@startuml session_revocation_cookie_invalidation_sequences
title Before Flow: Revoke Succeeds but Cookie Can Stay Stale

actor "Browser Client" as Client
participant "Session Revoke Route" as Route
participant "SessionManager + DB" as DB

Client -> Route: POST /revoke-session (target token)
Route -> DB: delete_session(target token)
DB --> Route: success
Route --> Client: 200 { status: true } (no clear Set-Cookie)
note over Client
Stale session-token cookie may remain
until a later request.
end note

@enduml

@startuml session_revocation_cookie_invalidation_sequences_after_a
title After Flow A: Self-Revoke Returns Clear Set-Cookie Immediately

actor "Browser Client" as Client
participant "Session Revoke Route" as Route
participant "SessionManager + DB" as DB
participant "Cookie utils" as Cookie

Client -> Route: POST /revoke-session (target token == current token)
Route -> DB: delete_session(current token)
DB --> Route: success
Route -> Cookie: create_clear_session_cookie(...)
Cookie --> Route: clear Set-Cookie value
Route --> Client: 200 { status: true } + clear Set-Cookie

@enduml

@startuml session_revocation_cookie_invalidation_sequences_after_b
title After Flow B: Later Revoked-Cookie Request Gets 401 + Clear Set-Cookie

actor "Browser Client" as Client
participant "AthenaAuth::handle_request" as Pipeline
participant "Session token extraction" as Extract
participant "SessionManager + DB" as DB
participant "Cookie utils" as Cookie

Client -> Pipeline: Request with revoked session-token cookie
Pipeline -> Extract: read bearer/cookie token
Extract -> DB: get_session(cookie token)
DB --> Extract: not found (revoked/expired)
Extract --> Pipeline: AuthError::SessionNotFound
Pipeline -> Cookie: create_clear_session_cookie(...)
Cookie --> Pipeline: clear Set-Cookie value
Pipeline --> Client: 401 { message: ... } + clear Set-Cookie

@enduml

@startuml session_revocation_cookie_invalidation_sequences_admin
title Admin Self-Revoke Flow: Same Cookie-Clearing Behavior

actor "Admin Browser Client" as AdminClient
participant "Admin Revoke Route" as AdminRoute
participant "SessionManager + DB" as DB
participant "Cookie utils" as Cookie

AdminClient -> AdminRoute: POST /admin/revoke-user-session or /admin/revoke-user-sessions (self target)
AdminRoute -> DB: revoke current admin session(s)
DB --> AdminRoute: success
AdminRoute -> Cookie: create_clear_session_cookie(...)
Cookie --> AdminRoute: clear Set-Cookie value
AdminRoute --> AdminClient: 200 { success: true } + clear Set-Cookie

@enduml
