User Workflows

User Workflows

Registration and First Use

SaaS Registration Flow

1. The user navigates to the registration page (/signup)
2. Step 1: Enter email and password
3. Step 2: Company information (name, address)
4. Step 3: Plan selection (Free, Pro, Business)
   • For paid plans, a Stripe CardElement form is displayed
   • Payment uses a Stripe SetupIntent with a 14-day free trial
5. Step 4: Confirmation and account creation

What the backend does automatically during registration:

• Creates the user with the client_admin role
• Creates the associated organization
• Creates the Stripe customer
• Provisions a dedicated OVH S3 bucket
• Generates the organization's RSA-4096 key pair
• Creates default folders (uploads, transfert, Data)
• Assigns the selected plan and creates the subscription
• Sends a welcome email

MFA Activation

1. The user navigates to their profile (/profile)
2. Clicks "Enable two-factor authentication"
3. The API generates a TOTP secret and QR code
4. The user scans the QR code with a TOTP app (Google Authenticator, etc.)
5. Confirms with a 6-digit code
6. MFA is activated for subsequent logins

File Management

File Upload

The React frontend handles two upload modes:

Mode 1: Client-side encryption (E2E)

1. The user selects one or more files
2. The browser generates a random AES-256 key
3. The file is encrypted in chunks in the browser (Web Crypto API)
4. The AES key is encrypted with the organization's RSA public key
5. The encrypted file + encrypted key are sent to the server
6. The server stores directly in S3 (streaming, no buffering)

Mode 2: Server-side encryption

1. The user selects a file
2. The file is sent in plaintext to the server (TLS in transit)
3. The server encrypts with AES-256-GCM and stores in S3
4. The encryption key is managed by the server

File Download

1. The user clicks on a file in the list
2. If client-side encrypted (uses_custom_key=true):
   • The encrypted file is downloaded
   • The browser decrypts using the organization's RSA private key
   • The plaintext file is offered for download
3. If server-side encrypted:
   • The server decrypts and returns the plaintext file

Folder Management

• Creation: Click "New folder" with hierarchical navigation
• Rename: Via the context menu (three dots)
• Move: Via the context menu or batch (select + "Move" button)
• Delete: Recursive (deletes subfolders and files)
• Navigation: Clickable breadcrumb with navigable folder tree

Batch Operations

1. Select multiple files/folders via checkboxes
2. The batch action bar appears at the bottom of the page
3. Available actions:
   • Delete: Batch deletion
   • Move: Opens the folder tree picker to choose a destination

File Sharing (Share Links)

Creating a Download Link

1. Context menu on a file > "Share"
2. Link configuration:
   • Link name
   • Password protection (optional)
   • Expiration date
   • Maximum number of downloads
3. The generated token is displayed and copyable
4. Public URL: https://secufile.secuaas.dev/s/{token}

Creating an Upload Link

1. Dashboard > "Create upload link"
2. Navigate the folder tree to choose a destination
3. Configuration similar to download links
4. Files uploaded by third parties are stored in a named subfolder

Using a Share Link (external perspective)

1. The external user accesses the public URL
2. If a Loi 25 consent text is configured:
   • The text is displayed with a checkbox
   • Acceptance is traced in the audit trail
3. If password protected: password entry required
4. For a download link: The file is downloaded
5. For an upload link: The file deposit form is displayed

Secure Transfers

Sending a Transfer

1. Transfers page > "New Transfer"
2. Navigate folders to select files
3. Configuration:
   • Name and description (TinyMCE editor)
   • Recipient email (automatic notification)
   • Expiration date (max 30 days)
   • Agreement required (optional)
4. Selected files are copied to a dedicated transfer folder

Receiving a Transfer

1. The recipient receives an email with the link
2. Accesses the public transfer page
3. If agreement required: accepts the terms
4. Downloads the files
5. The viewed_at tracking is recorded on first consultation