/*
What each `/api/<path>` does and who may call it. `kind` says what it touches:
`read` (no change), `write-one` (changes one server) and `write-all` (changes every server).
A path that is not listed is refused. Today every entry is a read.

Not in the table: `status`, `user/login`, `user/session/get` and `user/logout`, which the
server answers itself before the table is consulted.
*/
import type { Capability } from './users.ts'

export type RouteKind = 'read' | 'write-one' | 'write-all'

export interface Route {
  kind: RouteKind
  capability: Capability
}

const read = (capability: Capability = 'read'): Route => ({ kind: 'read', capability })

export const ROUTES: Record<string, Route> = {
  'dashboard/stats/get': read(),
  'dashboard/stats/getTop': read(),
  'dashboard/metrics/json': read(),
  'apps/list': read(),
  'logs/query': read(),
  'logs/list': read(),
  'settings/get': read(),
  'user/checkForUpdate': read(),
  'admin/cluster/state': read(),
  // The hub's own namespace; never forwarded to a server.
  'hub/audit/list': read('audit.read'),
  'hub/apps/matrix': read(),
}

export function routeFor(apiPath: string): Route | undefined {
  return Object.hasOwn(ROUTES, apiPath) ? ROUTES[apiPath] : undefined
}

export const isHubPath = (apiPath: string): boolean => apiPath.startsWith('hub/')