@startuml
title Athena Auth Axum Router Composition (After Refactor)

skinparam shadowing false

actor "Axum server run() [src/bin/server.rs]" as Run
participant "AxumRouterComposer [src/core/router_composer.rs]" as Composer
participant "base_router" as BaseRouter
participant "auth_router" as AuthRouter
participant "dispatch_auth_request" as Dispatch
participant "middleware+state wiring" as FinalApp

Run -> Composer: new(base_path)\nwith_v07_path_check_policy(...)
Run -> BaseRouter: build status/metrics routes

Run -> Composer: build_auth_router(any(dispatch_auth_request))
Composer -> AuthRouter: route(\"/{*path}\")\n(+ route(\"/\") for nested base paths)
AuthRouter -> Dispatch: forwards auth requests
Composer --> Run: auth_router

Run -> Composer: mount_auth_router(base_router, auth_router)
Composer -> Composer: if base_path == \"/\" => merge\nelse => nest(base_path, auth_router)
Composer --> Run: composed_router

Run -> FinalApp: layer(middleware)\nwith_state(tenant_registry)

note right of Composer
Ordering is strict:
1) build_auth_router
2) mount_auth_router(base_router, auth_router)
No mount occurs before auth_router exists.
end note

@enduml
