@startuml
title Get Session Failure Diagnostics - After

skinparam backgroundColor #FFFFFF
skinparam defaultTextAlignment center
skinparam shadowing false
skinparam sequence {
  ArrowColor #1F2937
  ActorBorderColor #111827
  ActorFontColor #111827
  LifeLineBorderColor #6B7280
  LifeLineBackgroundColor #FFFFFF
  ParticipantBorderColor #374151
  ParticipantBackgroundColor #F9FAFB
  ParticipantFontColor #111827
  BoxBorderColor #CBD5E1
  BoxFontColor #111827
}
skinparam note {
  BackgroundColor #DBEAFE
  BorderColor #2563EB
  FontColor #111827
}

actor Browser
participant "Server Middleware\nrequest trace" as Middleware
participant "Tenant Dispatch\nsession trace context" as Dispatch
participant "SessionManagementPlugin\nhandle_get_session" as Plugin
participant "SessionManager\nextract with source" as Manager
database "Session Store" as Store

Browser -> Middleware: GET /api/auth/get-session?disableCookieCache=true
Middleware -> Middleware: log method, path, origin,\nAuthorization presence, cookie presence
Middleware -> Dispatch: continue
Dispatch -> Dispatch: resolve tenant and build\nAuthRequestTraceContext
Dispatch -> Plugin: normalized GET /get-session
Plugin -> Manager: extract_session_token_with_source(request)

alt no Authorization header and no configured session cookie
  Manager --> Plugin: None
  Plugin -> Plugin: log SESSION_TOKEN_MISSING
  Plugin --> Dispatch: 401 diagnostic JSON
else token exists but row is missing, expired, or inactive
  Manager --> Plugin: token + source
  Plugin -> Store: get_session(token)
  Store --> Plugin: None
  Plugin -> Plugin: log SESSION_NOT_FOUND\nwith hashed token prefix
  Plugin --> Dispatch: 401 diagnostic JSON\nand clear cookie when cookie supplied
else session row exists but user lookup fails
  Manager --> Plugin: token + source
  Plugin -> Store: get_session(token)
  Store --> Plugin: session
  Plugin -> Store: get_user_by_id(session.user_id)
  Store --> Plugin: None
  Plugin -> Plugin: log SESSION_USER_NOT_FOUND
  Plugin --> Dispatch: 401 diagnostic JSON
else active session and user exist
  Manager --> Plugin: token + source
  Plugin -> Store: get_session(token)
  Store --> Plugin: session
  Plugin -> Store: get_user_by_id(session.user_id)
  Store --> Plugin: user
  Plugin --> Dispatch: 200 session + user JSON
end

Dispatch -> Dispatch: log status, tenant,\ncredential source hints, Set-Cookie
Dispatch --> Middleware: response
Middleware -> Middleware: log completion with status,\nX-Athena-Time, cookie diagnostics
Middleware --> Browser: JSON response

note right of Browser
  401 responses now include code,
  reason, null session/user, and
  safe diagnostics such as token
  source and cookie presence.
end note

@enduml
