@startuml
title Demo proxy wildcard origin matching before change

skinparam backgroundColor white
skinparam defaultTextAlignment center
skinparam shadowing false
skinparam ArrowColor #222222
skinparam ArrowFontColor #111111
skinparam defaultFontColor #111111
skinparam sequence {
  LifeLineBorderColor #333333
  LifeLineBackgroundColor white
  ParticipantBorderColor #333333
  ParticipantBackgroundColor #F8FAFC
  ParticipantFontColor #111111
  BoxBorderColor #CBD5E1
  BoxBackgroundColor #FFFFFF
}

actor Browser as browser
participant "Next demo proxy\n/api/auth/*" as proxy
participant "CORS helper" as cors
participant "Upstream map helper" as upstream
participant "Diagnostics JSON" as diag
participant "Rust auth server" as server

browser -> proxy: OPTIONS or get-session\nOrigin: https://preview.vercel.app
proxy -> cors: Parse TRUSTED_ORIGINS
note right of cors
  Bare wildcard values stayed literal:
  *.vercel.app

  They were compared against:
  https://preview.vercel.app
end note
cors --> proxy: No match for wildcard host pattern
proxy --> browser: 403 ORIGIN_NOT_TRUSTED\nor missing CORS headers

browser -> proxy: Auth request on preview URL
proxy -> upstream: Match ATHENA_AUTH_ORIGIN_MAP
note right of upstream
  URL-shaped map keys were matched
  against the request host without
  reducing them to host patterns.
end note
upstream --> proxy: Map can miss preview host
proxy --> browser: 401 or proxy config failure

browser -> diag: GET /api/auth/diagnostics
diag --> browser: Raw TRUSTED_ORIGINS only\nno normalized pattern match evidence

@enduml
