sequenceDiagram
  title GAIN POC - Authorization Code Flow

  autonumber

  actor H as Holder
  participant B as Browser
  participant HW as Holder Wallet
  participant IW as Issuer Website
  participant OWA as Conformance Issuer

  H->>IW: Initiate credential offer (auth code grant)
  alt same-device
    IW->>IW: Show button
    H->>IW: Click button
    IW-->>HW: 302 credential offer uri
  else cross-device
    IW->>IW: Show QR code
    H->>HW: Navigate to QR code scanner
    HW->>+IW: Scan QR code
    IW-->>-HW: credential offer uri
  end

  Note over HW,OWA: Discovery
  HW->>+OWA: GET /.well-known/openid-credential-issuer
  OWA-->>-HW: 200 OpenID Credential Issuer Metadata
  HW->>+OWA: GET /.well-known/jwt-issuer
  OWA-->>-HW: 200 OpenID Issuer Signing Key Metadata
  HW->>+OWA: GET /.well-known/oauth-authorization-server
  OWA-->>-HW: 200 OAuth Authorization Server Metadata

  Note over HW,OWA: Authorization request
  HW->>HW: Create PKCE code verifier
  alt Pushed Authorization Request (PAR)
    HW->>+OWA: POST /authorize/par <br/>{response_type, client_id, code_challenge, code_challenge_method, <br>authorization_details, scope, redirect_uri}
    OWA-->>-HW: 200 PAR Response {request_uri}
    HW->>B: 302 Authorization Request {request_uri, client_id}
    B->>OWA: Authorization Request {request_uri, client_id}
  else Non-PAR
    HW->>+OWA: GET /authorize <br>{response_type, client_id, code_challenge, code_challenge_method, <br>authorization_details, scope, redirect_uri}
  end
  Note over B,OWA: Dummy user authentication
  OWA-->>B: 302 Authorization Response {code, state, iss}
  B-->>HW: Authorization Response {code, state, iss}
  Note over HW,OWA: Token request
  HW->>+OWA: POST /token<br>{grant_type, code, code_verifier, redirect_uri}
  OWA-->>-HW: 200 Token Response {access_token, c_nonce}
  Note over HW,OWA: Credential request
  HW->>+OWA: POST /credential<br>{access_token, credential_definition, format, proof}
  OWA-->>-HW: 200 Credential Response<br>{format, credential, c_nonce, c_nonce_expires_in}
  HW->>HW: Verify credential
  HW->>HW: Store credential