@startuml
title After: Scheme-less origin handling is centralized

skinparam backgroundColor #FFFFFF
skinparam shadowing false
skinparam defaultTextAlignment center
skinparam defaultFontColor #000000
skinparam ArrowColor #333333
skinparam component {
  BackgroundColor #ECFDF5
  BorderColor #047857
  FontColor #000000
}
skinparam database {
  BackgroundColor #F0F9FF
  BorderColor #0369A1
  FontColor #000000
}
skinparam note {
  BackgroundColor #FFFDEB
  BorderColor #A16207
  FontColor #000000
}

actor "Operator" as operator
database "Env/YAML\nBASE_URL\nTRUSTED_ORIGINS" as config
component "load_config" as load
component "AuthConfig::base_url" as base_url
component "normalize_configured_url" as normalize_url
component "normalize_configured_origin_pattern" as normalize_origin
component "CSRF\nis_origin_trusted" as csrf
component "CORS middleware" as cors
component "Passkey RP id\nUrl::parse(normalized base_url)" as passkey
component "Public URL builder\npublic_auth_url" as public_url

operator --> config : supplies runtime values
config --> load : raw strings
load --> base_url : base_url
base_url --> normalize_url : add default scheme
normalize_url --> base_url : normalized base_url
base_url --> passkey : parseable URL
base_url --> public_url : normalized public URL

load --> normalize_origin : trusted_origins
normalize_origin --> csrf : shared matching pattern
normalize_origin --> cors : shared matching pattern

note right of normalize_url
No scheme:
- localhost-style host -> http
- sslmode=disable -> http
- public host -> https
end note

note bottom of normalize_origin
Example:
*suits-formations.v2.athena-auth.com/*
becomes
https://*suits-formations.v2.athena-auth.com
end note
@enduml
