docs/diagrams/gen/user-auth-flow.svg

<svg xmlns="http://www.w3.org/2000/svg" width="1216.398386001587px" height="1165.200038909912px" class="sequence hand"><desc>User Authentication flow</desc><defs><marker viewBox="0 0 5 5" markerWidth="5" markerHeight="5" orient="auto" refX="5" refY="2.5" id="markerArrowBlock"><path d="M 0 0 L 5 2.5 L 0 5 z"/></marker><marker viewBox="0 0 9.6 16" markerWidth="4" markerHeight="16" orient="auto" refX="9.6" refY="8" id="markerArrowOpen"><path d="M 9.6,8 1.92,16 0,13.7 5.76,8 0,2.286 1.92,0 9.6,8 z"/></marker></defs><g class="title"><path d="M10,10C194.6,0.8 47.0,19.2 241.0,10.0C240.0,14.9 242.1,16.4 241.0,36.8C112.0,46.0 109.7,27.6 10.0,36.8C8.9,25.5 11.1,16.4 10.0,10.0" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="15" y="28.200000762939453" style="font-size: 16px; font-family: danielbd;"><tspan x="15">User Authentication flow</tspan></text></g><g class="actor"><path d="M10,46.80000114440918C39.2,49.4 44.5,44.2 74.8,46.8C76.5,60.2 73.2,60.6 74.8,87.2C45.3,84.6 35.8,89.8 10.0,87.2C11.6,73.7 8.4,75.9 10.0,46.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="20" y="71.8000020980835" style="font-size: 16px; font-family: danielbd;"><tspan x="20">User</tspan></text></g><g class="actor"><path d="M10,1104.8000373840332C59.3,1107.4 25.6,1102.2 74.8,1104.8C76.5,1125.4 73.2,1135.4 74.8,1145.2C60.9,1147.8 20.4,1142.6 10.0,1145.2C8.4,1115.0 11.6,1117.7 10.0,1104.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="20" y="1129.8000383377075" style="font-size: 16px; font-family: danielbd;"><tspan x="20">User</tspan></text></g><path d="M42.4,87.2C83.1,531.2 1.7,860.6 42.4,1104.8" stroke="#000000" fill="none" style="stroke-width: 2;"/><g class="actor"><path d="M349.91000175476074,46.80000114440918C379.1,41.9 394.0,51.7 471.5,46.8C469.9,66.9 473.1,75.0 471.5,87.2C427.4,82.3 369.4,92.1 349.9,87.2C351.5,72.8 348.3,56.6 349.9,46.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="359.91000175476074" y="71.8000020980835" style="font-size: 16px; font-family: danielbd;"><tspan x="359.91000175476074">BFF server</tspan></text></g><g class="actor"><path d="M349.91000175476074,1104.8000373840332C394.0,1109.7 433.4,1099.9 471.5,1104.8C473.1,1123.5 469.9,1138.7 471.5,1145.2C401.6,1140.3 369.4,1150.1 349.9,1145.2C348.3,1135.5 351.5,1115.9 349.9,1104.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="359.91000175476074" y="1129.8000383377075" style="font-size: 16px; font-family: danielbd;"><tspan x="359.91000175476074">BFF server</tspan></text></g><path d="M410.7,87.2C370.0,475.8 451.4,517.9 410.7,1104.8" stroke="#000000" fill="none" style="stroke-width: 2;"/><g class="actor"><path d="M518.2775745391846,46.80000114440918C617.4,41.7 559.2,51.9 646.2,46.8C647.8,74.0 644.6,53.3 646.2,87.2C568.9,92.3 615.5,82.1 518.3,87.2C519.9,62.5 516.7,77.5 518.3,46.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="528.2775745391846" y="71.8000020980835" style="font-size: 16px; font-family: danielbd;"><tspan x="528.2775745391846">Auth server</tspan></text></g><g class="actor"><path d="M518.2775745391846,1104.8000373840332C570.0,1109.9 561.6,1099.7 646.2,1104.8C647.8,1124.5 644.6,1138.7 646.2,1145.2C538.8,1140.1 625.8,1150.3 518.3,1145.2C516.7,1111.3 519.9,1114.9 518.3,1104.