# SteerEx Login Process Flow
direction: down

title: {
  label: SteerEx Authentication Flow
  near: top-center
  shape: text
  style: {
    font-size: 24
    bold: true
  }
}

# ============================================
# Entry Point
# ============================================
user: {
  label: User
  shape: person
  style.fill: "#e3f2fd"
}

# ============================================
# Login Phase
# ============================================
login_phase: Login Phase {
  style.fill: "#fafafa"
  style.stroke: "#bdbdbd"
  style.border-radius: 8

  index_route: {
    label: |md
      **/** (Index Route)
      Entry point
    |
    style.fill: "#e3f2fd"
    style.border-radius: 6
  }

  login_page: {
    label: |md
      **/login**
      LoginPage component
    |
    style.fill: "#fff3e0"
    style.border-radius: 6
  }

  index_route -> login_page: Redirect
}

# ============================================
# Keycloak Authentication
# ============================================
keycloak_phase: Keycloak Authentication {
  style.fill: "#f3e5f5"
  style.stroke: "#ce93d8"
  style.border-radius: 8

  kc_init: {
    label: |md
      **Keycloak Init**
      check-sso mode
      loginState = 'inProgress'
    |
    style.fill: "#e1bee7"
    style.border-radius: 6
  }

  init_result: {
    shape: diamond
    label: |md
      Init
      result?
    |
    style.fill: "#fff9c4"
  }

  sso_check: {
    shape: diamond
    label: |md
      SSO
      Session?
    |
    style.fill: "#fff9c4"
  }

  kc_login: {
    label: |md
      **Keycloak Login**
      User enters credentials
      loginState = 'loggedOut'
    |
    style.fill: "#ffccbc"
    style.border-radius: 6
  }

  silent_token: {
    label: |md
      **Silent Token**
      Via iframe
      loginState = 'loggedIn'
    |
    style.fill: "#c8e6c9"
    style.border-radius: 6
  }

  kc_init -> init_result
  init_result -> sso_check: Success
  init_result -> errors.auth_error_init: "Failure → errorInit"
  sso_check -> kc_login: No
  sso_check -> silent_token: Yes
}

# ============================================
# User Data & Authorization
# ============================================
auth_phase: User Data & Authorization {
  style.fill: "#e8f5e9"
  style.stroke: "#81c784"
  style.border-radius: 8

  load_user: {
    label: |md
      **Load User Data**
      trpc.viewer.viewer
      (enabled when loggedIn)
    |
    style.fill: "#c8e6c9"
    style.border-radius: 6
  }

  load_check: {
    shape: diamond
    label: |md
      Load
      success?
    |
    style.fill: "#fff9c4"
  }

  role_check: {
    shape: diamond
    label: |md
      Has
      'unauthorized'
      role?
    |
    style.fill: "#fff9c4"
  }

  load_user -> load_check
  load_check -> role_check: Success
  load_check -> errors.auth_error_load: "Failure → errorLoadUser"
}

# ============================================
# Error States
# ============================================
errors: Error States {
  style.fill: "#ffebee"
  style.stroke: "#ef9a9a"
  style.border-radius: 8

  auth_error_init: {
    label: |md
      **/auth-error**
      ?type=errorInit
    |
    style.fill: "#ffcdd2"
    style.border-radius: 6
  }

  auth_error_load: {
    label: |md
      **/auth-error**
      ?type=errorLoadUser
    |
    style.fill: "#ffcdd2"
    style.border-radius: 6
  }

  auth_error_token: {
    label: |md
      **/auth-error**
      ?type=errorTokenRefresh
    |
    style.fill: "#ffcdd2"
    style.border-radius: 6
  }

  unauthorized: {
    label: |md
      **/unauthorized**
    |
    style.fill: "#ffcdd2"
    style.border-radius: 6
  }

  no_programs: {
    label: |md
      **Error**
      No Programs
    |
    style.fill: "#ffcdd2"
    style.border-radius: 6
  }
}

# ============================================
# Protected Routes
# ============================================
protected_phase: Protected Routes {
  style.fill: "#e3f2fd"
  style.stroke: "#64b5f6"
  style.border-radius: 8

  auth_guard: {
    label: |md
      **/_auth-routes**
      AuthGuard component
      (renders when loggedIn)
    |
    style.fill: "#bbdefb"
    style.border-radius: 6
  }

  load_programs: {
    label: |md
      **Load Programs**
      useUserPrograms()
    |
    style.fill: "#b3e5fc"
    style.border-radius: 6
  }

  programs_check: {
    shape: diamond
    label: |md
      Programs
      available?
    |
    style.fill: "#fff9c4"
  }

  select_program: {
    label: |md
      **Select Program**
      localStorage or first
    |
    style.fill: "#b3e5fc"
    style.border-radius: 6
  }

  set_theme: {
    label: |md
      **Set Theme**
      program.themeKey
    |
    style.fill: "#b3e5fc"
    style.border-radius: 6
  }

  auth_guard -> load_programs
  load_programs -> programs_check
  programs_check -> select_program: Yes
  select_program -> set_theme
}

# ============================================
# Dashboard Redirects
# ============================================
dashboard_phase: Dashboard Redirects {
  style.fill: "#fff8e1"
  style.stroke: "#ffcc80"
  style.border-radius: 8

  program_index: {
    label: |md
      **/$programId** (index)
      Redirect to deliverable
    |
    style.fill: "#ffe0b2"
    style.border-radius: 6
  }

  deliverable_index: {
    label: |md
      **/$programId/$deliverableId** (index)
      Default to 'overview' tab
    |
    style.fill: "#ffe0b2"
    style.border-radius: 6
  }
}

# ============================================
# Final Destination
# ============================================
final: {
  label: |md
    **/dashboard/$programId/$deliverableId/overview**

    Application Ready
  |
  style.fill: "#81c784"
  style.stroke: "#43a047"
  style.stroke-width: 3
  style.border-radius: 8
  style.font-color: "#1b5e20"
  style.bold: true
}

# ============================================
# Main Flow Connections
# ============================================
user -> login_phase.index_route: Opens app

login_phase.login_page -> keycloak_phase.kc_init

keycloak_phase.kc_login -> auth_phase.load_user: "Token received → loggedIn"
keycloak_phase.silent_token -> auth_phase.load_user

auth_phase.role_check -> errors.unauthorized: Yes
auth_phase.role_check -> protected_phase.auth_guard: No

protected_phase.programs_check -> errors.no_programs: No
protected_phase.set_theme -> dashboard_phase.program_index

dashboard_phase.program_index -> dashboard_phase.deliverable_index: Redirect
dashboard_phase.deliverable_index -> final: Redirect

# Token refresh error (runtime)
protected_phase.auth_guard -> errors.auth_error_token: "Token refresh fails → errorTokenRefresh" {
  style.stroke-dash: 5
  style.stroke: "#ef9a9a"
}

# ============================================
# Legend
# ============================================
legend: Legend {
  style.fill: "#fafafa"
  style.stroke: "#e0e0e0"
  style.border-radius: 8
  near: bottom-right

  l1: Login {
    style.fill: "#fff3e0"
    style.border-radius: 4
  }
  l2: Keycloak {
    style.fill: "#e1bee7"
    style.border-radius: 4
  }
  l3: Auth {
    style.fill: "#c8e6c9"
    style.border-radius: 4
  }
  l4: Routes {
    style.fill: "#bbdefb"
    style.border-radius: 4
  }
  l5: Dashboard {
    style.fill: "#ffe0b2"
    style.border-radius: 4
  }
  l6: Error {
    style.fill: "#ffcdd2"
    style.border-radius: 4
  }
}
