From 1a2e490ae7e32cfb8a068ad30c2b7cf15751ce8a Mon Sep 17 00:00:00 2001
From: Julian Sommer <115516918+juliansommer@users.noreply.github.com>
Date: Thu, 9 Apr 2026 15:34:43 +1000
Subject: [PATCH] fix: policy matching case insensitive

---
 spinifex/admin/admin.go                   | 2 +-
 spinifex/gateway/policy/evaluator.go      | 4 ++--
 spinifex/gateway/policy/evaluator_test.go | 2 ++
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/spinifex/admin/admin.go b/spinifex/admin/admin.go
index e8092b6cb..0752fef55 100644
--- a/spinifex/admin/admin.go
+++ b/spinifex/admin/admin.go
@@ -266,7 +266,7 @@ func ChownRecursive(path, username string) {
 		// will retain their original ownership.
 		slog.Warn("ChownRecursive: OpenRoot not available, only top-level directory ownership changed",
 			"path", path, "err", rootErr)
-		if chownErr := os.Chown(path, uid, gid); chownErr != nil { // #nosec G122
+		if chownErr := os.Lchown(path, uid, gid); chownErr != nil {
 			slog.Warn("chown failed", "path", path, "err", chownErr)
 		}
 		return
diff --git a/spinifex/gateway/policy/evaluator.go b/spinifex/gateway/policy/evaluator.go
index a8e8f1160..a4fe8ca80 100644
--- a/spinifex/gateway/policy/evaluator.go
+++ b/spinifex/gateway/policy/evaluator.go
@@ -86,8 +86,8 @@ func matchWildcard(pattern, value string) bool {
 		return true
 	}
 	if strings.HasSuffix(pattern, "*") {
-		prefix := pattern[:len(pattern)-1]
-		return strings.HasPrefix(value, prefix)
+		prefix := strings.ToLower(pattern[:len(pattern)-1])
+		return strings.HasPrefix(strings.ToLower(value), prefix)
 	}
 	return strings.EqualFold(pattern, value)
 }
diff --git a/spinifex/gateway/policy/evaluator_test.go b/spinifex/gateway/policy/evaluator_test.go
index 8cefe53f5..a58e57e58 100644
--- a/spinifex/gateway/policy/evaluator_test.go
+++ b/spinifex/gateway/policy/evaluator_test.go
@@ -233,11 +233,13 @@ func TestMatchWildcard(t *testing.T) {
 		{"ec2:*", "ec2:RunInstances", true},
 		{"ec2:*", "ec2:DescribeInstances", true},
 		{"ec2:*", "s3:GetObject", false},
+		{"EC2:*", "ec2:RunInstances", true},
 
 		// Prefix wildcard
 		{"s3:Get*", "s3:GetObject", true},
 		{"s3:Get*", "s3:GetBucketPolicy", true},
 		{"s3:Get*", "s3:PutObject", false},
+		{"S3:get*", "s3:GetObject", true},
 
 		// Exact match
 		{"ec2:RunInstances", "ec2:RunInstances", true},