/**
 * Parse optional **`BARE_OS_HRPC_ALLOWLIST_JSON`** for stock **`ctx.bareOsHrpcRequest`**.
 * @param {string} raw
 * @returns {{ allow: Set<string> | null, parseError: boolean }}
 */
export function parseBareOsHrpcAllowlistJson(raw) {
  const s = String(raw || '').trim()
  if (!s) return { allow: null, parseError: false }
  try {
    const parsed = JSON.parse(s)
    /** @type {Set<string>} */
    const allow = new Set()
    if (Array.isArray(parsed)) {
      for (const v of parsed) {
        const x = String(v || '').trim()
        if (x) allow.add(x)
      }
    } else if (parsed && typeof parsed === 'object') {
      for (const [k, v] of Object.entries(parsed)) {
        if (v) allow.add(String(k).trim())
      }
    }
    return { allow: allow.size > 0 ? allow : null, parseError: false }
  } catch {
    return { allow: null, parseError: true }
  }
}

/**
 * @param {Set<string> | null} allow
 * @param {string} svc
 * @param {string} method
 * @returns {boolean} true when the route is denied by a non-empty allowlist
 */
export function bareOsHrpcAllowlistDeniesRoute(allow, svc, method) {
  if (!allow || allow.size === 0) return false
  const key = `${svc}.${method}`
  return !allow.has('*') && !allow.has(`${svc}.*`) && !allow.has(key)
}