@startuml athena_auth_multitenancy_dispatch_sequence
title Multitenancy Runtime Dispatch (Axum -> TenantRuntimeRegistry -> AthenaAuth)

actor "Client" as Client
participant "Axum Router\n/*path -> dispatch_auth_request" as Axum
participant "dispatch_auth_request" as Dispatch
participant "HeaderTenantResolver" as Resolver
participant "TenantRuntimeRegistry" as Registry
participant "dispatch_auth_axum_request" as SharedDispatch
participant "AthenaAuth runtime\n(selected tenant)" as Runtime

Client -> Axum: HTTP /api/auth/* + tenant headers
Axum -> Dispatch: request
Dispatch -> Resolver: resolve_tenant_from_headers(headers)

alt tenant header invalid
    Resolver --> Dispatch: error
    Dispatch --> Client: 400 { message }
else tenant resolved
    Resolver --> Dispatch: TenantId
    Dispatch -> Registry: runtime(TenantId)

    alt runtime missing
        Registry --> Dispatch: None
        Dispatch --> Client: 500 { message }
    else runtime found
        Registry --> Dispatch: Arc<AthenaAuth>
        Dispatch -> SharedDispatch: dispatch_auth_axum_request(auth, req)
        SharedDispatch -> Runtime: handle_request(AuthRequest)
        Runtime --> SharedDispatch: AuthResponse / AuthError
        SharedDispatch --> Dispatch: Axum Response
        Dispatch -> Dispatch: add header x-athena-tenant
        Dispatch --> Client: Response + x-athena-tenant
    end
end

@enduml

