Initial import of verae-access-authz from zapier monorepo

src/subjects.js

@@ -0,0 +1,36 @@
+/**
+ * Access planes sit in front of internal verae.<area>.* addresses.
+ * Pattern:
+ *   verae.access.<plane>.<area>.<resource>.<action>   ingress (that plane only)
+ *   verae.access.authz.check                          authorization step
+ *   verae.<area>.<resource>.<action>                  internal (unchanged)
+ */
+export const PLANES = Object.freeze(['zapier', 'web', 'api', 'leaf', 'staff']);
+
+export const SUBJECTS = Object.freeze({
+  AUTHZ_CHECK: 'verae.access.authz.check',
+  AUTHZ_DENY: 'verae.access.authz.deny',
+  QUEUE: 'access-authz',
+  ingress: (plane) => `verae.access.${plane}.in`,
+});
+
+/** verae.billing.statement.get + plane web → verae.access.web.billing.statement.get */
+export function accessAddress(plane, internalSubject) {
+  if (!PLANES.includes(plane)) throw new Error(`unknown plane ${plane}`);
+  if (!internalSubject.startsWith('verae.') || internalSubject.startsWith('verae.access.')) {
+    throw new Error(`not an internal verae.* subject: ${internalSubject}`);
+  }
+  return `verae.access.${plane}.${internalSubject.slice('verae.'.length)}`;
+}
+
+/** Parse an access or internal subject into { plane, internal }. */
+export function parseAddress(subject, planeHint) {
+  const s = String(subject || '');
+  const m = s.match(/^verae\.access\.([a-z]+)\.(.+)$/);
+  if (m) {
+    const plane = m[1];
+    if (plane === 'authz') return { plane: planeHint || null, internal: s, authz: true };
+    return { plane, internal: `verae.${m[2]}`, authz: false };
+  }
+  return { plane: planeHint || null, internal: s, authz: false };
+}