@startuml athena_auth_runtime_plugin_composition_component
title Athena Auth Runtime - Plugin Composition (Server Binary)

skinparam componentStyle rectangle
skinparam shadowing false

actor "Operator" as Operator
component "Environment + config.yaml" as Config
component "src/bin/server.rs\nbuild_auth(...)" as BuildAuth
component "AuthBuilder" as AuthBuilder
component "SqlxAdapter" as SqlxAdapter
component "DatabaseLoggingEmailProvider\n(optional SMTP wrapper)" as EmailProvider
component "AthenaAuth<SqlxAdapter>" as AthenaAuth

component "EmailPasswordPlugin" as P1
component "SessionManagementPlugin" as P2
component "PasswordManagementPlugin" as P3
component "AccountManagementPlugin" as P4
component "EmailVerificationPlugin" as P5
component "ApiKeyPlugin\n(enable_session_for_api_keys=true)" as P6
component "OAuthPlugin\n(google + apple + microsoft providers configured)" as P7
component "TwoFactorPlugin" as P8
component "OrganizationPlugin" as P9
component "PasskeyPlugin\n(rp_id/rp_name/origin)" as P10
component "AdminPlugin" as P11
component "UserManagementPlugin\n(change_email + delete_user enabled)" as P12

Operator --> Config
Config --> BuildAuth
BuildAuth --> SqlxAdapter
BuildAuth --> AuthBuilder
BuildAuth --> EmailProvider

AuthBuilder --> P1
AuthBuilder --> P2
AuthBuilder --> P3
AuthBuilder --> P4
AuthBuilder --> P5
AuthBuilder --> P6
AuthBuilder --> P7
AuthBuilder --> P8
AuthBuilder --> P9
AuthBuilder --> P10
AuthBuilder --> P11
AuthBuilder --> P12

AuthBuilder --> AthenaAuth : build().await
SqlxAdapter --> AthenaAuth : database adapter
EmailProvider --> AthenaAuth : email provider (if configured)

note right of AthenaAuth
Request handling order is defined by core:
1) middleware
2) plugin before_request hooks
3) core routes
4) plugin on_request routes
end note

@enduml

