# Data Flow — Ninja Nexus

> **Prototype 1:** Se [docs/NEXUS_DATA_FLOW.md](../docs/NEXUS_DATA_FLOW.md) for autoritativ POC-dataflow.  
> Dette dokument beskriver den **fulde platform** (Fase 2+).

## 1. Login-flow

```
Bruger                Shell              Identity           Agent
  │                     │                    │                 │
  │── åbn PC ──────────►│                    │                 │
  │                     │── device check ────┼────────────────►│
  │                     │◄── device status ──┼─────────────────│
  │── email/password ──►│                    │                 │
  │                     │── OIDC auth ──────►│                 │
  │                     │                    │── MFA challenge │
  │◄── MFA prompt ──────│◄───────────────────│                 │
  │── MFA code ────────►│── verify ─────────►│                 │
  │                     │◄── tokens ─────────│                 │
  │                     │── register session ─┼────────────────►│
  │◄── desktop load ────│                    │                 │
```

**Data:**
- Input: credentials, MFA token, device fingerprint
- Output: access_token, refresh_token, id_token, session_id
- Storage: tokens i Shell (encrypted memory), session i Identity DB

---

## 2. Politik-flow

```
Admin              Control Center       Device Mgmt        Agent (PC)
  │                     │                    │                 │
  │── opret policy ────►│                    │                 │
  │                     │── gem policy ─────►│                 │
  │                     │                    │                 │
  │                     │                    │◄── poll ────────│
  │                     │                    │── policy set ──►│
  │                     │                    │                 │── anvend
  │                     │                    │◄── compliance ────│
  │◄── dashboard ───────│◄── aggregate ──────│                 │
```

**Data:**
- Policy: JSON/YAML definition (registry keys, app rules, network, encryption)
- Compliance: `{ policy_id, status: compliant|non_compliant|unknown, details }`
- Sync: Agent poller hvert 5. minut; push via WebSocket ved akut ændring

---

## 3. App-installation

```
Bruger           Shell            App Center        Update Svc       Agent
  │                │                  │                 │              │
  │── vælg app ───►│                  │                 │              │
  │                │── request ──────►│                 │              │
  │                │                  │── godkendt? ────│              │
  │                │                  │── deploy job ──►│              │
  │                │                  │                 │── package ──►│
  │                │                  │                 │              │── install
  │                │◄── progress ─────┼─────────────────┼──────────────│
  │◄── app klar ───│                  │                 │              │
```

**Data:**
- App manifest: `{ id, name, version, package_url, hash, requirements }`
- Install job: `{ job_id, device_id, app_id, status, progress }`
- Package: MSI/MSIX/EXE hosted i object storage

---

## 4. Inventar-flow

```
Agent (PC)              Control Center          Device Mgmt
     │                        │                      │
     │── heartbeat ──────────►│                      │
     │   + inventory delta    │── forward ──────────►│
     │                        │                      │── merge
     │                        │                      │── update DB
     │◄── ack ────────────────│                      │
```

**Inventory data (agent indsamler):**
```json
{
  "device_id": "uuid",
  "hostname": "PC-001",
  "os": { "name": "Windows 11", "build": "22631", "patch_level": "..." },
  "hardware": { "cpu": "...", "ram_gb": 16, "disk_gb": 512 },
  "software": [{ "name": "...", "version": "...", "publisher": "..." }],
  "network": { "ip": "...", "mac": "...", "domain": "..." },
  "nexus": { "agent_version": "1.0.0", "shell_version": "1.0.0", "compliance": "..." }
}
```

---

## 5. Remote support-flow

```
Admin              Control Center       Remote Support      Agent           Bruger
  │                     │                    │                │               │
  │── start session ───►│                    │                │               │
  │                     │── create session ─►│                │               │
  │                     │                    │── invite ─────►│               │
  │                     │                    │                │── prompt ────►│
  │                     │                    │                │◄── accept ────│
  │                     │                    │◄── WebRTC SDP ─│               │
  │◄── connect ─────────│◄── relay ──────────│                │               │
  │═══ screen share ═══════════════════════════════════════════════════════════│
  │                     │── audit log ───────►│                │               │
```

**Data:**
- Session: `{ session_id, admin_id, device_id, user_id, type, started, ended }`
- Audit: alle handlinger (connect, control, file transfer, command) logges
- Recording: optional encrypted blob i object storage

---

## 6. Audit-flow

Alle moduler emitter audit events:

```
Modul → Event Bus (Redis) → Audit Service → PostgreSQL (append-only)
                                          → SIEM export (fremtid)
```

**Audit event format:**
```json
{
  "event_id": "uuid",
  "timestamp": "ISO8601",
  "actor": { "type": "user|admin|system|agent", "id": "...", "ip": "..." },
  "action": "login|policy_apply|app_install|remote_connect|...",
  "resource": { "type": "device|user|app|policy", "id": "..." },
  "result": "success|failure",
  "details": {}
}
```

---

## Dataklassificering

| Klasse | Eksempler | Opbevaring | Kryptering |
|--------|-----------|------------|------------|
| **Kritisk** | Passwords, MFA secrets, private keys | Identity DB | At-rest + in-transit |
| **Følsom** | Session tokens, device certs | Memory/encrypted store | In-transit (TLS) |
| **Intern** | Policies, inventory, audit | PostgreSQL | At-rest |
| **Offentlig** | App metadata, branding | CDN/DB | In-transit |

---

*Se også: [OFFLINE_STRATEGY.md](./OFFLINE_STRATEGY.md) · [CLIENT_SERVER_ARCHITECTURE.md](./CLIENT_SERVER_ARCHITECTURE.md)*
