.py`)
- Admin console → Audit service: queries audit (evidence: `app/web/admin_router.py`)
- Auth REST routes → Registration and login: calls (evidence: `app/auth/router.py`)
- Admin GraphQL API → Registration and login: uses account service (evidence: `app/graphql/resolvers.py`)
- PostgreSQL → User records: persists
- Token introspection and revocation → Redis state: blacklists tokens