@startuml
title Demo Auth Proxy Upstream Path Forwarding (Before)

skinparam backgroundColor #FFFFFF
skinparam shadowing false
skinparam ArrowColor #000000
skinparam DefaultFontColor #000000
skinparam NoteFontColor #000000
skinparam ParticipantBorderColor #000000
skinparam ParticipantFontColor #000000
skinparam sequence {
  LifeLineBorderColor #000000
  LifeLineBackgroundColor #F5F5F5
}

actor "Browser Client" as Client
participant "Next.js proxy\n/api/auth/[...path]" as Proxy #FFF4CC
participant "Auth upstream" as Upstream #FFE6E6

note over Proxy
Configured upstream URL includes path:
https://auth.example.com/api/auth
end note

Client -> Proxy: GET /api/auth/x
activate Proxy
Proxy -> Upstream: GET /api/auth/x
activate Upstream
Upstream --> Proxy: 404 (route mismatch possible)
deactivate Upstream
Proxy --> Client: 404 / fallback diagnostics
deactivate Proxy

note right of Proxy
Primary forwarding reuses upstream URL pathname,
so proxy prefix can leak upstream.
end note
@enduml
