@startuml admin_on_request_audit_failure_capture_sequence
title Admin Plugin - Centralized Failure Audit in on_request

actor "Admin Client" as Client
participant "AdminPlugin::on_request" as OnRequest
participant "route_action(...)" as RouteAction
participant "dispatch_admin_route(...)" as Dispatch
participant "require_admin_or_audit(...)" as RequireAdmin
participant "DatabaseAdapter\nadmin operation" as AdminDB
participant "audit_failure_if_needed(...)" as AuditFailure
participant "write_audit(...)" as WriteAudit
participant "admin_audit_logs table" as AuditTable

Client -> OnRequest: /admin/* request
OnRequest -> RouteAction: resolve action name

alt not an admin route
    RouteAction --> OnRequest: None
    OnRequest --> Client: pass-through (None)
else admin route
    RouteAction --> OnRequest: action id
    OnRequest -> Dispatch: execute handler
    Dispatch -> RequireAdmin: session + role checks

    alt authorized + successful op
        RequireAdmin -> AdminDB: perform mutation/query
        AdminDB --> Dispatch: success
        Dispatch --> OnRequest: Ok(Some(response<400))
        OnRequest -> AuditFailure: evaluate result
        AuditFailure --> OnRequest: no failure audit write
        OnRequest --> Client: success response
    else unauthorized or handler failure
        RequireAdmin --> Dispatch: AuthError or error response
        Dispatch --> OnRequest: Err(...) or response>=400
        OnRequest -> AuditFailure: action + request + result
        AuditFailure -> WriteAudit: build metadata(source=admin.on_request,...)
        WriteAudit -> AuditTable: insert failure audit row
        AuditTable --> WriteAudit: stored
        OnRequest --> Client: error response
    end
end

@enduml

