Flusso corretto autenticazione

flowchart TD START(["#1 Schermata Login
email OPPURE telefono"]) --> TYPE{"#2 Cosa inserisce?"} TYPE -->|Telefono| P1b TYPE -->|Email| E_OTP1 subgraph PHONE["Percorso TELEFONO"] P1b["#13 otp_generate
solo SMS"] P1b --> P2["#14 Schermata OTP"] P2 --> P3["#15 verify_otp"] P3 --> P4{"#16 OTP ok?"} P4 -->|No| P2 P4 -->|Sì| P5["#17 search_user
conferma utente"] P5 --> P6{"#18 Utente esiste?"} P6 -->|Sì| P7["#19 access_token"] P7 --> P7b["login-ingestion
in QN*"] P7b --> POK(["#90 Schermata OK loggato
token in cookie"]) P6 -->|No| R1 end subgraph REG["Registrazione nuovo utente da telefono"] R1["#20 Schermata solo email"] R1 --> R3["#22 otp_generate
solo email
(richiede phone_proof)"] R3 --> R3a["#23 Schermata OTP email"] R3a --> R3b["#24 verify_otp email"] R3b --> R3c["#24b email verificata
register_proof firmato"] R3c --> R4["#25 Schermata profilo + consensi
nome, cognome, data nascita, città"] R4 --> R2["#21 QNRegister + profilo + consensi
register + doi + update"] R2 --> R5a["#27 Piano identity
first_name last_name"] R2 --> R5b["#28 Piano custom JSON
otp_phone city birth_date"] R5a --> R6["#29 access_token
cookie __utp"] R5b --> R6 R6 --> R6b["login-ingestion-user-collector"] R6b --> POK end subgraph EMAIL["Percorso EMAIL"] E_OTP1["#32 otp_generate
solo email"] E_OTP1 --> E_OTP2["#33 Schermata OTP email"] E_OTP2 --> E_OTP3["#34 verify_otp"] E_OTP3 --> E_OTP_OK{"#34b OTP ok?"} E_OTP_OK -->|No| E_OTP2 E_OTP_OK -->|Sì → email_proof| E1["#30 get_user_email"] E1 --> E1a{"#31 Utente esiste?"} E1a -->|No| E_NEW6["#37 Schermata telefono"] E_NEW6 --> E_NEW7["#38 otp_generate SMS"] E_NEW7 --> E_NEW8["#39 verify_otp telefono
→ register_proof"] E_NEW8 --> E_NEW10["#41 Schermata profilo + consensi"] E_NEW10 --> E_NEW11["#35+#36 QNRegister
register+DOI+update #40+#42"] E_NEW11 --> E_NEW12["#43 access_token"] E_NEW12 --> E_NEW12b["login-ingestion in QN*"] E_NEW12b --> POK E1a -->|Sì| E2{"#50 Ha otp_phone?"} E2 -->|Sì| E9["#65 access_token"] E9 --> E9b["login-ingestion in QN*"] E9b --> POK E2 -->|No| E5["#61 Schermata richiesta telefono"] E5 --> E6["#62 otp_generate + verify_otp"] E6 --> E7["#63 Schermata = #25
nome, cognome, data, città
(precompilati se presenti)"] E7 --> E8["#64 update_profile"] E8 --> E9 end

sequenceDiagram participant UI as Frontend participant BE as Backend participant Piano as Piano.io participant UC as User Collector Note over UI: #1 Login - telefono Note over UI: #10/#11/#12 rimossi — sempre OTP SMS UI->>BE: #13 POST QNLogin → otp_generate { phone } solo SMS BE-->>UI: otp solo via SMS Note over UI: #14 Schermata OTP UI->>BE: #15 POST QNVerifyOtp { phone, otp_code, flow: phone } BE-->>UI: valid=true Note over BE: #17 search_user (dopo OTP) BE->>Piano: /api/v3/publisher/user/search alt Utente esiste BE->>Piano: /api/v3/publisher/user/search Piano-->>BE: users[] + uid UI->>BE: #19 QNVerifyOtp → access_token { uid } BE->>Piano: /publisher/token BE->>UC: login ingest {uid, accessToken} BE-->>UI: access_token Note over UI: #90 OK - cookie __utp else Utente NON esiste → registrazione Note over UI: #20 Schermata solo email (consensi a #25) Note over UI: Telefono verificato → phone_proof (no sessione) UI->>BE: #22 POST QNRegister phase=email_otp { email, phone, phone_proof } BE-->>UI: OTP email + pending_proof Note over UI: #23 Schermata OTP email UI->>BE: #24 POST QNVerifyOtp { email, otp_code, pending_proof, flow: phone_register } Note over UI: #24b email verificata → register_proof Note over UI: #25 Schermata profilo + consensi (prima del register) UI->>BE: #21 POST QNRegister phase=register { register_proof, consents, profilo } BE->>Piano: /identity/register BE->>Piano: /identity/doi/status confirmed BE->>Piano: #27/#28 update identity + custom (otp_phone+anagrafica) BE->>Piano: #29 access_token BE->>UC: login ingest {uid, accessToken} Note over UI: #90 Cookie __utp · Schermata OK end

sequenceDiagram participant UI as Frontend participant BE as Backend participant Piano as Piano.io participant UC as User Collector Note over UI: #1 Login - email UI->>BE: #32 POST QNLogin → otp_generate solo email BE-->>UI: OTP email Note over UI: #33 Schermata OTP email UI->>BE: #34 POST QNVerifyOtp { email, flow: email_verify } alt #34b OTP non valido BE-->>UI: valid=false Note over UI: resta su #33 else #34b OTP ok → email_proof BE->>Piano: #30 get_user_email alt #31 Utente NON esiste BE-->>UI: next_step 37 + email_proof Note over UI: #37 Schermata telefono + OTP SMS UI->>BE: #38/#39 QNAddPhone + QNVerifyOtp { phone, email_proof } Note over UI: #41 profilo + consensi → #35 QNRegister UI->>BE: #35 POST QNRegister { register_proof, consents, profilo } BE->>Piano: register + doi + update + #43 token BE->>UC: login ingest Note over UI: #90 OK else #31 Utente esiste alt #50 Ha otp_phone BE->>Piano: #65 access_token BE->>UC: login ingest BE-->>UI: next_step 90 + token Note over UI: #90 OK else #50 No telefono BE-->>UI: next_step 61 + uid + email_proof Note over UI: #61 Schermata telefono UI->>BE: #62/#63 QNAddPhone + verify → profilo UI->>BE: #64/#65 QNUpdateProfile → token BE->>UC: login ingest Note over UI: #90 OK end end end