@startuml
title Demo Auth Proxy Upstream Path Forwarding (After)

skinparam backgroundColor #FFFFFF
skinparam shadowing false
skinparam ArrowColor #000000
skinparam DefaultFontColor #000000
skinparam NoteFontColor #000000
skinparam ParticipantBorderColor #000000
skinparam ParticipantFontColor #000000
skinparam sequence {
  LifeLineBorderColor #000000
  LifeLineBackgroundColor #F5F5F5
}

actor "Browser Client" as Client
participant "Next.js proxy\n/api/auth/[...path]" as Proxy #E8FFE8
participant "Auth upstream" as Upstream #EAF2FF

note over Proxy
Configured upstream URL may include path,
but primary forwarding is normalized to root.
end note

Client -> Proxy: GET /api/auth/x
activate Proxy
Proxy -> Upstream: GET /x
activate Upstream
Upstream --> Proxy: 200 / 404
deactivate Upstream

alt upstream status is 404
  Proxy -> Upstream: GET /api/auth/x (fallback)
  activate Upstream
  Upstream --> Proxy: fallback response
  deactivate Upstream
end

Proxy --> Client: upstream response + diagnostics headers
deactivate Proxy

note right of Proxy
Proxy prefix is stripped for primary request.
Fallback keeps compatibility for upstreams
expecting /api/auth/<path>.
end note
@enduml