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="528.2775745391846" y="1129.8000383377075" style="font-size: 16px; font-family: danielbd;"><tspan x="528.2775745391846">Auth server</tspan></text></g><path d="M582.3,87.2C623.0,365.0 541.6,331.4 582.3,1104.8" stroke="#000000" fill="none" style="stroke-width: 2;"/><g class="actor"><path d="M666.2322788238525,46.80000114440918C754.2,53.4 804.6,40.2 830.9,46.8C832.5,55.3 829.3,69.6 830.9,87.2C727.3,93.8 763.6,80.6 666.2,87.2C667.8,77.5 664.6,57.6 666.2,46.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="676.2322788238525" y="70.00000190734863" style="font-size: 16px; font-family: danielbd;"><tspan x="676.2322788238525">OAuth provider</tspan></text></g><g class="actor"><path d="M666.2322788238525,1104.8000373840332C776.4,1098.2 692.6,1111.4 830.9,1104.8C829.3,1112.0 832.5,1138.7 830.9,1145.2C721.4,1151.8 692.6,1138.6 666.2,1145.2C664.6,1138.7 667.8,1132.9 666.2,1104.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="676.2322788238525" y="1128.0000381469727" style="font-size: 16px; font-family: danielbd;"><tspan x="676.2322788238525">OAuth provider</tspan></text></g><path d="M748.6,87.2C707.9,480.2 789.3,250.0 748.6,1104.8" stroke="#000000" fill="none" style="stroke-width: 2;"/><g class="actor"><path d="M850.9304447174072,46.80000114440918C953.5,53.3 947.3,40.3 1012.3,46.8C1013.9,64.0 1010.7,68.5 1012.3,87.2C919.7,80.7 957.8,93.7 850.9,87.2C849.3,67.2 852.5,56.5 850.9,46.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="860.9304447174072" y="71.8000020980835" style="font-size: 16px; font-family: danielbd;"><tspan x="860.9304447174072">Resource server</tspan></text></g><g class="actor"><path d="M850.9304447174072,1104.8000373840332C955.7,1098.3 914.4,1111.3 1012.3,1104.8C1010.7,1135.0 1013.9,1114.5 1012.3,1145.2C902.2,1138.7 892.5,1151.7 850.9,1145.2C852.5,1114.5 849.3,1112.1 850.9,1104.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="860.9304447174072" y="1129.8000383377075" style="font-size: 16px; font-family: danielbd;"><tspan x="860.9304447174072">Resource server</tspan></text></g><path d="M931.6,87.2C890.9,758.1 972.3,263.3 931.6,1104.8" stroke="#000000" fill="none" style="stroke-width: 2;"/><g class="signal"><text x="52.41937065124512" y="115.80000305175781" style="font-size: 16px; font-family: danielbd;"><tspan x="52.41937065124512">Auth req {email, password, User-Agent}</tspan></text><path d="M42.4,128.8C351.8,114.1 267.2,143.5 410.7,128.8" stroke="#000000" fill="none" style="stroke-width: 2; marker-end: url(&quot;#markerArrowBlock&quot;);"/></g><g class="signal"><text x="420.6893901824951" y="157.40000343322754" style="font-size: 16px; font-family: danielbd;"><tspan x="420.6893901824951">{email, password}</tspan></text><path d="M410.7,170.4C452.5,163.5 541.1,177.3 582.3,170.4" stroke="#000000" fill="none" style="stroke-width: 2; marker-end: url(&quot;#markerArrowBlock&quot;);"/></g><g class="note"><path d="M454.30978202819824,190.40000343322754C582.9,200.6 528.1,180.2 710.2,190.4C708.2,217.0 712.2,228.1 710.2,240.0C540.1,229.8 495.3,250.2 454.3,240.0C452.3,222.3 456.3,199.4 454.3,190.4" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="459.30978202819824" y="208.600004196167" style="font-size: 16px; font-family: danielbd;"><tspan x="459.30978202819824">offline_access