{
  "schema_version": 1,
  "diagram_type": "architecture",
  "meta": {
    "title": "llm-proxy-admin Architecture",
    "output": "diagrams/llm-proxy-admin.html",
    "quality_profile": "showcase",
    "repository": {
      "url": "https://github.com/ai-process/llm-proxy-admin",
      "revision": "2d7c701bde353927abc1a591bf8211139d03b8e2"
    }
  },
  "components": [
    {
      "id": "browser",
      "type": "external",
      "label": "Admin Browser",
      "sublabel": "SPA & SSE Streaming",
      "pos": [40, 260],
      "size": [140, 64],
      "sources": [
        { "path": "internal/web/web.go", "line": 1, "end_line": 19, "label": "Static files embedded FS" },
        { "path": "internal/web/static/app.js", "line": 1, "end_line": 50, "label": "SPA console & SSE stream" }
      ]
    },
    {
      "id": "google",
      "type": "cloud",
      "label": "Google Identity",
      "sublabel": "OIDC & OAuth2 PKCE",
      "pos": [40, 80],
      "size": [140, 64],
      "sources": [
        { "path": "internal/auth/auth.go", "line": 161, "end_line": 230, "label": "Login, state, nonce & callback" }
      ]
    },
    {
      "id": "ingress",
      "type": "security",
      "label": "Ingress & Guard",
      "sublabel": "Auth, Session & CSRF",
      "tag": "RBAC + Allowlist",
      "pos": [280, 260],
      "size": [160, 64],
      "sources": [
        { "path": "internal/auth/auth.go", "line": 114, "end_line": 132, "label": "Cookie session verification" },
        { "path": "internal/auth/allowlist.go", "line": 39, "end_line": 55, "label": "Admin/Viewer email match" },
        { "path": "internal/api/api.go", "line": 161, "end_line": 195, "label": "Role & CSRF guard middleware" }
      ]
    },
    {
      "id": "api",
      "type": "backend",
      "label": "Admin Gateway",
      "sublabel": "CRUD, Playground, Judge",
      "pos": [530, 260],
      "size": [160, 64],
      "sources": [
        { "path": "internal/api/api.go", "line": 102, "end_line": 126, "label": "Proxy API routes" },
        { "path": "internal/api/proxy.go", "line": 23, "end_line": 68, "label": "Config & keys proxying" },
        { "path": "internal/api/proxy.go", "line": 231, "end_line": 360, "label": "Playground stream & Judge" }
      ]
    },
    {
      "id": "analytics",
      "type": "backend",
      "label": "Analytics Engine",
      "sublabel": "Cost & Efficiency Scoring",
      "pos": [530, 440],
      "size": [160, 64],
      "sources": [
        { "path": "internal/usage/usage.go", "line": 66, "end_line": 100, "label": "Tokenmeter summary aggregation" },
        { "path": "internal/usage/usage.go", "line": 257, "end_line": 277, "label": "Greedy vs Worthy verdict" }
      ]
    },
    {
      "id": "llm_proxy",
      "type": "external",
      "label": "llm-proxy",
      "sublabel": "Admin & Data gRPC (:9090)",
      "tag": "Bearer admin_key",
      "pos": [800, 260],
      "size": [170, 64],
      "sources": [
        { "path": "internal/api/api.go", "line": 52, "end_line": 74, "label": "gRPC client & interceptors" }
      ]
    },
    {
      "id": "tokenmeter",
      "type": "external",
      "label": "light-tokenmeter",
      "sublabel": "HTTP Usage API (:8080)",
      "tag": "/readyz probe",
      "pos": [800, 440],
      "size": [170, 64],
      "sources": [
        { "path": "internal/usage/usage.go", "line": 38, "end_line": 62, "label": "Readiness check & HTTP client" }
      ]
    }
  ],
  "boundaries": [
    {
      "kind": "security-group",
      "label": "llm-proxy-admin Runtime (:8080)",
      "wraps": ["ingress", "api", "analytics"]
    }
  ],
  "connections": [
    { "id": "browser-login", "from": "browser", "to": "google", "label": "OIDC & PKCE", "variant": "security", "fromSide": "top", "toSide": "bottom" },
    { "id": "google-callback", "from": "google", "to": "ingress", "label": "/auth/callback", "variant": "security", "fromSide": "right", "toSide": "top", "labelDy": 20 },
    { "id": "browser-req", "from": "browser", "to": "ingress", "label": "HTTPS / UI & API", "variant": "emphasis", "labelDy": -16 },
    { "id": "ingress-api", "from": "ingress", "to": "api", "label": "Authorized /api/*", "labelDy": -16 },
    { "id": "ingress-analytics", "from": "ingress", "to": "analytics", "label": "/api/usage", "fromSide": "bottom", "toSide": "left", "labelDy": 20 },
    { "id": "api-proxy", "from": "api", "to": "llm_proxy", "label": "Admin & Data gRPC", "variant": "emphasis", "labelDy": -16 },
    { "id": "analytics-tokenmeter", "from": "analytics", "to": "tokenmeter", "label": "Summary & /readyz", "labelDy": -16 }
  ],
  "cards": [
    {
      "dot": "cyan",
      "title": "Authentication & Guard",
      "items": [
        "Google OAuth2 with PKCE, state & nonce; session stored in signed encrypted cookie",
        "Two-tier RBAC: admin (full mutations) and viewer (read-only) evaluated per request",
        "Strict CSRF protection via X-Requested-With header, SameSite cookies, and CSP"
      ]
    },
    {
      "dot": "emerald",
      "title": "Dual-Backend Console",
      "items": [
        "llm-proxy gRPC: live model/rule mutations, token rotation, streaming playground, and Judge",
        "light-tokenmeter HTTP: daily token aggregations, cost breakdown, and readiness probe",
        "In-memory analytics calculates 'Greedy' vs 'Worthy' usage efficiency verdicts"
      ]
    }
  ]
}