@startuml
title Get Session Failure Diagnostics - Before

skinparam backgroundColor #FFFFFF
skinparam defaultTextAlignment center
skinparam shadowing false
skinparam sequence {
  ArrowColor #1F2937
  ActorBorderColor #111827
  ActorFontColor #111827
  LifeLineBorderColor #6B7280
  LifeLineBackgroundColor #FFFFFF
  ParticipantBorderColor #374151
  ParticipantBackgroundColor #F9FAFB
  ParticipantFontColor #111827
  BoxBorderColor #CBD5E1
  BoxFontColor #111827
}
skinparam note {
  BackgroundColor #FEF3C7
  BorderColor #D97706
  FontColor #111827
}

actor Browser
participant "Athena Auth\nServer Router" as Router
participant "Auth Dispatch" as Dispatch
participant "SessionManagementPlugin\nhandle_get_session" as Plugin
participant "AuthContext\nrequire_session" as Require
database "Session Store" as Store

Browser -> Router: GET /api/auth/get-session?disableCookieCache=true
Router -> Dispatch: resolve tenant and dispatch request
Dispatch -> Plugin: normalized GET /get-session
Plugin -> Require: require_session(request)

alt no Authorization header and no configured session cookie
  Require --> Plugin: Err Unauthenticated
else token exists but row is missing, expired, or inactive
  Require -> Store: get_session(token)
  Store --> Require: None
  Require --> Plugin: Err Unauthenticated
else session row exists but user lookup fails
  Require -> Store: get_session(token)
  Store --> Require: session
  Require -> Store: get_user_by_id(session.user_id)
  Store --> Require: None
  Require --> Plugin: Err Unauthenticated
end

Plugin --> Dispatch: error
Dispatch --> Router: 401 {"message":"Authentication required"}
Router --> Browser: 401

note right of Browser
  Browser sees a generic 401.
  Server logs do not show whether
  the cookie was absent, invalid,
  expired, or tied to a missing user.
end note

@enduml
