# Architecture Diagram Index

This folder contains implementation-aligned architecture diagrams for Athena Auth.

## Existing diagrams
- `session_revocation_cookie_invalidation_component.puml`
- `session_revocation_cookie_invalidation_sequences.puml`
- `multitenancy_runtime_design.md` (Mermaid)

## New PlantUML diagrams
- `athena_auth_runtime_plugin_composition_component.puml`
  - Server runtime composition and plugin stack from `src/bin/server.rs`.
- `athena_auth_multitenancy_dispatch_sequence.puml`
  - Tenant resolution and per-tenant runtime dispatch path.
- `athena_auth_request_pipeline_ordering_sequence.puml`
  - Internal request ordering: base-path normalization, hooks, core routes, plugin routes, error mapping.
- `change_email_route_precedence_sequences.puml`
  - Why `POST /change-email` is core-first while verify remains plugin-owned.
- `oauth_pkce_social_sign_in_sequence.puml`
  - OAuth sign-in/link flow with PKCE state, callback, account linking, and session issuance.
- `passkey_webauthn_registration_and_signin_sequences.puml`
  - Passkey state persistence and session issuance on successful authentication.
- `admin_on_request_audit_failure_capture_sequence.puml`
  - Centralized admin request dispatch and failure audit behavior.
- `session_ip_capture_fallback/before.puml` + `session_ip_capture_fallback/after.puml`
  - Header-first IP extraction with Axum connect-info fallback for signup/session creation.
- `dual_server_endpoint_latency_benchmark/before.puml` + `dual_server_endpoint_latency_benchmark/after.puml`
  - Dual-server endpoint timing flow before/after introducing per-endpoint latency benchmarking and Mermaid report output.
- `axum_router_composition_before_refactor.puml`
  - Previous inline `server.rs` base-path and auth-router merge/nest wiring.
- `axum_router_composition_after_refactor.puml`
  - Extracted `router_composer` trait/implementation flow with Axum 0.8 wildcard routing.
- `passkey_related_origins_well_known/before.puml` + `passkey_related_origins_well_known/after.puml`
  - Browser RP-ID mismatch flow before/after enabling `GET /.well-known/webauthn` for WebAuthn Related Origin Requests.
- `axum_response_conversion_hardening/before.puml` + `axum_response_conversion_hardening/after.puml`
  - Axum response conversion before/after removing fallback unwrap and hardening invalid status/header handling.
- `panic_free_mutex_recovery/before.puml` + `panic_free_mutex_recovery/after.puml`
  - Core in-memory adapter/cache/rate-limiter paths before/after replacing `lock().unwrap()` with poisoned-mutex recovery.

