Home

sequenceDiagram
    autonumber
    participant C as SSH CLI
    participant P as SSH Proxy
    participant I as Identity
    participant R as Provisioner
    participant K as k8shelld (Workspace)

    C->>P: Open SSH connection (handshake)
    note right of P: Parse login (user~bp@addr)

    %% Auth via SSH key
    P->>P: Verify SSH key / cert
    P->>I: Resolve user mapping
    alt User mapped
        I-->>P: Mapping OK
    else User not mapped
        P->>I: Start onboarding (e.g. GitHub Device Flow)
        alt Onboarding successful
            I-->>P: Mapping created
        else Onboarding failed
            I-->>P: No mapping
            P-->>C: Access denied
        end
    end

    %% Workspace
    P->>R: Get workspace for user
    alt Workspace exists
        R-->>P: Workspace {id, state}
    else Workspace missing
        P->>R: Provision workspace (blueprint, params)
        R-->>P: Accepted {workspaceId}
    end

    %% Push events
    note over P,R: Provisioner pushes events (stream)
    R-->>P: Scheduled
    R-->>P: Pulling images
    R-->>P: Starting
    alt Failure
        R-->>P: Failed {reason}
        P-->>C: Report failure & close
    else Running
        R-->>P: Running {ip, tlsCert, endpoints}
    end

    note right of P: Use IP + TLS cert for gRPC
    P->>K: Connect gRPC over TLS
    K-->>P: Session service ready
    P-->>C: SSH channel established

    par Interactive shell
        C-->>P: stdin / keystrokes
        P-->>K: stream to gRPC shell
    and
        K-->>P: stdout / stderr
        P-->>C: forward to SSH client
    end

Loading