UC02

Use Case Specification: UC-02

Field	Content
Use Case Number:	UC-02
Use Case Name:	System Login / Authentication
Actor(s):	Admin / Museum Staff (Primary), Authentication Service (Secondary)
Maturity:	Focused
Summary:	Admin or Museum Staff authenticates into the administrative portal by submitting valid credentials to obtain role-based access to management features.
Reference: Business Rules:	BR-AUTH-01 (Password Encryption), BR-AUTH-02 (Lockout & Rate Limiting), BR-AUTH-03 (Session Lifetime), BR-AUTH-04 (Role-Based Access Control)

Actor Action	System Response
1. Admin / Museum Staff accesses the admin portal and submits login credentials. [A1]
	2. System validates credential format and sends verification request to the Authentication Service. [E1]
	3. Authentication Service verifies credentials against stored records and confirms account status. [E2] [E3]
	4. System establishes an authorized session and grants access to the Admin Dashboard according to role permissions.

Actor Action	System Response
1. Actor accesses the administrative portal with an active unexpired session.
	2. System verifies session validity and bypasses credential entry.
	3. Proceed directly to Step 4 of the Basic Course of Events.

Actor Action	System Response
1. Authenticated Actor requests to log out.
	2. System terminates the active session, invalidates session tokens, and returns to unauthenticated state.

E1: At step 2, if credentials are empty or malformed, the system displays an input error message and returns to Step 1.
E2: At step 3, if credentials are incorrect or the user is not found, the system displays a generic error message, records the failed attempt in the audit log, and returns to Step 1.
E3: At step 3, if consecutive failed attempts exceed the allowed threshold (5 times) or the account is inactive, the system temporarily locks the account, logs a security alert, and terminates the use case.
E4: At step 2 or 3, if the Authentication Service or database is unreachable, the system displays a service outage notification and terminates the use case.

Field	Content
Extension Points:	Multi-Factor Authentication (MFA / 2FA) for Super Admin accounts; Session inactivity timeout after 30 minutes.
Triggers:	Actor accesses a protected administrative URL (`/admin`) or existing session expires.
Assumptions:	Client application communicates over encrypted HTTPS channel; server endpoints are protected against CSRF and brute-force attacks.
Preconditions:	User account is pre-provisioned and active in the system database with an assigned role (`ADMIN`, `CURATOR`, or `STAFF`).
Post Conditions:	An authorized session is established, security audit log is updated, and access is granted to role-specific administrative views.
Author(s):	@kkons2212 (Thái Đặng Quốc Bảo)
Date:	September 21, 2026

BR-AUTH-01 (Password Encryption & Storage): Passwords must be hashed using industry-standard one-way cryptographic algorithms (Bcrypt with cost factor ≥ 12 or Argon2id). Plaintext passwords must never be stored, cached, or logged.
BR-AUTH-02 (Anti-Brute-Force & Lockout Controls): Generic error messages must be returned on failed logins to prevent user enumeration. Accounts are temporarily locked for 15 minutes after 5 consecutive failed attempts.
BR-AUTH-03 (Session Lifetime): Access tokens have a maximum lifespan of 60 minutes and must be transmitted via secure, HttpOnly, SameSite=Strict cookies.
BR-AUTH-04 (Role-Based Access Control - RBAC):
- ADMIN: Full administrative control (User management, POI CRUD, system configuration, audit logs).
- CURATOR: Exhibit content management, translation review, audio regeneration.
- STAFF: Exhibit viewing, media upload, and GPS coordinate / POI management.