sequence diagram

sequenceDiagram
    participant Client
    participant Echo as Echo Server
    participant JWTAuth as JWTAuthMiddleware
    participant TokenVal as TokenValidationMiddleware
    participant Login as initiateLoginWithPKCE
    participant Cognito as AWS Cognito
    participant Callback as handleOAuthCallback
    participant Verify as verifyToken
    participant JWKS as GetJWKS
    participant Home as HomeHandler

    Client->>Echo: GET /login
    
    Echo->>JWTAuth: JWTAuthMiddleware
    Note over JWTAuth: Skips auth check for /login path
    JWTAuth-->>Echo: Proceed to next handler
    
    Echo->>TokenVal: TokenValidationMiddleware
    Note over TokenVal: Detects login request
    TokenVal->>Login: initiateLoginWithPKCE()
    
    Login->>Login: generateRandomString() for state
    Login->>Login: generateRandomString() for codeVerifier
    Login->>Login: createCodeChallenge(codeVerifier)
    Login->>Login: storePKCESession(state, codeVerifier)
    Login-->>Client: HTTP 302 Redirect to Cognito auth URL
    
    Client->>Cognito: GET Cognito Auth URL
    Note over Cognito: User authenticates with Cognito
    Cognito-->>Client: HTTP 302 Redirect to /login-callback with code
    
    Client->>Echo: GET /login-callback?code=xxx&state=yyy
    
    Echo->>JWTAuth: JWTAuthMiddleware
    Note over JWTAuth: Skips auth check for callback path
    JWTAuth-->>Echo: Proceed to next handler
    
    Echo->>TokenVal: TokenValidationMiddleware
    Note over TokenVal: Detects OAuth callback
    TokenVal->>Callback: handleOAuthCallback()
    
    Callback->>Callback: getCodeVerifier(state)
    Callback->>Callback: exchangeCodeForTokensWithPKCE(code, codeVerifier)
    Callback->>Cognito: POST /oauth2/token
    Cognito-->>Callback: Return tokens (IDToken, AccessToken)
    
    Callback->>JWKS: GetJWKS(config.JwksURL)
    JWKS-->>Callback: Return JWKS
    
    Callback->>Verify: verifyToken(tokens.IDToken, keySet)
    Verify-->>Callback: Return verified token claims
    
    Callback->>Callback: GetUserGroups(idTokenClaims)
    Callback->>Callback: checkPermissions(path, userGroups, routePermissions)
    Note over Callback: Sets auth_token cookie with AccessToken
    
    Callback-->>Client: HTTP 302 Redirect to /home
    
    Client->>Echo: GET /home
    
    Echo->>JWTAuth: JWTAuthMiddleware
    Note over JWTAuth: Skips auth check for /home path
    JWTAuth-->>Echo: Proceed to next handler
    
    Echo->>TokenVal: TokenValidationMiddleware
    Note over TokenVal: Skips token validation for /home path
    TokenVal-->>Echo: Proceed to next handler
    
    Echo->>Home: HomeHandler()
    Home-->>Client: Return HTML with auth status and links
2.6 KiB Raw Blame History

sequence diagram

2.6 KiB

Raw Blame History
