@startuml
skinparam backgroundColor #FAFBFF
skinparam componentStyle rectangle
skinparam packageStyle rectangle
skinparam shadowing false
skinparam ArrowColor #0F172A
skinparam DefaultFontName Inter
skinparam DefaultFontSize 12

component "Client request\nGET /debug/schema?jwt_secret=..." as Client #E2E8F0
component "Axum Query<SchemaDebugQuery>\nserde urlencoded" as QueryDecode #FDE68A
component "evaluate_schema_debug_access" as Gate #FEE2E2
component "runtime.access_gate.jwt_secret" as Expected #DBEAFE
component "privileged payload" as Privileged #E5E7EB

Client --> QueryDecode
QueryDecode --> Gate : query_secret (decoded)
Expected --> Gate : expected_secret
Gate --> Privileged : enabled only if exact string match

note right of QueryDecode
  + in query values can decode to space
  via form-urlencoded parsing.
end note

note right of Gate
  Before: only exact compare after trim.
  Result: query_param_present=true but
  access_reason=jwt_secret_query_mismatch
  for plus/quote edge cases.
end note
@enduml
