17 - Auth Business Scenarios and Decision Tree

Dokumen ini merangkum skenario bisnis auth yang paling sering terjadi beserta keputusan implementasinya.

Scenario Map

Core Scenarios

Flow:

POST /api/v1/auth/login

optional 2FA challenge jika policy aktif

untuk user multi-tenant: POST /api/v1/auth/select-tenant

GET /api/v1/auth/me untuk bootstrap FE state

2. Token Refresh

Flow:

FE detect access token expired

POST /api/v1/auth/refresh

jika refresh success: retry request

jika refresh gagal: force logout + redirect login

3. Suspicious Auth Activity

Trigger umum:

refresh token replay

device fingerprint mismatch

repeated invalid refresh attempts

Aksi:

log activity

optional notification ke user/admin

invalidasi sesi sesuai policy

4. Password and Step-up Protected Action

Flow:

endpoint sensitif minta password.confirmed atau stepup.confirmed

FE jalankan confirm flow

request sensitif dieksekusi ulang

5. Tenant Context Mismatch

Kondisi:

X-Tenant-ID tidak sama dengan tenant pada token

Expected result:

403 FORBIDDEN dengan code yang sesuai

FE harus reset context dan minta user pilih tenant ulang

Decision Tree for New Auth Endpoint

FE Integration Rules

gunakan GET /auth/me sebagai sumber state user + authz.

jangan hardcode permission di FE tanpa authz payload.

selalu log request_id saat error agar trace backend cepat.

Test Scenarios (Minimum)

Untuk endpoint auth baru minimal cover:

success path

unauthorized

forbidden (ability/context)

validation error

regression pada refresh/logout flow

docs/03-central-auth-runtime.md

docs/06-fe-integration-contracts.md

docs/07-security-middleware-and-rls.md

docs/11-architecture-decisions.md

17 - Auth Business Scenarios and Decision Tree

Scenario Map#

Core Scenarios#

1. User Login Standard#

2. Token Refresh#

3. Suspicious Auth Activity#

4. Password and Step-up Protected Action#

5. Tenant Context Mismatch#

Decision Tree for New Auth Endpoint#

FE Integration Rules#

Test Scenarios (Minimum)#

Related Docs#

Scenario Map

Core Scenarios

1. User Login Standard

2. Token Refresh

3. Suspicious Auth Activity

4. Password and Step-up Protected Action

5. Tenant Context Mismatch

Decision Tree for New Auth Endpoint

FE Integration Rules

Test Scenarios (Minimum)

Related Docs