# Business Logic Model — Unit 6: Profile, Settings & CMS Placeholder

## 1. Profile Update Flow

```mermaid
sequenceDiagram
    box rgba(33,150,243,0.15) Frontend
        participant U as User
        participant PF as ProfilePage
        participant AC as AuthContext
    end
    box rgba(244,67,54,0.15) Backend
        participant API as PUT /Users/me
        participant REF as POST /auth/refresh
    end

    U->>PF: Edit name or email, click Save
    PF->>PF: Validate form (name required, email valid)
    alt Validation fails
        PF-->>U: Show inline field errors
    else Validation passes
        PF->>API: PUT /api/v1/Users/me with name and email
        alt API error
            API-->>PF: 400 or 409 (e.g. email taken)
            PF-->>U: Show error message
        else Success
            API-->>PF: 200 Updated user data
            PF->>REF: POST /api/v1/Auth/refresh
            REF-->>AC: New access token plus updated user object
            AC-->>PF: AuthContext updated
            PF-->>U: Show success toast, form reset to saved values
        end
    end
```

Text alternative: User edits name/email on ProfilePage → frontend validates → PUT /Users/me → on success calls /auth/refresh to sync AuthContext → success toast shown.

---

## 2. Change Password Flow

```mermaid
sequenceDiagram
    box rgba(33,150,243,0.15) Frontend
        participant U as User
        participant PF as ProfilePage
        participant DL as ChangePasswordDialog
    end
    box rgba(244,67,54,0.15) Backend
        participant API as POST /auth/change-password
    end

    U->>PF: Click Change Password button
    PF->>DL: Open dialog
    U->>DL: Enter currentPassword, newPassword, confirmPassword
    DL->>DL: Validate (newPassword matches confirm, meets policy)
    alt Validation fails
        DL-->>U: Show inline errors
    else Validation passes
        DL->>API: POST /api/v1/Auth/change-password
        alt Wrong current password or policy violation
            API-->>DL: 400 with error detail
            DL-->>U: Show error message
        else Success
            API-->>DL: 200 OK
            DL-->>U: Close dialog, show success toast on ProfilePage
        end
    end
```

Text alternative: User opens Change Password dialog → validates fields → POST /auth/change-password → success closes dialog and shows toast.

---

## 3. Settings — Availability Update Flow

```mermaid
sequenceDiagram
    box rgba(33,150,243,0.15) Frontend
        participant U as User
        participant SP as SettingsPage
        participant QC as QueryClient
    end
    box rgba(244,67,54,0.15) Backend
        participant GET as GET /availability/status
        participant PUT as POST /availability/admin/status
    end

    SP->>GET: Fetch current availability on mount
    GET-->>SP: status, message, checkedAt
    SP-->>U: Display current mode and message
    U->>SP: Select new mode and optional message, click Save
    SP->>PUT: POST /api/v1/Availability/admin/status
    alt Success
        PUT-->>SP: 200 OK
        SP->>QC: Invalidate availability query cache
        QC->>GET: Re-fetch status
        GET-->>SP: Updated status
        SP-->>U: Show success toast, updated badge
    else Error
        PUT-->>SP: 400 or 403
        SP-->>U: Show error message
    end
```

Text alternative: SettingsPage fetches availability on mount. User selects new mode and saves → POST to admin status endpoint → on success invalidate cache to re-fetch updated status.

---

## 4. Route Guard Flow (403 / 404)

```mermaid
graph TD
    Nav["Navigation event"]
    ProtectedRoute{"ProtectedRoute check\n(authenticated?)"}
    RoleGuard{"RoleGuard check\n(role allowed?)"}
    RouteMatch{"Route exists?"}
    Page["Render Page"]
    P403["Render 403 AccessDeniedPage"]
    P404["Render 404 NotFoundPage"]
    Login["Redirect to /login"]

    Nav --> ProtectedRoute
    ProtectedRoute -->|No| Login
    ProtectedRoute -->|Yes| RouteMatch
    RouteMatch -->|No| P404
    RouteMatch -->|Yes, has RoleGuard| RoleGuard
    RouteMatch -->|Yes, no RoleGuard| Page
    RoleGuard -->|Allowed| Page
    RoleGuard -->|Denied| P403

    classDef guard fill:#FF9800,stroke:#e65100,color:#000
    classDef page fill:#2196F3,stroke:#0d47a1,color:#000
    classDef error fill:#F44336,stroke:#b71c1c,color:#000
    classDef start fill:#9C27B0,stroke:#4a148c,color:#000

    class ProtectedRoute guard
    class RoleGuard guard
    class RouteMatch guard
    class Page page
    class P403 error
    class P404 error
    class Login error
    class Nav start
```

Text alternative: Navigation → ProtectedRoute (unauthenticated → /login) → route match (unknown → 404) → RoleGuard (denied → 403, allowed → page renders).