From 4c850fc3c9fb753aa924b205779e018ba289c545 Mon Sep 17 00:00:00 2001
From: HueByte <ihuebyte@gmail.com>
Date: Fri, 20 Feb 2026 17:19:18 +0100
Subject: [PATCH] feat: Update encryption documentation with mermaid sequence
 diagram for clarity

---
 docs/articles/encryption.md | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/docs/articles/encryption.md b/docs/articles/encryption.md
index 3bbc08c..f8ac5ae 100644
--- a/docs/articles/encryption.md
+++ b/docs/articles/encryption.md
@@ -4,19 +4,23 @@ EchoHub uses application-layer AES-256-GCM encryption to protect message content
 
 ## How It Works
 
-```text
-TUI Client                          Server                           TUI Client
-    │                                  │                                  │
-    │  encrypt(plaintext)              │                                  │
-    │ ──── $ENC$v1$... ──────────────► │                                  │
-    │                                  │  decrypt → validate/sanitize     │
-    │                                  │  fetch embeds on plaintext       │
-    │                                  │  encrypt(plaintext)              │
-    │                                  │ ──── $ENC$v1$... ──────────────► │
-    │                                  │                                  │  decrypt → display
-    │                                  │                                  │
-    │                                  │  (optional) encrypt for DB       │
-    │                                  │  store to SQLite                 │
+```mermaid
+sequenceDiagram
+    participant Sender as TUI Client (Sender)
+    participant Server
+    participant Receiver as TUI Client (Receiver)
+    participant IRC as IRC Client
+
+    Sender->>Sender: encrypt(plaintext)
+    Sender->>Server: $ENC$v1$... (SignalR)
+    Server->>Server: decrypt → validate/sanitize
+    Server->>Server: fetch embeds on plaintext
+    Server->>Server: (optional) encrypt for DB storage
+    Server->>Server: encrypt(plaintext) with fresh nonce
+    Server->>Receiver: $ENC$v1$... (SignalR broadcast)
+    Receiver->>Receiver: decrypt → display
+    Server->>Server: decrypt for IRC
+    Server->>IRC: plaintext (IRC PRIVMSG)
 ```
 
 1. **Client encrypts** the message before sending it over SignalR