# Business Logic Model — Unit 0: Backend Prerequisites

## Overview

Unit 0 modifies the authentication flow to use httpOnly cookies for refresh token delivery and adds CORS support for the React SPA. No new business transactions are introduced — existing auth transactions are made more secure.

---

## Flow 1: Login

```mermaid
sequenceDiagram
    participant FE as Frontend
    participant AC as AuthController
    participant AS as AuthService
    participant DB as Database

    FE->>AC: POST /auth/login
    AC->>AS: AuthenticateAsync()
    AS->>DB: FindUser + ValidatePassword
    DB-->>AS: User + Role
    AS-->>AC: TokenResponse
    AC-->>FE: 200 accessToken + Set-Cookie refreshToken
```

**Changes from current behaviour**:
- `RefreshToken` is no longer returned in the response body
- httpOnly cookie is set on the response
- `UserDto` with `Name` (DisplayName ?? Email) is added to response

---

## Flow 2: Refresh Token

```mermaid
sequenceDiagram
    participant FE as Frontend
    participant AC as AuthController
    participant AS as AuthService
    participant DB as Database

    FE->>AC: POST /auth/refresh (cookie auto-sent)
    AC->>AC: Read cookie refreshToken
    AC->>AS: RefreshTokenAsync(cookieValue)
    AS->>DB: Validate RefreshToken
    DB-->>AS: Valid + User
    AS-->>AC: new TokenResponse
    AC-->>FE: 200 new accessToken + Set-Cookie new refreshToken
```

**Changes from current behaviour**:
- Request body (`RefreshTokenRequest`) is **removed** — token read from cookie only
- New refresh token set in cookie (rotation still applies)

---

## Flow 3: Revoke (Logout)

```mermaid
sequenceDiagram
    participant FE as Frontend
    participant AC as AuthController
    participant AS as AuthService
    participant DB as Database

    FE->>AC: POST /auth/revoke (no Authorize)
    AC->>AC: Read cookie refreshToken
    AC->>AS: RevokeTokenAsync(cookieValue)
    AS->>DB: Mark token revoked
    DB-->>AS: OK
    AC->>AC: Clear cookie Expires=epoch
    AC-->>FE: 204 No Content
```

**Changes from current behaviour**:
- `[Authorize]` attribute removed — logout works even if access token has expired
- Token read from cookie, not request body
- Cookie explicitly cleared in response

---

## Flow 4: CORS Preflight

```mermaid
sequenceDiagram
    participant Browser
    participant API as API

    Browser->>API: OPTIONS /auth/login preflight
    API-->>Browser: 204 Access-Control-Allow headers
    Browser->>API: POST /auth/login with credentials
    API-->>Browser: 200 + Set-Cookie
```