@startuml
skinparam backgroundColor #F8FFFB
skinparam componentStyle rectangle
skinparam packageStyle rectangle
skinparam shadowing false
skinparam ArrowColor #0F172A
skinparam DefaultFontName Inter
skinparam DefaultFontSize 12

component "Client request\nGET /debug/schema?jwt_secret=..." as Client #E2E8F0
component "Axum Query<SchemaDebugQuery>\nserde urlencoded" as QueryDecode #FDE68A
component "normalize_debug_secret" as Normalize #BBF7D0
component "secret_matches_expected" as Compare #93C5FD
component "runtime.access_gate.jwt_secret" as Expected #DBEAFE
component "privileged payload" as Privileged #DCFCE7

Client --> QueryDecode
QueryDecode --> Normalize : query_secret
Expected --> Normalize : expected_secret
Normalize --> Compare : normalized query + expected
Compare --> Privileged : enable on exact OR space->plus compatible match

note right of Normalize
  Strips wrapping quotes and trims
  empty values to None.
end note

note right of Compare
  Compatibility rule:
  if provided contains spaces and expected contains '+',
  compare with spaces replaced by '+'.
end note
@enduml
