Repository navigation
UC‐02
| Field | Content |
|---|---|
| Use Case Number: | UC-02 |
| Use Case Name: | System Login & Session Management |
| Actor(s): | Admin, Museum Staff |
| Maturity: | Focused |
| Summary: | Admin or Museum Staff authenticates into the administrative portal by submitting valid credentials to obtain role-based access to management features. |
| Basic Course of Events: |
Actor Action 1. Actor accesses the administrative portal URL (/admin). A1 System Response 2. The system checks for active sessions, verifies no valid session exists, and displays the login screen. Actor Action 3. The Actor enters their username/email and password, then selects "Login". System Response 4. The system validates the input format and verifies the credentials against stored user records in the database. E1, E2, E3 5. The system confirms the account status is active, generates an authentication token/session, and logs the login event. 6. The system redirects the Actor to the Admin Dashboard according to their assigned role permissions. A2 |
| Alternative Paths: |
A1: Active Session Exists (Auto-Login) Actor Action 1. The Actor accesses the administrative portal while holding an active, unexpired session token. System Response 2. The system validates the existing session token and bypasses the login screen. Return to step 6 of the Basic Course of Events. A2: User Logout Actor Action 1. While on the Admin Dashboard, the Actor selects the "Logout" option. System Response 2. The system invalidates the active session token, clears client credentials, and redirects the Actor to the login screen. |
| Exception Paths: |
E1: At step 4, if the username or password fields are empty or malformed, the system highlights the invalid fields and displays an input error message. Returns to Basic Flow Step 3. E2: At step 4, if the credentials do not match any stored record, the system displays a generic error message ("Invalid username or password"), records the failed attempt in the audit log, and returns to Basic Flow Step 3. E3: At step 4, if consecutive failed login attempts exceed the allowed threshold (5 attempts) or the account is disabled, the system temporarily locks the account, logs a security alert, and informs the Actor. The use case ends. |
| Extension Points: | None. |
| Triggers: | Actor navigates to a protected administrative route (/admin) or an existing session expires. |
| Assumptions: | All authentication requests are transmitted over HTTPS; passwords are stored as cryptographic hashes in the database. |
| Preconditions: | The Actor's account is pre-provisioned and active in the system database with an assigned role (ADMIN or STAFF). |
| Postconditions: | An authenticated session is established (or terminated upon logout), the security audit log is updated, and role-based access to the Admin Dashboard is granted. |
