Flowchart · blog-event core v1
Auth & permission flow
blog-event core auth and permission flow
Flowchart showing an incoming request checked for a valid session, a valid CSRF token on state-changing requests, and RBAC permission for the route, before the controller executes; each failed check exits to its own rejection response.
NO
YES
NO
YES
NO
YES
Request arrives
Router dispatches
Logged in?
(session valid)
Redirect to login
302 · unauthenticated
CSRF token
valid?
Reject request
419 · csrf mismatch
Has permission
for this route?
Forbidden
403 · RBAC denied
Controller executes
request handled
LEGEND · SHAPE CARRIES TYPE
Start / end (oval)
Step (rectangle)
Decision (diamond)
Happy path
Branch