Gronod
6675e5dcfe
All checks were successful
Build and Push Docker Image / build (push) Successful in 24s
ARCHITECTURE.md: - Directory structure: add middleware/requireAuth.js and favicon assets - §4.1: remove CORS from middleware list - §4.2: all proxy routes now auth-required via requireAuth; add middleware description - §6: cookie payload corrected (no token); document secure+sameSite - §7: add emby:users cache key (60s TTL) - §8: Download Object table: userTag → allTags/matchedUserTag/tagBadges - §9 POST /login: document cookie security attributes - §10: add Tag Badge Rendering section; remove hardcoded line count Diagrams: - class-server.puml: add requireAuth middleware module; update dashboard.js methods (extractAllTags, extractUserTag w/ username, buildTagBadges, getEmbyUsers); add TagBadge value class; add auth relationships for all proxy routes - class-data.puml: Download Object userTag → allTags/matchedUserTag/ tagBadges; add TagBadge class; remove token from Session Cookie - seq-auth.puml: cookie payload no longer contains token; add secure/sameSite note - component.puml: remove CORS component; add requireAuth; consolidate Emby connection to show tag badge + user-summary usage - activity-matching.puml: update to extractAllTags/extractUserTag (with username); showAll uses hasAnyTag; tagBadges built from embyUserMap; add Emby user fetch step; update legend - seq-dashboard.puml: add emby:users cache lookup / Emby fetch for showAll; update matching groups to show tag classification; add tag badge rendering note on renderDownloads()
68 lines
2.1 KiB
Plaintext
68 lines
2.1 KiB
Plaintext
@startuml seq-auth
|
|
!theme plain
|
|
title sofarr — Authentication Sequence
|
|
|
|
actor User as user
|
|
participant "Browser\n(app.js)" as browser
|
|
participant "Express\n/api/auth" as auth
|
|
participant "Emby\nServer" as emby
|
|
|
|
== Page Load ==
|
|
user -> browser : Navigate to sofarr
|
|
activate browser
|
|
browser -> auth : GET /api/auth/me
|
|
activate auth
|
|
auth -> auth : Read emby_user cookie
|
|
alt Cookie exists and valid
|
|
auth --> browser : { authenticated: true, user: { name, isAdmin } }
|
|
browser -> browser : showDashboard()
|
|
browser -> browser : fetchUserDownloads(true)
|
|
browser -> browser : startAutoRefresh()
|
|
browser -> browser : dismissSplash()
|
|
else No cookie
|
|
auth --> browser : { authenticated: false }
|
|
browser -> browser : dismissSplash()
|
|
browser -> browser : showLogin()
|
|
end
|
|
deactivate auth
|
|
|
|
== Login ==
|
|
user -> browser : Enter username + password
|
|
browser -> auth : POST /api/auth/login\n{ username, password }
|
|
activate auth
|
|
auth -> emby : POST /Users/authenticatebyname\n{ Username, Pw }
|
|
activate emby
|
|
alt Valid credentials
|
|
emby --> auth : { User: { Id, ... }, AccessToken }
|
|
auth -> emby : GET /Users/{userId}
|
|
emby --> auth : { Name, Policy: { IsAdministrator } }
|
|
deactivate emby
|
|
auth -> auth : Set httpOnly cookie\nemby_user = { id, name, isAdmin }\n(24h TTL, secure in prod, sameSite=strict)\nNote: AccessToken NOT stored
|
|
auth --> browser : { success: true, user: { name, isAdmin } }
|
|
browser -> browser : fadeOutLogin()
|
|
browser -> browser : showSplash()
|
|
browser -> browser : showDashboard()
|
|
browser -> browser : fetchUserDownloads(true)
|
|
browser -> browser : startAutoRefresh()
|
|
browser -> browser : dismissSplash()
|
|
else Invalid credentials
|
|
emby --> auth : 401 Error
|
|
deactivate emby
|
|
auth --> browser : { success: false, error: "Invalid..." }
|
|
browser -> browser : showLoginError()
|
|
end
|
|
deactivate auth
|
|
|
|
== Logout ==
|
|
user -> browser : Click Logout
|
|
browser -> browser : stopAutoRefresh()
|
|
browser -> auth : POST /api/auth/logout
|
|
activate auth
|
|
auth -> auth : Clear emby_user cookie
|
|
auth --> browser : { success: true }
|
|
deactivate auth
|
|
browser -> browser : showLogin()
|
|
|
|
deactivate browser
|
|
@enduml
|