@startuml
title Demo proxy wildcard origin matching after change

skinparam backgroundColor white
skinparam defaultTextAlignment center
skinparam shadowing false
skinparam ArrowColor #222222
skinparam ArrowFontColor #111111
skinparam defaultFontColor #111111
skinparam sequence {
  LifeLineBorderColor #333333
  LifeLineBackgroundColor white
  ParticipantBorderColor #333333
  ParticipantBackgroundColor #F8FAFC
  ParticipantFontColor #111111
  BoxBorderColor #CBD5E1
  BoxBackgroundColor #FFFFFF
}

actor Browser as browser
participant "Next demo proxy\n/api/auth/*" as proxy
participant "Pattern normalizer" as normalizer
participant "CORS helper" as cors
participant "Upstream map helper" as upstream
participant "Diagnostics JSON" as diag
participant "Rust auth server" as server

browser -> proxy: OPTIONS or get-session\nOrigin: https://preview.vercel.app
proxy -> normalizer: Normalize TRUSTED_ORIGINS
note right of normalizer
  *.vercel.app becomes
  https://*.vercel.app

  URL-shaped values keep only
  scheme, host, and port.
end note
normalizer -> cors: Match normalized origin pattern
cors --> proxy: Origin allowed

browser -> proxy: Auth request on preview URL
proxy -> normalizer: Normalize origin-map key
note right of normalizer
  https://preview-*.vercel.app/api/auth
  becomes preview-*.vercel.app
end note
normalizer -> upstream: Match request host
upstream --> proxy: Concrete upstream URL
proxy -> server: Forward with cookies and auth headers
server --> proxy: get-session JSON response
proxy --> browser: Auth response with CORS headers

browser -> diag: GET /api/auth/diagnostics
diag -> normalizer: Normalize trusted origins\nand origin-map keys
diag --> browser: JSON with normalized patterns,\nrequest host, and match result

@enduml