OAuth flow</tspan><tspan dy="1.2em" x="459.30978202819824">scope: openid, email, profile</tspan></text></g><g class="signal"><text x="136.61034202575684" y="268.0000057220459" style="font-size: 16px; font-family: danielbd;"><tspan x="136.61034202575684">Redirect to Auth page with: state, nonce</tspan></text><path d="M582.3,280.4C495.9,302.0 452.7,258.8 42.4,280.4" stroke="#000000" fill="none" style="stroke-width: 2; marker-end: url(&quot;#markerArrowBlock&quot;);"/></g><g class="signal"><text x="255.17535400390625" y="310.20000743865967" style="font-size: 16px; font-family: danielbd;"><tspan x="255.17535400390625">User Authenticates with OAuth</tspan></text><path d="M42.4,317.2C424.6,289.0 211.9,345.4 748.6,317.2" stroke="#000000" fill="none" style="stroke-width: 2; stroke-dasharray: 6, 2; marker-end: url(&quot;#markerArrowBlock&quot;);"/></g><g class="note"><path d="M658.6707630157471,337.200008392334C701.8,330.0 772.2,344.4 838.5,337.2C839.6,345.5 837.4,349.1 838.5,364.0C701.8,371.2 795.3,356.8 658.7,364.0C659.7,353.2 657.6,343.6 658.7,337.2" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="663.6707630157471" y="355.40000915527344" style="font-size: 16px; font-family: danielbd;"><tspan x="663.6707630157471">User Authenticated</tspan></text></g><g class="signal"><text x="607.4449005126953" y="393.800009727478" style="font-size: 16px; font-family: danielbd;"><tspan x="607.4449005126953">Auth callback</tspan></text><path d="M748.6,400.8C698.6,407.5 621.6,394.1 582.3,400.8" stroke="#000000" fill="none" style="stroke-width: 2; marker-end: url(&quot;#markerArrowBlock&quot;);"/></g><g class="note"><path d="M484.4632625579834,420.80001068115234C531.4,428.6 620.0,413.0 680.0,420.8C682.0,440.0 678.1,446.8 680.0,470.4C533.0,462.6 531.4,478.2 484.5,470.4C486.4,428.7 482.5,448.0 484.5,420.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="490.6632626056671" y="439.0000114440918" style="font-size: 16px; font-family: danielbd;"><tspan x="489.4632625579834">Store id_token data</tspan><tspan dy="1.2em" x="489.4632625579834">(only new users)</tspan></text></g><g class="signal"><text x="421.1866283416748" y="500.20001316070557" style="font-size: 16px; font-family: danielbd;"><tspan x="421.1866283416748">send Auth tokens</tspan></text><path d="M582.3,507.2C468.9,514.1 456.9,500.3 410.7,507.2" stroke="#000000" fill="none" style="stroke-width: 2; marker-end: url(&quot;#markerArrowBlock&quot;);"/></g><g class="note"><path d="M266.8153820037842,527.2000141143799C374.5,515.7 482.4,538.7 554.6,527.2C556.5,561.5 552.6,535.1 554.6,576.8C317.1,565.3 335.9,588.3 266.8,576.8C264.8,535.1 268.8,539.9 266.8,527.2" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="271.8153820037842" y="545.4000148773193" style="font-size: 16px; font-family: danielbd;"><tspan x="271.8153820037842">Generate Session-Cookie</tspan><tspan dy="1.2em" x="271.8153820037842">for tracking user active sessions</tspan></text></g><g class="note"><path d="M283.40790367126465,596.8000164031982C427.7,607.0 361.3,586.6 538.0,596.8C542.1,683.8 533.8,668.8 538.0,700.4C371.5,710.6 476.9,690.2 283.4,700.4C279.3,683.8 287.6,659.3 283.4,596.