full sequence

2025-04-01 14:48:27 -07:00
parent 4885a594a0
commit 11222646a5
1 changed files with 74 additions and 0 deletions
@@ -0,0 +1,74 @@
+# sequence diagram
+```mermaid
+sequenceDiagram
+    participant Client
+    participant Echo as Echo Server
+    participant JWTAuth as JWTAuthMiddleware
+    participant TokenVal as TokenValidationMiddleware
+    participant Login as initiateLoginWithPKCE
+    participant Cognito as AWS Cognito
+    participant Callback as handleOAuthCallback
+    participant Verify as verifyToken
+    participant JWKS as GetJWKS
+    participant Home as HomeHandler
+
+    Client->>Echo: GET /login
+    
+    Echo->>JWTAuth: JWTAuthMiddleware
+    Note over JWTAuth: Skips auth check for /login path
+    JWTAuth-->>Echo: Proceed to next handler
+    
+    Echo->>TokenVal: TokenValidationMiddleware
+    Note over TokenVal: Detects login request
+    TokenVal->>Login: initiateLoginWithPKCE()
+    
+    Login->>Login: generateRandomString() for state
+    Login->>Login: generateRandomString() for codeVerifier
+    Login->>Login: createCodeChallenge(codeVerifier)
+    Login->>Login: storePKCESession(state, codeVerifier)
+    Login-->>Client: HTTP 302 Redirect to Cognito auth URL
+    
+    Client->>Cognito: GET Cognito Auth URL
+    Note over Cognito: User authenticates with Cognito
+    Cognito-->>Client: HTTP 302 Redirect to /login-callback with code
+    
+    Client->>Echo: GET /login-callback?code=xxx&state=yyy
+    
+    Echo->>JWTAuth: JWTAuthMiddleware
+    Note over JWTAuth: Skips auth check for callback path
+    JWTAuth-->>Echo: Proceed to next handler
+    
+    Echo->>TokenVal: TokenValidationMiddleware
+    Note over TokenVal: Detects OAuth callback
+    TokenVal->>Callback: handleOAuthCallback()
+    
+    Callback->>Callback: getCodeVerifier(state)
+    Callback->>Callback: exchangeCodeForTokensWithPKCE(code, codeVerifier)
+    Callback->>Cognito: POST /oauth2/token
+    Cognito-->>Callback: Return tokens (IDToken, AccessToken)
+    
+    Callback->>JWKS: GetJWKS(config.JwksURL)
+    JWKS-->>Callback: Return JWKS
+    
+    Callback->>Verify: verifyToken(tokens.IDToken, keySet)
+    Verify-->>Callback: Return verified token claims
+    
+    Callback->>Callback: GetUserGroups(idTokenClaims)
+    Callback->>Callback: checkPermissions(path, userGroups, routePermissions)
+    Note over Callback: Sets auth_token cookie with AccessToken
+    
+    Callback-->>Client: HTTP 302 Redirect to /home
+    
+    Client->>Echo: GET /home
+    
+    Echo->>JWTAuth: JWTAuthMiddleware
+    Note over JWTAuth: Skips auth check for /home path
+    JWTAuth-->>Echo: Proceed to next handler
+    
+    Echo->>TokenVal: TokenValidationMiddleware
+    Note over TokenVal: Skips token validation for /home path
+    TokenVal-->>Echo: Proceed to next handler
+    
+    Echo->>Home: HomeHandler()
+    Home-->>Client: Return HTML with auth status and links
+```