Auth & Session — DocQStack Data Flow

Data flow

Authentication & session

Google and LinkedIn OIDC with server-side sessions stored in MySQL. HttpOnly cookie docqstack_session; mutating requests require CSRF token from GET /api/v1/auth/csrf.

Sequence

sequenceDiagram
    participant U as User
    participant FE as Next.js
    participant API as FastAPI
    participant OAuth as Google / LinkedIn
    participant DB as MySQL
    U->>FE: Sign in
    FE->>API: GET /auth/google/start
    API-->>U: Redirect OAuth
    U->>OAuth: Authorize
    OAuth-->>API: Callback
    API->>DB: Upsert user + session
    API-->>U: Set-Cookie docqstack_session
    FE->>API: GET /auth/session
    API-->>FE: user, roles

Production guards

COOKIE_SECURE=true required in production
Banned users blocked at OAuth callback and session validation
Logout revokes session server-side

Key endpoints

GET /api/v1/auth/google/start, GET /api/v1/auth/linkedin/start
GET /api/v1/auth/session, POST /api/v1/auth/logout