@startuml
Title  Tapestry to Rebellion Toggling
participant User_Agent 
participant Tapestry as App
participant API_Gateway  as APIG
participant TMobileIDM  as IDM
participant Rebellion as App2
participant APIs

User_Agent->App: User tries to access Tapestry application
App->App: Check key chain if Access Token Exists

alt If Okta Session does not exists
    
== User Login ==
    App->User_Agent: Displays Login page over system browser
    User_Agent->App: User enters the credentials
    App->APIG: submits the credentials  
    APIG->IDM:Invoke [[https://bitbucket.service.edp.t-mobile.com/projects/EITCODEDOC/repos/flow-documentation/browse/swagger/ce.dsg.idm/AuthenticationService.swagger.json AuthenticationService]] - primaryAuthentication API
    IDM->IDM: Validates the credentials
    IDM->APIG: If Success, Session Token is passed back
    APIG->App: Passes the session token back to calling client

else If Okta Session exists
     App->APIG: Request Authcode using Session Token and Code Challenge 
     APIG->IDM: Invoke [[https://bitbucket.service.edp.t-mobile.com/projects/EITCODEDOC/repos/flow-documentation/browse/swagger/ce.dsg.idm/AuthenticationService.swagger.json AuthenticationService]] - Authorize API
     IDM->IDM: Validates Okta session
     IDM->APIG: Send the "Authorization Code"
     APIG -> App: Pass back the "Authorization Code"
end
App->APIG: Request token using Authorization Code + Code Verifier
APIG->APIG: Verifies request
APIG->IDM: Invoke [[https://bitbucket.service.edp.t-mobile.com/projects/EITCODEDOC/repos/flow-documentation/browse/swagger/ce.dsg.idm/AuthenticationService.swagger.json AuthenticationService]] - Token API
IDM->IDM: Validates the codes
IDM->APIG:If success,Sends Tokens(Access Tokens, Refresh Tokens, ID Tokens)
APIG->APIG:Validates token and retreive attribute
APIG->App: Tokens and response parameters

== ==
App->User_Agent: Display Tapestry page
User_Agent->App: Toggle to Rebellion
App->App2: Toggling to Rebellion using OIDC tokens
App2->App2: validates request and store toggled data locally
App2->APIG: Invoke  [[https://bitbucket.service.edp.t-mobile.com/projects/EITCODEDOC/repos/flow-documentation/browse/swagger/ce.dsg.idm/AuthenticationService.swagger.json AuthenticationService]] - ValidateToken API
APIG->APIG: Validates token

group alt If access token is invalid

APIG->User_Agent: OKTA login page is displayed to the User
end group

group else If access token is expired
APIG->IDM: Request for refresh token
IDM->APIG: Okta refresh token
end group
APIG->App2: APIGEE send the response to Rebellion
App2->APIs:call backend API's to retrieve the data
APIs->App2: API response body
App2->User_Agent: Rendering data for requested service
@enduml