@startuml passkey_webauthn_registration_and_signin_sequences_register
title Passkey Registration - WebAuthn State Stored in Verification Table

actor "Browser Client" as Client
participant "PasskeyPlugin\n/generate-register-options" as RegisterOptions
participant "passkey-server crate" as PasskeyServer
participant "PasskeyStoreAdapter" as Store
participant "Verification table\npasskey_state:*" as VerifyTable
participant "PasskeyPlugin\n/verify-registration" as VerifyRegistration
participant "Passkeys table" as Passkeys

Client -> RegisterOptions: GET /passkey/generate-register-options
RegisterOptions -> PasskeyServer: start_registration(...)
PasskeyServer -> Store: save_state(id, state_json, expires_at)
Store -> VerifyTable: create_verification(identifier=passkey_state:{id}, value=state_json)
VerifyTable --> Store: stored
PasskeyServer --> RegisterOptions: PublicKeyCredentialCreationOptions
RegisterOptions --> Client: 200 options

Client -> VerifyRegistration: POST /passkey/verify-registration { credential response }
VerifyRegistration -> PasskeyServer: finish_registration(...)
PasskeyServer -> Store: get_state(id) + delete_state(id)
Store -> VerifyTable: read/delete passkey_state
PasskeyServer -> Store: create_passkey(...)
Store -> Passkeys: create_passkey(user_id, credential_id, public_key, counter)
VerifyRegistration --> Client: 200 PasskeyView

@enduml

@startuml passkey_webauthn_registration_and_signin_sequences_auth
title Passkey Authentication - Session Issued After Assertion Verification

actor "Browser Client" as Client
participant "PasskeyPlugin\n/generate-authenticate-options" as AuthOptions
participant "PasskeyPlugin\n/verify-authentication" as VerifyAuth
participant "passkey-server crate" as PasskeyServer
participant "PasskeyStoreAdapter" as Store
participant "Passkeys table" as Passkeys
participant "Users table" as Users
participant "SessionManager" as SessionManager

Client -> AuthOptions: POST /passkey/generate-authenticate-options
AuthOptions -> PasskeyServer: start_login(...)
PasskeyServer -> Store: save_state(id, state_json, expires_at)
AuthOptions --> Client: 200 options

Client -> VerifyAuth: POST /passkey/verify-authentication { assertion response }
VerifyAuth -> PasskeyServer: finish_login(...)
PasskeyServer -> Store: get_state + get_passkey + update_passkey_counter
Store -> Passkeys: load/update credential counter
PasskeyServer --> VerifyAuth: authenticated user_id

VerifyAuth -> Users: get_user_by_id(user_id)
VerifyAuth -> SessionManager: create_session(user, ip, user_agent)
SessionManager --> VerifyAuth: session token + session entity
VerifyAuth --> Client: 200 { session, user } + Set-Cookie session token

@enduml

