@startuml FHIR-Directory, Sequenzdiagram Änderung von eigenen -Einträgen
skinparam dpi 100
skinparam WrapWidth 200
skinparam monochrome true

'title "FHIR-Directory, Sequenzdiagram Änderung von eigenen Einträgen'
actor o as "Org-Admin\noder LE"
participant cl as "Org-Admin-Client\noder\nTI-Messenger-Client"
participant aa as "Authenticator App\ndes IDP"
participant au as "Auth-Service"
participant fp as "FHIR-Proxy"
participant idp as "Identity Provider"
participant fd as "FHIR-Directory"
participant rd as "TI-Messenger\nRegistrierungsdienst"
o -> cl: möchte seinen FHIR-Eintrag\nändern
activate cl
cl -> cl: prüfe ob noch gültiges owner-accesstoken\nfür Schreibzugriff vom Auth-Service vorliegt
alt kein gültiges owner-accesstoken für Schreibzugriff vorhanden
alt Org-Admin
cl -> rd: POST /regservice/user/{userId}/request_token
activate rd
rd --> cl: HTTP 200 OK, Result body {"access_token": "RegService-OpenID-Token=id_token"}
deactivate rd
cl -> au: GET /owner-authenticate... ((Auth Header mit RegService-OpenID-Token))
activate au
au -> au: verify RegService-OpenID-Token (telematikID, professionOID)
else LE mit HBA und TI-Messenger Client
cl -> au: GET /owner-authenticate
au -> au: Erzeuge PKCE Code für verifier und challenge
au --> cl: Redirect to IDP Authorization Endpoint
cl -> idp: POST /authorize
idp --> cl: Authentication challenge
activate aa
aa -> aa: Authentication
aa --> idp: Authentication challenge response
deactivate aa
activate idp
idp --> cl: Authorization Response with Authorization code
cl -> au: GET /signin-gematik-idp-dienst with Authorization code
au -> idp: POST /tokenEndpoint {authorization code}
idp --> au: Response {id_token}

deactivate idp
end
au -> au: erzeuge owner-accesstoken
au --> cl: HTTP 200 OK, Result body {"access_token"="owner-accesstoken"}
deactivate au
end
cl -> fp: POST /owner/TIHealthcareService (Authorization Bearer owner-accesstoken) {providedBy.id=telematikID}
activate fp
fp -> fp: prüfe owner-accesstoken
fp -> fd: POST /TIHealthcareService {providedBy.id=telematikID}
activate fd
fd --> fp: HTTP 200 OK (Result Body json)
fp --> cl: HTTP 200 OK (Result Body json)
deactivate fd
deactivate fp
deactivate cl
@enduml
