@startuml
title Formations origins before allowlist update

skinparam backgroundColor white
skinparam defaultTextAlignment center
skinparam shadowing false
skinparam ArrowColor #222222
skinparam ArrowFontColor #111111
skinparam defaultFontColor #111111
skinparam sequence {
  LifeLineBorderColor #333333
  LifeLineBackgroundColor white
  ParticipantBorderColor #333333
  ParticipantBackgroundColor #F8FAFC
  ParticipantFontColor #111111
  BoxBorderColor #CBD5E1
  BoxBackgroundColor #FFFFFF
}

actor Browser as browser
participant "Formations app\nstable production URL" as app
participant "Next demo proxy\n/api/auth/*" as proxy
participant "Rust athena-auth\nCORS middleware" as server
participant "TRUSTED_ORIGINS\nexamples/config" as config

browser -> app: Open app.formations.company\nor speedrun-formations.vercel.app
app -> proxy: Auth request with Origin\nstable Formations origin
proxy -> config: Read trusted origins
config --> proxy: Preview wildcard and local origins
proxy --> app: Origin not listed in copied config
app -> server: Direct or forwarded auth request
server -> config: Read trusted origins
config --> server: Stable Formations origins absent
server --> app: CORS headers missing\nor preflight rejected

@enduml
