@startuml oauth_preconfigured_providers_after
title After - OAuth preconfigured providers expanded (google + apple + microsoft)

skinparam backgroundColor White
skinparam defaultFontColor Black
skinparam ArrowColor Black
skinparam componentStyle rectangle
skinparam shadowing false

actor "Server Startup" as Startup #EAF3FF
component ".env / runtime env\nGOOGLE_*, APPLE_*, MICROSOFT_*\n(MICROSOFT_SECRET alias supported)" as Env #FFF2CC
component "src/bin/server.rs\nbuild_auth(...)" as BuildAuth #D5E8D4
component "oauth_env_or_default(...)\n+ env_var_non_empty(...)" as EnvResolver #F5F5F5
component "OAuthProvider::google(...)" as GoogleProvider #FFE6CC
component "OAuthProvider::apple(...)" as AppleProvider #FFE6CC
component "OAuthProvider::microsoft(...)" as MicrosoftProvider #FFE6CC
component "OAuthPlugin" as OAuthPlugin #F8CECC
component "AthenaAuth Runtime" as Runtime #DAE8FC
component "Schema Debug Payload\nplugins.oauth.providers" as DebugPayload #E1D5E7

Startup --> BuildAuth : initialize auth runtime
BuildAuth --> EnvResolver : resolve credentials
Env --> EnvResolver : provider client ids + secrets
EnvResolver --> GoogleProvider : credentials
EnvResolver --> AppleProvider : credentials
EnvResolver --> MicrosoftProvider : credentials
BuildAuth --> OAuthPlugin : add_provider(\"google\", ...)
BuildAuth --> OAuthPlugin : add_provider(\"apple\", ...)
BuildAuth --> OAuthPlugin : add_provider(\"microsoft\", ...)
OAuthPlugin --> Runtime : provider map = { google, apple, microsoft }
BuildAuth --> DebugPayload : providers = [\"google\", \"apple\", \"microsoft\"]

note right of OAuthPlugin
Provider wiring now supports Apple and Microsoft
with the same preconfigured flow used for Google.
end note

@enduml
