@startuml uc-02-authenticate
autonumber
title UC-02 Authenticate (design sequence)
actor Guest
participant "TokenService\n«POST /api/auth/login»" as boundary <<boundary>>
participant "Authenticator\nsb-api::routes::login" as control <<control>>

== Login ==
Guest -> boundary : name, password
boundary -> control : login(name, password)
alt unknown name or wrong password
  control --> boundary : 401 UNAUTHORIZED
else valid
  control -> control : verify_password (sb-auth::hash)
  control -> control : create_token (sb-auth::jwt, real role)
  control --> boundary : {token, user_id, name, role}
  boundary --> Guest : {token, user_id, name, role}
end
note over boundary : auth_middleware guards\nUC-03..UC-12
@enduml