@startuml
skinparam backgroundColor #FFFFFF
skinparam sequence {
  ArrowColor #4A5568
  LifeLineBorderColor #4A5568
  LifeLineBackgroundColor #F5F7FA
  ParticipantBorderColor #1E3A8A
  ParticipantBackgroundColor #DBEAFE
  ParticipantFontColor #1E293B
}
title Debug Route After JWT Secret Gate

actor "Operator" as User #FFF4CC
participant "Axum Router\nGET /debug/schema" as Router #DDEEFF
participant "schema_debug_handler" as Handler #DFF7E6
participant "Access Gate\n?jwt_secret == JWT_SECRET" as Gate #FEE2E2
database "PostgreSQL\nprobe" as DB #FFE9D6
collections "Privileged Builder\nconfig + env + tenant internals" as Priv #EDE9FE

User -> Router : GET /debug/schema?jwt_secret=...
Router -> Handler : call(query, headers, runtime)
Handler -> Gate : evaluate_schema_debug_access(...)
Gate --> Handler : privileged=true/false + reason
Handler -> DB : query_schema_debug_probe(...)
DB --> Handler : schema/table visibility

alt jwt_secret matches env JWT_SECRET
  Handler -> Priv : build_schema_debug_privileged_payload(...)
  Priv --> Handler : includes full config file raw contents
  Handler --> User : base payload + privileged_debug.details
else missing/mismatched jwt_secret
  Handler --> User : base payload + access metadata only
end

note right of Priv
Expanded diagnostics are unlocked only when
query jwt_secret exactly matches runtime JWT_SECRET.
end note
@enduml