Skip to main content

Auth Flow Diagram

The implemented authentication/authorization middleware layer: the global pipeline (in order), the per-route-class chains, token types, and rate limits. For the step-by-step login / 2FA / reset flows, see the Auth Sequence Diagram.

Orientation​

  • Global middleware runs in order for every request: request-ID/logging → global rate limit → body-size limit → cookie parser → CORS → security headers → path-based routing.
  • Two auth chains diverge by path: the browser chain (operator rate limit → CSRF → user JWT → JTI revocation) protects the operator app; the machine chain (machine rate limit → API-Key middleware) protects /api/machine.
  • Two token types: the User JWT (signed with user_jwt_secret, HttpOnly cookie) and the API-Key JWT (signed with workflow_jwt_secret, Bearer header) — the human/machine split made concrete.
  • JTI revocation applies to both classes: user tokens via the revoked_user_token_jti denylist, machine tokens via the API key's revoked flag.
  • There is no refresh-token / session store — the JWT is delivered and verified only via the HttpOnly cookie.

Note: some node labels here are simplified from the source diagram to render cleanly in Mermaid; the structure, chains, and edges are reproduced faithfully.