package capturehttp

import "github.com/mathiasbq/hyperguild/ingestion/internal/capture"

// OriginResolver maps an authenticated principal to its trust zone
// (spec §4.2). The mapping is server-side and never reads caller input.
//
// Rules:
//   - The static-token path is a homelab CLI caller on sovereign soil →
//     ZoneSovereign.
//   - A JWT principal in the sovereign allowlist → ZoneSovereign.
//   - Any other JWT principal (e.g. claude.ai's OAuth identity, or any
//     unrecognised subject) → ZoneUSNexus.
//
// The default is the strict one: an unknown principal is treated as
// us-nexus so the I1 gate fails safe (refuses confidential), exactly as
// an untagged classification target fails safe to confidential (#50).
type OriginResolver struct {
	sovereign map[string]bool
}

// NewOriginResolver builds a resolver whose JWT sovereign principals are
// the given subjects. The static-token caller is always sovereign and
// need not be listed.
func NewOriginResolver(sovereignPrincipals []string) OriginResolver {
	m := make(map[string]bool, len(sovereignPrincipals))
	for _, p := range sovereignPrincipals {
		if p != "" {
			m[p] = true
		}
	}
	return OriginResolver{sovereign: m}
}

// Resolve returns the trust zone for a principal. viaStatic is true when
// the static-token auth path was taken.
func (r OriginResolver) Resolve(principal string, viaStatic bool) capture.Zone {
	if viaStatic || r.sovereign[principal] {
		return capture.ZoneSovereign
	}
	return capture.ZoneUSNexus
}