Console
Sign in
Health

Status

Whether each service is up. Versions, latencies and probe answers are shown to operators who hold console.status.

Every service answers and is ready

checked 21:28:32 UTC

Gateway

up

Access

up

Data

up

Console

up

Request map

Which services talk to each other when a record is read, someone signs in, or an operator changes a grant. Pick a request to highlight its exchanges in order.

7 exchanges, read from the top to the bottom

A record is read and written on the same path: the same services, the same contracts, the same order. A write asks Access for a fresh context — the decision of a moment ago is exactly the decision that has to be checked — and it carries an idempotency key and the etag of the record it changes.

The browser: A person, or an application, that holds a session cookie, or a bearer token, and asks the platform for the data of a workspace.a callerbrowserConsole: The web application of the platform: it shows the data of a workspace and the administration of Access. It is a client of the three services, it signs no identity of its own, and it decides nothing.a callerConsoleGateway: It authenticates the caller against an identity provider, asks Access whether the caller may use the workspace, and forwards the request to the upstream of the route it matched. It never decides an access of its own: it asks, and it refuses the request when the service does not answer.a serviceGatewayThe database of Gateway: The store of the gateway: the sessions of the callers, the route table and its revisions, the cache of the decisions, the counters of the limits, the audit and the failures of the control plane.PostgreSQLdatabase ofGatewayThe shared state: The Redis of the deployment: the sessions, the route table and the counters of the gateway, and the codes of the logins of Access. A deployment with several replicas shares it, and a deployment with one may leave it out.Redisshared stateAccess: It is the OpenID Connect broker and the decision service of the platform: it authenticates a caller against the provider of a tenant, maps the identity to a principal, and answers the decisions of the gateway and the contexts of Data.a serviceAccessThe identity provider: The OpenID Connect provider of a tenant: it holds the identity of the people of the tenant, and Access brokers it. The gateway may also be registered with a provider of its own.a provideridentity providerThe database of Access: The store of Access: the tenants, the principals, the permissions, the groups, the grants and the audit of the administration.PostgreSQLdatabase ofAccessData: The headless backend of the data: it owns the workspaces, the collections, the policies, the records, the versions, the audit and the events. It verifies the identity the gateway signed, asks Access for the permissions of the caller, and answers with the rows that caller may see.a serviceDataThe database of Data: The store of Data: the workspaces, the registry of the collections, the policy bundles, the records, their versions, the audit, the events and the receipts of the writes.PostgreSQLdatabase of DataThe browser → Gateway: the contract of Data, behind the gateway1. the credentialGateway → The shared state: the commands of the shared state2. the route table and the limitsGateway → The database of Gateway: the table of the sessions3. the sessionGateway → Access: POST /v1/decisions4. the decisionGateway → Data: /ws/:workspaceId/v1/*5. the signed requestData → Access: POST /v1/access-context6. the permissionsData → The database of Data: the query7. the rows
#ExchangeContractCarriesDecidesRefuses
1the credential
The browser → Gateway
the contract of Data, behind the gatewaythe session cookie, or the bearer tokenwho the caller is401, or a redirect to the sign-in
2the route table and the limits
Gateway → The shared state
the commands of the shared statethe route table, the counters of the limitshow much of the budget is leftthe request is counted in the process
3the session
Gateway → The database of Gateway
the table of the sessionsthe session of the callerwhether the session is alivethe caller is refused when the store does not answer
4the decision
Gateway → Access
POST /v1/decisionsthe subject, the workspace, the route and the roleswhether the caller may use the workspace403, or 503 when the service does not answer
5the signed request
Gateway → Data
/ws/:workspaceId/v1/*the identity headers and their detached signaturenothing: the gateway forwards the request502
6the permissions
Data → Access
POST /v1/access-contextthe subject, the tenant, the workspace and the routewhich permissions the caller holds503 when the service does not answer
7the rows
Data → The database of Data
the querythe query and its bound valueswhich rows the caller seesa row the caller may not see