slp-modular-cms/aidlc-docs/features/cms-frontend/construction/unit-0/functional-design/business-logic-model.md

Business Logic Model — Unit 0: Backend Prerequisites

Overview

Unit 0 modifies the authentication flow to use httpOnly cookies for refresh token delivery and adds CORS support for the React SPA. No new business transactions are introduced — existing auth transactions are made more secure.

---

Flow 1: Login

sequenceDiagram
    participant FE as Frontend
    participant AC as AuthController
    participant AS as AuthService
    participant DB as Database

    FE->>AC: POST /auth/login
    AC->>AS: AuthenticateAsync()
    AS->>DB: FindUser + ValidatePassword
    DB-->>AS: User + Role
    AS-->>AC: TokenResponse
    AC-->>FE: 200 accessToken + Set-Cookie refreshToken

Changes from current behaviour:

• RefreshToken is no longer returned in the response body
• httpOnly cookie is set on the response
• UserDto with Name (DisplayName ?? Email) is added to response

---

Flow 2: Refresh Token

sequenceDiagram
    participant FE as Frontend
    participant AC as AuthController
    participant AS as AuthService
    participant DB as Database

    FE->>AC: POST /auth/refresh (cookie auto-sent)
    AC->>AC: Read cookie refreshToken
    AC->>AS: RefreshTokenAsync(cookieValue)
    AS->>DB: Validate RefreshToken
    DB-->>AS: Valid + User
    AS-->>AC: new TokenResponse
    AC-->>FE: 200 new accessToken + Set-Cookie new refreshToken

Changes from current behaviour:

• Request body (RefreshTokenRequest) is removed — token read from cookie only
• New refresh token set in cookie (rotation still applies)

---

Flow 3: Revoke (Logout)

sequenceDiagram
    participant FE as Frontend
    participant AC as AuthController
    participant AS as AuthService
    participant DB as Database

    FE->>AC: POST /auth/revoke (no Authorize)
    AC->>AC: Read cookie refreshToken
    AC->>AS: RevokeTokenAsync(cookieValue)
    AS->>DB: Mark token revoked
    DB-->>AS: OK
    AC->>AC: Clear cookie Expires=epoch
    AC-->>FE: 204 No Content

Changes from current behaviour:

• [Authorize] attribute removed — logout works even if access token has expired
• Token read from cookie, not request body
• Cookie explicitly cleared in response

---

Flow 4: CORS Preflight

sequenceDiagram
    participant Browser
    participant API as API

    Browser->>API: OPTIONS /auth/login preflight
    API-->>Browser: 204 Access-Control-Allow headers
    Browser->>API: POST /auth/login with credentials
    API-->>Browser: 200 + Set-Cookie