fix: policy matching case insensitive

spinifex/admin/admin.go

@@ -266,7 +266,7 @@ func ChownRecursive(path, username string) {
 		// will retain their original ownership.
 		slog.Warn("ChownRecursive: OpenRoot not available, only top-level directory ownership changed",
 			"path", path, "err", rootErr)
-		if chownErr := os.Chown(path, uid, gid); chownErr != nil { // #nosec G122
+		if chownErr := os.Lchown(path, uid, gid); chownErr != nil {
 			slog.Warn("chown failed", "path", path, "err", chownErr)
 		}
 		return

spinifex/gateway/policy/evaluator.go

@@ -86,8 +86,8 @@ func matchWildcard(pattern, value string) bool {
 		return true
 	}
 	if strings.HasSuffix(pattern, "*") {
-		prefix := pattern[:len(pattern)-1]
-		return strings.HasPrefix(value, prefix)
+		prefix := strings.ToLower(pattern[:len(pattern)-1])
+		return strings.HasPrefix(strings.ToLower(value), prefix)
 	}
 	return strings.EqualFold(pattern, value)
 }

spinifex/gateway/policy/evaluator_test.go

@@ -233,11 +233,13 @@ func TestMatchWildcard(t *testing.T) {
 		{"ec2:*", "ec2:RunInstances", true},
 		{"ec2:*", "ec2:DescribeInstances", true},
 		{"ec2:*", "s3:GetObject", false},
+		{"EC2:*", "ec2:RunInstances", true},
 
 		// Prefix wildcard
 		{"s3:Get*", "s3:GetObject", true},
 		{"s3:Get*", "s3:GetBucketPolicy", true},
 		{"s3:Get*", "s3:PutObject", false},
+		{"S3:get*", "s3:GetObject", true},
 
 		// Exact match
 		{"ec2:RunInstances", "ec2:RunInstances", true},