/**
 * Access planes sit in front of internal verae.<area>.* addresses.
 * Pattern:
 *   verae.access.<plane>.<area>.<resource>.<action>   ingress (that plane only)
 *   verae.access.authz.check                          authorization step
 *   verae.<area>.<resource>.<action>                  internal (unchanged)
 */
export const PLANES = Object.freeze(['zapier', 'web', 'api', 'leaf', 'staff']);

export const SUBJECTS = Object.freeze({
  AUTHZ_CHECK: 'verae.access.authz.check',
  AUTHZ_DENY: 'verae.access.authz.deny',
  QUEUE: 'access-authz',
  ingress: (plane) => `verae.access.${plane}.in`,
});

/** verae.billing.statement.get + plane web → verae.access.web.billing.statement.get */
export function accessAddress(plane, internalSubject) {
  if (!PLANES.includes(plane)) throw new Error(`unknown plane ${plane}`);
  if (!internalSubject.startsWith('verae.') || internalSubject.startsWith('verae.access.')) {
    throw new Error(`not an internal verae.* subject: ${internalSubject}`);
  }
  return `verae.access.${plane}.${internalSubject.slice('verae.'.length)}`;
}

/** Parse an access or internal subject into { plane, internal }. */
export function parseAddress(subject, planeHint) {
  const s = String(subject || '');
  const m = s.match(/^verae\.access\.([a-z]+)\.(.+)$/);
  if (m) {
    const plane = m[1];
    if (plane === 'authz') return { plane: planeHint || null, internal: s, authz: true };
    return { plane, internal: `verae.${m[2]}`, authz: false };
  }
  return { plane: planeHint || null, internal: s, authz: false };
}