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="289.60790371894836" y="615.0000171661377" style="font-size: 16px; font-family: danielbd;"><tspan x="288.40790367126465">Store access_token in redis</tspan><tspan dy="1.2em" x="288.40790367126465">{</tspan><tspan dy="1.2em" x="288.40790367126465">key: Session-Cookie,</tspan><tspan dy="1.2em" x="288.40790367126465">value: {access_token, email}</tspan><tspan dy="1.2em" x="288.40790367126465">}</tspan></text></g><g class="note"><path d="M275.54379081726074,720.4000225067139C481.0,731.2 367.4,709.6 545.8,720.4C550.0,807.4 541.7,753.8 545.8,824.0C318.8,834.8 502.6,813.2 275.5,824.0C279.7,774.8 271.4,798.3 275.5,720.4" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="281.74379086494446" y="738.6000232696533" style="font-size: 16px; font-family: danielbd;"><tspan x="280.54379081726074">Store refresh_token in redis</tspan><tspan dy="1.2em" x="280.54379081726074">{</tspan><tspan dy="1.2em" x="280.54379081726074">key: Session-Cookie,</tspan><tspan dy="1.2em" x="280.54379081726074">value: {refresh_token, email}</tspan><tspan dy="1.2em" x="280.54379081726074">}</tspan></text></g><g class="signal"><text x="106.64297294616699" y="842.4000282287598" style="font-size: 16px; font-family: danielbd;"><tspan x="106.64297294616699">set-cookie: Session-Cookie</tspan><tspan dy="1.2em" x="106.64297294616699">(httpOnly, SameSite: Strict)</tspan></text><path d="M410.7,883.6C222.3,898.3 281.3,868.9 42.4,883.6" stroke="#000000" fill="none" style="stroke-width: 2; marker-end: url(&quot;#markerArrowBlock&quot;);"/></g><g class="signal"><text x="134.720609664917" y="913.4000310897827" style="font-size: 16px; font-family: danielbd;"><tspan x="134.720609664917">cookie: Session-Cookie</tspan></text><path d="M42.4,920.4C318.8,905.7 351.8,935.1 410.7,920.4" stroke="#000000" fill="none" style="stroke-width: 2; marker-end: url(&quot;#markerArrowBlock&quot;);"/></g><g class="signal"><text x="562.0686264038086" y="948.400032043457" style="font-size: 16px; font-family: danielbd;"><tspan x="562.0686264038086">Auth tokens and request</tspan></text><path d="M410.7,960.8C818.0,940.0 494.0,981.6 931.6,960.8" stroke="#000000" fill="none" style="stroke-width: 2; marker-end: url(&quot;#markerArrowBlock&quot;);"/></g><g class="note"><path d="M767.5312519073486,980.8000335693359C997.5,993.9 885.1,967.7 1095.7,980.8C1096.9,996.7 1094.5,997.8 1095.7,1011.2C820.6,998.1 880.7,1024.3 767.5,1011.2C768.7,998.2 766.3,1006.3 767.5,980.8" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"/><text x="772.5312519073486" y="999.0000343322754" style="font-size: 16px; font-family: danielbd;"><tspan x="772.5312519073486">validate tokens using .well-known keys</tspan></text></g><g class="signal"><text x="651.7627487182617" y="1041.0000352859497" style="font-size: 16px; font-family: danielbd;"><tspan x="651.7627487182617">data</tspan></text><path d="M931.6,1048.0C573.5,1027.2 806.6,1068.8 410.7,1048.0" stroke="#000000" fill="none" style="stroke-width: 2; marker-end: url(&quot;#markerArrowBlock&quot;);"/></g><g class="signal"><text x="207.16242027282715" y="1077.800036430359" style="font-size: 16px; font-family: danielbd;"><tspan x="207.16242027282715">data</tspan></text><path d="M410.7,1084.8C351.8,1070.1 101.3,1099.5 42.4,1084.8" stroke="#000000" fill="none" style="stroke-width: 2; marker-end: url(&quot;#markerArrowBlock&quot;);"/></g></svg>