@startuml
skinparam backgroundColor white
skinparam defaultFontColor black
skinparam ArrowColor black
skinparam SequenceLifeLineBorderColor black
skinparam SequenceLifeLineBackgroundColor #F8F8F8
skinparam ParticipantBorderColor black
skinparam ParticipantBackgroundColor #EDEDED
skinparam NoteBorderColor black
skinparam NoteBackgroundColor #E8F5E9
title After: Runtime-Wired CORS + Pattern Matching

participant Browser as B #E3F2FD
participant "Server Startup\n(build_auth)" as S #E8F5E9
participant "CorsMiddleware\n(glob-aware)" as C #FFF3E0
participant "Auth Route Resolver\n(core + plugins)" as R #FFEBEE

S -> C: configure allowed_origins\n= base_url origin + TRUSTED_ORIGINS patterns
note right of C
Pattern examples now work:\nhttps://*.vercel.app\nlocalhost:40**
end note

B -> C: OPTIONS /sign-in/email\nOrigin: https://preview.example.vercel.app
alt Origin matches trusted pattern
  C --> B: 204 + Access-Control-Allow-* headers
else Origin does not match
  C --> B: 403 JSON { code: CORS_ORIGIN_NOT_ALLOWED }
end

B -> R: POST /sign-in/email (only after successful preflight)
R --> B: 200/401 auth result

@enduml
