@startuml
title Email Admin Tenant Audit Hardening (Before)

skinparam backgroundColor #FFFFFF
skinparam defaultFontColor #000000
skinparam ArrowColor #000000
skinparam SequenceLifeLineBorderColor #000000
skinparam SequenceLifeLineBackgroundColor #F7F7F7
skinparam ParticipantBorderColor #000000
skinparam ParticipantBackgroundColor #FFE8CC
skinparam NoteBackgroundColor #FFF5CC
skinparam NoteBorderColor #000000

actor "Tenant Admin" as Admin
participant "Axum dispatch\n(dispatch_auth_request)" as Dispatch
participant "AdminPlugin" as Plugin
participant "Admin audit logger\n(write_audit)" as Audit
database "admin_audit_logs" as AuditTable

Admin -> Dispatch: /admin/email* request\n(tenant header optional/custom)
Dispatch -> Plugin: request forwarded to tenant runtime
Plugin -> Audit: write_audit(metadata from route/failure path)
Audit -> AuditTable: insert audit event
AuditTable --> Audit: persisted

note right of Dispatch
Resolved tenant was not normalized onto\nrequest headers before plugin handling.
end note

note right of Audit
Route metadata could carry user-provided keys\nthat overlap with source/path/method context.
end note

@enduml
