Mermaid diagram syntax for Token-based authentication system

 sequenceDiagram

    participant User

    participant Browser

    participant AuthServer

    participant Database

    % Login Flow

    User->>Browser: Enter Credentials

    Browser->>AuthServer: POST /api/login

    AuthServer->>Database: Validate Credentials

    alt Credentials Valid

        Database-->>AuthServer: User Found

        AuthServer->>AuthServer: Generate Access Token

        AuthServer->>AuthServer: Generate Refresh Token

        AuthServer->>Database: Store Refresh Token

        AuthServer-->>Browser: Return Tokens

        Browser->>Browser: Store Tokens in HTTP-only Cookies

        Browser-->>User: Login Successful

    else Credentials Invalid

        Database-->>AuthServer: User Not Found/Invalid

        AuthServer-->>Browser: Login Failed (401)

        Browser-->>User: Show Error Message

    end

    % Token Validation Flow

    User->>Browser: Access Protected Route

    Browser->>AuthServer: Request with Access Token

    AuthServer->>AuthServer: Validate Access Token

    alt Token Valid

        AuthServer-->>Browser: Allow Access

        Browser-->>User: Show Protected Content

    else Token Expired

        Browser->>AuthServer: POST /api/token/refresh

        AuthServer->>Database: Validate Refresh Token

        alt Refresh Token Valid

            Database-->>AuthServer: Token Verified

            AuthServer->>AuthServer: Generate New Access Token

            AuthServer-->>Browser: New Access Token

            Browser->>Browser: Update Access Token Cookie

            Browser->>AuthServer: Retry Original Request

            AuthServer-->>Browser: Allow Access

        else Refresh Token Invalid

            AuthServer-->>Browser: Unauthorized (401)

            Browser-->>User: Redirect to Login

        end

    end

    % Logout Flow

    User->>Browser: Click Logout

    Browser->>AuthServer: POST /api/logout

    AuthServer->>Database: Revoke Refresh Token

    AuthServer->>Database: Invalidate Access Token

    AuthServer-->>Browser: Logout Successful

    Browser->>Browser: Clear Cookies

    Browser-->>User: Redirect to Login Page

    % Two-Factor Authentication Flow

    User->>Browser: Enter Username/Password

    Browser->>AuthServer: POST /api/login

    AuthServer->>Database: Validate Credentials

    alt First-time Login

        AuthServer->>AuthServer: Generate TOTP Secret

        AuthServer->>Database: Store TOTP Secret

        AuthServer-->>Browser: Return QR Code

        Browser-->>User: Display QR Code for Scanning

        User->>User: Scan QR with Authenticator App

    end

    User->>Browser: Enter TOTP Code

    Browser->>AuthServer: Submit TOTP

    AuthServer->>AuthServer: Validate TOTP

    alt TOTP Valid

        AuthServer->>AuthServer: Complete Authentication

        AuthServer-->>Browser: Return Tokens

    else TOTP Invalid

        AuthServer-->>Browser: 2FA Failed

        Browser-->>User: Show Error

    end

    % Password Reset Flow

    User->>Browser: Request Password Reset

    Browser->>AuthServer: POST /api/request_reset

    AuthServer->>Database: Check User Exists

    alt User Exists

        AuthServer->>AuthServer: Generate Reset Token

        AuthServer->>Database: Store Reset Token

        AuthServer->>User: Send Reset Email

        User->>Browser: Click Reset Link

        Browser->>AuthServer: POST /api/reset_password

        AuthServer->>Database: Validate Reset Token

        alt Token Valid

            AuthServer->>Database: Update Password

            AuthServer-->>Browser: Password Reset Success

        else Token Invalid

            AuthServer-->>Browser: Reset Failed

        end

    end