Finishes functional design for unit 0 (back-end changes before front-end work)

2026-06-18 21:40:45 +02:00
parent 9e49489f7e
commit 53a307cdbd
14 changed files with 1065 additions and 4 deletions
@@ -0,0 +1,93 @@
+# Business Logic Model — Unit 0: Backend Prerequisites
+
+## Overview
+
+Unit 0 modifies the authentication flow to use httpOnly cookies for refresh token delivery and adds CORS support for the React SPA. No new business transactions are introduced — existing auth transactions are made more secure.
+
+---
+
+## Flow 1: Login
+
+```mermaid
+sequenceDiagram
+    participant FE as Frontend
+    participant AC as AuthController
+    participant AS as AuthService
+    participant DB as Database
+
+    FE->>AC: POST /auth/login
+    AC->>AS: AuthenticateAsync()
+    AS->>DB: FindUser + ValidatePassword
+    DB-->>AS: User + Role
+    AS-->>AC: TokenResponse
+    AC-->>FE: 200 accessToken + Set-Cookie refreshToken
+```
+
+**Changes from current behaviour**:
+- `RefreshToken` is no longer returned in the response body
+- httpOnly cookie is set on the response
+- `UserDto` with `Name` (DisplayName ?? Email) is added to response
+
+---
+
+## Flow 2: Refresh Token
+
+```mermaid
+sequenceDiagram
+    participant FE as Frontend
+    participant AC as AuthController
+    participant AS as AuthService
+    participant DB as Database
+
+    FE->>AC: POST /auth/refresh (cookie auto-sent)
+    AC->>AC: Read cookie refreshToken
+    AC->>AS: RefreshTokenAsync(cookieValue)
+    AS->>DB: Validate RefreshToken
+    DB-->>AS: Valid + User
+    AS-->>AC: new TokenResponse
+    AC-->>FE: 200 new accessToken + Set-Cookie new refreshToken
+```
+
+**Changes from current behaviour**:
+- Request body (`RefreshTokenRequest`) is **removed** — token read from cookie only
+- New refresh token set in cookie (rotation still applies)
+
+---
+
+## Flow 3: Revoke (Logout)
+
+```mermaid
+sequenceDiagram
+    participant FE as Frontend
+    participant AC as AuthController
+    participant AS as AuthService
+    participant DB as Database
+
+    FE->>AC: POST /auth/revoke (no Authorize)
+    AC->>AC: Read cookie refreshToken
+    AC->>AS: RevokeTokenAsync(cookieValue)
+    AS->>DB: Mark token revoked
+    DB-->>AS: OK
+    AC->>AC: Clear cookie Expires=epoch
+    AC-->>FE: 204 No Content
+```
+
+**Changes from current behaviour**:
+- `[Authorize]` attribute removed — logout works even if access token has expired
+- Token read from cookie, not request body
+- Cookie explicitly cleared in response
+
+---
+
+## Flow 4: CORS Preflight
+
+```mermaid
+sequenceDiagram
+    participant Browser
+    participant API as API
+
+    Browser->>API: OPTIONS /auth/login preflight
+    API-->>Browser: 204 Access-Control-Allow headers
+    Browser->>API: POST /auth/login with credentials
+    API-->>Browser: 200 + Set-Cookie
+```