{
  "schema_version": 1,
  "diagram_type": "sequence",
  "meta": {
    "title": "User Direct Access with JWT",
    "viewBox": [1000, 640],
    "column_fit": "spread",
    "quality_profile": "showcase"
  },
  "participants": [
    { "id": "user", "type": "external", "label": "User", "sublabel": "browser" },
    { "id": "app", "type": "frontend", "label": "Web App", "sublabel": "poimen UI" },
    { "id": "authentik", "type": "security", "label": "Authentik", "sublabel": "OIDC provider" },
    { "id": "memory", "type": "backend", "label": "Memory API", "sublabel": "poimen-memory" },
    { "id": "jwks", "type": "security", "label": "JWKS", "sublabel": "RS256 keys" }
  ],
  "segments": [
    { "from": 150, "to": 370, "label": "OIDC Login" },
    { "from": 380, "to": 540, "label": "API + RBAC" }
  ],
  "messages": [
    { "id": "click-login", "from": "user", "to": "app", "y": 165, "label": "click Login", "variant": "default" },
    { "id": "redirect-auth", "from": "app", "to": "authentik", "y": 200, "label": "redirect /authorize", "variant": "emphasis", "note": "scope=openid groups roles" },
    { "id": "show-login", "from": "authentik", "to": "user", "y": 235, "label": "login form", "variant": "default" },
    { "id": "submit-creds", "from": "user", "to": "authentik", "y": 270, "label": "username + password", "variant": "security" },
    { "id": "auth-code", "from": "authentik", "to": "app", "y": 305, "label": "redirect ?code=xxx", "variant": "return" },
    { "id": "exchange-token", "from": "app", "to": "authentik", "y": 340, "label": "POST /token code=xxx", "variant": "emphasis" },
    { "id": "jwt-resp", "from": "authentik", "to": "app", "y": 375, "label": "JWT {groups,roles,sub}", "variant": "return" },
    { "id": "query-api", "from": "app", "to": "memory", "y": 420, "label": "GET /memory/query", "variant": "emphasis", "note": "Authorization: Bearer <JWT>" },
    { "id": "fetch-jwks", "from": "memory", "to": "jwks", "y": 455, "label": "GET /jwks (cached)", "variant": "dashed" },
    { "id": "jwks-keys", "from": "jwks", "to": "memory", "y": 490, "label": "RSA pubkey", "variant": "return" },
    { "id": "query-resp", "from": "memory", "to": "app", "y": 525, "label": "200 JSON results", "variant": "return", "note": "has_capability(memory:read) ✓" }
  ],
  "activations": [
    { "participant": "user", "from": 160, "to": 276, "type": "external" },
    { "participant": "app", "from": 165, "to": 531, "type": "frontend" },
    { "participant": "authentik", "from": 195, "to": 381, "type": "security" },
    { "participant": "memory", "from": 415, "to": 531, "type": "backend" },
    { "participant": "jwks", "from": 450, "to": 496, "type": "security" }
  ],
  "cards": [
    {
      "dot": "emerald",
      "title": "Authorization Code Flow",
      "items": [
        "User authenticates directly with Authentik",
        "App exchanges code for JWT",
        "Scopes: openid groups roles permissions"
      ]
    },
    {
      "dot": "rose",
      "title": "JWT Contents",
      "items": [
        "iss: .../application/o/poimen/",
        "aud: poimen (provider client_id)",
        "groups: user's group memberships"
      ]
    }
  ]
}