Login
UC-11 — password authentication, the uniform rejection, and the branch into a two-factor challenge.
Flows
Sequence diagrams for the paths that are worth tracing end to end.
Most endpoints are a straight line: validate, read, write, respond. The flows collected here are the ones that are not — they cross services, branch on stored state, or deliberately answer the same way down several different paths.
| Flow | Why it is worth tracing |
|---|---|
| Login | Five distinct failure causes, one answer — and a sixth outcome that is not a token at all. |
| Two-factor authentication | Setup, confirmation, and the challenge-token round trip that completes a gated login. |
| Google Sign-In | Verification before anything else, then sign-up or sign-in down the same endpoint. |
| Person onboarding | Creation, the verification email, and the resend path — including what happens with no mail credentials. |
| Password recovery | An endpoint whose whole design is about what it must not reveal. |
| Scope permission claims | How a permission defined in a scope ends up inside a caller’s JWT. |
| Audit logging | One decorator, every write, no handler changes. |
| Application authentication | Issue a secret, exchange it for a token, and re-check that token live: what a consumer such as Cerberus has to do. |
Each page cites the use case (UC-…) and alternative flows (AF-…) it implements. The authoritative
descriptions live in the
Use Case Specification Document
.
Two-factor authentication
UC-36 to UC-40 — setup, confirmation, the challenge-token round trip, and recovery codes.
Google Sign-In
UC-24 to UC-29 — enabling the feature per scope, sign-up and sign-in down one endpoint, and administering Google Users.
Person onboarding
UC-06, UC-14 and UC-15 — creating a person, the verification email, and replacing a lost link.
Password recovery
UC-12 and UC-13 — an endpoint whose whole design is about what it must not reveal.
Scope permission claims
UC-31 to UC-35 and FR-AU-08 — how a permission defined in a scope ends up inside a caller JWT.
Audit logging
NFR-09 — one decorator, every write, no handler changes.
Application authentication
UC-53 to UC-57 — credentials for a registered application, the token they buy, and the live re-check consumers make.