From 11222646a5006f188f83bc3667f52cd3af77f2ac Mon Sep 17 00:00:00 2001
From: jay brown <jay.a.brown@gmail.com>
Date: Tue, 1 Apr 2025 14:48:27 -0700
Subject: [PATCH] full sequence

---
 .../cognito.pkce/main_sequence.md             | 74 +++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 cmd/cognito_test/cognito.pkce/main_sequence.md

diff --git a/cmd/cognito_test/cognito.pkce/main_sequence.md b/cmd/cognito_test/cognito.pkce/main_sequence.md
new file mode 100644
index 00000000..c85eef52
--- /dev/null
+++ b/cmd/cognito_test/cognito.pkce/main_sequence.md
@@ -0,0 +1,74 @@
+# sequence diagram
+```mermaid
+sequenceDiagram
+    participant Client
+    participant Echo as Echo Server
+    participant JWTAuth as JWTAuthMiddleware
+    participant TokenVal as TokenValidationMiddleware
+    participant Login as initiateLoginWithPKCE
+    participant Cognito as AWS Cognito
+    participant Callback as handleOAuthCallback
+    participant Verify as verifyToken
+    participant JWKS as GetJWKS
+    participant Home as HomeHandler
+
+    Client->>Echo: GET /login
+    
+    Echo->>JWTAuth: JWTAuthMiddleware
+    Note over JWTAuth: Skips auth check for /login path
+    JWTAuth-->>Echo: Proceed to next handler
+    
+    Echo->>TokenVal: TokenValidationMiddleware
+    Note over TokenVal: Detects login request
+    TokenVal->>Login: initiateLoginWithPKCE()
+    
+    Login->>Login: generateRandomString() for state
+    Login->>Login: generateRandomString() for codeVerifier
+    Login->>Login: createCodeChallenge(codeVerifier)
+    Login->>Login: storePKCESession(state, codeVerifier)
+    Login-->>Client: HTTP 302 Redirect to Cognito auth URL
+    
+    Client->>Cognito: GET Cognito Auth URL
+    Note over Cognito: User authenticates with Cognito
+    Cognito-->>Client: HTTP 302 Redirect to /login-callback with code
+    
+    Client->>Echo: GET /login-callback?code=xxx&state=yyy
+    
+    Echo->>JWTAuth: JWTAuthMiddleware
+    Note over JWTAuth: Skips auth check for callback path
+    JWTAuth-->>Echo: Proceed to next handler
+    
+    Echo->>TokenVal: TokenValidationMiddleware
+    Note over TokenVal: Detects OAuth callback
+    TokenVal->>Callback: handleOAuthCallback()
+    
+    Callback->>Callback: getCodeVerifier(state)
+    Callback->>Callback: exchangeCodeForTokensWithPKCE(code, codeVerifier)
+    Callback->>Cognito: POST /oauth2/token
+    Cognito-->>Callback: Return tokens (IDToken, AccessToken)
+    
+    Callback->>JWKS: GetJWKS(config.JwksURL)
+    JWKS-->>Callback: Return JWKS
+    
+    Callback->>Verify: verifyToken(tokens.IDToken, keySet)
+    Verify-->>Callback: Return verified token claims
+    
+    Callback->>Callback: GetUserGroups(idTokenClaims)
+    Callback->>Callback: checkPermissions(path, userGroups, routePermissions)
+    Note over Callback: Sets auth_token cookie with AccessToken
+    
+    Callback-->>Client: HTTP 302 Redirect to /home
+    
+    Client->>Echo: GET /home
+    
+    Echo->>JWTAuth: JWTAuthMiddleware
+    Note over JWTAuth: Skips auth check for /home path
+    JWTAuth-->>Echo: Proceed to next handler
+    
+    Echo->>TokenVal: TokenValidationMiddleware
+    Note over TokenVal: Skips token validation for /home path
+    TokenVal-->>Echo: Proceed to next handler
+    
+    Echo->>Home: HomeHandler()
+    Home-->>Client: Return HTML with auth status and links
+```
\ No newline at end of file