36 lines
1.5 KiB
JavaScript
36 lines
1.5 KiB
JavaScript
/**
|
|
* Access planes sit in front of internal verae.<area>.* addresses.
|
|
* Pattern:
|
|
* verae.access.<plane>.<area>.<resource>.<action> ingress (that plane only)
|
|
* verae.access.authz.check authorization step
|
|
* verae.<area>.<resource>.<action> internal (unchanged)
|
|
*/
|
|
export const PLANES = Object.freeze(['zapier', 'web', 'api', 'leaf', 'staff']);
|
|
|
|
export const SUBJECTS = Object.freeze({
|
|
AUTHZ_CHECK: 'verae.access.authz.check',
|
|
AUTHZ_DENY: 'verae.access.authz.deny',
|
|
QUEUE: 'access-authz',
|
|
ingress: (plane) => `verae.access.${plane}.in`,
|
|
});
|
|
|
|
/** verae.billing.statement.get + plane web → verae.access.web.billing.statement.get */
|
|
export function accessAddress(plane, internalSubject) {
|
|
if (!PLANES.includes(plane)) throw new Error(`unknown plane ${plane}`);
|
|
if (!internalSubject.startsWith('verae.') || internalSubject.startsWith('verae.access.')) {
|
|
throw new Error(`not an internal verae.* subject: ${internalSubject}`);
|
|
}
|
|
return `verae.access.${plane}.${internalSubject.slice('verae.'.length)}`;
|
|
}
|
|
|
|
/** Parse an access or internal subject into { plane, internal }. */
|
|
export function parseAddress(subject, planeHint) {
|
|
const s = String(subject || '');
|
|
const m = s.match(/^verae\.access\.([a-z]+)\.(.+)$/);
|
|
if (m) {
|
|
const plane = m[1];
|
|
if (plane === 'authz') return { plane: planeHint || null, internal: s, authz: true };
|
|
return { plane, internal: `verae.${m[2]}`, authz: false };
|
|
}
|
|
return { plane: planeHint || null, internal: s, authz: false };
|
|
}
|