Fluxos do Sistema - ecosif-auth

MVP1: JWT via ecosif-spring-boot-starter-security; login externo via external-login.

1. Autenticação local (POST /api/auth/signin)

sequenceDiagram
    participant C as Cliente
    participant AC as AuthController
    participant AM as AuthenticationManager
    participant US as UserService
    participant TP as TokenProvider (starter)
    participant SC as SecurityContext

    C->>AC: POST /api/auth/signin {username, password}
    AC->>US: findUserByUsername
    alt inválido / inativo / expirado
        AC-->>C: 401
    else OK
        AC->>AM: authenticate(username, password)
        AM-->>AC: Authentication
        AC->>TP: createToken(username, userId)
        TP-->>AC: JWT ECOSIF
        AC->>SC: setAuthentication
        AC-->>C: 200 {accessToken, user, tenantName}
    end

Logs: local_signin event=* (sem senha).

2. Login externo (POST /api/auth/external-login)

sequenceDiagram
    participant B as Browser (Angular)
    participant IdP as Entra ID / Google
    participant EL as ExternalLoginController
    participant EAS as ExternalAuthenticationService
    participant V as IdentityProviderValidator
    participant UPS as UserProvisioningService
    participant TP as TokenProvider (starter)

    B->>IdP: Popup / GIS login
    IdP-->>B: id_token
    B->>EL: POST /api/auth/external-login {provider, token, tokenType}
    EL->>EAS: authenticate
    EAS->>V: validate(token) via JWKS
    V-->>EAS: ExternalIdentity
    EAS->>UPS: findOrProvision
    UPS-->>EAS: User
    EAS->>TP: createToken
    TP-->>EAS: JWT ECOSIF
    EAS-->>B: 200 {accessToken, user, tenantName}

Logs: external_login event=* (provider, sub; sem token).

3. Validação JWT nas APIs (starter)

sequenceDiagram
    participant C as Cliente
    participant TAF as TokenAuthenticationFilter
    participant TP as TokenProvider (starter)
    participant LUD as LocalUserDetailService
    participant E as Endpoint

    C->>TAF: Authorization: Bearer JWT_ECOSIF
    TAF->>TP: validateToken
    alt inválido
        TAF-->>C: 401
    else OK
        TAF->>LUD: loadUserByUsername(sub)
        TAF->>E: request autenticada
        E-->>C: 200
    end

4. Refresh de sessão (Angular)

1. AuthInterceptor chama GET /ecosif-masterdata/user com JWT atual
2. Resposta inclui novo accessToken
3. Falha → remove token e redirect /#/login

5. Logs Docker (admin)

Requer JWT válido — fluxo inalterado (DockerLogsController).

Resumo dos fluxos

Exceções tratadas (GlobalExceptionHandler)

• BadCredentialsException → 401
• BadRequestException → 400
• ResourceNotFoundException → 404
• Demais → 500 (sem vazar detalhes internos)

Contratos e fluxos descontinuados: migracao-signin-azure.md.