refactor: move aws body scope parsing to ingress

spinifex/domains/acm/awsapi/authz.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/arn"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	"github.com/mulgadc/spinifex/spinifex/gateway/bodyscope"
+	"github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope"
 )
 
 // The resource a policy check evaluates against when the request names nothing

spinifex/domains/ecr/awsapi/authz.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/arn"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	"github.com/mulgadc/spinifex/spinifex/gateway/bodyscope"
+	"github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope"
 	"github.com/mulgadc/spinifex/spinifex/ingress/aws/query"
 )
 

spinifex/gateway/bedrock/authz.go

@@ -8,7 +8,7 @@ import (
 	"slices"
 
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	"github.com/mulgadc/spinifex/spinifex/gateway/bodyscope"
+	"github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope"
 )
 
 // The resource a policy check evaluates against when the request names nothing

spinifex/gateway/ecs/authz.go

@@ -6,10 +6,10 @@ import (
 	"maps"
 	"slices"
 
-	"github.com/mulgadc/spinifex/spinifex/ingress/aws/query"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	"github.com/mulgadc/spinifex/spinifex/gateway/bodyscope"
 	handlers_ecs "github.com/mulgadc/spinifex/spinifex/handlers/ecs"
+	"github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope"
+	"github.com/mulgadc/spinifex/spinifex/ingress/aws/query"
 )
 
 // The resource a policy check evaluates against when the request names nothing

spinifex/gateway/eks/authz.go

@@ -12,8 +12,8 @@ import (
 	"github.com/aws/aws-sdk-go/service/eks"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/arn"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	"github.com/mulgadc/spinifex/spinifex/gateway/bodyscope"
 	handlers_eks "github.com/mulgadc/spinifex/spinifex/handlers/eks"
+	"github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope"
 )
 
 // The resource a policy check evaluates against when the request names nothing

spinifex/ingress/aws/bodyscope/bodyscope.go

@@ -1,6 +1,6 @@
-// Package bodyscope reads the handful of identifier fields a policy scope
+// Package bodyscope reads the identifier fields an AWS ingress policy-scope
 // resolver needs out of a JSON request body, without deserialising the typed
-// input the handler will build from the same bytes.
+// input an action adapter will build from the same bytes.
 //
 // Two properties matter here. A type mismatch on an unrelated field cannot
 // poison the parse and silently widen the request to "*", because every field

spinifex/ingress/aws/bodyscope/bodyscope_test.go

@@ -3,7 +3,7 @@ package bodyscope_test
 import (
 	"testing"
 
-	"github.com/mulgadc/spinifex/spinifex/gateway/bodyscope"
+	"github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

spinifex/ingress/aws/bodyscope/differential_fuzz_test.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/mulgadc/spinifex/spinifex/gateway/bodyscope"
+	"github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope"
 )
 
 // A lookup is one identifier an authz resolver reads through bodyscope, paired