Skip to main content

Auth Sequence Diagram

The step-by-step sequences for each authentication flow, reproduced faithfully. For the middleware/component view, see the Auth Flow Diagram.

Orientation​

The diagram walks six flows:

  • 0) First-run registration — available only while no user exists; confirmation both activates the account and logs the user in.
  • 1) Login — password verification, and, when 2FA is enabled, a second step that issues the session only after a valid TOTP or backup code.
  • 2) Protected request — CSRF (on state-changing calls) → user-JWT verification → JTI revocation (which also rejects tokens issued before the last password change).
  • 3) Logout — the token's jti is added to the denylist and the cookies are cleared.
  • 4) Machine auth — the engine's Bearer API-Key JWT is verified against workflow_jwt_secret and checked for revocation/expiry.
  • 5) Forgot password — a deliberately non-enumerating flow that emails a temporary password and invalidates existing sessions.